Title Author(s) Citation Issue Date URL Rights Reliable control using redundant controllers Yang, G; Zhang, SY; Lam, J; Wang, J IEEE Transactions on Automatic Control, 1998, v. 43 n. 11, p. 1588-1593 1998 http://hdl.handle.net/10722/43025 ©1998 IEEE. Personal use of this material is permitted. However, permission to reprint/republish this material for advertising or promotional purposes or for creating new collective works for resale or redistribution to servers or lists, or to reuse any copyrighted component of this work in other works must be obtained from the IEEE. 1588 IEEE TRANSACTIONS ON AUTOMATIC CONTROL, VOL. 43, NO. 11, NOVEMBER 1998 it converges to the (n 0 3)-dimensional subspace of the eigenvectors with the n 0 3 largest eigenvalue magnitudes, and so on. Eventually, the trajectory converges to a one-dimensional attractor, spanned by the eigenvector of matrix A0i (Xi3 ; i3 ) with the maximal eigenvalue magnitude, and finally to the zero-dimensional vertex of the limit cycle which corresponds to the setup change under consideration. [10] F. L. Lewis, Optimal Control, Wiley, 1988. [11] A. Sharifnia, M. Caramanis, and S. Gershwin, “Dynamic set-up scheduling and flow control in manufacturing systems,” Discrete Event Dynamic Syst., vol. 1, pp. 149–175, 1991. [12] G.-X. Yu and P. Vakili, “Periodic and chaotic dynamics of a switchedserver system under corridor policies,” IEEE Trans. Automat. Contr., vol. 15, Apr. 1996. V. CONCLUSION The dynamics of the one-machine n-part-type setup scheduling problem have been studied analytically. The study is conducted in the phase space of both state and costate variables. Making use of necessary optimal setup change conditions allows us to derive an operator which maps a point in the phase space into another point of the same space along the solution of both state and costate differential equations. Expressed analytically, the operator maps the optimal switching surface out of a specific setup to itself and therefore provides insight into the optimal behavior of the system and proves various properties of the optimal schedule including the existence of attractors driving its dynamics. Different procedures for numerical construction of the switching surfaces in X -space can be suggested on the basis of our results. For example, one can collect points that lie close to the switching surface in the manner described below and then spline them to build its approximation. The collection of those points is obtained by 1 to the points that belong to the hyperplane applying the operator A0 i which approximates the switching surface in the vicinity of the 1 limit cycle. Since this hyperplane and operator A0 are expressed i analytically, the procedure may locate points that are arbitrarily close to the switching surface for a particular setup. This and other ideas for numerical development of the presented approach constitute interesting objectives of future research. REFERENCES [1] M. Caramanis, A. Sharifnia, J. Hu, and S. Gershwin, “Development of a science base for planning and scheduling manufacturing systems,” in Proc. NSF Design and Manufacturing Systems Conf., Austin, TX, 1991, pp. 27–40. [2] C. Chase, J. Serrano, and P. Ramadge, “Periodicity and chaos from switched flow systems: Contrasting examples of discretely controlled continuous systems,” IEEE Trans. Automat. Contr., vol. 38, pp. 70–83, 1993. [3] G. Dobson, “The economic lot scheduling problem: Achieving feasibility using time-varying lot sizes,” Ops. Res., vol. 35, pp. 764–771, 1987. [4] M. Elhafsi and S. Bai, “Transient and steady-state analysis of a manufacturing system with setup changes,” J. Global Optim., vol. 8, pp. 349–378, 1996. [5] J. Hu and M. Caramanis, “Dynamic set-up scheduling of flexible manufacturing systems: Design and stability of near optimal general round robin policies,” in Discrete Event Systems, IMA vol. in Math. and Appl. Series, P. R. Kumar and P. P. Varaiya, Eds. New York: Springer-Verlag, 1995, pp. 73–104. [6] C. Humes, Jr., L. O. Brandao, and M. P. Garcia, “A mixed dynamics approach for linear corridor policy: A revisitation of dynamic setup scheduling and flow control in manufacturing systems,” Discrete Event Dynamic Syst., vol. 5, pp. 59–82, 1995. [7] J. G. Kimemia and S. B. Gershwin, “An algorithm for the computer control of a flexible manufacturing system,” IIE Trans., vol. 15, no. 4, pp. 353–362, 1983. [8] E. Khmelnitsky, K. Kogan, and O. Maimon, “A maximum principle based method for scheduling in a flexible manufacturing system,” Discrete Event Dynamic Syst., vol. 5, pp. 343–355, 1995. [9] E. Khmelnitsky and K. Kogan, “Necessary optimality conditions for a generalized problem of production scheduling,” Optimal Contr. Appl. Methods, vol. 15, pp. 215–222, 1994. Reliable Control Using Redundant Controllers Guang-Hong Yang, Si-Ying Zhang, James Lam, and Jianliang Wang Abstract—This paper presents a methodology for the design of reliable control systems by using multiple identical controllers to a given plant. The resulting closed-loop control system is reliable in the sense that it provides guaranteed internal stability and 1 performance (in terms of disturbance attenuation), not only when all controllers are operational but also when some controller outages (sensor and/or actuator) occur. A numerical example is given to illustrate the proposed design procedures. H Index Terms—Algebraic Riccati equations, control system design, reliable control. I. INTRODUCTION Recently, the design problems of reliable centralized and decentralized control systems achieving various reliability goals have been treated by several authors; see [1]–[4] and references therein. One such goal is the reliable stabilization problem for a given plant. Vidyasagar and Viswanadham [1] discuss the reliable stabilization of a plant by two controllers summed together by means of factorization methods and given any stabilizing controller for a plant, a procedure of designing a second stabilizing controller such that the sum of the two controllers also stabilizes the plant. Gundes and Kabuli [2] investigate the reliable stabilization problem for two-channel decentralized control systems and present reliable decentralized controller design methods for strongly stabilizable plants. Another reliability goal is to provide guaranteed system performance. Veillette et al. [3] present a new methodology for the design of reliable centralized and decentralized control systems by using the algebraic Riccati equation approach, where the resulting designs provide guaranteed closed-loop stability and H1 performance not only when all control components are operating, but also in case of some admissible control component failures. In [4], Siljak investigated reliability of control structures using more than one controller for a given plant, which is a natural way to introduce redundancy into a control scheme for enhancing reliability. In this paper, we consider the reliable multicontroller design problem in the special case where all the control channels are identical. Manuscript received June 6, 1995; revised January 29, 1996 and July 30, 1996. This work was supported in part by the Chinese Natural Science Foundation. G.-H. Yang was with the Department of Automatic Control, Northeastern University, Shenyang, Liaoning, 110006 China. He is now with the School of Electrical and Electronic Engineering, Nanyang Technological University, Singapore 639798 (egyang@ntu.edu.sg). S.-Y. Zhang is with the Department of Automatic Control, Northeastern University, Shenyang, Liaoning, 110006 China. J. Lam is with the Department of Mechanical Engineering, The University of Hong Kong, Hong Kong. J. Wang is with the School of Electrical and Electronic Engineering, Nanyang Technological University, Singapore 639798. Publisher Item Identifier S 0018-9286(98)08422-0. 0018–9286/98$10.00  1998 IEEE IEEE TRANSACTIONS ON AUTOMATIC CONTROL, VOL. 43, NO. 11, NOVEMBER 1998 II. PROBLEM FORMULATION Consider the linear time-invariant plant with channels described by q identical control q Bui + Gw0 (q > 1) (1) i=1 yi = Cx + wi ; i = 1; 1 1 1 ; q (2) z = xT H T u1T 1 1 1 uqT T (3) where x 2 Rn is the state, yi (i = 1; 1 1 1 ; q ) are the measured outputs, z is an output to be regulated, wi (i = 0; 1; 1 1 1 ; q ) are the square-integrable disturbances, and ui (i = 1; 1 1 1 ; q ) are the control x_ = Ax + inputs. The problem is to design q identical controllers for the plant, where the ith controller uses the measurement yi to generate the control ui . The q controllers are described by _i = Ac i + Lyi ui = Ki ; i = 1; 1 1 1 ; q where K is the feedback gain, disturbance estimate gain, and L (4) (5) is the observer gain, Kw Ac = A + BK + GKw 0 LC: is the Aq = x_ q = Aq xq + Gq wq z = Hq xq 111 qT ]T ; wq T T = [w0 w1 1 1 1 LC 1 1 1 0 Gq = diag G L L (7) (8) 111 1 1 1 BK 111 0 111 0 111 1 111 1 111 1 1 1 1 Ac A BK BK LC Ac 0 LC 0 Ac 1 1 1 0 111 L wqT ]T (9) 111 K : T 1 1 1 tq wqT T (12) weo = w0T w1T 1 1 1 wrT tr+1 wr+1 T zeo = xT H T u1T 1 1 1 urT pr+1 ur+1 1 1 1 pq uqT T (13) tj = (10) 0; 1; j 2 eo j 6= eo pj = 0; 1; j 2 ec j 6= ec : (14) When the controller failures corresponding to the subset e = eo [ ec occur, the closed-loop system matrices then take the form (11) q The failure of a controller is modeled as the measurement outage or the control input outage (ui = 0). The design objective is to select the feedback gain K , the observer gain L, and the disturbance estimate gain Kw so that for any p controller failures (0  p  q 0 1), the resulting closed-loop system is internally stable and the H1 -norm of the closed-loop transfer function matrix is bounded by some prescribed constant > 0. Remark 2.1: It should be noted that the closed-loop system of (7) and (8) is very similar to the state model of symmetrically interconnected systems discussed in [5] and [6]. By the results in [5], A qBK ] and Ac are Hurwitz. Aq is Hurwitz if and only if both [ LC A So, all controllers of (4) and (5) must be guaranteed to be open-loop stable in the design procedure in order to ensure closed-loop internal stability and system performance. In other words, the system must be strongly stabilizable. This necessary condition for the above reliable control problem is due to the symmetry in the closed-loop system. The problem formulation given above in (1)–(6) has the following characteristics. First, identical channels (with identical sensors and (yi = 0) III. MAIN RESULTS Let E = f1; 2; 1 1 1 ; q g denote the set of the q controllers of (4) and (5) subject to failures. The problem is to compute a control law which guarantees closed-loop stability and an H1 -norm bound in spite of controller failures corresponding to any proper subset e  E . By the symmetry of the matrix Aq , we may assume that e = fr + 1; r + 2; :::; qg = eo [ ec with r  1, where eo = fj : yj = 0; j = r + 1; 1 1 1 ; q g, and ec = fj : uj = 0; j = r + 1; 1 1 1 ; q g. Let where q Hq = diag H K K identical actuators) are used to improve the reliability of the closedloop system. This is motivated by the common practice in (e.g., aircraft) industry to use identical sensors, actuators, subsystems and/or channels to prove high reliability [9, Sec. 5.4]. Second, the redundant channels are introduced in a pure passive way [9, Sec. 3.4]. Namely, there is no control system reconfiguration involved when any of the allowable outages occurs. The resulting controller provides guaranteed internal stability and system performance (in the sense of H1 disturbance attenuation) not only when all control channels are operating correctly, but also when some control channels experience breakdowns/outages. This formulation is related to the multimodel approach (simultaneous stabilization) of [7] and [8] but is different from the active approaches of redundancy of fault detection, fault location, and fault recovery [9]–[12]. In the active approaches, system malfunction has to be allowed for a finite amount of time to facilitate fault detection, location, isolation, and recovery. But such a malfunction does not exist in the passive approach proposed here in this paper, making our method suitable for applications where even a temporary malfunction is not allowed. The next section will present a design procedure for the reliable controller design problem by using the algebraic Riccati equation approach. (6) Applying the q controllers of (4) and (5) to the plant of (1)–(3), the resulting closed-loop system is as follows: where xq = [xT 1T 1589 Aqe = A LC BK Ac LC pr+1 LC 0 0 pq LC 0 1 1 1 1 1 1 1 1 1 1 1 BK tr+1 BK 111 0 0 111 1 1 111 1 1 1 1 1 Ac 0 111 0 Ac 111 1 1 111 1 1 111 0 0 1 1 1 tq BK 111 0 111 1 111 1 111 0 111 0 111 1 111 1 1 1 1 Ac (15) Gqeo = diag G L 1 1 1 L tr+1 L 1 1 1 tq L Hqec = diag H K 1 1 1 K pr+1 K 1 1 1 pq K (16) r r (17) where Ac = A + BK + GKw 0 LC . The result given in the following theorem presents a procedure for output feedback controller design to guarantee that Aqe is Hurwitz and that Te (s) = Hqec (sI 0Aqe )01 Gqeo , the transfer function matrix from weo to zec , satisfies kTe k1  . 1590 IEEE TRANSACTIONS ON AUTOMATIC CONTROL, VOL. 43, NO. 11, NOVEMBER 1998 Theorem 3.1: Let (A; H ) be a detectable pair and constant. Suppose K=0 BT X 0; 1 Kw = 2 be a positive GT X +H with T H + (q A + BK + GKw 1 2 X0 GGT X0 0 X0 BB T X0 2 (19) 2 01 Y C T ) + 1 T T + Y A1 + 2 Y H HY 2q 2 Y K T KY 3 + 2 0 q01 Y C T CY + GGT 2 BB T 1 2 =0 0 In In In 0 0 0 XG0 GT0 X + H0T H0  0 T (n; s) = 1 1 1 1 1 1 In n2n 0 where In is an R(q+1)n2(q+1)n be T 0 0 111 0 0In 0In 1 1 1 0In In 0 111 0 0 In 1 1 1 0 1 1 111 1 1 1 111 1 1 1 111 1 0 0 1 1 1 In (s = T (0) T (1) i Lemma 3.3: Let F where f00 ; f11 2 F = 2R 2(q+1)n (q +1)n where 111 111 111 1 111 1 111 1 111 0 111 f01 f10 f11 1 1 1 0 0 0 1 1 1 Rn2n . Then the following equalities hold. q 0 1 C T ]T : (24) 2 XGq+ GTq+ X + HqT+ Hq+  0 (25) is given by (9) 111 L Gq+ = diag G+ L L (26) q 111 K Hq+ = diag H+ K K X0 + X1 0 q1 X1 0 q1 X1 1 1 1 X= 0qX 1 1 q (27) 0qX 0qX 1 1 1 0qX 0 111 0 qX 0 X 1 11 0 q 1 1 111 1 1 1 111 1 1 1 111 1 0 0 111 qX 1 1 1 1 1 1 1 1 1 1 1 (28) 1 with X1 = ( 2 Y 01 0 X0 )01 , where X0 and Y are as given in Theorem 3.1. Proof: By Lemma 3.3, (9), and (26)–(28), we have T T XT T 01 Gq+ GTq+ (T 01 )T T T XT + T T HqT+ Hq+ T = diag[41 q (q 0 1)42 1 1 1 642 242 ] (29) 1 T 2 2 where 4 (23) 1 = A qBK ; At = LC Ac 4 2 = 1 ATt Xt + Xt At + Gt = diag G+ f00 f01 f01 f10 f11 0 f10 0 f11 1 1 1 Aq + i = 0; 1; :::; q 0 1: be given by H+ = [H T 1 ATq X + XAq + with 1 1 1 In T (n; q 0 i) ; : q where T (i) = diag In 1 T T ATq X + XAq + 12 XGq+ GTq+ + HqT+ Hq+ T T T T 01 T T 01 Aq T = T A (T ) T XT + T XT T > 1) 1 1 1 T (q 0 1) q 0 1 B ]; G+ = [G (22) identity matrix. Let the matrix defined as follows: q f01 1 q f11 1 Lemma 3.4: Let (21) then F is Hurwitz and T (s) satisfies kT k1  . Consider the matrix T (n; s) 2 R(s+1)n2(s+1)n given by T (n; 1) = diag[In In ] In where Then, under the assumptions of Theorem 3.1 and where A1 = A 0 qBB T X0 , and fY X0 g < 2 . Then, for controller failures corresponding to any proper subset e  E , the closed-loop system is asymptotically stable and kTe k1  . Furthermore, all controllers are open-loop stable (Ac Hurwitz). The following preliminaries will be used in the proof of Theorem 3.1. Lemma 3.2 [3]: Let T (s) = H0 (sI 0 F )01 G0 , with (F; H0 ) a detectable pair. If there exists a real matrix X  0 and a positive scalar such that F T X + XF + 11 ], f00 q f10 f3 = (20) where Y > 0 is symmetric and satisfies the observer design algebraic Riccati equation 111;f where Hurwitz. Suppose also L = q(I 0 Y X0 = A1 Y 3.3-2) 3.3-3) 0 1) C T C = 0 = diag[f1 ; f11 ; 01 f1 = ff00 qf f11 : 10 T T F T = diag[f2 ; q(q 0 1)f11 ; 1 1 1 ; 6f11 ; 2f11 ], where f00 qf01 : f2 = qf qf11 10 T 01 F (T 01 )T = diag[f3 ; q(q101) f11 ; 1 1 1 ; 321 2 f11 ; 221 1 f11 ], (18) 0 where X0  0 is symmetric and satisfies the state-feedback design algebraic Riccati equation AT X0 + X0 A + T 01 F T 3.3-1) 2 X1 Xt = X00+ X1 p1q L ; ATc X1 + X1 Ac + Xt Gt GTt Xt + HtT Ht 0X 1 X1 Ht = diag[H+ 1 2 q In the following, we shall show that (30) pqK ] X1 LLT X1 + qK T K: (31) 4  0 and 4  0. Let 1 Mt = II I0 : 2 Then, from (18), (19), and (24) MtT 41 Mt = U01 U0 2 (32) IEEE TRANSACTIONS ON AUTOMATIC CONTROL, VOL. 43, NO. 11, NOVEMBER 1998 where 1 U1 = 0 + X0 A + 2 X0 G+ GT+ X0 0 qX0BBT X0 + H+T H+ = 0 T U2 = A + 1 G+ GT+ X0 0 LC X1 AT X (33) 2 + X1 A + 12 G+ GT+ X0 0 LC + 12 q X1 LLT X1 (34) + 1 X1 G+ GT+ X1 + qK T K: 2 By (20) and (28), we have L = q 2 X101 C T ; X1 + X0 = 2 Y 01 : (35) Thus, from (21), it follows that U X X A AT X X 2 =( 1 + 0 ) + ( 1 + 0) 1 + 2 (X1 + X0 )G+ GT+ (X1 + X0 ) + H+T H+ 0 q 2 C T C + p1 q X1 L 0 pq C T p1 q LT X1 0 pq C = 2 Y 01 AY + Y AT + 1 Y H T HY 0 Y C T CY 1591 From (29), (36), and (37), and a nonsingularity of the matrix of (23), it follows that inequality (25) is true. Lemma 3.5: Under the assumptions of Theorem 3.1, the matrix Ac A BK GKw 0 LC is Hurwitz. Proof: From (31) and (37), it follows: = + X101(A + BK + GKw 0 LC )T + (A + BK + GKw (38) 0 LC )X101 + 12 q LLT  X10142 X101  0: Let v 6= 0 satisfy (A + BK + GKw 0 LC )T v = v . Then (38) gives 2Re()v3 X101v + 1 q v3 LLT v  0, and it implies that Re()  0. If Re() = 0, then LT v = 0. Thus, (A + BK + GKw )T v = (A + BK + GKw 0 LC )T v = v. Since A + BK + GKw is Hurwitz, it follows that Re() < 0, which is in contradiction with Re() = 0. Hence, if Re() < 0, it further implies that A + BK + GKw 0 LC is Hurwitz. Proof of Theorem 3.1: Let e fr ; r ; 1 1 1 ; qg eo [ ec r  correspond to a subset of controllers subject to outages. From (9)–(11) and (15)–(17), we have ( 2 Y 01 A1 Y = 2 BB T Y 01 2 BB T 0 qBKY 0 qY K T B T Y 01  2 Y 01 A1 Y + Y AT1 + 12 Y H T HY 0 Y C T CY = 0: + GGT + 2q2 Y K T KY + 32 q 0 1 2 BB T Y 01 Hence 41 = MtT 01 U01 U02 Mt01  0: (36) Similarly, from (19), (21), (24), (34), and (35) 42 = X1 A1 + 12 X0 G+ GT+ X1 0 X1 LC 0 C T LT X1 + 12 q X1 LLT X1 + qK T K = X1 A1 + AT1 X1 + 12 X1 G+ GT+ X0 + 12 X0 G+ GT+ X1 0 X1 LC 0 C T LT X1 + 12 q X1 LLT X1 + X0 A1 + AT1 X0 + 12 X0 G+ GT+ X0 + H+T H+ 0 qX0 BK 0 qK T BT X0  (X1 + X0 )A1 + AT1 (X1 + X0 ) + 12 (X1 + X0 )G+ 2 GT+ (X1 + X0 ) + H T H 0 C T C + 2qX0 BBT X0 = 2 Y 01 A1 Y + Y AT1 + 12 Y H T HY 0 Y C T CY + GGT + 2q Y K T KY + (q 0 1) 2 BBT Y 01  0: 0 111 0 Bec = 01 11 11 11 01 0 111 0 0 111 0 T Ceo = 01 11 11 11 01 0 111 0 Kec = diag[0 1 1 1 Leo = diag[0 1 1 1 (1 0 tr+1 )B 1 1 1 (1 0 tq )B 0 111 0 1 111 1 1 111 0 (1 0 pr+1 )C T 1 1 1 (1 0 pq )C T 0 111 0 1 111 1 1 111 0 0 (1 0 tr+1 )K 1 1 1 (1 0 tq )K] 0 (1 0 pr+1 )L 1 1 1 (1 0 pq )L]: By Lemma 3.2, this closed-loop system with sensor and/or actuator outages is internally stable and has an H1 disturbance attenuation of > if 1qe 0 T X + H T H  0: ATqe X + XAqe + 12 XGqeo Gqeo qec qec (39) It is easy to see that 1 1 + 2 X1 G+ GT+ X0 + AT X 1 = Aqe = Aq 0 Bec Kec 0 Leo Ceo Hqec = Hq 0 Kec T Gqeo = Gq 0 Leo Leo where + Y AT1 + 12 Y H T HY 0 Y C T CY + GGT +(q 0 1) = +1 +2 1) 2 + GGT + (q 0 1) + 2 (37) T H = HT H 0 KT K Hqec qec q q ec ec T Gqeo GTqeo = Gq GTq 0 Leo Leo T  diag[(q 0 1)BB T 0 1 1 1 Bec Bec T Ceo Cec  diag[(q 0 1)C T C 0 1 1 1 0] 0]: Then by Lemma 3.4 and (26)–(28), we have that 1qe = ATq X + XAq + 12 XGq GqT X + HqT Hq 0 KecT BecT X 0 CeoT LTeo X 0 XBec Kec 0 XLeoCeo 0 12 XLeoLeoT X 0 KecT Kec = ATq X + XAq + 12 XGq+ GTq+ X + HqT+ Hq+ 0 X diag[(q 0 1)BBT 0 1 1 1 0]X 0 diag[(q 0 1)C T C 0 1 1 1 0] 0 KecT BecT X 0 XBecKec 0 KecT Kec 0 XLeoCeo 0 CeoT LTeo X 0 12 XLeo LeoT X  0 1 XLeo + CeoT 1 LeoT X + Ceo 0 XBec + KecT BecT X + Kec  0: 1592 IEEE TRANSACTIONS ON AUTOMATIC CONTROL, VOL. 43, NO. 11, NOVEMBER 1998 Provided that (Aqe ; Hqec ) is a detectable pair, Lemma 3.2 guarantees that Aqe is Hurwitz and that Te (s) = Hqec (sI 0 Aqe )01 Gqeo , the transfer function matrix from weo to zec , satisfies kTe k  . To prove detectability of (Aqe ; Hqec ), assume that v T = (v1T ; v2T ) 6= 0 satisfies Aqe v = v and Hqec v = 0. Then Av1 = v1 and Hv1 = 0. From detectability of (A; H ), it follows that either Re() < 0 or v1 = 0. If v1 = 0, then Aqe v = v gives (A + BK + GKw 0 LC )v2 = v2 . By Lemma 3.5, we have that Re() < 0. Thus, the proof of Theorem 3.1 is completed. For the decentralized reliable control problem, the outage of all sensors in a control channel is the same as the outage of all actuators in that control channel. As the system under consideration is singleinput/single-output (SISO) in each control channel, a controller failure can be modeled as either an actuator outage or a sensor outage in that channel. By modeling controller failures only as actuator outages in the corresponding control channels and by using similar arguments as in Theorem 3.1, we have the following design procedure. Corollary 3.6: Let (A; H ) be a detectable pair and be a positive constant. Suppose that K and Kw are as given in (18) with X0  0 being symmetric and satisfying the following state-feedback design algebraic Riccati equation: 1 AT X0 + X0 A + 12 X0 GGT X0 0 X0 BB T X0 + H T H = 0 (40) and with A + BK + GKw Hurwitz. Suppose also that L is as given in (20) with Y > 0 being symmetric and satisfying the observer design algebraic Riccati equation A1 Y + Y AT1 + 12 Y H T HY 0 qY C T CY + GGT + 2q Y K T KY + 3 q 0 1 2 BB T = 0 2 2 (41) where A1 = A 0 qBB T X0 and fY X0 g < 2 . Then, for controller failures corresponding to any proper subset e  E , the closed-loop system is asymptotically stable and kTe k  . Similarly, by modeling controller failures only as sensor outages in the corresponding control channels, we have the following design procedure. Corollary 3.7: Let (A; H ) be a detectable pair and be a positive constant. Suppose that K and Kw are as given in (18) with X0  0 being symmetric and satisfying the state-feedback design algebraic Riccati equation 1 AT X0 + X0 A + 12 X0 GGT X0 0 qX0 BB T X0 + H T H + (q 0 1) 2 C T C = 0 A1 Y (42) 1 + 12 Y H T HY 0 Y C T CY + GGT + 2q2 Y K T KY + 2q 2 BB T = 0 0 f g (43) with A1 = A qBB T X0 and  Y X0 < 2 . Then, for controller failures corresponding to any proper subset e E , the closed-loop system is asymptotically stable, and Te . It can be seen easily that the controller designs in Corollaries 3.6 and 3.7 are less conservative than that in Theorem 3.1. The proofs for the above two corollaries are quite similar to that of Theorem 3.1 and are hence omitted. k k1   IV. AN EXAMPLE Now we look at an example to illustrate the design procedure given in the previous section. The plant is of the form (1)–(3) and has two identical control channels (q = 2). The plant matrices are given as follows: 02 1 1 3 0 A = 01 0 002 02 01 2 H= 0 0 1 0 ; 2 with A + BK + GKw Hurwitz. Suppose also that L is as given in (20) with Y > 0 being symmetric and satisfying the observer design algebraic Riccati equation + Y AT Remark 3.8: It should be noted that a solution to the above reliable controller design problem could be derived directly from the work of Veillette et al. [3]. This is done by setting all the B’s and C’s equal in their design equations for reliable decentralized control, where the decentralized design for the case of redundant controllers is achieved with a combined observer-design equation of dimensions qn 2 qn;1 which can be reduced to an algebraic Riccati-like equation (ARLE) of dimension 2n 2 2n by using a method similar to that of Lemma 3.4. Similar to the approach of Veillette et al. to reliable control [3], sensor and/or actuator failures (outages) are also treated as plant uncertainty in our approach here. However, by using the symmetry in the closed-loop system, our design approach in this paper involves two n 2 n design equations only, as opposed to the higher order design equations of Veillette et al. [3] (order 2n 2 2n). The design given by Theorem 3.1 requires only a standard algebraic Riccati equation (ARE) of dimensions n 2 n for the observer design. Hence computational procedure in Theorem 3.1 is much simpler than that of Veillette et al. Furthermore, the redundant controllers themselves are automatically guaranteed to be stable. The design method in [3] for decentralized reliable control (for actuator outages) guarantees only that some of the controllers are open-loop stable, unless more complicated design equations are used. In the context of our (decentralized) design problem here, all controllers are guaranteed to be open-loop stable. This is equivalent to any one of the decentralized controllers being open-loop stable because all controllers are assumed identical here. Remark 3.9: For simplicity, only results for SISO systems are given. The generalization to multi-input/multi-output (MIMO) systems is straightforward, except that the notations will get complicated. But in the MIMO case, Corollaries 3.6 and 3.7 may only apply to actuator outages and sensor outages, respectively. 1 2 03 ; 01 0 B = 00 1 1 2 G = 00 ; 0 C = [1 0 0 0]; q = 2: It is easy to check that the open-loop system is unstable, and (A; H ) is a completely observable pair, and hence, detectable. By solving the ARE’s in (40) and (41) in Corollaries 3.6, we have an output feedback controller 6a of the form (4) and (5) with 0261:5469 1:0223 1:0153 0 651:5013 0 0 Ac = 0300 :5297 0 02:0000 337:4229 02:0018 1:3165 1:0097 2:0000 03:0000 01:4850 259:5615 654 5013 L = 299::5297 0340:0691 K = [00:6462 0 1:0018 0 0:6835 0 0:4850]: 1 This high-order design equation is similar to but not the same as the algebraic Riccati equation (ARE) and it is referred to as algebraic Riccati-like equation (ARLE). IEEE TRANSACTIONS ON AUTOMATIC CONTROL, VOL. 43, NO. 11, NOVEMBER 1998 TABLE I RELIABLE CONTROLLER DESIGN RESULTS Similarly, by solving the ARE’s in (42) and (43) in Corollaries 3.7, we have an output feedback controller 6s of the form (4) and (5) with 023:9136 1:0316 1:0271 0 :1069 0 0 Ac = 021 53:4086 0 02:0000 36:2765 02:1497 1:1114 1:0169 2:0000 03:0000 01:5931 21:9833 24 1069 L = 52::4086 039:5770 K = [01:3005 0 1:1497 0 0:8886 0 0:5931]: Both of these two controllers 6a and 6s can provide internal stability and guaranteed disturbance attenuation for the closed-loop system not only when both control channels are operational but also when any of these two control channels experiences an outage. The design results are given in Table I. The two values of the closed-loop disturbance attenuation are computed for each of the two controllers. Namely: 1593 [4] D. D. Siljak, “Reliable control using multiple control systems,” Int. J. Contr., vol. 31, no. 2, pp. 303–329, 1980. [5] C. S. Araujo and J. C. Castro, “Application of power system stabilisers in a plant with identical units,” Proc. Inst. Elec. Eng., vol. 138, pt. C, no. 1, pp. 11–18, 1991. [6] K. M. Sundareshan and R. M. Elbanna, “Qualitative analysis and decentralized controller synthesis for a class of large-scale systems with symmetrically interconnected subsystems,” Automatica, vol. 27, no. 2, pp. 383–388, 1991. [7] J. Ackermann, “Multi-model approaches to robust control system design,” in Uncertainty and Control: Proceedings of an International Seminar Organized by DFVLR, Bonn, Germany, May 1985, J. Ackermann, Ed. Berlin, Germany: Springer-Verlag, 1986. , Sampled-Data Control Systems. Berlin, Germany: Springer[8] Verlag, 1985. [9] B. W. Johnson, Design and Analysis of Fault Tolerant Digital Systems. Reading, MA: Addison-Wesley, 1989. [10] H. E. Rauch, “Autonomous control reconfiguration,” IEEE Contr. Syst., vol. 15, no. 6, pp. 37–48, 1995. [11] M. Kinnaert, R. Hanus, and P. Arte, “Fault detection and isolation for unstable linear systems,” IEEE Trans. Automat. Contr., vol. 40, pp. 740–742, Apr. 1995. [12] C.-C. Tsui, “A general failure detection, isolation and accommodation system with model uncertainty and measurement noise,” IEEE Trans. Automat. Contr., vol. 39, pp. 2318–2321, Nov. 1994. Design of Performance Robustness for Uncertain Linear Systems with State and Control Delays J. S. Luo, P. P. J. van den Bosch, S. Weiland, and A. Goldenberge : c : when there is a controller failure. o when there is no outage; The “Design ” in Table I is the value of used in solving the two corresponding design equations. The actual achievable values of (namely o and c ) for the closed-loop system are all less than and quite close to the value of for which the design equations have solutions and the conditions in the Corollaries are satisfied. This indicates that degree of conservativeness in the design method is not very severe. From Table I, it would seem that the actual system performance would be better when some controller failure occurs, contrary to the desirable property of graceful degradation of performance. This is so, however, because a controller failure (modeled as an actuator outage and/or sensor outage) effectively eliminates one column and/or one row of the closed-loop transfer function matrix. This is similar to an observation made in [3]. ACKNOWLEDGMENT The authors wish to thank the reviewers for many useful suggestions on the initial manuscript of the present work. Abstract—The linear systems considered in this paper are subject to uncertain perturbations of norm-bounded time-varying parameters and multiple time delays in system state and control. The time delays are uncertain, independent of each other, and allowed to be time-varying. The integral quadratic cost criterion is employed to measure system performance. Using solutions of Lyapunov and Riccati equations, a linear state feedback control law is proposed to stabilize the perturbed system and to guarantee an upper bound of system performance, which is applicable to arbitrary time delays. Index Terms— Algebraic Riccati equation, delay effects, linear– quadratic control, Lyapunov matrix equation, robustness, stability, uncertain systems. I. INTRODUCTION The problem of stabilizing uncertain systems with time-varying and bounded parametric uncertainties has attracted a considerable amount of interest in recent years. Among different approaches, Lyapunov and Riccati equation descriptions of uncertainty are important ways to deal with the problem. Based on linear optimal control theory with quadratic cost criteria and using Lyapunov stability theory, many methods have been proposed for finding a linear state feedback law REFERENCES [1] M. Vidyasagar and N. Viswanadham, “Reliable stabilization using a multicontroller configuration,” Automatica, vol. 21, no. 5, pp. 599–602, 1985. [2] A. N. Gundes and M. G. Kabuli, “Reliable decentralized control,” in Proc. American Control Conf., Baltimore, MD, pp. 3359–3363. [3] R. J. Veillette, J. V. Medanic, and W. R. Perkins, “Design of reliable control systems,” IEEE Trans. Automat. Contr., vol. 37, pp. 290–304, 1992. Manuscript received April 22, 1996. J. S. Luo is with the Bombardier-DeHaviland, Canada. P. P. J. van den Bosch and S. Weiland are with the Measurement and Control Group, Department of Electrical Engineering, Eindhoven University of Technology, 5600 MB Eindhoven, The Netherlands (e-mail: P.P.J.v.d.Bosch@ele.tue.nl). A. Goldenberge is with the Robotics and Automation Laboratory, University of Toronto, Toronto, Canada. Publisher Item Identifier S 0018-9286(98)07533-3. 0018–9286/98$10.00  1998 IEEE