Automatica 81 (2017) 87–95

Contents lists available at ScienceDirect

Automatica
journal homepage: www.elsevier.com/locate/automatica

Brief paper

Adaptive fault-tolerant control for actuator failures: A switching

strategy✩
Hupo Ouyang, Yan Lin
School of Automation, Beijing University of Aeronautics and Astronautics, Beijing, 100191, China

article info abstract

Article history: In this paper, a new adaptive fault-tolerant control (FTC) scheme based on a switching strategy is proposed
Received 11 November 2015 for a class of nonlinear systems with uncertain parameters and actuator failures, for which some healthy
Received in revised form actuators are available as backups. By designing a set of monitoring functions (MFs) to supervise the
12 December 2016
behavior of some variables, it is shown that the failure detection and the switching from a faulty actuator
Accepted 22 February 2017
Available online 19 April 2017
to a healthy one can be performed simultaneously without any knowledge of failure patterns, and the
prescribed transient and steady-state performance for the tracking error can be achieved regardless of
Keywords:
the switching.
Actuator failure © 2017 Elsevier Ltd. All rights reserved.
Fault detection
Fault-tolerant control
Adaptive control
Switching control

1. Introduction combine adaptive control and actuator-switching have also been

Since the pioneering works reported in the early 1990s (Pat-
ton, 1997), many fault-tolerant control (FTC) approaches against
actuator failures have been proposed (Boskovic, Jackson, Mehra,
& Nguyen, 2009; Boskovic & Mehra, 2010; Tao, Joshi, & Ma, 2001;
Zhang & Jiang, 2008; Zhang, Parisini, & Polycarpou, 2004), in which
adaptive FTC has been proved to be an effective way to accom-
modate system uncertainties, actuator failures and external dis-
turbances. The mainstream approaches of adaptive FTC against
actuator failures can be roughly divided into the following cat-
egories: MMST (Boskovic et al., 2009; Boskovic & Mehra, 2010),
information-based diagnostic approach (Zhang et al., 2004), and
direct adaptive actuator failure compensation (Tao et al., 2001).
For MMST, a bank of identification models and a corresponding
controller bank were used to implement failure detection and
isolation, and to determine, through the supervision of a set of per-
formance indices, the switching of the controller when the actua-
tor or sensor failure occurs. Recently, with appropriately designed
selecting functions based on tracking error, some approaches that
✩ This work was supported in part by NSFC under Grants 61673038, 61433011
and the National Basic Research Program of China (973 Program) under Grant
2014CB046406. The material in this paper was not presented at any conference.
This paper was recommended for publication in revised form by Associate Editor
Gang Tao under the direction of Editor Miroslav Krstic.
E-mail addresses: ouyanghupo@163.com (H. Ouyang), linyan@buaa.edu.cn
(Y. Lin).
http://dx.doi.org/10.1016/j.automatica.2017.03.014
0005-1098/© 2017 Elsevier Ltd. All rights reserved.
developed to adaptively pick out the failed ones among multiple
actuators without using fault detection mechanism (Takahashi &
Takagi, 2012; Yang, Ge, & Sun, 2015), but the price paid is that the
tracking performance may be poor (Takahashi & Takagi, 2012). The
information-based diagnostic approach (Zhang et al., 2004) pro-
vides a unified methodology for fault diagnosis and accommoda-
tion, whose architecture combines an online monitoring module
consisting of a bank of nonlinear adaptive estimators, and a con-
troller module to accommodate the effects of faults on the basis
of the fault information. Motivated by control problems encoun-
tered in some control systems such as aircraft flight control, a direct
adaptive actuator failure compensation approach was proposed by
Tao et al. (2001) and has been extended to cover a large class of
systems (Tao, 2014; Wang & Wen, 2010). With the assumption
that the actuation redundancy can guarantee the control objectives
even if some actuators suffer failures, the proposed approach by
Tao et al. (2001) possesses some features such as no fault detection
is needed, and the control reconfiguration is adaptively updated.
In this paper, an adaptive state feedback FTC is proposed based
on a supervisory switching strategy for a general class of nonlin-
ear systems with uncertain parameters and possible actuator fail-
ures, for which some healthy actuators are available as backups.
The motivation behind the research is twofold. Firstly, in many ap-
plications such as civil aircrafts, satellite attitude control systems,
hydraulic systems and chemical processes, some actuators are
used as ‘‘backups’’, i.e., once the actuator failure is detected, one
or more of the backup actuators will be used to replace the failed
88 H. Ouyang, Y. Lin / Automatica 81 (2017) 87–95
one (Alwi & Edwards, 2008; Goupil, 2011; Isermann, Schwarz, &
Stolzl, 2002; Muenchhof, Beck, & Isermann, 2009). Secondly, de-
spite the great progress in adaptive FTC, the existing literature still
has several drawbacks that hinder the range of their applications:
• To detect the failures, a bank containing possible failure models
needs to be constructed for most of the adaptive FTC approaches
against actuator failures (Boskovic & Mehra, 2010; Zhang et al.,
2004). Therefore, if any failure outside the bank occurs, the
system stability and performance specifications may not be
guaranteed (Zhou, Rachinayani, Liu, Ren, & Aravena, 2004).
• The lack of fault detection and isolation mechanism in Tao et al.
(2001) implies that the failed actuators may not be deactivated
since we do not know which one fails. Consequently, if more
actuators are stuck, the reconfigured inputs may saturate since
more control effort is needed to overcome the effect of the stuck
inputs (Peni, Vanek, Szabo, & Bokor, 2014).
In the FTC design, we first introduce two types of prescribed
performance that we borrow from Bechlioulis and Rovithakis
(2010), Tee, Ge, and Tay (2009) and Wang and Wen (2010) in
backstepping technique: One type is used to bound the transient
and steady-state performance of the tracking error, and another
one is used to bound the amplitudes of the other errors of the
backstepping design. They are then used to construct a Lyapunov
function, by which a set of monitoring functions (MFs) is designed
as tolerance bands for supervising the behavior of the errors in
such a way that: (1) The adaptive control law can make the errors
lie within their tolerance bands in the presence of parameter
uncertainties and actuator failures, as long as the failures do not
bring any error out of its band, and (2) The actuator switching is
triggered only when the failure is detected by at least one of the
MFs. The main contributions of this paper are summarized below.
• To the best of our knowledge, this is the first adaptive FTC based
on supervisory switching that guarantees the tracking error
to satisfy a prescribed transient and steady-state performance
regardless of actuator switching.
• Under the supervision of the proposed MFs, fault detection and
actuator switching can be performed simultaneously without
using any bank of fault detection estimators.
• The tolerance bands given by the MFs, together with the
inherent robustness of the adaptive control, can accommodate
a certain degree of actuator and other system component
faults without triggering switching. Moreover, the ‘‘width’’
of the tolerance bands can be altered according to practical
engineering problem.
• The MFs guarantee that all the closed-loop states belong to L∞
for finite switchings of the actuators without any additional as-
sumption. By comparison, some strict assumptions are required
in Zhang et al. (2004) to ensure that the failure can be detected
before possible occurrence of an unbounded growth of some
state variable.
2. Problem statement
We consider the following nonlinear plant in strict-feedback
form
ẋi = xi+1 + θ ϕi (x̄i ),
T
i = 1, 2, . . . , n − 1,
ẋn = u + ϕ0 (x) + θ ϕn (x),
T
y = x1 ,
where x̄i := [x1 , x2 , . . . , xi ]T ∈ Ri , i = 1, 2, . . . , n, are state vec-
tors with x = x̄n , which are assumed available for measurement,
θ ∈ Rr is an unknown constant vector, ϕ0 (x) ∈ R, ϕi (x̄i ) ∈ Rr and
ϕn (x) ∈ Rr are known smooth nonlinear functions, y ∈ R is the
system output and u ∈ R is the input whose components may fail
during the system operation.
The control objective of this paper is to design an adaptive
FTC based on a switching strategy so that the output y can track
a desired trajectory yr with a prescribed transient and steady-
state performance even if actuator failures occur. Fig. 1 shows the
schematic diagram of the control structure, where we assume that
there are total m actuators, among which only one actuator is
connected to the controller at any given moment. If at some time
instant, the failure of the current actuator is detected by one of the
appropriately designed MFs, the current actuator will be switched
to the next one. Here, by actuator switching we mean that the
controller is switched from the faulty actuator to a healthy one.
We make the following assumptions.
Assumption 1. Each actuator can be connected to the control
signal v only once and is failure free at the switching instant when
the actuator is applied. Moreover, it is assumed that one actuator
has been connected to the system at t = 0.
Assumption 2. The m actuators can guarantee that the closed-
loop system works normally on [0, +∞).
Assumption 3. The unknown parameter vector θ lies in a known
bounded convex set
Πθ = {θ̂ ∈ Rr |P (θ̂ ) ≤ 0}, (2)
where P is a convex smooth function.
Assumption 4. The reference signal yr and its derivatives up to
order n are known, bounded, and piecewise continuous.
Remark 1. Assumption 1 implies that there is no switching at t =
0. Assumption 3 implies that an upper bound of ∥θ∥, say, θM , can
be obtained such that ∥θ ∥ ≤ θM .
Remark 2. Usually, actuator dynamics are much faster than the
plant to be controlled and therefore, can be ignored without
causing significant error (Yu & Jiang, 2012). In this paper, the same
as many publications, we assume that the gain of the actuators has
been normalized to unity when they are failure free; in this case,
from Fig. 1, u = ui = v . If actuator dynamics are taken into account
and can be described by a stable linear model (Boskovic & Mehra,
2010), Fig. 1 shows that simply combining the actuator model with
the plant, the proposed scheme can still be applied.
3. Adaptive fault-tolerant control based on monitoring func-
tions
3.1. Prescribed performances
First of all, since the system (1) is in strict-feedback form, we
shall use backstepping technique to design the adaptive controller,
for which the tracking error and the other error variables are
defined as follows1 :
ϵ = y − yr , (3)
zi = xi − αi−1 , i = 2, . . . , n, (4)
where αi−1 are the virtual control signals to be designed.
The motivation for introducing prescribed performances for the
tracking error ϵ and the errors zi is twofold: to provide criteria
under which the MFs can be constructed to detect the failures of
(1) the actuators, and on the other hand, to make ϵ and zi satisfy the
prescribed performances even if actuator failures occur.
1 Throughout of the paper, for the sake of brevity, we shall drop the argument of
some functions unless otherwise specified; for example, y is used to denote y(t ).
 H. Ouyang, Y. Lin / Automatica 81 (2017) 87–95 89

Fig. 1. Architecture of the fault tolerant control.

1. Prescribed performance for ϵ Remark 3. Both (5) and (9) are suitable as criteria for constructing
The prescribed performance for the tracking error, which we MFs since they provide prescribed bounds for ϵ and zi . Note that (5)
borrow from Bechlioulis and Rovithakis (2010) and Wang and and (9) are different because for the tracking error ϵ , both transient
Wen (2010), is defined as follows: and steady-state performances are concerned, while for zi , only
their boundedness is needed.
− δ p(t ) < ϵ(t ) < δ p(t ), ∀t ≥ 0, (5)
3.2. Adaptive controller design without actuator failure
in which δ and δ are given positive constants with δ, δ ≤ 1, and
p is a given decreasing smooth performance function described
We shall first consider the case that the actuator connected
by
to the controller is failure free on [0, +∞). In what follows, we
p = (p0 − p∞ )e−at + p∞ , ∀t ≥ 0 , (6) assume that the initial conditions of ϵ and zi , i = 1, 2, . . . , n,
satisfy
where a, p0 and p∞ are positive constants with p0 > p∞ .
To make ϵ satisfy (5), let z1 be a transformed error and S (·) −δ p0 < ϵ(0) < δ p0 ,
be a smooth, strictly increasing and thus invertible function |zi (0)| < Kbi , i = 2, 3, . . . , n, (11)
satisfying (Wang & Wen, 2010)2 :
where the prescribed constants δ, δ, p0 and Kbi are defined by (5)
(i). − δ < S (z1 ) < δ, and (9), respectively.
(ii). lim S (z1 ) = δ, lim S (z1 ) = −δ,
z1 →+∞ z1 →−∞ Lemma 1. Let the closed-loop system be shown in Fig. 1, where the
(iii). S (0) = 0. (7) plant to be controlled is given by (1). Assume that Assumptions 3 and
4 hold, the initial conditions satisfy (11), and the actuator connected
If we define to the controller is failure free on [0, +∞). Then, by applying
ϵ = pS (z1 ), (8) backstepping technique with the Lyapunov function, the parameter
update law and the adaptive control law being chosen, respectively,
then z1 = S (ϵ/p) is well defined, provided the performance
−1
as
(5) holds or equivalently, z1 ∈ L∞ . n
1 1  1  
2. Prescribed performances for zi V = z12 + θ̃ T Γ −1 θ̃ + log Kb2j /(Kb2j − zj2 ) ,
The prescribed performance for each error zi , i ∈ {2, 3, 2 2 j=2
2
. . . , n}, is defined as follows:
θ̂˙ = ProjΠθ {τn },
|zi (t )| < Kbi , ∀t ≥ 0 , (9)  zn−1 
v = (Kb2n − zn2 ) −cn zn −
where Kbi is a prescribed positive constant. (9) can be achieved Kb2n−1 − zn2−1
by employing the following Barrier Lyapunov Function Tee et al.
(2009) in the backstepping design: − θ̂ T wn−1 − βn−1 + Υn , (12)

1 it follows that
B(zi ) = log Kb2i /(Kb2i − zi2 ) ,
 
(10)
2 cj
V̇ ≤ −Σjn=1 zj2 , (13)
where log(·) denotes the natural logarithmic function. Obvi- 2
ously, B(zi ) escapes to infinity at |zi | = Kbi . It can be shown that
where the definitions of θ̃ , θ̂ , Γ , τn , wn−1 , βn−1 , Υn and cj are given
B(zi ) is positive definite and C 1 for |zi | < Kbi and therefore is a in the Appendix. Moreover, the tracking error ϵ and the errors zi , i =
valid Lyapunov function candidate. 2, 3, . . . , n, tend to zero asymptotically.
Proof. See Appendix. 

2 For example, S (z ) = δ̄ e(z1 +r ) −δ e−(z1 +r ) with r = log(δ/δ̄)

is precisely a suitable Remark 4. Since it is assumed that the actuator is failure free, as
1 (z1 +r ) −(z1 +r ) 2
shown in Fig. 1 and explained in Remark 2, the input signal u = v .
e +e
candidate satisfying (i)–(iii).
90 H. Ouyang, Y. Lin / Automatica 81 (2017) 87–95

Now, integrating both sides of Eq. (13) yields • The inequalities (19) and (20) still hold on [t1′ , +∞) which
implies that all the system states as well as the other closed-
n  t
 cj loop signals belong to L∞ . Hence, no actuator switching is
V (t ) − V (0) ≤ − zj2 (τ )dτ ≤ 0, ∀t ≥ 0 . (14)
0 2 needed.
j =1
• There exists a finite time instant t1 , t1 > t1′ , at which at least
Hence, V (t ) ≤ V (0). On the other hand, viewing Assumption 3 and one of the n conditions of (19)–(20) is violated; for instance,
the definition of V in (12), for all t ≥ 0, we have ϵ(t1 ) = δ 0 p(t1 ). Consequently, an actuator switching must be
 applied at t1 .
1
V (t ) ≤ V (0) ≤ z12 (0) + λmax (Γ −1 )(θM + ∥θ̂ (0)∥)2 In general, by Assumptions 1 and 2, we assume that there are
2 a total of q actuator switchings on (0, +∞) due to their failures,
n
   where q ≤ m − 1. Let tk , k = 1, 2, . . . , q, be the switching instants
+ log Kb2j /(
Kb2j − zj2 (0)) . (15) satisfying t0 < t1 < · · · < tk < tk+1 < · · · < tq < tq+1 ,
j=2 where t0 := 0 and tq+1 := +∞. Note that by Assumption 1,
there is no switching at t0 . In order to design the MFs, inspired by
Define
 the aforementioned analysis, for each instant tk , k = 0, 1, . . . , q,
µ0 = z12 (0) + λmax (Γ −1 )(θM + ∥θ̂ (0)∥)2 define

n    12 µk = z12 (tk ) + λmax (Γ −1 )(θM + ∥θ̂ (tk )∥)2

+ log Kb2j /(Kb2j − zj2 (0)) + ε0 , (16) n    21

j =2
+ log Kb2j /(Kb2j − zj2 (tk )) + εk , (23)
where ε0 is a very small positive constant. Then, j =2

where we can choose the positive constant εk for each k the same
1
V (t ) ≤ V (0) < µ .
2
0 (17) as that in (16). Let
2 
It is worth mentioning that µ0 is a positive constant that can be
2
δ k = −S (−µk ), δ k = S (µk ), γk = 1 − e−µk . (24)
determined a priori, which paves the way for the design of MFs
when actuator failures are taken into account. With µ0 in hand, the Then, for t ∈ [tk , tk+1 ), the MFs can thus be defined as3
following results show that we can get tighter bounds for ϵ and zi .
−δ k p(t ) < ϵ(t ) < δ k p(t ), (25)

Lemma 2. Let the closed-loop system shown in Fig. 1 satisfy Assump-

|zi (t )| < γk Kbi , i = 2, 3, . . . , n, (26)
tions 3 and 4, where the plant is given by (1). Assume the actuator based on which, the switching instant is determined as
connected to the control signal v is failure free on [0, +∞). Define 
 tk+1 := min t : ϵ(t ) = −δ k p(t ), ϵ(t ) = δ k p(t ),
2
δ 0 = −S (−µ0 ), δ 0 = S (µ0 ), γ0 = 1 − e−µ0 . (18) 
|zi (t )| = γk Kbi , i = 2, 3, . . . , n . (27)
If the initial conditions of ϵ and zi , i = 2, 3, . . . , n, satisfy (11), then
˙ That is, tk+1 is the time instant at which the failure of the current
with the control signal v and the update law θ̂ given by (12), for all
actuator is detected by at least one of the MFs and therefore, a
t ≥ 0, we have
switching from the current actuator to the next one is needed. Note
−δ 0 p(t ) < ϵ(t ) < δ 0 p(t ), (19) that to determine t1 , one needs the MFs on [t0 , t1 ) as shown in
(19)–(20), which have been included in (25)–(26) with k = 0.
|zi (t )| < γ0 Kbi . (20)

Moreover, (19) and (20) are, respectively, tighter than (5) and (9), i.e., 3.4. Main results
−δ p(t ) < −δ 0 p(t ) < ϵ(t ) < δ 0 p(t ) < δ p(t ), (21)
Before we introduce the main results, the following conclusion
|zi (t )| < γ0 Kbi < Kbi , i = 2, 3 · · · , n. (22) with respect to µk is useful in the performance analysis.

Proof. By Lemma 1 and Assumption 3, we obtain (17), from which,
z12 /2 < µ20 /2. Therefore, −µ0 < z1 < µ0 , for all t ≥ 0, is achieved.
Viewing (8), δ 0 and δ 0 defined by (18), we obtain (19). Similarly,
from (17), we have 12 log(Kb2i /(Kb2i − zi2 )) < 21 µ20 , from which we
can readily get (20), where i ∈ {2, 3, . . . , n}.
Since µ0 is finite and S (z1 ) is a strictly increasing function
satisfying (ii) of (7), it follows that δ > δ 0 , δ > δ 0 , i.e., (21)
holds. Meanwhile, from (18), it is clear that γ0 < 1. Hence, (22)
is true. Notably, both (19) and (20) are tighter than (5) and (9),
respectively. 
3.3. Monitoring functions
Lemma 3. Let µk , k = 0, 1, . . . , q − 1, be defined by (23). Then,
µk+1 > µk . (28)
Proof. By (27), the switching is triggered when at least one of the
MFs (25)–(26) is violated. More specifically,
• ϵ(tk+1 ) = δ k p(tk+1 ). In this case, by virtue of (8), S (z1 (tk+1 )) =
δ k . From (23), we have µk+1 > z1 (tk+1 ). Noting (24) and that
S (·) is a strictly increasing function, it follows that S (µk+1 ) >
S (z1 (tk+1 )) = δ k = S (µk ). Again, using the strictly increasing
property of S (·), S (µk+1 ) > S (µk ) implies that (28) holds.
Similarly, we can prove that if ϵ(tk+1 ) = −δ k p(tk+1 ), the
inequality (28) holds as well.

For the general case that actuator failures exist, the key issue is
how to detect the failures. Assume that the first failure occurs at an 3 Actually, the MFs should be δ p(t ), δ p(t ), γ K , i = 2, 3, . . . , n. For simplicity,
k k bi
unknown finite time instant t1′ . Then, we have two possibilities: k
we shall use (25) and (26) to denote the MFs whenever no confusion can arise.
 H. Ouyang, Y. Lin / Automatica 81 (2017) 87–95 91

• |zi (tk+1 )| = γk Kbi for i ∈ {2, 3, . . . , n}. In this case, notice that performances (5) and (9) hold on [t0 , t1 ). By Lemma 3, together
with (24) and the strictly increasing property of S (·), we have
1 1
µ2k+1 > V (tk+1 ) ≥ log Kb2i /(Kb2i − zi2 (tk+1 )) .
 
(29) δ0 < δ1 < · · · < δk < · · · < δq ,
2 2
δ0 < δ1 < · · · < δk < · · · < δq ,
By replacing |zi (tk+1 )| = γk Kbi into the above inequality yields
(28).  γ0 < γ1 < · · · < γk < · · · < γq , (32)
which by using property (ii) of (7) and noting that q is finite, implies
We are now in the position to present our main results. that δ q < δ , −δ < −δ q , γq < 1.
Hence, for any k ∈ {0, 1, . . . , q},
Theorem 1. Let the closed-loop system shown in Fig. 1 satisfy As-
−δ p(t ) < −δ k p(t ) < ϵ(t ) < δ k p(t ) < δ p(t ),
sumptions 1–4, where the plant is given by (1). Let the prescribed per-
formances for the tracking error ϵ and the errors zi , i = 2, 3, . . . , n, |zi (t )| < γk Kbi < Kbi , i = 2, 3, . . . , n. (33)
be defined by (5) and (9), respectively. If the initial conditions sat- That is, (5) and (9) hold. This completes the proof. 
isfy (11), then with the control signal, the update law, and the actuator
From (32) and (33), it is clear that with an increasing k, the gaps
switching law based on the MFs given by (12) and (27), all the closed between δ k p(t ) and δ p(t ) (or δ k p(t ) and δ p(t )), and γk Kbi and Kbi
loop signals belong to L∞ . Moreover, ϵ and zi , i = 2, 3, . . . , n, satisfy, will become narrow. Consequently, to guarantee the prescribed
respectively, (5) and (9) for all t ≥ 0. performances, more control effort is needed. However, if the
minimum life-span of the actuators is taken into account, wider
Proof. Consider the general case that there are q switchings with gaps may be obtained.
switching instants tk , k = 1, 2, . . . , q, determined by (27).
Firstly, we shall prove that ϵ and zi , i = 2, 3, . . . , n, are bounded Corollary 1. Suppose the minimum life-span of the actuators is
on [tk , tk+1 ) for k = 0, 1, . . . , q. To this end, let tk′ +1 ∈ (tk , tk+1 ) [0, Tm ], on which they are failure free, where Tm is known. Then,
be the time instant at which the failure of the (k + 1)th actuator by modifying µk (tk ) in (23) as µk (tk + Tm ), k = 0, 1, . . . , q, the
occurs4 . Therefore, the output of the actuator can be written as prescribed performances (5) and (9) hold on [0, +∞). In particular,
if Tm is sufficiently large, wider gaps than those of Theorem 1 may be
v, if t ∈ [tk , tk′ +1 ); obtained.

uk+1 = (30)
u(k+1)f , if t ∈ [tk′ +1 , tk+1 ), Proof. By replacing µk (tk + Tm ) into (24), new bounds δ k , δ k and γk
can be obtained. Since the actuator is failure free on [tk , tk + Tm ], by
where uk+1 = v with v being given by (12) means that the actuator Lemma 1, ϵ, zi , i = 2, 3, . . . , n, are bounded by (5) and (9) on this
is failure free, while uk+1 = u(k+1)f means that the actuator suffers interval. The proof of the boundedness of ϵ, zi on [tk + Tm , tk+1 )
a failure (partial or total failure). Note that the signal v is known is the same as that of Theorem 1. With k = 0, 1, . . . , q, one can
while the time tk′ +1 and the output u(k+1)f are unknown. obtain the conclusion. Further, if Tm is sufficiently large (which is
reasonable from an engineering viewpoint), by Lemma 1, ϵ and zi
• For t ∈ [tk , tk′ +1 ), uk+1 = v . Hence, using Lemma 1 with t0 being tend to zero. Therefore, µk (tk + Tm ) < µk (tk ) may hold, which
replaced by tk , it follows that (13) holds on [tk , tk′ +1 ). As a result, from (24) implies that wider gaps than those of Theorem 1 may be
for all t ∈ [tk , tk′ +1 ), obtained. 
 n  t
cj 2 Furthermore, in the event of disturbances or noises, the following
V (t ) − V (tk ) ≤ − zj (τ )dτ ≤ 0, (31) conclusion holds.
j =1 tk 2
Corollary 2. Consider the following class of uncertain nonlinear
which implies that V (t ) ≤ V (tk ) < 21 µ2k . That is, ϵ and zi , i = systems:
2, 3, . . . , n, are bounded on [tk , tk′ +1 ). ẋi = xi+1 + θ T ϕi (x̄i ) + di (x, t ), i = 1, 2, . . . , n − 1,
• For t ∈ [tk′ +1 , tk+1 ), uk+1 = u(k+1)f . Since u(k+1)f is an unknown
ẋn = u + ϕ0 (x) + θ ϕn (x) + dn (x, t ),
T
failure control signal, (13) may not hold. However, the MFs
(25)–(26) guarantee that ϵ, zi , i = 2, 3, . . . , n, are still bounded y = x1 , (34)
on [tk′ +1 , tk+1 ). Otherwise, a new actuator switching would be where di (x, t ) denote unmeasured disturbances or noises satisfying
triggered at t = tk+1 . |di (x, t )| ≤ d̄i with d̄i a known constant. Then, by modifying µk
in (23) as
Since tq+1 = +∞, the above analysis shows that ϵ and zi , i =
2, 3, . . . , n, belong to L∞ , with which the boundedness of other    12 
2b
signals of the closed-loop control system can be inferred. µ̃k = max µk , + εk , k = 0, 1, . . . , q, (35)
Next, we shall prove that by using the proposed switching c
strategy, the prescribed performances (5) and (9) for the tracking
the prescribed performances (5) and (9) hold on [0, +∞) regardless
error ϵ and the errors zi , respectively, can be guaranteed for all
t ≥ 0 even if the actuator switchings exist. Obviously, it suffices of the existence of di (x, t ), where c = min c1 , 2c2 , . . . , 2cn ,
to prove that (5) and (9) hold on [tk , tk+1 ) for k = 0, 1, . . . , q.

σ
, b = 2σ θ + (n + 1 − i)d̄2i with σ , ci being positive
2 1
n
In fact, from the above stability analysis, the performances λmax (Γ −1 ) M 4 i =1
design parameters.
(25) and (26) for ϵ and zi , i = 2, 3, . . . , n, hold on [tk , tk+1 ). In
particular, with the initial conditions satisfying (11), by applying Proof. By replacing (1) with (34), the backstepping design
Lemma 2, the inequalities (19) and (20) hold on [t0 , t1 ), i.e., the procedure similar to Lemma 1 yields V̇ ≤  −cV + b. For t ∈
[tk , tk+1 ), 0 ≤ V (t ) ≤ bc + V (tk ) − bc e−c (t −tk ) . Hence, 0 ≤
V (t ) ≤ max V (tk ), b
 
c
which, together with (23) and (35), implies
4 For example, u corresponds to the first actuator connected to the plant (1) on that V (t ) < 12 µ̃2k . Therefore, replacing µk with µ̃k in (24), the
1
[t0 , t1 ). Note that, once an actuator failure occurs, its output will no longer abide by modified MFs (25) and (26) can be obtained and all the conclusions
the law obtained in (12). of Theorem 1 hold for (34) as well. 
92 H. Ouyang, Y. Lin / Automatica 81 (2017) 87–95

With Theorem 1 and Corollaries 1 and 2 in hand, the switching

algorithm is given below.
Initialization: Based on (5) and (9), set δ, δ, p(t ) and Kbi such that
ϵ(0) and zi (0) satisfy (11). Then, set k = 0 at t = t0 = 0.
Switching logic:
Step 1: Based on µk (tk ) (or µk (tk + TM ), µ̃k (tk )), evaluate δ k ,
δ k , γk .
Step 2: If there exists a time t > tk such that the right-hand side
of (27) holds, then go to Step 3. Otherwise, go to Step 2.
Step 3: Switch to the next actuator. Set tk+1 = t and k = k + 1,
go to Step 1.

Remark 5. The above results show that the proposed adaptive FTC Fig. 2. A two-tank system.

scheme possesses the following merits: (1) The first inequalities

of (33) ensure that the prescribed transient and steady-state
performance for the tracking error can be achieved regardless of
the switching; (2) From (27), the failure detection and actuator
switching are performed simultaneously without any knowledge
of failure patterns; and (3) The MFs (25) and (26) actually form a
set of tolerance bands for ϵ and zi which, together with the inherent
robustness of the adaptive control, can accommodate a certain
degree of actuator and other component faults without triggering
switching. Note that the choice of the prescribed performances,
which bound the ‘‘width’’ of the tolerance bands as shown in (33),
should be determined from practical engineering problem.
Remark 6. In Wang and Wen (2010), the prescribed performance
for tracking error can also be achieved by applying the approach by
Tao et al. (2001) without using Assumption 3, but some knowledge
of failure patterns such as the failure can occur only once for
each actuator is required which, from an engineering viewpoint,
is relatively rigorous. By comparison, in our proposed scheme,
no knowledge of failure patterns is needed and the actuator may
suffer partial failures more than once on [tk , tk+1 ) until one of the
MFs is violated. In particular, if tk+1 = +∞, no more switching is
triggered.
4. Simulation results
In this section, a well-known benchmark problem for fault-
tolerant control is used, which deals with a process using two
tanks with fluid flow (Blanke, Kinnaert, Lunze, & Staroswiecki,
2006; Zhang et al., 2004). The system is shown in Fig. 2 with
three input pipes. Instead of investigating the faults due to the
leakage of the two tanks in Zhang et al. (2004), we discuss the
failures of the valves. As pointed out in Blanke et al. (2006), for the
level control, only one pipe is necessary as control input and the
redundant inputs can be used in case of actuator failures. The two
tanks are identical and cylindrical in shape, with a cross section
As = 0.0154 m2 . The cross section of the connection pipes is
Sp = 3.6 × 10−5 m2 , and the liquid levels in the two tanks are
denoted by h1 and h2 , respectively. The supplying flow rate u to
tank 1 is controlled by the valve, and there is an outflow from tank
2. By using balance equations and Torricelli’s rule, we obtain the
following equations (Zhang et al., 2004):
 
ḣ1 = −a1 Sp sign(h1 − h2 ) 2g |h1 − h2 | + u /As ,

he1 = 0.4667 m, he2 = 0.2333 m, and ue = 7.7027 × 10−5 m3 /s,
and taking the parameter uncertainty into account, we have
ẋ1 = θ x1 + 0.0107x2 ,
ẋ2 = 0.0107x1 − 0.0107x2 + 64.9351ū,
y = x1 , (37)
where x1 = h2 − , x2 = h1 −
he2 and ū = u − u ; θ = −0.0214 is
he1 , e
unknown but belongs to a known interval [−0.5, 0.5]. The control
objective is to maintain the fluid level in tank 2 at a reference value
yr = 0.
In the simulation, the initial states and estimate are set as
x1 (0) = x2 (0) = 0.005, θ̂ (0) = 0, respectively. The performance
function for ϵ is chosen as p(t ) = 0.018e−t + 0.002, δ = 0.2 and
δ̄ = 1. Other design parameters are chosen as f21 = f22 = c1 =
c2 = 1, Γ = I and Kb2 = 2. It can be checked that the initial condi-
tions satisfy the inequalities (11). The following cases are consid-
ered, in which Cases 1 and 3 are only based on Theorem 1 while
the comparison of Theorem 1 and Corollary 1 is given in Case 2.
Case 1: From (23), µ0 = 0.9986, δ 0 = 0.1627, δ 0 = 0.4663 and
γ0 = 0.7534. It is assumed that valve 1 loses 15% of its effectiveness
at t = 1s, and then 30% from t = 1.5 s. Figs. 3–4 show that in
this case, no switching occurs for neither ϵ nor z2 owing to the
properly chosen MFs and the robustness of the adaptive control.
Fig. 5 clearly shows the two failure instants of the valve.
Case 2: (a). Firstly, by Theorem 1, µ0 , δ 0 , δ 0 and γ0 are the same
as Case 1. It is assumed that valve 1 suffers an abrupt failure at
t = t1′ = 4 s with the input ū1 being stuck at 0.01 m3 /s. The failure
is detected and the controller is switched to valve 2 at t1 = 4.51 s,
with which the parameters of the MFs for valve 2 are evaluated as
µ1 = 1.3592, δ 1 = 0.1844, δ 1 = 0.7023 and γ1 = 0.9178. Then, it
is assumed that valve 2 suffers a failure at t = t2′ = 8 s with input
ū2 being stuck at 0.015 m3 /s. Finally, the controller is switched to
valve 3 at t2 = 8.58 s. Both switchings are triggered by the MF in
(25). Figs. 6 and 7 show that as the gap between blue and red dotted
lines becomes narrow, the control amplitude is larger.
(b). To compare with Theorem 1, we then consider Corollary 1
with Tm = 1 s. With µ0 (Tm ) = 0.8836, we obtain δ 0 =
0.1604, δ 0 = 0.4472 and γ0 = 0.7362. We still assume that
valves 1 and 2 suffer the same failures as case (a). The controller
is switched to valve 2 at t1 = 4.48 s. The parameters of the MFs
for valve 2 are evaluated as µ1 (t1 + Tm ) = 0.7334, δ 1 = 0.1471,
δ 1 = 0.3573 and γ1 = 0.6450. Then, the controller is switched to
valve 3 at t2 = 8.38 s. Both switchings are triggered by the MF in

 
ḣ2 = a1 Sp sign(h1 − h2 ) 2g |h1 − h2 | − a2 Sp 2gh2 /As ,
 
(36)
where a1 = 1 and a2 = 1 denote nondimensional outflow
coefficients, and g is the gravity acceleration. By linearizing the
nominal system model described by (36) at a trim condition of
(25). Figs. 8 and 9 show that by considering the life-span, the gap
between blue and red dotted lines even becomes wider than that
determined by µ0 (Tm ) and the control amplitude does not change
significantly.
Case 3: We alter p(t ) and Kb2 as p(t ) = 0.048e−t + 0.006 and Kb2 =
1.7, respectively, and all the other conditions remain unchanged. It
 H. Ouyang, Y. Lin / Automatica 81 (2017) 87–95 93

Fig. 3. Tracking error ϵ . Fig. 6. Tracking error ϵ . (For interpretation of the references to color in this figure
legend, the reader is referred to the web version of this article.)

Fig. 4. Error z2 . Fig. 7. Input ū.

Fig. 8. Tracking error ϵ . (For interpretation of the references to color in this figure
Fig. 5. Input ū. legend, the reader is referred to the web version of this article.)

can be obtained that µ0 = 0.9883, δ 0 = 0.1677, δ 0 = 0.5090 and

γ0 = 0.7896. It is assumed that valve 1 suffers the same failure
as (a) of Case 2 and valve 2 is failure free. Figs. 10–11 show that,
z2 (t ) = γ0 Kb2 |t =t1 =4.81 s (see (27)). That is, different from the above
two cases, the failure of valve 1 is detected at t1 = 4.81 s by the
MF in (26). Fig. 12 illustrates the instant that the stuck occurs.
For all the cases, it is seen that the control objective is achieved
by using the proposed control scheme.

5. Conclusion

In this paper, a new adaptive FTC scheme based on a supervisory

switching strategy has been proposed with some healthy actuators
as backups. The novelty is that we established a set of MFs
to supervise the behavior of the errors, which ensures the Fig. 9. Input ū.
94 H. Ouyang, Y. Lin / Automatica 81 (2017) 87–95

Table 1
Adaptive controller design.

Errors:
z1 = S −1 (ϵ/p),
zi = xi − αi−1 , i = 2, . . . , n.
Lyapunov functions:
V1 = 12 z12 + 12 θ̃ T Γ −1 θ̃ ,
Kb2
Vi = Vi−1 + 1
2
log 2 i 2
K −z
, i = 2, . . . , n − 1,
bi i

1 Kb2
V = Vn−1 + 2
log 2 n 2 .
Kb −zn
n

Virtual control signals:

α1 = −c1 zζ1 + ẏr + ϵpṗ − θ̂ T ϕ1 ,
α2 = (Kb22 − z22 )(−c2 z2 − ζ z1 ) − θ̂
T
w1 − β1 + Υ2 ,
zi−1
αi = (Kb2i − zi2 ) −ci zi − − θ̂ T wi−1 − βi−1 + Υi , i = 3, . . . , n − 1,
Fig. 10. Tracking error ϵ . Kb2
i− 1
−zi2−1

Tuning functions:
τ1 = W1 z1 ,
τi = τi−1 + Wi zi , i = 2, . . . , n.
Parameter update law:
θ̂˙ = ProjΠθ {τn } = ProjΠθ
n 
k=1 Wk zk .

Adaptive controllaw: 
z
v = (Kb2n − zn2 ) −cn zn − K 2 n−−1z 2 − θ̂ T wn−1 − βn−1 + Υn .
  bn−1 n−1 2   2 
 ∂α 
Υi = − K 2 z−i z 2 ik−=11 fik  i−1  ∥Wk ∥ + fk+1,i  ∂αk  ∥Wi ∥ ,i =
  
bi i
∂ θ̂ ∂ θ̂
2, . . . , n.

wi−1 , βi−1 , i = 2, . . . , n, are some known terms in the backstep-

ping design, and W1 = ζ Γ ϕ1 , Wi = Γ wi−1 /(Kb2i − zi2 ), i =
2, . . . , n. The projection operator can be found in Kristic, Kanel-
Fig. 11. Error z2 . lakopoulos, and Kokotovic (1995, p. 512). Following the back-
stepping design procedure, it can be verified that by properly
choosing the design parameters fik , fk+1,i in Υi , one can obtain (13).
The proof of the asymptotic property of the errors is straightfor-
ward and therefore omitted. 

References

Fig. 12. Input ū.
failure detection and the actuator switching can be performed
simultaneously without any knowledge of failure patterns, and the
prescribed transient and steady-state performance for the tracking
error can be achieved regardless of the switching. Finally, it should
be noted that the proposed scheme only focuses on actuator
failure and lacks mechanism for failure isolation among different
components. This is indeed a drawback and deserves our future
research.
Appendix
Proof of Lemma 1. For simplicity, we summarize the backstep-
ping design in Table 1, in which θ̃ = θ̂ − θ with θ̂ an es-
timate of θ , Γ is a positive definite matrix, λ = ϵ/p, ζ =
[∂ S −1 /∂(λ)]/p, ci , i = 1, . . . , n, are positive design parameters,
Alwi, H., & Edwards, C. (2008). Fault detection and fault-tolerant control of a
civil aircraft using a sliding-mode-based scheme. IEEE Transactions on Control
Systems Technology, 16(3), 499–510.
Bechlioulis, C. P., & Rovithakis, G. A. (2010). Prescribed performance adaptive
control for multi-input multi-output affine in the control nonlinear systems.
IEEE Transactions on Automatic Control, 55(5), 1220–1226.
Blanke, M., Kinnaert, M., Lunze, J., & Staroswiecki, M. (2006). Diagnosis and fault-
tolerant control. Berlin, Heidelberg: Spring-Verlag.
Boskovic, J. D., Jackson, J. A., Mehra, R. K., & Nguyen, N. T. (2009). Multiple-
model adaptive fault-tolerant control of a planetary lander. Journal of Guidance,
Control, and Dynamics, 32(6), 1812–1826.
Boskovic, J. D., & Mehra, R. K. (2010). A decentralized fault-tolerant control system
for accommodation of failures in higher-order flight control actuators. IEEE
Transactions on Control Systems Technology, 18(5), 1103–1115.
Goupil, P. (2011). AIRBUS state of the art and practices on FDI and FTC in flight
control system. Control Engineering Practice, 19(6), 524–539.
Isermann, R., Schwarz, R., & Stolzl, S. (2002). Fault-tolerant drive-by-wire systems.
IEEE Control Systems Magazine, 22(5), 64–81.
Kristic, M., Kanellakopoulos, I., & Kokotovic, P. V. (1995). Nonlinear and adaptive
control design. New York: Wiley.
Muenchhof, M., Beck, M., & Isermann, R. (2009). Fault-tolerant actuators and
drives—Structures, faults detection principles and applications. Annual Reviews
in Control, 33(2), 136–148.
Patton, R.J. (1997). Fault-tolerant control: The 1997 situation. In Proceedings
of IFAC symp. fault detection, supervision, and safety for technical processes
(pp. 1029–1052).
Peni, T., Vanek, B., Szabo, Z., & Bokor, J. (2014). Supervisory fault tolerant control of
the NASA airstar aircraft. In Proceedings of the 2014 American control conference
(pp. 666–671).
Takahashi, M., & Takagi, T. (2012). Adaptive fault-tolerant control based on hybrid
redundancy. Asia-Pacific Journal of Chemical Engineering, 7(5), 642–650.
Tao, G. (2014). Direct adaptive actuator failure compensation control: a tutorial.
Journal of Control and Decision, 1(1), 75–101.
 H. Ouyang, Y. Lin / Automatica 81 (2017) 87–95 95

Tao, G., Joshi, S. M., & Ma, X. L. (2001). Adaptive state feedback control and tracking Hupo Ouyang received the B.E. degree in Automation
control of systems with actuator failures. IEEE Transactions on Automatic Control, Science and Electrical Engineering, Beihang University in
46(1), 78–95. 2013, and he is currently a Ph.D. candidate in the school
Tee, K. P., Ge, S. S., & Tay, E. H. (2009). Barrier Lyapunov functions for the control of of Automation, Beihang University. His research interests
output-constrained nonlinear systems. Automatica, 45(4), 918–927. include fault-tolerant control, adaptive control and flight
Wang, W., & Wen, C. Y. (2010). Adaptive actuator failure compensation control control systems.
of uncertain nonlinear systems with guaranteed transient performance.
Automatica, 46(12), 2082–2091.
Yang, Q. M., Ge, S. S., & Sun, Y. X. (2015). Adaptive actuator fault tolerant control
for uncertain nonlinear systems with multiple actuators. Automatica, 60(10),
92–99.
Yu, X., & Jiang, J. (2012). Hybrid fault-tolerant flight control systems design against
Yan Lin received the B.E. degree from Beijing Institute
partial actuator failures. IEEE Transactions on Control Systems Technology, 20(4),
of Aeronautics and Astronautics (Branch) in 1983, and
871–886. the M.S. and Ph.D. degrees from the Beijing University
Zhang, Y., & Jiang, J. (2008). Bibliographical review on reconfigurable fault-tolerant
of Aeronautics and Astronautics (Beihang University),
control systems. Annual Reviews in Control, 32(2), 229–252.
Beijing, China, in 1988 and 1999, respectively. He is
Zhang, X. D., Parisini, T., & Polycarpou, M. M. (2004). Adaptive fault-tolerant control
currently a Professor in the school of Automation, Beihang
of nonlinear uncertain systems: an information-based diagnostic approach. University. His research interests include robust control
IEEE Transactions on Automatic Control, 49(8), 1259–1274. and adaptive control.
Zhou, K., Rachinayani, P.K., Liu, N., Ren, Z., & Aravena, J. (2004). Fault diagnosis
and reconfigurable control for flight control systems with actuator failures. In
Proceedings of the 2004 conference on decision and control (pp. 5266–5271).