IEEE TRANSACTIONS ON CONTROL SYSTEMS TECHNOLOGY, VOL. 13, NO.
1, JANUARY 2005
Fault-Tolerant Control of a Servohydraulic Positioning System
With Crossport Leakage
Mark Karpenko and Nariman Sepehri
Abstract—This brief details the design of a fault-tolerant control
(FTC) scheme for a servohydraulic positioning system with a
faulty actuator piston seal that introduces internal (crossport)
leakage between the actuator chambers. It is shown that the
leakage fault changes the plant type from 1 to 0, decreases the
open-loop gain, and increases the effective damping. A fixed-gain
linear time-invariant control law is synthesized via quantitative
feedback theory (QFT) to guarantee satisfaction of a priori-
defined reference tracking and stability requirements, despite the
occurrence of the leakage fault. Experiments verify the ability
of the designed fault-tolerant controller to compensate for the
degrading effects of this fault. Experiments also demonstrate the
superior tracking performance of the FTC scheme as compared
to a control loop in which the effects of the leakage fault are not
considered in the controller design.
Index Terms—Fault-tolerant control (FTC), fluid power control,
hydraulic actuators, quantitative feedback theory (QFT).
I. INTRODUCTION
O VER the past decade, there has been an increasing in-
terest in developing methods for fault detection and iso-
lation (FDI) in fluid power systems. The research has been mo-
tivated by the desire to increase levels of safety, reliability, and
availability of these systems, in a wide variety of demanding in-
dustrial applications. The literature, too vast to be listed here,
has clearly illustrated the usefulness of FDI techniques in sig-
naling the occurrence of faulty behavior and assisting in the
troubleshooting of complex hydraulic systems. However, FDI
is a supervisory process that can do little to maintain the perfor-
mance or functionality of the faulty system in the absence of a
suitable fault-tolerant control (FTC) strategy. Despite this, ex-
amples of FTC strategies for fluid power systems remain sparse
and much development is needed in this area.
A number of techniques for developing fault-tolerant con-
trollers have been investigated in the literature including robust
servo control [1], algebraic factorization [2], pseudo-inverse
methods [3], and adaptive neural/fuzzy control [4]. These may
be classified as either passive or active approaches depending on
how the effects of the faulty plant dynamics are accommodated.
In the active approach, faults are handled through controller
Manuscript received January 30, 2003; revised January 15, 2004. Manuscript
received in final form May 17, 2004. Recommended by Associate Editor
D. W. Repperger. This work was supported by the Natural Sciences and
Engineering Research Council (NSERC) of Canada.
The authors are with the Department of Mechanical and Manufacturing Engi-
neering, The University of Manitoba, Winnipeg, MB R3T 5V6, Canada (e-mail:
karpenko@cc.umanitoba.ca; nariman@cc.umanitoba.ca).
Digital Object Identifier 10.1109/TCST.2004.838570
1063-6536/$20.00 © 2005 IEEE
155
adaptation, reconfiguration or switching. A passive FTC loop
is designed to be insensitive to a priori-defined variations in
the parameters of the dynamic system that are affected by the
faults. Passive FTC schemes may be derived in a relatively
straightforward manner via well-developed robust control
methods such as modern [5], [6] or classical quantitative
feedback theory (QFT) [7], [8]. In either case, the controller is
synthesized to satisfy specified tolerances on the closed-loop
performance despite uncertainties in the model of the plant that
arise due to faults or ignorance of the true values of the plant
parameters.
With respect to the development of FTC strategies within
the framework of QFT, Niksefat and Sepehri [9] designed a
QFT-based position controller with tolerance to malfunctioning
position sensors and hydraulic pump failures. More recently,
Karpenko and Sepehri [10] applied QFT to design a servohy-
draulic positioning system with tolerance to a faulty actuator
piston seal. However, the active approach to the FTC design
taken in [10] necessitates the use of control law scheduling and
an identification module to report the condition of the system.
In this brief, the passive approach to the design of a QFT-based
fault-tolerant controller for a servohydraulic positioning system
with tolerance to a faulty actuator piston seal is investigated
for the first time. The high transparency of QFT to design
tradeoffs such as control law complexity, sensor noise effects,
and bandwidth [11] as well as the ability to consider both loop
gain and phase during synthesis make the QFT solution to
this FTC problem both attractive and practical. The fault of
interest, namely a partially failed actuator piston seal, gives rise
to an internal (crossport) leakage where fluid is allowed to flow
through a breech in the seal.
II. EXPERIMENTAL SETUP
The experimental test station, upon which all tests were car-
ried out, is shown in Fig. 1. A detailed description of the test rig
and its functionality has been given elsewhere and is, therefore,
not repeated here. The piston seal leakage, which is the focus
of this brief, is created by opening a ball valve that connects
the two chambers of the actuator. This allows hydraulic fluid to
be bypassed across the piston. The severity of the fault is con-
trolled through the adjustment of a needle valve, see the inset
of Fig. 1, and a positive displacement flow meter is used to
measure the leakage rate. In the experiments, the actuator was
made to move against a spring-type environment, also shown
in Fig. 1, to stimulate the generation of a load pressure across
the piston.
156 IEEE TRANSACTIONS ON CONTROL SYSTEMS TECHNOLOGY, VOL. 13, NO. 1, JANUARY 2005

flow across the defective actuator piston seal in (1) is also

modeled as a turbulent orifice flow

(3)

is the leakage orifice coefficient of discharge, is the

area of the leakage orifice, and the term “ ” is used to
account for the directionality of the flow.
The state equations are now linearized about an operating
point, denoted hereafter by the subscript

(4)
Fig. 1. Experimental test rig illustrating the environment and components used
for creating piston seal leakage.
In (4), denotes a perturbation from the operating point
III. MODELING value, e.g., . Coefficients , and
arise from the linearization of the servovalve load flow (2) [12]
A. Derivation of Transfer Function Model and the leakage flow (3)
State equations that describe the actuator dynamics between
control valve input and the piston position can be formed
as [10] (5)

(6)

(7)

Parameters and are further combined as the total flow-

(1) pressure coefficient . At a given operating
point, the flows through the servovalve and the leakage orifice
Referring to (1), the system states are actuator position , are equal by conservation of mass. Hence, it is possible to elim-
actuator velocity , load pressure , valve spool inate parameter and rewrite the total flow-pressure coeffi-
displacement , and valve spool velocity . Parameters , cient as a function of and only
and are the mass of the load, the effective viscous damping
of the actuator, and the load stiffness, respectively. refers to (8)
the annulus area of the piston, is the effective bulk modulus of
the hydraulic fluid, and is the total volume of the cylinder and
connecting lines. The valve spool dynamics are expressed as a Laplace transforms of (4) are now reduced to obtain the re-
second-order lag where is the valve spool position gain and quired transfer function that relates to .
parameters and represent the servovalve natural frequency is formed as the cascade connection of
and damping ratio, respectively.
Assuming the valve orifices are matched and symmetrical, the
load flow in (1) depends upon the turbulent
orifice equation [12] (9)

(2)

(10)
where is the valve orifice coefficient of discharge, is the
orifice area gradient, is the valve spool displacement, and
is the density of the hydraulic fluid. is the servovalve supply where represents the valve spool dynamics, and
pressure. As suggested by Thompson et al. [8], the rate of fluid represents the nonlinear hydraulic actuator functions.
IEEE TRANSACTIONS ON CONTROL SYSTEMS TECHNOLOGY, VOL. 13, NO. 1, JANUARY 2005 157

TABLE I tive area of the actuator piston seal, due to wear. The expected
NOMINAL PARAMETERS OF THE EXPERIMENTAL SYSTEM
range in was taken to be 0.3 MPa MPa. The
minimum arises due to the presence of coulomb friction in
the actuator, which always maintains some pressure differential
across the piston. The maximum expected corresponds to
[12]. The maximum loss in effective area of the piston
seal, for which the FTC system should perform well, was es-
tablished as 25%. Assuming a clearance between the piston and
cylinder wall of mm, the maximum corresponding is
mm . With the expected variation in and deter-
mined, the uncertainty in and was calculated from (5)
and (8). The ranges of the uncertain parameters to be considered
in the design of the fault-tolerant controller are summarized in
Table II.

B. Model Parametric Uncertainty
The nominal parameters of the experimental test station
required for modeling are summarized in Table I. The dynamics
of the servovalve spool described by (9), i.e., , depend
upon a number of factors including the magnitude of the input
signal and flow reaction forces on the spool. These effects
may be captured as variations in the natural frequency and
damping ratio of (9), the values of which are listed in Table I.
The reported valve dynamic parameters are representative of
the minimum expected values and give rise to a well-damped
complex mode with a break frequency rad/s. Hence,
variations in these parameters were assumed to have little effect
on the system response and were not considered. Variation in
the valve spool position gain affects the loop gain over
the entire control bandwidth. However, the servovalve used
has integrated electronic feedback circuitry that maintains the
position of the valve spool proportional to the input signal in
spite of such disturbances. Thus, the reported value of is
considered relatively accurate.
With respect to the dynamics of the hydraulic actuator de-
scribed by (10), i.e., , geometric parameters and , as
well as the servovalve coefficient of discharge were obtained
directly from available manufacturer’s data. The reported values
for dynamic parameters and were carefully measured ex-
perimentally. A representative value for the viscous damping co-
efficient was obtained by comparing the results of nonlinear
simulations with ones from experiments. Consequently, varia-
tions in these parameters were not considered to contribute ap-
preciably to the uncertainty in (10). The effective bulk modulus
of the hydraulic fluid changes due to fluctuations in the oper-
ating temperature, pressure, and entrained air or water [13]. The
expected variation in parameter was assumed to be 550 MPa
MPa, which corresponds to a 20% decrease or 30%
increase in from the nominal value.
From (5) and (8), it is apparent that uncertainty in parameters
and arises due to changes in resulting from mi-
gration of the system operating point. Hence, variations in
and reflect model uncertainty due to linearization of the hy-
draulic functions. is also dependent on the loss in the effec-
C. Plant Templates
To facilitate the controller synthesis using QFT, the plant un-
certainty must first be characterized on the Nichols chart. Fig. 2
shows templates (boundaries of the magnitude and phase vari-
ations) of plant at selected frequencies,
, for normal operation and for the leakage fault
condition . To investigate the manner in which the
parametric uncertainty affects the plant dynamics, it is useful to
recast (10) as
(11)
where is the hydraulic natural fre-
quency, is the hy-
draulic damping, and is a proportional con-
stant term.
Referring to (11), when there is no leakage of fluid across the
piston (i.e., ), the hydraulic damping is minimum and
so the plant is Type 1. Thus, when the loop is closed, there
will be no position error provided . Variation in param-
eter shifts the hydraulic natural frequency, which affects both
the open-loop gain and phase of the plant. Conversely, variation
in parameter affects only the open-loop gain. With refer-
ence to Fig. 2, at low frequencies ( rad/s) the templates
appear as vertical lines due to the uncertainty in . The ef-
fects of uncertainty in are insignificant in this frequency range
since there is little variation in the phase. However, the effect of
uncertainty in on the plant dynamics becomes important for
rad/s. As the leakage fault begins to manifest itself,
parameter increases from zero. This has the effect of in-
creasing through introduction of term . In
addition, since , the plant becomes Type 0. The leakage
fault also significantly increases the sizes of the templates. Re-
ferring to Fig. 2, term causes a gain variation of over 30 dB
and a phase variation of approximately 90 at rad/s. This
is in contrast to the 4-dB variation in the open-loop gain that
occurs in the absence of leakage. As the frequency increases,
the influence of is diminished. At high frequencies (
rad/s), the leakage fault causes a greater phase lag. This is due
to increased damping of the hydraulic resonance at .
158 IEEE TRANSACTIONS ON CONTROL SYSTEMS TECHNOLOGY, VOL. 13, NO. 1, JANUARY 2005

TABLE II
RANGES OF UNCERTAIN MODEL PARAMETERS

Fig. 2. Templates of P (s) at various frequencies on the Nichols chart. Solid: Fig. 3. QFT bounds B (! ) and nominal loop transmission L(j!;  )
K = 0. Dashed: K > 0. considering the effects of leakage fault.

IV. CONTROLLER SYNTHESIS

The lower tracking bound was constructed to have a 2%
The fault-tolerant controller is designed using a typical two- settling time of 0.85 s while the upper tracking bound was
degree-of-freedom (DOF) tracking control structure [14]. The built to have a maximum overshoot of 5% and a 2% settling time
uncertain plant, , can be represented by a set of 0.4 s.
of fixed-parameter transfer functions, shown in (12) at the bottom 2) Closed-Loop Stability: To ensure gain and phase margins
of the page, where denotes the vector of of approximately 6 dB and 60 , respectively, the following con-
uncertain parameters. The QFT FTC system is designed to meet straint on the closed-loop magnitude must also be satisfied:
the following closed-loop performance specifications [11], [14].
1) Reference Tracking: The step responses of the closed- (14)
loop tracking transfer functions

QFT bounds were computed at various design frequen-

cies with respect to nominal plant using the plant tem-
where is the controller and is a prefilter, should sat- plates together with the specified closed-loop performance tol-
isfy the following inequality: erances. The QFT bounds delineate regions on the Nichols chart
where the nominal loop transmission
should lie to achieve the required closed-loop performance for
all plants in the set . A suitable loop transmission, shown
(13)
in Fig. 3 along with the relevant , was designed next via

(12)
IEEE TRANSACTIONS ON CONTROL SYSTEMS TECHNOLOGY, VOL. 13, NO. 1, JANUARY 2005 159

Fig. 4. Envelope of closed-loop responses for fault-tolerant controller under

normal operation and leakage fault.

loop shaping [15] by adjusting the loop gain and adding con-
trol elements in series with . The resulting fault-tolerant
controller is

Fig. 5. QFT bounds B (!) and nominal loop transmission L(j!;  ),

designed for normal operation only.
(15)

Prefilter was synthesized via straight-line Bode

analysis [15] to ensure the closed-loop step responses fall
between the specified and

(16)

To verify the design, the unit step responses

Fig. 6. Envelope of closed-loop step responses for normal controller under

were simulated. Fig. 4 shows the simulation results for 70 repre- normal operation and leakage fault.
sentative plants, including faulty ones, from the set . As
is seen, the envelopes of the responses are acceptable and fall
within the prescribed lower and upper tracking bounds.
A second controller was also synthesized using the templates
for (see Fig. 2), which represent the normal operation
of the system with no leakage fault. The QFT bounds, and cor-
responding nominal , are shown in Fig. 5. The normal
controller is

(17)

and the prefilter, , which gives similar time responses to

the FTC system is

(18)

With reference to Fig. 6, when using the normal controller in the

presence of the leakage fault, i.e., , the lower tracking
bound is violated indicating inadequate speed of the position
response.
Fig. 7. Ratio of controller gains jG s = jG (s )j .
( )j
The ratio is now examined to ascertain
the price, in terms of controller gain, that must be paid for
tolerance to the leakage fault. Referring to Fig. 7, it is seen that remove the static position errors caused by the leakage. This is
dB of extra gain is required for rad/s to adequately representative of the relative increase in the integral gain of the
160 IEEE TRANSACTIONS ON CONTROL SYSTEMS TECHNOLOGY, VOL. 13, NO. 1, JANUARY 2005

FTC law. In the intermediate frequencies ( rad/s)

ratio dB is representative of the
increase in the proportional loop gain. In the high-frequency
range, rad/s, it is evident that about 30 dB is needed
to keep the loop transmissions, , from penetrating the
0.3-dB M-circle. Clearly, due to the increased high-frequency
gain for rad/s, the FTC loop becomes more suscep-
tible to the effects of noise and unmodeled high-frequency
dynamics. This problem may be handled, if necessary, by
cascading some additional high-frequency poles in series with
or redesigning in the high-frequency range.
Alternatively, adding additional DOF in the feedback loop by
monitoring other plant states, for example load pressure, may
help to reduce the high-frequency gain.

V. EXPERIMENTAL RESULTS
The designed controllers were implemented to control the ex-
perimental hydraulic positioning system. The ability of the fault-
tolerant controller to maintain the performance of the system
despite the occurrence of the leakage fault and the characteris-
tics of the normal control law operating on the faulty system
were examined first. Next, the performance of the FTC strategy
was compared against that of the normal controller for the
case where the system suddenly becomes faulty. The internal
leakage fault was simulated experimentally by adjusting the
needle valve that controls the flow between the actuator cham- Fig. 8. Experimental responses, pushing against a spring, to a 12-mm step
bers (see Fig. 1). The needle valve was kept closed to represent command using fault-tolerant controller. (a) Position responses. (b) Leakage
the normal or no leak (NL) operating condition. The mean flows. (c) Control signals. Legend: no leak (NL), small leak (SL), small-medium
leak (SML), medium-large leak (MLL), and large leak (LL).
leakage rate for a small leak (SL) was 2.2 L/min. Flow rates
for small-medium leakages (SML) and medium-large leakages
(MLL) were 4.3 L/min and 6.2 L/min, respectively. Leakage
rates above 7.0 L/min were considered large leaks (LL) and
represent the desired range of fault tolerance, i.e., 25% loss in
effective area of the piston seal, quite well. Fig. 8(a) shows the
responses along with the tracking bounds and . The
corresponding leakage flows and control signals are shown in
Fig. 8(b) and (c). As is seen, the transient responses fall within
the lower and upper tracking bounds. The steady values of the
position responses were also found to lie within % of the
desired values. Clearly, the fault-tolerant controller is able to Fig. 9. Experimental position responses, pushing against a spring, to a 12-mm
maintain the performance of the positioning system, despite the step command using normal controller. Legend: no leak (NL), small leak (SL),
small-medium leak (SML), medium-large leak (MLL), and large leak (LL)
occurrence of the leakage fault. The performance of the normal
control law was also tested experimentally for the same levels
of the leakage fault as the fault-tolerant controller. Fig. 9 con- fault occurs at s the position of the actuator is disturbed
firms that the speed of the response using the normal controller slightly and both controllers react accordingly by opening the
is inadequate to meet the specified tracking tolerances when the servovalve to counteract the error. For s, the effectiveness
system becomes faulty. of the fault-tolerant controller over the normal control strategy
In the second set of tests, the same input signal as before was is clear. It is observed that the response of the fault-tolerant con-
used and the position of the actuator was monitored for 14 s. troller is approximately four times faster, with respect to the 2%
However, during the experiments, the ball valve was opened settling time, than that of the normal control scheme.
quickly at s, to simulate a sudden failure of the actuator
piston seal representing a severe leakage of L/min. Figs. 10 VI. CONCLUSION
and 11 show the results obtained using the FTC scheme and the A fixed-gain, linear time-invariant fault-tolerant controller
normal controller, respectively. They verify that the position re- was developed to maintain the tracking performance of an
sponses for the normal control scheme are similar to those given experimental servohydraulic positioning system despite the
by the fault-tolerant controller when there is no leakage across degrading effects of fluid leakage across the actuator piston
the actuator piston (for s). However, when the sudden seal. The fault-tolerant controller was designed via QFT to
IEEE TRANSACTIONS ON CONTROL SYSTEMS TECHNOLOGY, VOL. 13, NO. 1, JANUARY 2005 161

The passive approach to FTC of the servohydraulic po-

sitioning system developed in this brief lends itself well to
industrial implementation since the fault tolerance can be
achieved using a single fixed-gain control law without de-
pending on fault diagnostics algorithms. However, in practice,
care must be taken to ensure the chosen range of parametric un-
certainty in the hydraulic transfer functions accurately reflects
the task at hand. Otherwise, the convenience of a fixed-gain
control law comes at the cost of increased controller gain and
increased variability on the closed-loop tracking responses.
Moreover, since the performance of the fault-tolerant controller
is only guaranteed for the a priori specified range of the leakage
fault, the system may cease to function within the specified
tolerances if the leakage increases beyond the design range.

Fig. 10. Performance of fault-tolerant controller with introduction of a leakage
fault at approximately t = 3 s. (a) Position response. (b) Leakage flow.
Fig. 11. Performance of normal controller with introduction of a leakage fault
at approximately t = 3 s. (a) Position response. (b) Leakage flow.
guarantee the satisfaction of a priori-defined reference tracking
and stability requirements. Experiments demonstrated the ap-
plicability of the designed FTC scheme to compensate for the
effects of the leakage fault on a real servohydraulic positioning
system. The superior tracking performance of the developed
FTC scheme as compared to the normal controller was also
experimentally confirmed.
REFERENCES
[1] T. Chang and Z. Chen, “Reliable control for systems with block diagonal
feedback structure,” in Proc. Amer. Control Conf., Chicago, IL, 2000, pp.
829–833.
[2] A. N. Gundes, “Stability of feedback systems with sensor or sensor ac-
tuator failures: Analysis,” Int. J. Control, vol. 56, pp. 735–753, 1992.
[3] Z. Gao and P. J. Antsaklis, “Stability of the pseudo-inverse method
for reconfigurable control systems,” Int. J. Control, vol. 53, no. 3, pp.
717–729, 1991.
[4] Y. Diao and K. M. Passino, “Intelligent fault-tolerant control using adap-
tive and learning methods,” Control Eng. Practice, vol. 10, no. 8, pp.
801–817, 2002.
[5] I. A. Njabeleke, R. F. Pannett, P. K. Chawdhry, and C. R. Burrows, “De-
sign of H loop-shaping controllers for fluid power systems,” Proc.
Inst. Mech. Eng. C, Mech. Eng. Sci., vol. 214, no. 3, pp. 483–500, 2000.
[6] I. Tunay, E. Y. Rodin, and A. A. Beck, “Modeling and robust control
design for aircraft brake hydraulics,” IEEE Trans. Contr. Syst. Technol.,
vol. 9, pp. 319–329, Mar. 2001.
[7] M. Pachter, C. H. Houpis, and K. Kang, “Modeling and control of an
electro-hydrostatic actuator,” Int. J. Robust Nonlinear Control, vol. 7,
no. 6, pp. 591–608, 1997.
[8] D. F. Thompson, J. S. Pruyn, and A. Shukla, “Feedback design for robust
tracking and robust stiffness in flight control actuators using a modified
QFT technique,” Int. J. Control, vol. 72, no. 16, pp. 1480–1497, 1999.
[9] N. Niksefat and N. Sepehri, “A QFT fault-tolerant control for electrohy-
draulic positioning systems,” IEEE Trans. Contr. Syst. Technol., vol. 10,
pp. 626–632, Jul. 2002.
[10] M. Karpenko and N. Sepehri, “Robust position control of an electro-
hydraulic actuator with a faulty actuator piston seal,” ASME J. Dynam.
Syst., Meas. Control, vol. 125, no. 3, pp. 413–423, 2003.
[11] I. M. Horowitz, Quantitative Feedback Design Theory—QFT.
Boulder, CO: QFT Publications, 1993, vol. 1.
[12] H. E. Merritt, Hydraulic Control Systems. New York: Wiley, 1967.
[13] V. A. Skormin and J. Apone, “On-line diagnostics of a variable displace-
ment pump of a flight actuation system,” in Proc. IEEE Nat. Aerospace
Electronics Conf., vol. 1, Dayton, OH, 1995, pp. 503–510.
[14] N. Niksefat and N. Sepehri, “Robust force control of hydraulic actua-
tors despite system and environmental uncertainties,” IEEE Control Syst.
Mag., vol. 21, pp. 66–77, Feb. 2001.
[15] J. J. D’Azzo and C. H. Houpis, Linear Control System Analysis &
Design: Conventional and Modern, 3rd ed. New York: McGraw-Hill,
1988.