International Journal of Automotive Technology, Vol. 10, No. 4, pp.

505−512 (2009) Copyright © 2009 KSAE

DOI 10.1007/s12239−009−0058−5 1229−9138/2009/047−13

INTEGRATED FAULT DETECTION AND DIAGNOSIS SYSTEM

FOR LONGITUDINAL CONTROL OF AN AUTONOMOUS
ALL-TERRAIN VEHICLE (ATV)
S. KIM , B. SONG and H. SONG
1) 2)* 2)

Mando Corporation, 413-5 Gomae-dong, Giheung-gu, Yongin-si, Gyeonggi 449-901, Korea

1)

Department of Mechanical Engineering, Ajou University, Gyeonggi 443-749, Korea

2)

(Received 18 August 2008; Revised 3 February 2009)

ABSTRACT−This paper presents a fault detection and diagnosis (FDD) method to enhance the reliability and safety for
longitudinal control of an autonomous all-terrain vehicle (ATV). An integrated approach using decentralized and centralized
FDD is proposed to optimize the tradeoff between sensitivity and robustness. While the decentralized approach is suitable for
detecting faults in actuators and sensors directly connected to a single processor, it is sensitive to noises and disturbances and
thus may result in false alarms. On the other hand, the centralized approach is based on information communicated between
multiple processors, and it detects and diagnoses faults through analyzing concurrent computations of multiple hardware
modules. However, its performance is still limited to isolating faults specifically in terms of components in the single
hardware. To incorporate the advantages of both FDD approaches, a two-layered structure integrating both decentralized and
centralized FDD is proposed and allows us to perform more robust fault detection as well as more detailed fault isolation.
Finally, the proposed method is validated experimentally via field tests of an ATV.
KEY WORDS : Fault detection, Fault diagnosis, Longitudinal control, Distributed system

NOMENCLATURE 1. INTRODUCTION
v : longitudinal velocity of ATV The growing demand for enhanced reliability and safety in
vdes : desired longitudinal velocity autonomous control systems has drawn significant pro-
vGPS : longitudinal velocity measured by GPS gress in fault detection and diagnosis (FDD) over several
ωw : angular velocity of wheel decades. In particular, as the control systems for vehicles,
ωe : angular velocity of engine industrial robots and aircrafts have become more com-
h : effective wheel radius plicated and distributed, rigorous research on FDD has paid
α : angle of throttle control motor much attention in these areas of application (Zhang and Li,
β : angle of brake control motor 1998; Yi et al., 2000; Fantuzzi et al., 2003).
ωα : angular velocity of α Most model-based FDD methods in the literature use
ωβ : angular velocity of β residuals (Isermann, 1995, 2006). Residuals are quanti-
Vti : input DC voltage to throttle motor tative differences between estimates based on a nominal
Vbi : input DC voltage to brake motor model and measurements from sensors. The residuals
Iti : input DC current to throttle motor should be robust to avoid a false alarm due to noise and
Ibi : input DC current to brake motor disturbances as well as sensitive to the occurrence of faults
KE : back-EMF constant of DC motor to enhance reliability. In general, the performance of FDD
Ra : armature resistance of DC motor depends on the accuracy of model-based estimates and the
Vtd : input DC voltage to throttle motor driver optimal choice of threshold. Most estimation techniques to
Vbd : input DC voltage to brake motor driver generate these residuals for FDD are classified as the
Dti : input PWM duty ratio of throttle motor driver observer, the detection filter or the parity equation approach
Dto : output PWM duty ratio of throttle motor driver (Chow and Willsky, 1984; Gertler, 1998; El Brouji et al.,
Dbi : input PWM duty ratio of brake motor driver 2006). For determination of the threshold, the automatic
Dbo : output PWM duty ratio of brake motor driver calculation method was recently introduced in the
literature. For instance, there is a threshold determination
by analyzing the stability of a system using linear matrix
*Corresponding author. e-mail: bsong@ajou.ac.kr inequalities (Ding et al., 2003) and another method called

505
506 S. KIM, B. SONG and H. SONG
the double-threshold-statistical-testing method, which sets
the second threshold for the function statically by calculat-
ing the case that a residue exceeds the first threshold (Fang
et al. , 1994). However, since there are always noise and
disturbances in dynamic systems in reality, “robustness”
still remains one of the most important issues for FDD
(Fang , 1994).
et al.
A vehicle is one of the most well-known distributed
systems and contains many processors, sensors and actuators.
The multiple processors communicate via so called ECU
and share information via in-vehicle networks, e.g , the . mental results to show the effectiveness of IFDD.
controller area network (CAN). In the literature, appro-
aches of FDD are classified into two groups: decentralized
and centralized FDD. The former (DFDD) aims to detect
and identify faults in a single processor that connects
sensors and actuators. This is performed by analyzing
residuals and has been applied to many vehicle appli-
cations, e.g., a motor (Moseler and Isermann, 2000; Kim,
2007; Benbouzid et al. , 2007), a throttle and brake valve
system (Pfeuer, 1997; Isermann, 2006) and sensors (Ding
at al. , 2004). In general, the DFDD enables us to detect the
fault more immediately and identify it in terms of more
specific hardware components due to the simplicity of the
mathematical model for state estimation of the single
module. However, since it depends on single residual and
threshold, it is sensitive to noise and uncertainties in the
system and may result in a false alarm (Fang et al. , 1994;
Isermman, 1995).
On the other hand, the centralized FDD (CFDD) focuses
on performance degradation resulting from faults on the
level of a system or vehicle, not an individual component.
That is, it monitors the performances of multiple pieces of
hardware and identifies faults using kinematic, kinetic and/
or heuristic relationships among individual modules. For
instance, CFDD has been applied to longitudinal and/or
lateral control for automated vehicle systems (Yi ,
et al.
2000; Song and Hedrick, 2005; Rajamani et al. , 2007).
Since it uses multiple measurements coming from distri-
buted processors, the robustness for FDD can be enhanced,
and this is why CFDD is applied to safety critical system,
such as automated highway systems (AHS). However, it is
still limited to isolating the fault in the terms of the specific
component or part where the fault occurred (Isermann,
2006).
The contribution of this paper is to propose an integrated
FDD (IFDD) using the combination of the two approaches
above to achieve more robust fault detection and more
specific fault isolation. Furthermore, the proposed FDD
will be applied to a CAN-based distributed system for the
longitudinal control of an autonomous all-terrain vehicle
(ATV). The remainder of this paper is divided into three
sections; Section 2 will describe the CAN-based distributed
control system consisting of multiple DSPs, sensors and
actuators and define the possible faults considered in this
study. In Section 3, three approaches will be explained in
detail: DFDD, CFDD and IFDD. While DFDD is designed
for an individual DSP to detect and isolate faults of the
corresponding sensors and actuators, depending on charac-
teristics of each hardware model, simultaneous CFDD based
on kinematic and kinetic relationships among the measure-
ment information communicated via CAN is proposed.
Then, the integrated FDD algorithm, which is a two-
layered FDD structure that is a combination of DFDD and
CFDD, is proposed to enhance the robustness of fault
detection and more specific fault isolation by taking the
benefits of both. Finally, Section 4 will present experi-
2. DISTRIBUTED CONTROL SYSTEM
2.1. System Hardware Layout
The hardware layout of the autonomous ATV is shown in
Figure 1. Additional hardware, such as a laser scanner, an
inertial measurement unit (IMU) and a global positioning
system (GPS), are implemented. Furthermore, rotary en-
coders are used to measure the engine and wheel speeds for
longitudinal control, and two DC motors and rotary en-
coders are implemented to control the throttle and brake
valves.
If the control system is centralized, i.e., all data and
information are transmitted to single main processor, the
rate of data loss and time delays increase due to the limits
of the computational capability of the processor and data
communication. To overcome this disadvantage of centrali-
zed control systems, seven DSPs are distributed over the
system, as shown in Figure 2. The DSPs send either pro-
cessed or measurement data via the CAN bus and share
information among them. For instance, while DSP 3 is
connected with the engine and wheel speed sensors and
transmits the message ω and ω via the CAN bus, infor-
e w
mation measured by the IMU is transmitted from DSP 5.
The velocity and absolute position of the ATV are received
from GPS, and DSP 7 receives obstacle information from a
laser scanner. DSP 2 receives all messages necessary for
longitudinal control through the CAN bus and calculates
both the desired throttle and brake control motor angles .
DSP 1 includes a fault manager, which gathers all CAN
Figure 1. Hardware layout for autonomous ATV.
 INTEGRATED FAULT DETECTION AND DIAGNOSIS SYSTEM FOR LONGITUDINAL CONTROL 507

Table 2. Fault generation considered in the benchmark.

No. Target
FDD
for Type Method

1 DC motor Additive
- abrupt
H/W (electrical)
- change inner resistance
H/W (electrical)
2 Encoder Additive
- abrupt - exchange any bits of
digital signals
H/W (mechanical)
3 Actuator Additive
- abrupt - impose additional fric-
tion to motor shaft
4 CAN Additive
- abrupt
H/W (electrical)
- take CAN plug out
Figure 2. Schematics of data communication among DSPs
via CAN. 5 Wheel speed Multiplicative S/W (emulator)
encoder - abrupt - add multiplicative error

data and performs FDD for the system. Finally, PC/104 is

used to acquire all messages via the CAN bus.
2.2. Selection of Possible Faults
Since all possible faults cannot be considered, it is necess-
ary to conduct fault propagation analysis to determine the
severity of faults and select severe faults to be considered
(Blanke et al., 2003). However, based on the selection of
faults with applications to autonomous vehicles in the liter-
ature, it is assumed that additionally implemented hard-
ware, such as actuators and sensors, have higher chances of
fault occurrence (Yi et al., 2000; Song and Hedrick, 2005;
Rajamani et al. , 2007).
Furthermore, although all hardware for the autonomous
ATV is implemented as shown in Figure 1 and 2, FDD for
only longitudinal control is considered in this paper for
brevity. Thus, four DSPs and the corresponding hardware
related with longitudinal control are considered. However,
fault in the processors is not considered here, even though
Table 1. Hardware set for fault detection and diagnosis.
Processor Hardware Target for Variables for
FDD FDD
DC motor TI
V
Throttle encoder α nected or embedded to a single DSP, and the second
actuator
motor driver TO
D
its severity is very high. Therefore, the corresponding critical
variables for FDD, which are related to sensors, actuators
and communication, are listed in Table 1. More specifi-
cally, the proposed IFDD algorithm will be performed in
DSP 1, which is a fault manager, and DSP 2, 3 and 6 are
related to sensors and actuators for longitudinal control
(refer to Table 1).
2.3. Fault Generation
In order to generate faults related to the hardware shown in
Table 1 arbitrarily, three different methods described in
Table 2 are considered in the benchmark. The H/W method
means that an abrupt change is imposed either electrically
or mechanically, while with the S/W method, the fault
signal is emulated in the DSP triggered by an emulator via
the CAN (refer to Figure 2). The proposed fault generation
methods will be used for experimental validation of FDD
proposed in Section 3.
3. INTEGRATED FAULT DETECTION AND
DIAGONOSIS SYSTEM
In this section, three methods will be proposed: the first one
is decentralized FDD (DFDD) based on the modular
characteristics of sensors, actuators and controllers con-
method is CFDD, analyzing the performance of the vehicle
control system and/or comparing information between

DSP 2 DC motor BI
V different DSPs (or modules). The last method is called
Brake encoder β IFDD, which combines the two methods to gain the bene-
actuator fits of both.
motor driver BO
D

Communication CAN ∆ W, ∆ GPS

T T 3.1. Decentralized FDD (DFDD)
If the model-based FDD is applied to the ATV system, the
DSP 3 Speed sensor wheel speed
encoder ωW main problems of DFDD are to define residuals and to
determine the threshold. Since the fault is isolated by the
DSP 6 Speed sensor GPS GPS
v
definition of a residual in DFDD, the fault diagnosis be-
508 S. KIM, B. SONG and H. SONG

respectively, as follows.
R1 V t V̂ t R2 V t V̂ t
= ti ( )– ti ( ), = (2) bi ( )– bi ( )

Next, the fault of the throttle or brake motor driver can

be related to the similarity between the input and output
PWM signals. That is, the residual for each driver can be
defined as the difference between the input and output
Figure 3. Block diagram of throttle (or brake) motor con- PWM duty ratio of the motor driver.
trol system. R3 D t D t R 4 D t D t
= ti ( )– to ( ), = (3) bi ( )– bo ( )

where all duty ratios of the PWM are monitored for FDD.
comes relatively easier than that of CFDD. Third, the faults of encoders used to measure the output
angles of the throttle and brake motors are considered. In
3.1.1. Residual generation for DFDD this study, an absolute type of rotary encoder is used to
In order that faults in the throttle and brake actuators are overcome the fluctuation problem of the zero point of
considered in the framework of DFDD, the residual is encoders due to vibration of the ATV. Therefore, the out-
generated based on an independent model of each hard- puts of encoders are given as gray BCD codes of 10 bits,
ware component. As actuators to control throttle and brake which are generated by digital signals from 10 wires for
valves, two DC motors including a motor driver and an each encoder. Accordingly, if any fault occurs in one or
encoder are used and connected to DSP 2 (in Figure 2). As more wire, then the output value of the encoder changes
shown in Figure 3, there is a position controller to track the discontinuously. Using the fact that the amount of change
desired position angle resulting from a longitudinal con- in the output angle value is limited to some boundary under
troller in DSP 2, and the pulse width modulation (PWM) the no fault condition, the residual for each encoder is
signal corresponding to the command input calculating defined as follows.
from the position controller is supplied to the motor driver. R5 α· R6 β· (4)
Finally, the amplifying PWM is sent to the DC motor, and = , =

the motor angle measured by the encoder is fed into the Finally, if other faults which are not considered above
position controller. Among these components, faults of the may occur in components of throttle and brake actuators, it
DC motor, motor driver, encoder and position controller is expected that the desired performance of actuators is not
will be considered here. achieved. So, the residual for each of actuators using errors
First, to generate the residual related with the DC motor, between desired and measured angles of DC motors can be
the following mathematical model is used to estimate the defined as
electrical characteristics of the DC motor (Moseler and R7 α α R 8 β β (5)
Isermann, 2000). = – des , = – des

V̂ t R I t K ω α t (1) where αdes and βdes are calculated from a longitudinal

ti ( ) = a ti ( ) + E ( )
controller for speed or distance control.
where ti( ) and ωα are measured, and both a and E are
I t R K

estimated using least squares estimation based on experi- 3.1.2. Determination of threshold
mental data. Then, based on the average model of the It is challenging to set an optimal threshold of a residual for
motor driver, ti( ) is approximated as V t V D t ,
V t ti ( ) td ⋅ to ( ) FDD satisfying both sensitivity and robustness. In general,
where td and to( ) are measured. Finally, the time
V D t while more robustness can be achieved by setting a higher
responses of V̂ t and ti( ) are compared in Figure 4. If
ti ( ) V t threshold, sensitivity may be degraded. In order to over-
there are either electrical or mechanical faults in the DC come this drawback, a double-threshold-statistical-testing

motor, changes in a and E are expected, thus resulting in

R K method is applied to determine the threshold (Fang , et al.

a discrepancy between V̂ t and ti( ). Therefore, the ti ( ) V t 1994). This method uses two separate tests with two levels
residuals for the throttle and brake DC motors are defined, of thresholds to facilitate the trade-off between detection
power and false alarm probability. The fault is confirmed
by the second threshold for the function statically calcu-
lating the case that a residual exceeds the first threshold
established ahead. Mathematically, this can be expressed as
follows.
⎧
R ε 1 ε 2 F R H for = 1, ..., 8
if Pr ( i > i )> i ( i
(6)
)=
i
FR L
⎨
⎩ Otherwise, ( i )=

Figure 4. Time responses of V̂ t and V t under no fault ti ( ) ti ( ) where εi1 and εi2 are the first and second thresholds,
condition. respectively, and ( i) is the fault detection flag.
F R
 INTEGRATED FAULT DETECTION AND DIAGNOSIS SYSTEM FOR LONGITUDINAL CONTROL 509

Table 3. Fault signature for DFDD.

( )
F Ri
Isolated Fault
Hardware components flag
1 2 3 4 5 6 7 8
H L L L L L H L Motor ( 1)
F D

Throttle L L H L L L H L Driver ( 2)
F D

actuator H L L L H L H L Encoder ( 3)
F D

L L L L L L H L Controller ( 4)
F D

L H L L L L L H Motor ( 5)
F D

Brake L L L H L L L H Driver ( 6)
F D

actuator H L L L L H L H Encoder ( 7)
F D

L L L L L L L H Controller ( 8)
F D

Figure 6. Probability functions and fault flags for the fault

situation in Figure 5.
3.1.3. Fault isolation for DFDD
A fault that occurs in throttle and brake actuators can be seconds in Figure 6(a), the fault flag ( 7) becomes the
F R

isolated by fault signature, as shown in Table 2. That is, value in Figure 6(b). Similarly, ( 1) also turns to at 2
H F R H t

eight distinct fault flags, ( ), by examining eight indivi-

F Di in Figure 6(b), and ( 1) becomes at 2. Finally, based on
F D H t

dual fault detection flags, ( ), are generated in a single

F Ri Table 2, the fault in the throttle motor is detected and
DSP (i.e., DPS 2). Thus, the faulty component can be diagnosed at 2.
t

isolated by analyzing fault flags in Table 2.

In order to validate the proposed algorithm for DFDD,
experiments to evaluate how well a fault in the throttle
motor is detected were conducted. In general, it is known
that a high temperature of the inner stator, breakage of the
rotor or physical overload to motor can cause the inner
parameters of the motor to change or the performance of
the motor to be degraded (Moseler and Isermann, 2000;
Kim, 2007). To mimic these causes to generate faults, as
mentioned in Table 2 (No. 1), a variable resister is con-
nected to the input terminal of DC motor and the value of
the resistance increases arbitrarily at 1, as shown in Figure
t over multiple residuals (Yi et al. , 2000, Rajamani et al.,
5(a). Then, the residual 7 increases and exceeds the first
R 2007).
threshold at 2.8 seconds in Figure 5(c). After the prob-
ability function for 7 exceeds the second threshold at 3
R control of ATV is selected (refer to Table 3). Then, the
Figure 5. Residuals of DFDD for a DC motor in the case of
3.2. Centralized FDD (CFDD)
Since there are too many possible faults that may occur in
the system, it is almost impossible to consider all of them
in DFDD. Therefore, it is necessary to select a list of com-
ponents that are critical to the safety and/or performance of
the system. Especially in the vehicle applications, the
critical components are distributed and communicate with
each other via CAN. Therefore, most FDD approaches are
based on the analysis of the mathematical correlation
among measurements via CAN and concurrent observation
Similarly a list of critical components for longitudinal
residuals are defined based on local controllers or kinetic
and/or kinematic correlation among distributed sensors.
Finally, the detected fault is isolated via a fault signature
method.
3.2.1. Residual and threshold for CFDD
Using the error between the desired velocity and the wheel
rotation velocity measured from the wheel speed encoder, a
residual for CFDD is defined as follows.
r1= h ω w vdes
– (7)
In addition, when supposing that there is no slip between
wheels and ground, a residual based on the relation bet-
ween the wheel rotation speed and the velocity measured
by GPS can be defined as follows.
r2 v GPS h ω w (8)
= –

a change in inner resistance. The angular velocity of a wheel is measured by incre-

510 S. KIM, B. SONG and H. SONG

Table 4. Fault signature for CFDD.

Hardware Isolated Fault
( ) ( 2) ( 3) ( 4) Components
f r1 f r
Flag f r f r

Long. Ctrl H L L L Controller ( 1) f C

Rotary
Wheel speed L H L L encoder ( 2) f C

encoder
H H H L CAN ( 3) f C

GPS L H L H CAN ( 4) f C

mental encoders and sent to DSP 3 (refer to Figure 2).

Then, after filtering the noise of measurements out, the
calculated velocity data is sent to the CAN bus and
received by DSP 2 for longitudinal control. Similarly, the
velocity of the ATV measured by GPS is sent to DSP 2 via Figure 8. Probability functions and fault flags for the fault
CAN. Although there is no fault in the encoder, GPS or situation in Figure 7.
processor, some level of data (or packet) loss due to a
communication fault may have an equivalent impact in the 3.2.2. Fault isolation for CFDD
sense of performance degradation resulting from a sensor Each of the CFDD residuals is monitored by gathering
fault. To detect the communication fault, the communi- information among multiple hardware components via

cation period is used to generate the residual. That is, since CAN, and the corresponding fault can be isolated by the
the communication period of a CAN message can be fault signature (Yi et al., 2000; Rajamani , 2007).
et al.

measured using a timer in DSP 2 for longitudinal control, Based on the fault signature in Table 3, five possible faults
the residuals for the CAN are defined as corresponding to fault flags are detected and isolated.
r3 ∆ T ∆ T r4 ∆ T ∆ T (9) The performance of CFDD is tested experimentally for
= ref – w , = ref – GPS
the case of continuous packet loss of a CAN message, as
where ∆ is the reference communication period of CAN
Tref described in Table 2 (No. 4). After intentionally blocking a
message, and the communication periods of the wheel CAN message of ω for about 5 seconds starting at 1 in
w t

speed and GPS messages are defined respectively as follows: Figure 7(a), the corresponding residual is observed. The
∆T t[ ω (k ) ]−t[ ω ( k ) ] for = , residuals 1, 2, and 3 increase and go over each threshold
r r r
j j j –1 j w GPS
after 1 second, as shown in Figure 7(b)~(d). Then, each of
Next, as done in DFDD, a similar threshold to detect a the probability functions for 1, 2 and 3 exceeds the second
r r r

fault is determined based on the double-threshold-stati- threshold, as shown in Figure 8(a). Finally, three fault
stical-testing method, and fault detection flags are express- signals, ( ), become , as shown in Figure 8(b), and
f ri H

ed as follows. subsequently, according to Table 3, ( 3) becomes at 2.

f C H t

⎧ if Pr ( ri > δ i1 ) > δi2 Therefore, the fault in the CAN message of the wheel
f ( ri ) = H
⎨ for = 1, ..., 4
i (10) speed is detected and diagnosed successfully.
⎩ Otherwise, f (ri )=L

3.3. Integrated FDD (IFDD)

To incorporate the advantages of both the DFDD and
CFDD approaches, this FDD algorithm is proposed to
integrate both in DSP 1. The ultimate objective of IFDD is
to isolate fault components more specifically and distin-
guish fault from noise and disturbances robustly through
analyzing the system performance. As shown in Table 4, all
fault flags of both CFDD and DFDD are listed and are
matched up for fault isolation. More specifically speaking,
three cases of fault situation can be considered as follows
(refer to Table 4).
Case 1 : This is when a specific fault flag of DFDD is , H

and ( 1) of CFDD is in spite of some level of time

f C H

discrepancy between the two signals. In this case, fault

detection is double checked by both DFDD and CFDD,
Figure 7. Residuals of CFDD for fault of CAN message and its isolation is conducted more precisely. However,
(ω ).
w when all faults flags of DFDD are and ( 1) of CFDD is
L f C
 INTEGRATED FAULT DETECTION AND DIAGNOSIS SYSTEM FOR LONGITUDINAL CONTROL 511

Table 5. Fault signatures for IFDD.

DFDD CFDD Fault Isolation
( 1)
F D =H DC motor
( 2)
F D =H Throttle Motor driver
( 3)
F D =H actuator Encoder
( 4)
F D =H Controller
( 5)
F D =H
( 1)= Actuator
f C H
DC motor
( 6)
F D =H
Brake Motor driver
( 7)
F D =H
actuator Encoder
( 8)
F D =H Controller
( i) Intolerable and not
F D =L
isolatable
( i)
F D =H ( i)=
f C L Tolerable and isolatable Figure 9. IFDD for a fault occurring in the absolute
encoder for the throttle control motor.
( 2)=f C H Encoder for Rotary encoder
( 3)=f C H
wheel speed CAN message
( i)
F D =L Sensor
( 4)=f C H GPS module
GPS
( 5)=f C H CAN message

H , the fault is still classified as intolerable but not isolatable

(refer to Table 4). Thus, IFDD allows us to deal with other
possible faults that may occur in actuators but may not be
considered in DFDD.
Case 2 : This is the case that a specific fault flag of
DFDD is , but ( i) of CFDD is . In this case, the fault
H f C L

diagnosed by DFDD is concluded to be tolerable, because

the overall performance of the system (i.e., velocity track-
ing performance) is not degraded much. That is, it is not
necessary to stop the system immediately, although a fault
is detected by DFDD. Furthermore, in some cases, a false
alarm of DFDD due to unexpected noise or disturbances
can be prevented.
Case 3 : This is the case that any flag of CFDD except
( 1) is , but all of DFDD are . While all flags of DFDD
f C H L
are related only to actuators and the corresponding faults
affect the controller performance, i.e., ( 1), they are not
f C
related with other fault flags of CFDD. This means that
only CFDD works to detect the fault, as shown in Table 4.
Figure 10. IFDD for the case of temporary additive friction
to the throttle motor shaft.
ced through the proposed algorithm, which is Case 2 of
IFDD.
The first scenario is that a fault occurs in an encoder for
the throttle control motor (refer to Table 2~No. 2). That is,
the 5th wire signal of the 10 wires in the encoder is dis-
abled from 1 to 2 in Figure 9(b); thus, the angle measure-
t t

It is necessary to remark that IFDD can be expanded to ment of throttle motor changes suddenly with large
apply to sensors if more residuals are defined for the more amplitude. Then, the fault flag ( 3) coming from DFDD
F D

detailed components. becomes at 3, as shown in Figure 9(c). It is noted that the

H t

fault was not detected immediately after the fault occurred,

4. EXPERIMENTAL RESULTS
In order to validate the proposed IFDD algorithm experi-
mentally, two faulty scenarios were considered to demon-
strate the advantages of IFDD. One is to demonstrate that
concurrent observations by DFDD and CFDD lead to more
reliable fault detection, i.e., double fault detection and
since the double threshold method was applied. While the
first threshold is chosen to increase sensitivity, the second
threshold is chosen statistically to improve robustness.
Therefore, the second threshold may be changed if the
detection time needs to be shortened.
In addition, errors between the desired and measured ωw
increase in Figure 9(a); subsequently, the fault flag ( 1)
f C

more specific fault isolation, which is of IFDD. The

Case 1 resulting from CFDD turns to at 2 seconds in Figure
H

other is to show how the robustness of FDD can be enhan- 9(d). Therefore, the fault of the encoder in the throttle
512 S. KIM, B. SONG and H. SONG
control motor system is doubly detected by both DFDD
and CFDD. Moreover, IFDD diagnoses the fault specifical-
ly as a throttle motor encoder problem based on Table 4.
In the second scenario, it is supposed that temporary
friction is imposed to the throttle motor shaft from t1 to t2 in
Figure 10(b) (refer to Table 2~No. 3). The fault is detected
and isolated as one of the throttle actuator by DFDD as
fault flag F(D1) turns to H at t3 in Figure 10(c) (refer to
Table 4). However, the error between the desired and
measured ωw remains small over the period that the fault
occurs in Figure 10(a); thus, the fault flag f (C1) of CFDD
does not become H in Figure 10(d). This means that the
motor fault detected by DFDD does not degrade the per-
formance of the longitudinal controller much. Therefore,
the fault is classified as tolerable and isolatable according
to Table 4. In this scenario, the imposed friction is not the
fault but a disturbance. This experimental result implies
that a false alarm may be generated due to noise and dis-
turbance if only DFDD is used and/or its sensitivity is high.
However, the two-layered structure of IFDD including
DFDD and CFDD allows us to minimize the false alarms
due to uncertainties and disturbances.
5. CONCLUSIONS
The integrated FDD combining DFDD with CFDD was
applied to a CAN-based distributed system for an auto-
nomous ATV. While the DFDD was designed to detect a
fault in hardware connected to a single DPS, the CFDD
was proposed to the monitor performance degradation
resulting from faults at the level of a system or vehicle, not
an individual component. By integrating both methods, the
proposed IFDD algorithm allows us to perform more robust
fault detection as well as more specific fault isolation. The
performance and effectiveness of IFDD was validated
experimentally for the given possible faulty scenarios.
ACKNOWLEDGEMENT−This work was supported by grant
No. R01-2006-000-11373-0 from the Basic Research Program of
the Korea Science & Engineering Foundation.
REFERENCES
Benbouzid, M. E. H., Diallo, D., Zeraoulia, M. and Zidani,
F. (2006). Active fault-tolerant control of induction motor
drives in EV and HEV against sensor failures using a
fuzzy decision system. Int. J. Automotive Technology 7,
6, 729−739.
Blanke, M., Kinnaert, M., Lunze, J. and Staroswiecki, M.
(2003). Diagnosis and Fault-tolerant Control. Springer.
Chow, E. Y. and Willsky, A. S. (1984). Analytical redun-
dancy and the design of robust failure detection systems.
IEEE Trans. Automatic Contol, AC-29, 7, 603−614.
Ding, E. L., Fennel, H. and Ding, S. X. (2004). Model-
based diagnosis of sensor faults for ESP systems. Control
Engineering Practice, 847−856.
Ding, S. X., Zhang, P. and Frank, P. M. (2003). Threshold
calculation using LMI-technique and its integration in
the design of fault detection systems. Proc. IEEE Conf.
Decision and Control, Maui, Hawaii, USA.
El Brouji, H., Poure, P. and Saadate, S. (2006). A fast and
reliable fault diagnosis method for fault tolerant shunt
three phase active filter. IEEE ISIE, Montreal, Canada.
Fang, X., Gertler, J., Kunwer, M., Heron, J. and Barkana, T.
(1994). A double-threshold-testing robust method for
fault detection & isolation in dynamic systems. Proc.
ACC, Baltimore, Maryland. 1979−1983.
Fantuzzi, C., Secchi, C. and Visioli, A. (2003). On the fault
detection and isolation of industrial robot manipulators.
Proc. IFAC Symp. Fault Detection, Supervision and Safety
for Technological Processes, Washington.
Gertler, J. J. (1998). Survey of model-based failure detection
and isolation in complex plants. IEEE Control Systems
Magazine, 3, 11.
Isermann, R. (2006). Fault Diagnosis Systems. Springer.
Berlin.
Isermman, R. (1995). Model-based fault detection and
diagnosis methods. Proc. ACC, Seattle, Washington,
1605−1609.
Kim, N. (2007). Rotor fault detection system for inverter
driven induction motors using current signals and an
encoder. J. Power Electronics 7, 4, 870−881.
Moseler, O. and Isermann, R. (2000). Application of model-
based fault detection to a brushless DC motor. IEEE
Trans. Industrial Electronics 47, 5, 1015−1020.
Pfeuer, T. (1997). Application of model-based fault detec-
tion and diagnosis to the quality assurance of an auto-
motive actuator. Control Engineering Practice 5, 5,
703−708.
Rajamani, R., Howell, A. S., Chen, C., Hedrick, J. K. and
Tomizuka, M. (2007). A complete diagnostic system for
automated vehicles operating in a platoon. IEEE Trans.
Control Systems Technology 9, 4, 553−564.
Song, B. and Hedrick, J. K. (2005). Fault tolerant nonlinear
control with applications to an automated transit bus.
Vehicle System Dynamics 43, 5, 331−350.
Yi, J., Alvarez, L., Howell, A., Horowitz, R. and Hedrick,
J. K. (2000). A fault management system for longitudinal
vehicle control in AHS. Proc. ACC, 1514−1518.
Zhang, Y. and Li, X. R. (1998). Detection and diagnosis of
aircraft sensor and actuator failure. IEEE Trans. Aero-
space and Electronic Systems 34, 4, 1302−1312.