Model-based Fault Detection for Low-cost UAV Actuators

Transcription

1 Model-based Fault Detection for Low-cost UAV Actuators Inchara Lakshminarayan, Daniel Ossmann and Peter Seiler Abstract This paper focuses on the use of analytical redundancy to improve the reliability of low cost unmanned aerial vehicles (UAVs). Specifically, a model-based fault detection algorithm is designed and tested for one critical UAV component: a servo-actuator. A third-order dynamic model is identified for healthy actuators using experimental data. Next, a fault detection algorithm is designed to detect abnormalities in the actuator response. The detection thresholds are chosen to be robust against uncertainties and sensor noise. The performance of the fault detection algorithm is experimentally tested on both healthy and faulty (broken) actuators. This validation step is performed using actuator commands from recent flight tests conducted at the University of Minnesota. I. INTRODUCTION The market for small, low-cost unmanned aerial vehicles (UAVs) is rapidly increasing. The reliability of these aircrafts needs further consideration in order to ensure safe operation in the airspace. For comparison large or commercial aircrafts are required to meet two main reliability requirements: ) no more than one catastrophic failure per 9 flight hours and 2) no single point of failure [], [2]. Commercial aircraft manufacturers achieve these reliability requirements primarily through the use of hardware redundancy. For example the Boeing 777 has multiple redundant actuators and a tripletriple flight computer architecture []. The use of hardware redundancy is prohibitive on small, low-cost UAVs due to size, weight, power, and cost restrictions. This paper focuses on the use of analytical redundancy as a means of improving the reliability of UAVs. Specifically, the paper describes a model-based algorithm to detect faults for one specific but critical component: the servo-actuators. Analytical redundancy can be provided through a modelbased fault detection and isolation (FDI) filter. This FDI filter, also known as a diagnostic observer, generates residuals which allow the reliable detection in case of a fault. Thus, the residuals should be close to zero in fault free situations for all control, disturbance and noise inputs. In the presence of a fault, the residual should generate amplitudes proportional to the fault. Various approaches for solving the fault detection and isolation filter design problem are available in the literature [3], [4], [5]. Analytical redundancy can be applied for small UAVs either at the system or component level. The system level approach, e.g. [6], [7], [8], [9], [], combines models of the aircraft dynamics with various inertial measurements. The system level approach is challenging as it requires accurate models of the flight dynamics which may not be available for low-cost UAVs. Alternatively, fault detection algorithms can be developed at the sensor or actuator component level. Inchara Lakshminarayan, Daniel Ossmann and Peter Seiler are with the Department of Aerospace Engineering and Mechanics, University of Minnesota, Minneapolis, MN, 55455, USA. laksh28@umn.edu, dossmann@umn.edu, seile7@umn.edu For example, actuator faults can be detected by using fault detection filters which propagate only the actuator input and output signals. This approach has recently been studied for hydraulic actuators on larger commercial aircrafts [], [2], [3], [4]. This component level approach requires additional sensors to measure the actual actuator position but removes the need for accurate flight dynamics models. This paper proposes a component-level fault detection algorithm for servo-motors commonly found on low-cost UAVs. The fault detection architecture, described in Section II, requires a model of the actuator as well as a sensor to measure actual servo position. The actuator model is developed with a simple experimental testbed as discussed in Section III. The requirement of a servo position measurement is one limitation but smart actuators are being developed to enable the proposed local FDI approach [5]. The residual generator design is explained in Section IV and finally, the proposed algorithm is experimentally validated using both healthy and broken actuators (Section V). These tests are performed using actuator commands recorded on flight tests performed at the University of Minnesota s UAV Lab [6]. II. PROBLEM DEFINITION A complex mechanical system such as an unmanned aircraft may fail in many ways. Timely detection of faults and the knowledge of the cause of aircraft failure is needed to safely land the aircraft. In case any one of the servo motors breaks down in-flight, it may lead to loss of control (LOC), loss of mission (LOM) or a loss of vehicle (LOV) itself. In this section we present a description of the aircraft used for flight testing and analysis of the two types of actuator failure modes we encountered on this aircraft. An overview of the fault detection approach to address aircraft actuator failures is also presented here. A. Flight Test Equipment The experimental vehicle used for actuator monitoring is called FASER, and is a commercial, off-the-shelf, radiocontrolled unmanned aircraft with the Ultra Stick 2 airframe, shown in Figure. FASER has a wingspan of.92m and a mass of about 7.4kg. The aircraft has a flight endurance of 3 minutes and a cruise speed of 23m/sec. Additional details can be found in [7], [8]. FASER is retrofitted with UMN avionics hardware and software for real-time control, guidance, navigation, and fault detection. The avionics include a flight computer, telemetry radio and sensors. The aerodynamic control surfaces (flaps, ailerons, elevator and rudder) are actuated by its own servo motor. The system inputs are throttle, elevator deflection, rudder deflection, left and right aileron deflections and left and right flap deflections. The FASER platform was obtained by University of Minnesota from NASA Langley Research Center. NASA

2 Langley identified the aerodynamic coefficients from wind tunnel experiments [9], [2]. This aerodynamic data provides the foundation for a high fidelity, six degree-of-freedom nonlinear simulation model. This nonlinear simulation model is built in Simulink and includes models for the actuators, sensors, and environmental effects, e.g. a Dryden model for wind gusts. The simulation also includes baseline flight control laws and navigation filters. This simulation model and all flight data is publicly available [6]. C. Fault Detection Architecture Figure 2 depicts a high level view of the actuator fault detection architecture developed in this paper. The pilot sends commands through the flight controller to the servo actuator resulting in surface deflections of the aircraft. The performance of the actuator is monitored by recording the input-output data. This actuator data is fed to the residual filter which produces a residual signal based on the type of fault. The residual generator is a model based fault detection filter which also includes an accurate model of the actuator that gives an estimate of the true position output. Finally, a decision logic is established to declare the occurrence of a fault. Additional details on the FDI design are provided in Section IV. Fig. 2. Fault monitoring setup Fig.. Ultrastick 2 aircraft The setup of the system allows to record the data sent from the controller to the different actuators. This data can then be used in the simulation to excite the actuator and test the model based fault detection filter. For the purpose of residual filter design, the position outputs from the aircraft sensor are assumed to have low noise levels. A design team performed a reliability analysis on the Ultra Stick 2 including both a fault tree analysis (FTA) as well as failure modes and effects analysis (FMEA) [2]. The aircraft uses a single-string architecture and the fault tree analysis predicted one failure per 5 flight hours. It is important to emphasize that this is a theoretical reliability estimate. The UAV lab has not lost an aircraft to date. The analyses also identified the rudder and elevator actuators as critical components. Faults in these components would result in LOM or LOV depending on the scenario. B. UAV Actuator Failure Modes There are six different modes of failure that can potentially occur in a UAV actuator during its flight [22]. Each of these fault modes are classified as being catastrophic, critical, significant, or minor, according to the NASA standards for flight vehicle FMEA. In this paper we deal with the following two modes of failure encountered in FASER flight tests: Stuck Fault: Catastrophic in nature, this fault is known to occur due to a damage in the servo drive shaft, linkage or due to an unbalanced surface. This may lead to LOM, LOC, and in severe cases, LOV. Increased Deadband/Stiction: This is a critical fault known to occur due to slippage of gears, or damaged servo drive shaft. This may lead to LOM. III. ACTUATOR MODELING In this section we describe the experimental setup and the approach used to identify the actuator model. Various actuators of the same model and from the same manufacturer, are excited with chirp signals in the laboratory setup, to gather time domain data which is used to determine the linear frequency response. Further, step responses are simulated to quantify the inherent time delays in the actuators and to validate the rate limits. The outcome is one single model for all the actuators which serves as a basis for fault detection filter design. A. Laboratory Experimental Setup Figure 3 depicts the laboratory experimental setup used for actuator analysis. The actuators tested are HITEC manufactured HS-225BB analog servos made for small, lightweight applications requiring high speed and torque. A two cell lithium-polymer battery is used to supply power to the servo. A second servo modified to operate as a potentiometer is used as the position sensor by removing the gearset, wiring power and ground. Pulse width modulation (PWM) commands are sent to the servo through a Teensy3. microcontroller at a framerate of 5Hz. The Arduino integrated development environment is used as the programming software. The Teensy3. has a Cortex M4 processor and two native 6 bit analog to digital converters. The potentiometer measurements are calibrated to remove any DC offset in the frequency analysis. B. System Identification Frequency domain identification techniques are used to identify the actuator model. Input and output data has been collected from the actuators by sending a chirp signal with a

3 the HITEC HS-225BB actuator: Fig. 3. Experimental setup G f it (s) = e.4s 223 (s )(s s + 492) C. Model Validation This subsection presents time and frequency domain validation results to justify the identification of actuator model and demonstrate it s accuracy for aircraft simulations. Figure 4 illustrates the frequency response of the transfer function fit against the smoothed frequency response of all the tested servos. () frequency sweep of Hz to 25Hz and amplitudes of ±3deg. Fast fourier transformations of this input-output data is computed and used to obtain the empirical transfer function and frequency response G raw ( jω) of the raw data. A smoothed frequency response G sm ( jω) is obtained by spectral analysis using the spa MATLAB function. An optimal width of the Hanning window is chosen to minimize bias while still giving a smooth estimate. Since the servo excitation starts at 6rad/sec, the coherence between input and output data is found to be good (>.8) from frequencies starting at rad/sec. In general, the coherence describes how well the input/output data is fit with a linear model as a function of frequency. The coherence of the input and output data gets unsatisfactory at frequencies greater than rad/sec for this servo as high frequency noise and rate limits influence the output. This is the range in which the model adequately reflects the measured data, which is also shown in Figure 4. In order to account for variations in the response from different actuators, even of the same make and model, due to factors such as manufacturing defects and noise levels, the above experiment and simulation is repeated on multiple healthy servos. An average of the magnitude and the phase response is calculated and a nominal frequency response G nom ( jω) of the smoothed data is used for model identification. The dotted lines in subplot and 2 of Figure 4 show the smoothed data for three servos. i in G sm,i is used to denote the different servos. The nominal model consists of the average response on a frequency grid. The next step is to fit this data with a transfer function. An optimal transfer function fit G f it ( jω) is obtained using the fitmagfrd function of the robust control toolbox. fitmagfrd fits frequency response magnitude data with minimum-phase state-space model using log-chebychev magnitude design. This provided better fits for data just beyond the bandwidth. Alternative functions that use least squares, such as fitfrd, are very accurate at low frequencies but at the expense of poor fits just above the bandwidth. Since fitmagfrd assumes a stable system with minimal phase, a time delay of 4 milliseconds for the system is manually set in order to match the phase of the transfer function with that of the smoothed frequency response. By a comparative study of the Bode plots of G f it ( jω) and G nom ( jω) a linear third order model is identified for the actuator. Equation () describes the transfer function fit for Magnitude (db) Phase (deg) Normalized error Fig. 4. Model fit Smoothed data Frequency (rad/sec) Bode plots of G f it ( jω) and G sm,i ( jω) Subplot 3 of Figure 4 depicts the normalized magnitude error: e( jω) = G sm,i( jω) G f it ( jω) G f it ( jω) At frequencies greater than 5rad/sec, a surge in e( jω) appears indicating noise influence at high frequencies. The window of frequencies from -rad/sec depicts the region of best coherence between input and output. The normalized error for the different servos in this window varies from The bandwidth of HITEC HS-225BB actuator is determined to be 4.5Hz. An additional validation step is performed using flight test data. Specifically, actuator commands to the right aileron of the FASER aircraft are logged during a test flight. These commands are used as an input to the HITEC servo in the bench-top experiment at a sampling rate of Hz. Figure 5 shows the logged command and the actuator response (labelled output) from this bench-top experiment. Figure 5 also shows the response of the identified model Equation () to the same actuator commands (labelled Simulation). We observe that the error between the simulated and true actuator output has a standard deviation of.29deg. Note that the actuator in the bench-top experiment is unloaded. This is a (2)

4 significant difference from the flight tests where the actuator experiences the effects of the aerodynamic loads on the controllable surfaces. Future bench-top experiments will be performed to approximate the loaded conditions experienced in flight. Postion (deg) Fig Command Output Simulation Time (sec) Servo true output and simulated output for FASER flight commands IV. ACTUATOR FAULT DETECTION: DESIGN This section presents the methodology for implementing a residual filter, using the model from Section III, for the fault diagnosis approach to detect actuator faults. The modelbased fault diagnosis is defined in [5] as the determination of faults of a system from the comparison of available system measurements with a priori information represented by the system s mathematical model, through generation of residual quantities and their analysis. The actuator model identified in Section III provides this a priori information, while the input and the output signal are the available system measurements. The fault detection filter is based on this derived model and uses the system measurements as inputs to generate a residual which is only prone to faults. The fault detection filter (diagnostic observer) design problem for the servo is to generate a filter which: (a) decouples the input from the output (b) couples the fault to the residual and (c) is stable and proper. Various approaches to solve this problem based on parity space calculation, nullspace calculation or observer based approaches are available in literature. The contribution [23] explains in detail, that if the design problem is directly solvable, all of these approaches are able to generate the same fault detection filter. The design problem is directly solvable as there are no unknown inputs that need to be decoupled from the system. The approach used in this paper to solve the residual filter design problem for the linear actuator model is based on simple nullspace computations as presented in [24]. This approach only involves basic algebraic operations and also provides the designer with the freedom to directly select the poles of the filter. Modeling the actuator fault as an additive input, the inputoutput form is given by y(s) = G f it (s)(u(s) + f(s)) (3) where y(s), u(s) and f(s) are the Laplace-transformed quantities of the servo position y(t), the commanded input u(t) and the fault input f (t), respectively. To solve the fault detection problem for the system in Equation (3) a residual filter of the form [ ] y(s) r(s) = Q(s) (4) u(s) shall be generated, which uses the available command input signal u and the measured servo position y of the actuator to generate a residual r. In Equation (4), r(s) is the Laplacetransformed quantity of the residual signal r(t). The idea of the nullspace methodology becomes clear when inserting Equation (3) into the residual filter of Equation (4), resulting in [ G r(s) = Q(s) f it (s) ] [ G u(s) + Q(s) f it (s) ] f(s) (5) The residual r shall be zero in any fault free situation and non-zero if a fault occurs. Also, the residual shall be zero in case of no fault ( f = ) only if it is decoupled from the input u. Thus, the residual filter Q(s) must guarantee Q(s) [ G f it (s) ] = (6) implying that Q(s) belongs to the left nullspace of G f it (s). Note that the most intuitive solution of the filter problem considering the design constraints (a)-(c) for the actuator dynamics, is the filter Q(s) = [ G f it (s) ] (7) This filter generates the residual as a difference of the measured servo position y and its estimate ŷ = G f it u. Equation (8) is obtained by substituting Equation (7) in Equation (5). As desired, the influence of the input u gets decoupled from the residual r leaving only f r(s) = G f it (s)f(s) (8) allowing the detection of the fault. The drawback of this result is that the fault-to-residual transfer behavior is equal to the underlying system behavior G f it (s). This might be undesirable sometimes, such as when the designer wishes to decrease the detection time by making the fault-to-residual transfer behavior faster. Note that any unmodelled servo dynamics or noise in the output will be transferred to the residual through the transfer function. Thus, to filter out these effects it could also make sense to decrease the dynamics. At this point, instead of directly changing the filter we present a general design approach which can also be used for more complex systems. A filter design via the calculation of polynomial basis vectors for the required nullspace is presented in [24]. This approach provides the designer with maximum degree of design freedom. This process is summarized below for the no disturbance case and then applied to the servo fault detection problem.

5 In case of no disturbances the solution is based on a matrix fractional decomposition of the known input to the measurement matrix: G(s) = D (s)n(s). The transfer function matrix B(s) = [D (s) N(s)] contains row vectors forming the nullspace basis of G(s). Thus every row and every linear combination of the rows of B(s) is a potential residual filter, solving (a) of the design problem. The second step is to shape the fault-to-residual transfer behavior, thus solving (b) and (c) of the design process. To fulfill (b) any parametric linear combination of the rows of B(s), which couples the fault to the residual can be selected, by choosing a (polynomial) matrix φ(s) of suitable dimension [24]. Finally, as B(s) is a polynomial basis, its rows are non proper. To fulfill the design constrain (c) φ(s)n(s) can be further parametrized with a diagonal polynomial matrix M(s) containing the desired poles of the filter to make it (strictly) proper, defining the desired transfer behavior. Hence, the filter Q(s) is given by Q(s) = M (s)φ(s)b(s) (9) Thus, the only constraint limiting the design freedom is given by the row degree of M(s) that is needed to make the residual filter strictly proper. Applying the presented approach to the actuator model requires the decomposition of the actuator model from Equation () into G f it (s) = d (s)n () with n = 223 d(s) = (s ) (s s + 492) () resulting in the basis B(s) = [d (s) n]. As the basis in the case of a single transfer function consists of only one vector, no further parameterization with φ(s) is required. The last step is to define M(s), which is a single transfer function in our case. To provide a fast detection of the fault and still filter out the sensor induced noise, M(s) is selected as k(.2s+) 4. k denotes the dc-gain for the faultto-residual transfer and needs to be selected. Choosing k = n ensures a fault to residual dc-gain of. Thus, the resulting strictly proper filter is given by Q(s) = n(.2s + ) 4 [ d (s) n ] (2) The fault-to residual transfer behavior can be derived by inserting the filter Equation (2) and the model Equation (3) into Equation (4), resulting in: r(s) = f(s) (3) (.2s + ) 4 The decision logic for the detection of a fault involves comparing the generated residual to an upper and lower constant threshold ±τ. The decision variable i is defined as a boolean variable { if τ > r > τ i = (4) otherwise indicating the presence of a fault in the system (i = ) or its absence (i = ). The developed fault detection filter and its decision logic are applied to our actuator system and the results are presented in the next section. V. ACTUATOR FAULT DETECTION: RESULTS Figure 6 shows the residuals generated by a healthy actuator for logged flight data run on the bench-top experiment (with no aerodynamic loads). The commands correspond to aileron and elevator FASER commands involving 8deg turns of the aircraft in a rectangular pattern. The fault detection filter receives this flight command inputs as well as the measured actuator output of the experimental setup. We observe from Figure 6 that for the test signal, the residual stays well between ±.5deg. Hence, ±.5deg is concluded to be a reasonable threshold level. Residual (deg) Upper threshold Lower threshold Time (sec) Fig. 6. A collection of healthy residuals and the threshold for fault declaration Figure 7 displays the commanded input as well as the measured output of the actuator in case of a stuck fault. As expected, the actuator is stuck and does not move at all (output remains constant). Postion (deg) Residual (deg) command output Fig Time(sec) Input-output plot and residual for a stuck fault in an actuator The magnitude of the residual crosses the selected threshold values at multiple time points. During the first three seconds of the experiment, the actuator is commanded to the same position as its stuck position. Hence, residual is zero and within the threshold. Shortly after three seconds, fault is detected, as now the control inputs other than the stuck position are commanded by the flight computer. The maximum value of the residual is -37.5deg.

6 Figure 8 shows a comparison of residual generated by a healthy servo and a servo with the critical fault type (increased deadband). This fault is more challenging to detect as its influence on the actuator output shows up partly, and not fully. The highest magnitude of the residual vector is - 5.5deg and a fault is sensed 2 times starting from 8sec over a 2sec run-time. Thus, the fault can be detected multiple times during a dynamic maneuver. The FDI algorithm proposed here is one aspect of a complete fault tolerant approach. Specifically this detection can be used to reconfigure the controller, safely land the aircraft, and replace the faulty actuator. Residual (deg) 4 healthy servo unhealthy servo Time(sec) Fig. 8. Residuals generated for a healthy and unhealthy servo for FASER flight commands The validation of the fault detection algorithm using real flight test data together in the experimental setup provides a realistic validation framework for the fault detection filter. The results are satisfactory and confirm the adequate modeling of the underlying system, an adequate design of the fault detection filter, and the possibility to detect faults during the flight, while trying to minimize the probability of false alarms. VI. CONCLUSION A model based fault detection technique was applied to improve the reliability of a low cost UAV. The focus was on detecting abnormalities in a UAV servo actuaor. An experimental test setup was used to analyze different actuator response. The dynamics of a healthy actuator were captured by a third order system using system identification techniques. The detection thresholds chosen were robust against uncertainties and sensor noise. The performance of the fault detection algorithm was tested on healthy actuators and actuators with catastrophic and critical fault natures. Future work will consider bench-top experiments that include loads that approximate the aerodynamic forces observed in flight. This will be followed by flight test experiments of the proposed FDI algorithm. ACKNOWLEDGMENT This work was supported by a MnDrive Exploratory Grant entitled Smart Actuators for Preventative Maintenance of Small Uninhabited Aircraft. This work was also supported by the NASA Langley NRA Cooperative Agreement under Grant no. NNX2AM55A entitled Analytical Validation Tools for Safety Critical Systems Under Loss-of-Control Conditions. Dr. Christine Belcastro is the technical monitor. REFERENCES [] Y. Yeh, Triple-triple redundant 777 primary flight computer, in Proceedings on the 996 aerospace applications conference, pp , 996. [2] R. Collinson, Introduction to Avionics Systems. Springer, 23. [3] J. Gertler, Fault detection and dagnosis in engineering systems. New York, USA: Marcel Dekker, Inc., 998. [4] P. Frank, Fault diagnosis in dynamic systems using analytical and knowledge-based redundancy-a survey and some new results, in Automatica, Vol 26, No 3, pp , 99. [5] J. Chen and R. Patton, Robust Model-Based Fault diagnosis for dynamic systems. Kluwer academic publishers, 999. [6] P. Freeman, R. Pandita, N. Srivatsava, and G. Balas, Model-based and data-driven fault detection performance for a small UAV, in IEEE/ASME Transactions on Mechatronics, vol. 8, pp. 3 39, 23. [7] R. Pandita, J. Bokor, and G. Balas, Closed-loop performance metrics for fault detection and isolation filter and controller interaction, International Journal of Robust and Nonlinear Control, pp , 23. [8] X. Yang, M. Warren, B. Arain, B. Upcroft, F. Gonzalez, and L. Mejias, A UKF-based estimation strategy for actuator fault detection of UASs, in 23 International Conference on Unmanned Aircraft Systems (ICUAS), USA, pp , 23. [9] L. Ma and Y. Zhang, DUKF-based GTM UAV fault detection and diagnosis with nonlinear and LPV models, in Mechatronics and Embedded Systems and Applications (MESA), IEEE/ASME International Conference, pp , 2. [] F. Bateman, H. Noura, and M. Ouladsine, Actuators fault diagnosis and tolerant control for an unmanned aerial vehicle, in 6th IEEE International Conference on Control Applications, 27. [] P. Goupil, AIRBUS State of the Art and Practices on FDI and FTC, Control Engineering Practice, pp , 2. [2] A. Zolghadri, The challenge of advanced model-based FDIR techniques for aerospace systems: the 2 situation, in Proc. of 4th European Conference for Aerospace Sciences, 2. [3] A. Varga and D. Ossmann, LPV-techniques based robust diagnosis of flight actuator faults, Control Engineering Practice, vol. 3, pp , 24. [4] B. Vanek, A. Edelmayer, Z. Szab, and J. Bokor, Bridging the gap between theory and practice in LPV fault detection for flight control actuators, Control Engineering Practice, vol. 3, pp. 7 82, 24. [5] I. Reti, M. Lukatsi, B. Vanek, I. Gozse, A. Bakos, and J. Bokor, Smart mini actuators for safety critical unmanned aerial vehicles, in Proc. of 2nd Conference on Control and Fault-Tolerant Systems (SysTol 3), pp , 23. [6] U. of Minnesota, [7] F. Lie, A. Dorobantu, B. Taylor, D. Gebre-Egziabher, P. Seiler, and G. Balas, An Airborne Experimental Test Platform: From Theory to Flight (Part ), in InsideGNSS, pp , March/April 24. [8] F. Lie, A. Dorobantu, B. Taylor, D. Gebre-Egziabher, P. Seiler, and G. Balas, An Airborne Experimental Test Platform: From Theory to Flight (Part 2), in InsideGNSS, pp. 4 47, May/June 24. [9] G. How, D. Owens, and C. Denham, Forced oscillation wind tunnel testing for faser flight research aircraft, in AIAA Atmospheric Flight Mechanics Conference, August 22. [2] D. Owens, D. Cox, and E. Morelli, Development of a low-cost sub-scale aircraft for flight research: The faser project, in 25th AIAA Aerodynamic Measurement Technology and Ground Testing Conference, June 26. [2] J. Amos, E. Bergquist, J. Cole, J. Phillips, S. Reimann, and S. Shuster, UAV for reliability, December SeilerControl/Papers/Seiler All.html. [22] P. Freeman and G. Balas, Actuation failure modes and effects analysis for a small UAV, in American Control Conference (ACC), pp , 24. [23] J. Gertler, Analytical redundancy methods in fault detection and isolation, in IFAC/IMACS Symposium on Fault Detection, Supervision and Safety for Technical Processes SAFEPROCESS, pp. 9 2, 99. [24] E. Frisk and M. Nyberg, A minimal polynomial basis solution to residual generation for fault diagnosis in linear systems, Automatica, vol. 37, pp , 2.