Probabilistic Performance Analysis of Fault Diagnosis Schemes

let c i be the cost of implementing the system G (i )
θ
with the scheme V (i ) , for all i . A
trade study examines the trade-off between the cost c i and the performance of the
scheme V (i ) , with respect to the system G (i )
)
, for each i . For example, each system G(i
θ θ
may consist of a different combination of sensors and components, in which case
a trade study may be used to decide if it is more beneficial, from a fault diagnosis
standpoint, to use higher-quality components or to use redundant copies of a lowerquality
component. In addition to size, weight, and monetary costs, c i may also
include a measure of how difficult it is to compute the performance metrics for the
fault diagnosis problem given by G (i )
θ and V (i ) .
3. Certifying system safety: Suppose that when a fault is detected, the system G θ and
the fault diagnosis scheme V are reconfigured, as in Section 4.4.2. Recall that in
Section 4.4.2, we showed that
Ĵ k (i , j ) = P( ˆD j,k ∩ H i ,k )
is the probability of the system being in configuration s j when it should be in configuration
s j . Note that for some (i , j ) pairs, the event ˆD j,k ∩ H i ,k is safe, while for other
pairs it is not. For example, it is safe to be in the nominal mode when no faults have
occurred, but it is unsafe to be in the nominal mode when a critical sensor has failed.
Therefore, by computing and analyzing the matrices {Ĵ k }, we can quantitatively certify
that the probability that system is in a safe configuration, at time k, is within some
acceptable range [1 − α,1].
6.3 Air-Data Sensor Example
Nearly all aircraft use a pitot-static probe to determine airspeed V and altitude h. Because
these data are essential for flying, the pitot-static probe is integrated into the flight control
feedback loop. These sensors are prone to a number of failures, such as icing and blockage,
that cause them to produce incorrect values. If such a failure goes undetected, the autopilot
system or the pilot may use the erroneous values to issue commands that cause the aircraft
to crash. To avoid such disasters, large commercial aircraft, such as the Boeing 777 [103,104],
have multiple pitot-static probes in different locations. However, most aircraft designers
have developed a set of standard operating procedures that allow safe recovery of the aircraft
when a pitot-static probe failure is detected [6]. In this application we explore the detection
of such faults by exploiting the analytical redundancy between airspeed, altitude, and flight
path angle. This example was also studied less extensively in the conference papers [97, 98].
101