FAULT DETECTION, ISOLATION AND RECONFIGURATION SYSTEMS
AND METHODS FOR CONTROLLING ELECTROHYDRAULIC SYSTEMS
USED IN CONSTRUCTION EQUIPMENT
Cross-Reference to Related Application
This application is being filed on 05 March 2012, as a PCT International
Patent application in the name of Eaton Corporation, a U.S. national corporation,
applicant for the designation of all countries except the U.S., and, Qinghui Yuan, a
citizen of China, Michael Berne Rannow, a citizen of the U.S., Wade Leo Gehlhoff,
a citizen of the U.S., Christopher William Schottler, a citizen of the U.S., and Vishal
Mahulkar, a citizen of , applicants for the designation of the U.S. only, and
claims priority to U.S. Patent Application Serial No. 61/448,742 filed on 03 March
2011, the disclosure of which is incorporated herein by reference in its entirety.
Technical Field
The present disclosure relates generally to control systems for use in
electrohydraulic systems. More particularly, the present disclosure relates to fault
detection, isolation and reconfiguration systems for controlling electrohydraulic
systems for construction equipment.
Heavy construction vehicles such as excavators (e.g. front end loaders,
backhoes, wheel loaders, etc.) typically include hydraulic actuation systems for
actuating various components of the equipment. For example, front end loaders are
equipped excavation booms that are raised and lowered by lift hydraulic cylinders.
Often, a bucket is pivotally mounted at the end of the excavation boom. A tilt
cylinder is used to pivot/tilt the bucket relative to the excavation boom.
Additionally, the front end loader can include a boom suspension system that
dampens vibrations and impacts to improve operator comfort. A typical boom
suspension system includes a hydraulic accumulator. A typical hydraulic actuation
system also includes a hydraulic pump for providing pressurized hydraulic fluid to
the system and a reservoir tank from which the hydraulic pump draws hydraulic
fluid.
It is known in the art to utilize sensors (e.g. pressure sensors, position
sensors) for using use in controlling the operation of a hydraulic actuation system.

For safety and reliability, it is known to provide fault detection systems for
identifying when one or more sensors fail.
Summary
The present disclosure relates to fault detection, isolation and reconfiguration
schemes, architectures and methods for use in hydraulic actuation systems.
A variety of additional aspects will be set forth in the description that
follows. These aspects can relate to individual features and to combinations of
features. It is to be understood that both the foregoing general description and the
following detailed description are exemplary and explanatory only and are not
restrictive of the broad concepts upon which the embodiments disclose herein are
based.
Drawings
Figure 1 is a block diagram showing a control architecture in accordance
with the principles of the present disclosure.
Figure 2 shows a wheel loader to which the system architecture disclose here
and can be applied.
Figure 3 is a schematic view of a node in accordance with the principles of
the present disclosure.
Figure 4 is a diagram showing a fault detection, isolation and reconfiguration
architecture in accordance with the principles of the present disclosure.
Figure 5 is a steering node that is part of the schematic of Figure 4.
Figure 6 is an example valve pressure map showing a mapping of flow
pressure and spool position.
Figure 7 is an example valve spool position map showing a mapping of flow,
pressure and spool position.
Figures 8-11 show various sensor level faults.
Figure 12 shows logic for detecting a component level fault with respect to
spool position.
Figure 13 shows control logic for detecting a component level fault with
respect to pressure.
Figure 14 is a chart showing an example subsystem level fault detection
technique.

Figure 15 is an example fault detection, fault identification and
reconfiguration matrix.
Figure 16 is a schematic view showing an example lift cylinder control node
where the lift cylinder is equipped with a rod sensor.
Figure 17 shows an isolation matrix in accordance with the principles of the
present disclosure.
Figure 18 shows another isolation matrix in accordance with the principles of
the present disclosure.
Figure 19 shows a control loop strategy in accordance with the principles of
the present disclosure for controlling a multistage valve.
Figure 20 shows an example multistage valve that can be controlled by the
control strategy of Figure 19.
Figure 21 is an isolation matrix for isolating faults detected in the valve of
Figure 20.
Figure 22 is another fault isolation matrix in accordance with the principles
of the present disclosure.
Figure 23 is another fault isolation matrix in accordance with the principles
of the present disclosure.
Figure 24 is a schematic of a hydraulic system having features that are
examples of aspects in accordance with the principles of the present disclosure.
Figure 25 is a schematic view of a number of fault detection and isolation
tables that can be stored on a controller of the hydraulic system shown in Figure 24.
Figure 26 is a schematic view of an example embodiment of the fault
detection table shown in Figure 25.
Figure 27 is a schematic view of an example embodiment of the non-flow
share primary fault isolation matrix shown in Figure 25.
Figure 28 is a schematic view of an example embodiment of the flow share
primary fault isolation matrix shown in Figure 25.
Figure 29 is a schematic view of an example embodiment of the non-flow
share secondary fault isolation matrix shown in Figure 25.
Figure 30 is a schematic view of an example embodiment of the flow share
secondary fault isolation matrix shown in Figure 25.
Figure 31 is a schematic view of control algorithms stored on the controller
for operating the steering circuit of Figure 24.

Figure 32 is a schematic view of control algorithms stored on a controller for
operating the work circuit of Figure 24.
Figure 33 shows a performance graph for normal operation of the work
circuit shown in Figure 24.
Figure 34 shows a performance graph for operation of the work circuit of
Figure 100 when a fault initially occurs with a position sensor.
Figure 35 shows a performance graph for operation of the work circuit of
Figure 100 after a fault has been detected and isolated, and after the control
algorithm for the work circuit has been reconfigured.
Figure 36 shows a performance graph for operation of the work circuit of
Figure 100 after a fault has been detected and isolated, and after the control
algorithm for the work circuit has been reconfigured with a Smith Predictor.
Figure 37 is a schematic of an on operating method for a vehicle including an
off-line isolation procedure having features that are examples of aspects in
accordance with the principles of the present disclosure.
Figure 38 is a further detailed schematic of the off-line isolation procedure
shown in Figure 37.
Figure 39 is a further detailed schematic of the off-line isolation procedure
shown in Figure 37.
Figure 40 is a schematic'of a low flow mode of operation for the hydraulic
system of Figure 4.
Detailed Description
The present disclosure relates generally to fault detection, isolation and
reconfiguration schemes for use in hydraulic actuation systems. In certain
embodiments, a control system architecture is used that is modularized and
distributed. By using a modularized approach, the system can be reduced in
complexity and can provide enhanced flexibility. By using a distributed architecture
with overlapping and redundant fault detection strategies, fault isolation is enhanced.
Moreover, overlapping and redundant fault detection strategies provide various
options for reconfiguring a system to allow the system to continue to operate even
when a failed sensor has been isolated from the system. In certain embodiments,
analytical redundancies are provided by using an operational relationship between a
first component and one or more second components (e.g., valves) to generate a

reference parameter (e.g., flow) from the one or more second components that can
be compared to a corresponding operational parameter (e.g., flow) of the first
component. The reference and operational parameters can be determined based on
flow mapping techniques or other techniques. Based on the comparison between the
reference parameter and the operational parameter, it can be determined whether a
fault exists. The fault may be caused by the failure of one of many different sensors
within one node or across several nodes. Analysis (e.g., matrix based analysis) can
be used at the node level and/or at the system level to isolate (i.e., specifically
identify) the faulty sensor. Once the sensor has been isolated, the virtual reference
parameter can be used to generate a virtual signal that can be substituted into a
control algorithm for the first component in place of the faulty signal from the failed
and isolated sensor. In this way, the system can continue to operate while data from
the faulty sensor is not used in the control algorithm for the first component.
I. General Architecture Overview
Figure 1 illustrates an example fault detection, isolation and reconfiguration
(FDIR) architecture 20 in accordance with the principles of the present disclosure.
The FDIR architecture 20 is adapted to provide control of a hydraulic actuation
system of a vehicle such as a construction vehicle. In one example embodiment, the
FDIR architecture 20 can be used to control a hydraulic actuation system of a wheel
loader 22 (see Fig. 2). The FDIR architecture 20 includes a supervisory controller
24 adapted to interface with a main controller 26 of the wheel loader 50. The
supervisory controller 24 is at a supervisory control level of the hydraulic actuation
system. For example, the supervisory controller 24 supervises and interfaces with a
plurality of control nodes (e.g. control modules, control subsystems, etc.) that are at
a node level of the FDIR architecture 20. The FDIR architecture 20 is configured
such that all of the nodes report back through the supervisory controller 24. In
certain embodiments, there is no direct cross communication between the nodes.
Instead, the nodes interface vertically with the supervisory controller 24, which
functions to coordinate operation of the various nodes. As shown at Figure 1, the
nodes can include a pump control node 28, a tilt cylinder control node 30, a lift
cylinder control node 32, a boom suspension system control node 34, a tank control
unit node 36 and one or more additional auxiliary nodes 38.

Referring to Figure 3, an example node 40 is shown. It will be appreciated
that the node 40 can be representative of each of the nodes identified above. The
node 40 includes one or more components 42 (e.g. valves such as two-stage spool
valves, three-stage poppet valves, or other valves). Operation of the component 42
or components is controlled by a node controller 44. The node controller 44
interfaces with sensors 46 (e.g. pressure sensors, position sensors, etc.) that sense
parameters indicative of the operation of the component 42. Based on information
received from the sensors 46, the node controller 44 controls operation of the
component 42 or components (e.g., with a closed loop control structure). In certain
embodiments, the node controller 44 utilizes pulse with modulation control
technology to control a position of the component 42. In operation, the node
controller 44 receives commands (e.g. mode commands, operational demands, spool
position demands, pressure demands, etc.) from the supervisory controller 24. In
this way, the supervisory controller 24 ultimately controls and coordinates operation
of the node 40. Concurrently, the node controller 44 communicates with the
supervisory controller 24 by sending FDIR flags to the supervisory controller 24.
The supervisory controller 24 keeps each of the nodes apprised of the FDIR of the
other nodes.
For each of the nodes, the component 42 or components preferably control
hydraulic flow to or from a system structure 48 such as a pump, an actuator (e.g. a
hydraulic motor or a hydraulic cylinder) an accumulator or other hydraulic device.
Information relating to hydraulic fluid flow through the component 42 or
components, or to or from the system structure 48, can also be conveyed from the
node controller 44 to the supervisory controller 24. Such information can be used by
the supervisory controller 24 to allow the supervisory controller to detect faults, to
isolate faults, and/or to reconfigure the system to address faults at the supervisory
level.
The FDIR flags sent by the node controllers to the supervisory controller are
indicative of whether a fault has been detected at a given node. The FDIR flag may
indicate whether there or not the fault has been isolated at the node level. If the fault
has not been isolated at the node level, the supervisory controller 24 can use data
(e.g. flow data or information relating to faults detected at other nodes) to assist in
isolating the fault at the supervisory level.

II. Example Vehicle for Application of FDIR Architecture
Figure 2 illustrates a wheel loader 50, which is an example of a type of
construction vehicle to which aspects of the present disclosure can be applied. The
wheel loader includes a chassis or frame 52 supported on wheels 54. A cab 56 is
supported on the frame 52. A boom 58 is pivotally connected to the frame 52. A lift
cylinder 60 is used to pivot the boom 58 upwardly and downwardly relative to the
frame 52. A bucket 62 is pivotally mounted at the end of the boom 58. A tilt
cylinder 64 is used to pivot the bucket 62 relative to the boom 58.
III. Example Architecture Schematic
Figure 4 illustrates a schematic of system architecture suitable for use in
controlling the hydraulic actuation system of the wheel loader 50. The architecture
includes the supervisory controller 24 that interfaces with the pump control node 28,
the tilt cylinder control node 30, the lift cylinder control node 32, the boom
suspension system control node 34 and the tank control unit node 36 (auxiliary
nodes are not shown). The pump control node 28 (shown in more detail at Figure 5
and described at Section XV of this disclosure) controls the hydraulic fluid pressure
and flow rate needed to satisfy the flow and pressure requirements of the tilt cylinder
control node 30, the lift cylinder control node 32 and the boom suspension system
control node 34. The tank control unit node 36 receives the hydraulic fluid flow
discharged from the tilt cylinder control node 30, the lift cylinder control node 32
and the boom suspension system control node 34. The tilt cylinder control node 30
controls the hydraulic fluid flow provided to and from the tilt cylinder 64 of the
wheel loader 50. The lift cylinder control node 32 controls the hydraulic fluid flow
provided to and from the lift cylinder 60 of the wheel loader 50. The boom
suspension system control node 34 controls the hydraulic fluid flow provided to and
from an accumulator 66. The boom suspension system control node 34 also controls
fluid communication between the accumulator 66 and the lift cylinder 60.
The tilt cylinder control node 30 is in fluid communication with the one or
more pumps of the pump control node 28 and functions to selectively place a head
side 74 or a rod side 76 of the tilt cylinder 64 and fluid communication with the
pump or pumps. Similarly, the tilt cylinder control node 30 is in fluid
communication with the system tank 77 (i.e., the system reservoir) through the tank

control unit node 36 and functions to selectively place the head side 74 or rod side
76 of the tilt cylinder 64 and fluid communication with the tank 77.
The tilt cylinder control module 30 includes a head side flow control valve
Vth that selectively places the head side 74 of the tilt cylinder 64 in fluid
communication with either the system pump/pumps or the system tank. The tilt
cylinder control node 30 also includes a rod side flow control valve Vtr that
selectively places the rod side 76 of the tilt cylinder 64 in fluid communication with
either the system pump/pumps or the system tank. Valve position sensors Xth and
Xtr are provided for respectively sensing the spool positions (i.e., the sensors detect
positions of valve spools within valve sleeves) of the head side flow control valve
Vth and the rod side flow control valve Vtr. Additionally, pressure sensors Pth and Ptr
are provided for respectively sensing the head side and rod side pressures of the tilt
cylinder 64. The tilt cylinder control node 30 also includes a component controller
Ct that controls operation of the valves Vth, Vtr based on commands (e.g., mode,
pressure or spool position demands, etc.) received from a supervisory controller 24
and feedback provided by the sensors of the node. The component controller Ct also
monitors the node for failure conditions and reports any detected failure conditions
to the supervisory controller 24 as raised fault flags.
The lift cylinder control node 32 is in fluid communication with one or more
pumps of the pump control node 28 and functions to selectively place the one or
more pumps in fluid communication with a head side 70 or a rod side 72 of the lift-
cylinder 60. Similarly, the lift cylinder control node 32 is in fluid communication
with the tank 77 through the tank control unit node 36 and is configured to
selectively place the head side 70 and the rod side 72 of the boom cylinder 60 in
fluid communication with the tank 77.
The lift cylinder control node 32 includes a head side flow control valve Vth
and a rod side flow control valve Vtr. The head side flow control valve Vth is
configured to selectively place the head side 70 of the boom cylinder 60 in fluid
communication with either the one or more pumps of the pump control node 28 or
the system tank 77. The rod side flow control valve Vir is configured to selectively
place a rod side 72 of the boom cylinder 60 in fluid communication with either one
of the system pumps or the system tank 77. The lift cylinder control mode 32
further includes a head side valve position sensor Xlh for sensing a spool position of
the head side valve Vlh and a rod side valve position sensor Xlr for sensing the spool

position of the rod side flow control valve Vlr. The lift cylinder control node 32 also
includes a pressure sensor Plh2 for sensing the pressure of the head side 70 of the
boom cylinder 60, and a pressure sensor Plr for sensing the hydraulic pressure at the
rod side 72 of the boom cylinder 60. The lift cylinder control node 32 further
includes a component level controller Cl that interfaces with the various sensors of
the lift cylinder control node 32. The component controller Cl also interfaces with
the supervisory controller 24. The component controller Cl controls the operation of
the valves Vlh, Vlr based on demand signals (e.g., mode, pressure, spool position
demands, etc.) sent to the component controller Cl by the supervisory controller 24
and based on feedback provided by the sensors of the lift cylinder control node 32.
The component controller Ll also monitors the fault conditions that may arise within
the lift cylinder control node 32 and reports such fault conditions to the supervisory
controller 24 as raised fault flags.
The boom suspension system control node 34 is in fluid communication with
the one or more pumps of the pump control node 28 and is configured to selectively
place an accumulator 66 in fluid communication with the one or more pumps to
charge the accumulator 66. The boom suspension system control node 34 can also
place the accumulator 66 in fluid communication with the tank 77 and/or the head
side 70 of the lift cylinder 60.
The boom suspension system control node 34 includes a charge valve Vc and
a damping valve Vd. The charge valve Vc can be used to charge the accumulator 66
by placing the accumulator 66 in fluid communication with a pump of the pump
control node 28. The damping valve Vd is used to selectively place the accumulator
66 in fluid communication with a head side 70 of the boom cylinder 60. The boom
suspension system control node 34 further includes a charge valve position sensor
Xc that senses the spool position of the charge valve Vc. The boom suspension
system control node 34 also includes a damping valve position sensor Xd that senses
a position of the damping valve Vd. The boom suspension system control node 34
further includes a pressure sensor Pa that senses a pressure of the accumulator 66,
and a pressure sensor Pthl that senses the pressure at the head side 70 of the boom
cylinder 60. The sensors of the boom suspension system control node 34 interface
with a node controller Cbss which provides node level control of the boom
suspension system control node 34. The controller Cbss interfaces with the
supervisory controller 24 and reports fault conditions within the node to the

supervisory controller 24 as raised fault flags. The controller sends operational
commands (e.g., mode, pressure, spool position demands, etc.) to the valves.
The tank control unit node 36 includes a tank flow control valve V, that
controls system flow to the system tank 77. The tank control unit node 36 also
includes a pressure sensor Pt that senses the pressure of the system tank 77 at a
location upstream from the valve Vt. A position sensor X, senses a position of the
valve Vt. A component controller Ct is provided for controlling operation of the
valve Vt. The component controller Ct interfaces with the sensors of the mode and
also interfaces with the supervisory controller 24. Operation of the valve Vt is
controlled by the component controller Ct based on commands (e.g., mode, pressure,
spool position demands, etc.) received from the supervisory controller 24 and
feedback from the node sensors. The component controller Ct monitors operation of
the node and reports any failure conditions to the supervisory controller 24.
The FDIR architecture described above allows for fault detection at different
levels. For example, faults can be detected at the sensor level, at the component
level, at the intra-nodal level and at the inter-nodal (i.e. supervisory, system) level.
The architecture also allows for fault isolation at the sensor level, at the component
level, at the intra-nodal level and at the inter-nodal (i.e. supervisory, system) level.
Moreover, the architecture allows for reconfiguration at any or all of the above
levels.
IV. Parameter Mapping
Parameter maps can be created from empirical data or mathematical
formulas. Parameter maps can be stored in memory at either the node or supervisory
level and can be accessed by the supervisory controller or the node controllers as
parameter information is needed. Parameter maps correlate data in a graphical form
and can be used to estimate certain parameters based on other related parameters.
For example, in the case of a valve, the parameters of flow, spool position (which
indicates orifice size) and differential pressure across the valve can be correlated in
flow maps used to estimate an unknown parameter from known parameters. A flow
map for a valve is indicated by Q = map (P, X, a), where P is differential pressure
across the valve, X is the valve spool position and a is an additional variable such as
temperature. Based on the flow map, flow can be determined if the P, X and a are
known. A pressure map for a valve is indicated by P = map (Q, X, a). An example

pressure map is shown at Figure 6. Based on the pressure map, pressure can be
determined if Q, X and a are known. A spool position map is indicated by X = map
(Q, P, a). An example spool position map is shown at Figure 7. Based on the spool
position map, spool position can be determined if Q, X and a are known.
Other maps can also be used. For example, spool velocity maps define a
relationship between valve spool speed and the current of a pulse width modulation
signal used to control actuation of a solenoid used to axially move the spool within
the bore of the valve. Position maps can also define a relationship between the
position of a valve spool and the magnitude of a position demand signal used to
control movement of the spool. Pressure maps can also define a relationship
between the pressure differential across a spool and the magnitude of a pressure
demand signal used to control movement of the spool.
V. Sensor Level Fault Detection
Certain errors can be detected at the sensor level. Such errors are typically
not dependent upon variable parameters that require independent monitoring. For
example, such errors can be determined by comparing sensor readings to certain
preset or pre-established parameters, ranges or other criteria. One example of this
type of sensor fault is shown at Figure 8 where a sensor signal 130 is shown outside
the predefined range having an upper boundary 132 an a lower boundary 134.
Another example is shown at Figure 9 where the sensor generates a stationary signal
for a predetermined amount of time under circumstances where the sensor signal
should be changing. Figure 10 shows a further fault condition where the sensor
generates a predetermined amount of noise 138 corresponding to the signal. A
further example of a sensor level fault is where the sensor fails to generate any
signal at all. Figure 11 is representative of a condition where a sensor signal 140
tracks or follows an actual signal 142, but has the wrong magnitude. As long as the
sensor signal 140 stays within the predefined range of the sensor, this type of error
can be difficult to detect. In this regard, certain higher level of detection techniques
disclosed herein can be used to detect such a fault.
VI. Component Level Fault Detection
One example of fault detection that takes place at the component level is
fault detection based on closed loop position control of a valve. In this regard, for a

given valve, it is possible to estimate the spool position based on the spool position
demand commanded from the supervisory controller. For example, the spool
position can be estimated by using empirical look-up tables, position mapping, or a
second order transfer function parameter. The estimated spool position can be
compared to the spool position indicated by the position sensor corresponding to the
spool. If the estimated spool position varies from the sensed spool position by at
least predetermined amount for a predetermined time, an error flag can be raised.
Figure 12 is a schematic view showing this fault detection strategy. As shown in
Figure 12, a position closed loop transfer function 150 is used to provide a position
estimate 152 based on a position demand 154 provided by the supervisory controller.
A sensed position value 156 is subtracted from the estimated position value 152 to
provide a residual value 158. If the residual value exceeds a predetermined amount
for a predetermined time window, an error flag is raised at the respective node and is
conveyed to the supervisory controller. It will be appreciated that the above fault
detection technique can be used at the component level for any of the nodes 28, 30,
32, 34 and 36 depicted at Figure 4. For example, the fault detection technique can
be used to check the functionality of the position sensor Xth that controls the position
of the spool of the head side flow control valve V* of the tilt cylinder control node
30. A demand from the supervisory controller is received by the component
controller Q and the component controller Q, using conventional pulse width
modular control logic, generates a signal for controlling the position of the spool of
the valve Vtj,. Through position mapping, empirical data, lookup tables or other
means, it is possible to estimate the position of the spool of the valve Vth based on a
characteristic of the position demand commanded by the supervisory controller.
This estimated position is compared to the position indicated by the position sensor
Xth- If the estimated position varies from the sensed position by a predetermined
amount for a predetermined time window, an error flag is raised.
Another component level fault detection technique is based on closed loop
pressure control. Under this fault detection strategy, a pressure demand from the
supervisory controller is used to estimate a pressure for a given sensor. The pressure
can be estimated using pressure mapping techniques, empirical data, lookup tables
or formulas such as a second order pressure control transfer function. The estimated
pressure is then compared to a pressure sensed by the given sensor. If the estimated
pressure value varies from the sensed pressure value by a predetermined amount for

a predetermined time window, a fault flag can be raised. Figure 13 is a schematic
illustrating this type of technique for detecting a fault. Referring to Figure 13, a
closed loop pressure control transfer function 160 is used to estimate a pressure
value 162 for a given sensor based on a pressure demand 164 commanded by the
supervisory controller. A sensed pressure value 166 is subtracted from the estimated
pressure value 162 to generate a residual value 168. If the residual value 168
exceeds a predetermined amount for a predetermined time window, a fault flag is
generated. It will be appreciated that this type of fault detection strategy can be used
to monitor the operation of all of the pressure sensors provided in the system of
Figure 4. By way of example, in operation of the tilt cylinder control node 30, the
supervisory controller can send a pressure demand to the component controller Ct.
Based on the value of the pressure demand, the component controller Ct uses pulse
with modulation control logic to control the operation of the valve V,h so as to
achieve an estimated pressure value at the head side 74 of the tilt cylinder 64. It will
be appreciated that the estimated pressure value can be estimated based on pressure
mapping, empirical data, lookup tables or formulas such as a closed loop pressure
control transfer function. The estimated pressure value is compared to the sensed
pressure reading generated by the pressure sensor Pu,. If the sensed pressure value
differs from the estimated pressure value by a predetermined amount for a
predetermined amount of time, a fault flag is raised by the component controller Q
and forwarded to the supervisory controller.
A further example of fault detection at the component level relates to fault
detection based on the spool velocity of a spool valve. It will be appreciated that
this type of fault detection can be used in any of the valves of the system shown at
Figure 4. Using this technique, a velocity map is pre-generated that defines a
relationship between the spool velocity and the pulse width modulation (PWM)
signal (e.g., the current of the signal) generated by the component controller being
used to control operation of the valve at issue. The velocity map can take into
consideration variables such as temperature and other factors. By having a spool
velocity to PWM signal map stored in memory and readily accessible, it is possible
to estimate the velocity of the spool based on the magnitude of the PWM signal.
The estimated velocity is then compared to the calculated spool velocity based on
the readings provided by the position sensor of the spool. If the estimated velocity
varies from the calculated velocity by a predetermined amount/threshold for a

predetermined time window, a fault flag is raised by the component controller and
forwarded to the supervisory controller.
VII. Subsystem/Node Level Fault Detection
One example approach for subsystems/node level fault detection is to
estimate a "virtual" or reference flow value by leveraging an analytical redundancy,
and then comparing the reference flow value to a sensed flow value. For example,
the meter-in flow of an actuator can be used to determine/estimate the meter-out
flow of the same actuator. This type of fault detection strategy can be used to
compare flows passing through the valves Vu, and Vtf of the tilt cylinder control
node 30 as the tilt cylinder 64 is actuated. This type of control strategy can also be
used to compare flows passing through the valves V|h and V|r of the lift cylinder
control node 32 as the lift cylinder 60 is actuated. The meter-out flow of an actuator
can also be used determine a reference flow related to the meter-in flow of the same
actuator. Additionally, for an accumulator, the accumulator pressure and the rate of
change of the accumulator pressure can be used to provide a reference flow that
under normal circumstances is equal to a sensed flow passing through the a valve
controlling flow into and out of the accumulator.
Subsystem level fault detection is advantageous because any type of single
sensor failure can be detected in real time to significantly improve the system safety
and dependability. This type of sensing allows sensor faults that are difficult to
sense (e.g., dynamic offset in which the failed sensor is able to track the actual
signal), to be detected in real time. Moreover, by combining other techniques (e.g.,
signal processing, sensor level fault detection, component level fault detection,
subsystem level fault detection and system level fault detection), more than one
sensor failure can be detected.
A. Fault Detection and Reconfiguration Achieved by using Meter-in
Flows and Meter-out Flows of the Same Actuator as Reference Parameters
For certain hydraulic actuators, such as hydraulic motors and hydraulic
cylinders having equal sized piston rods on both sides of the piston head, the flow
entering the actuator will equal the flow exiting the actuator. Thus, if a single meter-
in valve provides all the flow to the actuator and a single meter-out valve receives all
of the flow out of the actuator, the flows passing through the meter-in valve and the

meter-out valve will be equal to one another. In this way, the actuator defines an
operational relationship between the meter-in valve and the meter-out valve. A flow
map (Ql = map (PI, XI, a 1)) for the meter-in valve can be used to calculate the
sensed flow through the meter-in valve. The flow through the meter-out valve can
also be calculated by using a flow map (Q2= map (P2, X2, a2))corresponding to the
meter out valve. Since the meter-out valve and the meter-in valves are both
connected to the same actuator, their calculated/estimated flows should not vary
from one another by more than a predetermined threshold. Thus, the Q2 is a
reference flow for Ql, and Ql is a reference flow for Q2. Thus, if Ql and Q2 differ
by a predetermined threshold, this indicates a sensor failure and a fault flag is raised.
If a reconfiguration for a faulty sensor is needed, the flow determined for the
related valve having operable sensors can be used to provide an estimated value for
controlling operation of the valve with the faulty sensor. For example, if a pressure
sensor corresponding to the meter-in valve fails, the reference flow Q2 calculated
from the corresponding meter-out valve can be substituted into the flow map for the
meter-in valve (Plest= map (Q2, XI, al)) to provide an estimated pressure value
PI est that can be used to operate the meter-in valve. Specifically, the estimated
pressure value Plest can be substituted into a closed loop control algorithm for
controlling operation of the meter-in valve. In this way, the faulty sensor can be
removed from the system while the system continues to operate. Similarly, if the
position sensor of the meter-in valve fails, the reference flow Q2 value calculated
from the meter-out valve can be substituted into the flow map for the meter-in valve
(XIest = map (Q2, PI, al)) and used to calculate estimated position values Xlest for
controlling operation of the meter-in valve. Specifically, the estimated pressure
value Xlest can be substituted into a closed loop control algorithm for controlling
operation of the meter-in valve. In a similar way, if the meter-out valve is faulty,
reference flow values from the meter-in valve can be used to generate estimated
sensor readings that can be substituted for the faulty sensors. In a reconfiguration
situation, a Smith Predictor can be used to remove oscillation due to time delay
associated with the time needed to make the calculations needed to derive the
estimated sensor value.
Referring to Figure 4, both the head side valve Vu, and the rod side valve Vtt
control fluid flow through the tilt cylinder 64. Because the piston includes a piston
head with a rod only at one side, the flow entering the cylinder does not equal the

flow exiting the cylinder. Instead, the flow Qr entering or exiting the rod side 74 of
the cylinder equals the flow Q, entering or exiting the head side 76 of the cylinder
multiplied by the ratio of the head side piston area Ah to the rod side piston area Ar.
The rod side piston area Ar equals the head side piston Ah area minus the cross-
sectional area of the piston rod. The relationship between the rod side flow Qr and
the head side flow of Qh provides a means for fault detection. The estimated flow
Ql through the valve V,h equals the head side flow Qh and the estimated flow across
the valvetr Q2 equals the rod side flow Qr. This establishes a mathematical
relationship between the flows Ql and Q2. Specifically, Ql should equal Q2
multiplied by Ah /Ar. Thus, Q2 x Ah /Ar is a reference flow for Ql and Ql x Ar/Ah
is a reference flow for Q2. If Ql is not within a predetermined threshold of Q2 x Ah
/Ar, then a fault exists and a fault flag should be raised. As described above, to
reconfigure the system, a reference flow value corresponding to an operable one of
the valves Vth and Vtr can be used to estimate sensed values for a failed sensor in a
faulty one of the valves Vth and Vtt. This allows real time reconfiguration of the
system in which the valves can be continued to operate with defective sensors placed
offline and replaced with virtual sensors generated from redundant/overlapping flow
relationships.
B. Accumulator Flow as a Reference Parameter
For accumulators, the accumulator pressure and accumulator pressure rate of
change determine the gas dynamics in the chamber, which is related to the
accumulator flow rate. Thus, an accumulator flow map can be generated based on
the pressure and the rate of pressure change of the accumulator. This being the case,
if the pressure and pressure rate of change of the accumulator are known, the flow
rate input into or output from the accumulator can be readily determined from the
accumulator flow map. If, at a given point in time, only one valve is used to control
the flow into or out of an accumulator, the accumulator flow determined from the
accumulator flow map can be used as a reference flow equal to the sensed flow
passing through the control valve. This relationship can be used in the boom
suspension system control node 34 to provide for subsystem level fault detection and
reconfiguration within the node 34. This type of subsystem level fault detection is
outlined at Figure 14.

As shown at Figure 14, two flows Ql and Q2 are determined. Depending on
the operating state of the node 32, the flow Ql corresponds to the calculated flow
through the valve Vc or the valve Vd. Q2 corresponds to the calculated accumulator
flow. Flow map fl corresponds to valve Vc and is used to calculate Ql when the
valve Vc is in a position where the accumulator 66 is connected to the tank 77. Flow
map f2 corresponds to valve Vc and is used to calculate Ql when the valve Vc is in a
position where the accumulator 66 is connected to the pump node 36. Flow map f3
corresponds to valve Vd and is used to calculate Ql when the valve Vd is in a
position where the accumulator 66 is connected to the head side of the lift cylinder
60. Flow map f4 is a flow map for the accumulator 66 and is used to calculate Q2.
If the difference between Ql and Q2 exceeds a predetermined flow threshold level
over a predetermined time period, then a sensor fault is detected in the boom
suspension system control node 34. Once the four flow maps described above have
been established, redundancies have provided that allow multiple flow calculations
that can be compared to determine if a fault condition has taken place. For example,
if the charge valve Vc is controlling flow to or from the accumulator, then the
calculated flow across the valve Vc as determined by the appropriate flow map fl or
f2 should equal the calculated flow exiting or entering the accumulator as
determined by the accumulator flow map f4. If the two flows Ql and Q2 do not
match within a predetermined threshold for a predetermined period of time, then a
fault flag is generated. The flow maps fl and f2 are used to estimate the flow Ql
across the charge valve Vc depending upon the position of the spool (e.g., depending
upon whether the accumulator is coupled to the pressure side or the tank side). The
flow map f3 is used to estimate the flow Ql when the boom suspension system is in
the boom suspension system mode in which the damping valve Vd places the
accumulator in fluid communication with the head side 70 of the lift cylinder 60.
Q2 is always calculated by the accumulator flow map f4. It will be appreciated that
when a fault is detected using the above-process, the source of the fault can be any
number of different sensors within the system. The architecture of the present
system allows various operational parameters to be cross-referenced to isolate the
fault to a particular sensor.
Similar to previously described embodiments, Ql is a reference flow for Q2
and Q2 is a reference flow for Ql. Thus, once a fault has been isolated to a
particular position sensor of one of the valves Vc, Vd, the flow Q2 can be substituted

into the spool position map of the faulty valve to calculate an estimated spool
position value that can be substituted into the closed loop control algorithm for the
faulty valve to allow the faulty valve to operate in a reconfigured state in which the
faulty sensor has been taken offline. In other embodiments, the system can be
reconfigured by stopping movement of the valves Vc, Vj.
If the accumulator 66 is piston style accumulator, a third redundancy in the
form of a third flow calculation Q3 can be made based on the piston velocity
(assuming a piston sensor is provided). Q3 equals the flow exiting or entering the
accumulator. Under normal operating conditions Q1=Q2=Q3. Figure 15 is a fault
isolation and reconfiguration chart for the boom suspension system node 34 when
the accumulator 66 is a piston style accumulator.
VIII. System Level Fault Detection
It will be appreciated that if the flow rate from each branch of a bigger flow
is known, adding the branch flows together will provide a reference flow value that
is representative of the total flow. For example, referring to Figure 4, the total flow
passing through the tank valve Vt equals the sum of the branch flows dispensed from
the tilt cylinder control node 30 and the lift cylinder control node 32 toward the tank
77. It will be appreciated that using flow maps of the type described above, the
flows through any one of the valves can be estimated. To identify a fault condition,
a first flow Ql through the tank valve Vt can be determined through flow mapping.
Also, flows Q2 and Q3 that respectively correspond to the flows dispensed from the
tilt cylinder control node 30 and the lift cylinder control node 32 can also be
determined using corresponding flow maps. Under normal circumstances, the sum
of the flows Q2, Q3 should equal the total flow Ql passing through the tank valve
Vt. However, if the sum of the flows Q2, Q3 are not within a predetermined
threshold of the total flow Ql passing through the tank valve V,, a fault flag is
raised.
It will be appreciated that (Q2+Q3) is a reference flow for Ql, (Q1-Q2) is a
reference flow for Q3, and (Q1-Q3) is a reference flow for Q2. Thus, once a fault
has been isolated to a particular sensor of one of the valves respective reference flow
can be substituted into the spool position map or pressure map of the faulty valve to
calculate an estimated spool position value or pressure value that can be substituted

into the closed loop control algorithm for the faulty valve to allow the faulty valve to
operate in a reconfigured state in which the faulty sensor has been taken offline.
Isolation for this type of fault can be done on the supervisory level using a
matrix analysis approach. For example, if the tank control node 36, the lift cylinder
control node 32 and the tilt cylinder control node 30 all report un-isolated faults to
the supervisory level, then the fault is a tank pressure sensor. Also, if the tank
control node 36 and the lift cylinder control node 32 report un-isolated faults and the
tilt cylinder control node 30 reports no fault, then the fault can be isolated to the lift
cylinder control node 32.
IX. Fault Detection. Isolation and Reconfiguration of an Electrohvdraulic
System with Sensing Cylinder
Figure 16 shows a fault isolation architecture 200 in accordance with the
principles of the present disclosure. The architecture 200 is adapted for controlling
actuation of a hydraulic actuator 202. The hydraulic actuator includes a cylinder
204 and a piston 206 reciprocally mounted within the cylinder 204. The piston 206
includes a piston rod 208 and a piston head 210. The cylinder 204 defines a head
side 212 and a rod side 214. The architecture 200 includes a sensor 216 for
detecting a velocity of the piston 206. It will be appreciated that the sensor 216 can
be a position sensor or a speed sensor. The architecture also includes valves for
controlling actuation of the actuator 202. The valves are depicted as including a
head side valve 220 fluidly connected to the head side 212 of the actuation device
202 and a rod side valve 222 fluidly connected to the rod side 214 of the actuator
202. The architecture 200 also includes a controller 224 capable of operating a
diagnostics and fault control algorithm. The controller 224 interfaces with a head
side pressure sensor 226, a rod side pressure sensor 228, a head side valve position
sensor 230 and a rod side valve position sensor 232. The controller 224 has access
to predefined flow maps corresponding to the valves 220, 222. A flow Ql through
the head side valve 220 can be determined by the controller 224 through the use of a
flow map for valve 220. Similarly, a flow Q2 that is an estimate of the flow across
the rod side valve 222 can be determined by a flow map of the valve 222. Since the
valves 220,222 are both fluidly coupled to the same actuator 202, a dependent
relationship is defined between the flows Ql and Q2. For example, the flow Ql
through the valve 220 equals the flow entering or exiting the head side 212 of the

cylinder 204, and the flow Q2 passing through the valve 222 equals the flow exiting
or entering the rod side 214 of the cylinder 204. Because the head side has a larger
active piston area than the rod side, the flow entering or exiting the piston side 212
of the cylinder 204 is equal to the flow entering or exiting the piston side 214 of the
cylinder 204 times the ratio of the active piston area Ah at the head side of the
cylinder 204 to the active piston area Ar at the rod side 214 of the cylinder 204. This
being the case, the flow Ql equals Q2 multiplied by Ah divided by Ar. Thus, the
relationship determined by the actuator 210 creates a redundancy that can be used to
detect faults. Specifically, if Ql and Q2 x Ah/Ar differ from one another by more
than a predetermined threshold, a fault flag is raised.
The system architecture 200 of Figure 16 can also be used to provide three
redundancies. Specifically, the sensor 216 can be used to calculate a velocity Vciyi
of the piston 206. Also, the mapped flow of the head side valve 220 can be used to
estimate a second velocity Vcyi2 of the piston 206. V^ equals the mapped flow Qh
through the head cylinder 220 divided by the head side piston area Ah. A third
velocity estimate Vcyi3 can be determined based on the mapped flow Qr for the rod
side cylinder 222. The third velocity estimate V^u for the cylinder equals Qr
divided by Ar. If any of these cylinder velocity values Vcyn , Vcyi2 and Vcyn is not
equal to the others within a predetermined threshold, then an error flag is raised.
Figure 17 shows a matrix for isolating certain fault conditions. For example,
case 1 indicates that the cylinder sensor 216 has failed. Also, case 2 indicates that
either the head side pressure sensor 226 or the head side valve position sensor 230
have failed, case three indicates that either the rod side pressure sensor 228 or the
rod side position sensor 232 has failed. Case four indicates that more than one
sensor has failed. Case five indicates no faults have occurred.
The redundancies created by the overlapping relationships also provide a
means for allowing the system to be reconfigured (see Figure 18) to isolate the failed
sensor from the system. Specifically, the faulty sensor can be taken offline and
estimated values derived from the redundancies can be used in place of the off-line
sensor. For case 1, the reconfiguration involves supporting the cylinder sensor value
in the supervisory control. In case two, if the head side pressure sensor 26 is faulty,
it can be taken offline and estimated value Ph«t can be used to control operation of
the valve 220. Phest can be derived by substituting an estimated flow value Qest and
the position sensor value Xh into the flow map for the valve 220. If the sensor 230 is

faulty, then it can be taken offline and estimated position value Xhest can be used to
control operation of the valve 220. The estimated position value Xhes, can be derived
from the flow map for the valve 220 where an estimated flow Q^, and the reading
from the pressure sensor 226 are used to derive the estimated value Xhest from the
flow map. It is noted that the estimated flow Q^ can be retrieved from either the
Vcyii or VCy|3 values. If the rod side pressure sensor 228 fails, an estimated pressure
Prest can be used to control operation of the valve 222. It will be appreciated that the
estimated pressure value Prest will be derived from a flow map using an estimated
flow Qest and the position value generated by the rod side position sensor 232.
Similarly, if the rod side position sensor 232 is faulty, it can be taken offline and
estimated position Xrest can be used to control the valve 222. The estimated position
Xrest can be derived from a flow map using an estimated flow Qest and a pressure
value sensed by the rod side pressure sensor 228. In case three, the estimated flow
Qest can be retrieved from the Vcyii and/or the Vcyi2 values.
In case four, the reconfiguration involves going to a fail safe configuration.
In case five, reconfiguration is not applicable since no faults have been detected.
X. Closed Loop Multi-Stage Valve Control and Fault Isolation
Figure 19 shows a closed looped pressure dictated control architecture for a
multistage valve. An example valve 300 is shown at Figure 20. The valve includes
a pilot stage 302 an intermediate stage 304 and a main stage 306. The closed loop
control architecture of Figure 19 has a cascaded configuration in which an inner
control loop 308 provides spool position control while an outer control loop 310
provides pressure control. Looking to Figure 19, the supervisory controller provides
a pressure demand 312 to a component controller at a node. At the component
controller, an estimated pressure value derived from the demand signal is compared
to a sensed pressure value 314. If the sensed pressure value and the estimated
pressure value are different, the component controller generates a position demand
signal 316. From the position demand signal 316, an estimated position is
generated, which is compared to a sensed spool position signal 318. If the estimated
spool position is different from the sensed spool position, the component controller
generates a PWM signal which causes movement of a spool 322 at the intermediate
stage 304. The sensed spool position value 318 is generated by a spool position
sensor 324 at the spool 322. Movement of the spool 322 causes adjustment of the

main stage 306 to alter the sensed pressure 314. The sensed pressure 314 is sensed
by a pressure sensor 326 at the main stage 306.
If the estimated position value 316 varies from the sensed position value 318
by an amount in excess of a threshold for a predetermined length of time, an error
flag is raised. Similarly, if the estimated pressure value varies from the sensed
pressure value 314 by an amount that exceeds a threshold for a predetermined
amount of time, an error flag is raised. It will be appreciated that a fault in the
position sensor 324 will cause a fault flag to be raised with respect to the pressure
sensor 326. In contrast, the pressure sensor 326 can be faulty without causing a fault
to be raised with respect to the position sensor 318. Figure 21 is a fault isolation
matrix for use in isolating the source of a fault corresponding to the closed control
architecture 301 of Figure 19. In the matrix 330, Rl represents the fault status of the
position sensor 324 and R2 represents the fault status of the pressure sensor 326. As
shown in the matrix, if Rl and R2 are both off, no fault has been detected.
However, if Rl is off and R2 is on, the fault can be isolated to the pressure sensor
326. If both Rl and R2 are on, this is indicative of a position sensor fault.
XI. Fault Detection Matrix Strategies
Figure 22 is a fault isolation matrix for the boom suspension system control
node 34. Referring to the fault isolation matrix, Rsl corresponds to a sensor level
fault for the position sensor Xc; Rs2 corresponds to a system level fault for the
pressure sensor Pacc; Rs3 corresponds to a system level fault for the sensor Xd; Rs4
corresponds to a system level fault for the sensor Pihi; Rcl corresponds to a
component level fault for the sensor Xc; Rc2 corresponds to a component level fault
for the sensor PaccJ Rc3 corresponds to a component level fault for the sensor X^
Rc4 corresponds to a component level fault for the sensor Pihi; Rc5 corresponds to
another component level fault for the position sensor Xc; and Rsysl corresponds to a
system level or subsystem level fault such as shown at Figure 14. In one
embodiment, Rc5 can be dependent upon the relationship between the speed of the
spool valve and a current of a PWM signal used to control a solenoid moving the
spool valve. As shown in the chart of Figure 22, Cases 1-8 are isolated. Cases 9
and 10 are un-isolated and can be analyzed on a system level for isolation.
Figure 23 is a fault isolation matrix for v lift cylinder control node 32. In the
fault isolation matrix, Rrslr corresponds to a sensor level fault for the position

sensor Xrh; Rs2r corresponds to a sensor level fault for the sensor Pir; Rclr
corresponds to a component level fault for the position sensor X|r; Rc3r corresponds
to another component level fault for the sensor X|r; Rsubsys corresponds to a
subsystem level fault determined between the valves Vm and V|r; Rslh corresponds
to a sensor level fault for the position sensor XK,; Rs2h corresponds to a system level
fault for the sensor P|h;, Rclh corresponds to a component level fault for the sensor
XIH; Rc3h corresponds to another component level fault for the sensor Xn,; Rsubsysh
is the same system fault as Rsubsysr; and Rsys-bss is a comparison between sensor
Pihi and P|h2- Looking to the matrix of Figure 23, section 300 represent single flag
faults isolation information, section 302 represents two flag fault isolation
information where the flags are either a sensor level fault or a component level fault,
and section 304 represents situations including a sensor or component level fault
combined with a subsystem level fault. The bottom row of the chart represents the
fault isolation status.
XII. Fault Detection System for Passive and Overrun Conditions
The lift cylinder control node 32 can operate in a passive condition and an
overrunning condition. In the passive condition, the lift cylinder 60 pushes against
the load. An example of a passive action is when the lift cylinder 60 raises the
boom. When this occurs, fluid from the system pump is directed through the valve
V|h into the head side 70 of the lift cylinder 60, and fluid from the rod side 72 of the
lift cylinder 60 is discharged through the valve V|r to tank 77. When the lift cylinder
control node 32 operates in the overrunning condition, the load pushes against the
lift cylinder 60. This would occur when a load is being lowered. During an
overrunning condition, hydraulic fluid at the head side 70 of the lift cylinder 60 is
discharged through the valve Vn, to tank 77, and hydraulic fluid from the tank 77 is
drawn through the valve Vir into the load side 72 of the lift cylinder 60. During both
conditions, it is possible for hydraulic fluid to be conveyed from the accumulator 66
through the valve Vd to the head side 70 of the lift cylinder 60, or from the head side
70 of the cylinder 60 through the valve Vd to the accumulator 66. The direction will
be dependent upon the relative pressures of the head side 70 of the cylinder 60 and
the accumulator 66. Such hydraulic fluid flow is provided for boom suspension
purposes. During an overrun condition, a net flow is directed through the valve Vt

to tank 77. Additionally, under certain circumstances, the valve V|r connects the
system pump to the rod side 72 of the lift cylinder 60 prevent cavitation.
In certain embodiments, the valves Vir, V|h can be designed with an anti-
cavitation feature that allows flow through the valves from tank 77 to the cylinder 60
even when the valves are in the closed center position. This flow rate is un-
calculatable from spool position and pressure signals.
During a passive actuation condition, flows Ql and Q2 correspond to the
head side 70 of the lift cylinder 60 and flow Q3 corresponds to the rod side 72 of the
cylinder 60. Ql equals the flow that enters the head side 70 from the system pump.
This value can be calculated from a flow map of the head side valve V|h. Q2 equals
the flow between the accumulator 66 and the head side 70 of the lift cylinder 60.
This flow can be calculated based on a flow map for the accumulator or a flow map
for the damping valve Vd. The flow Q3 proceeds to tank 77 and can be calculated
by using a flow map for the broad side valve Vir. As discussed above, it is known
that the flow into or out of the head side 70 equals the flow entering or exiting the
rod side 72 multiplied by Ah divided by Ar. Thus, assuming flow into the cylinder
has a positive sign and flow out of the cylinder has a negative side, Ql + Q2 + Q3 x
Ah /Ar should equal zero. If not, a fault flag can be raised. Thereafter, once the fault
is isolated, the above formula can be used to create a reference flow that can be
substituted into a map for the defective component to generate a virtual signal
reading can be substituted into a closed loop control algorithm for the defective
component to allow the component to continue to operate.
In an overrunning condition, the flow map for the valve Vir cannot be relied
upon because the valve V|r may be operating under un-commanded anti-cavitation
conditions. In these conditions, the flow through the valve cannot be calculated.
However, the flows through the valves Vt, V^,, Vtr, and V|h can all be calculated
using flow maps. As described previously, the flow passing through valve Vt equals
the branch flows from the tilt cylinder control node 30 and the lift cylinder control
node 32. Therefore, by subtracting the flows contributed by valves Vth, Vtr and Vir
from the total flow passing through the valve Vt it is possible to calculate the flow
through the valve V|r. This value can then be substituted into the equation described
above with respect to passive conditions, and used as another means for identifying
and reconfiguring faults. The following sections provide a more detailed description
of the above methodology:

Up stream flow: from supply pressure to work port head, Q_h,lift,pump
(>0)
• Down stream flow: from work port rod to tank pressure, Q_r,lift,tank (<0)
• Without loss of generality, Q_h.lift.pump is estimated from Ps, Ph.lift,
x_h,lift, or flow map Q_h.lift.pump(Ps, P_h,lift, xji.lift).
• Similarly, Q_r.lift,tank(Pt, P_r,lift, x_r,lift)
• According to the upstream and downstream flow correlation (i.e., the in-flow
and out flow are ratios of one another) of the lift cylinder 60, we have the
following constraint (Load Oriented Constraint (LOC))
Residual_Pass(Ps, PJi.lift, xji.lift, Pt, Pj\lift, x_r.lift) =
Residual(Q_h,lift,pump, Q_r,lift,tank)
: = Q_h,lift,pump + Q_r,lift,tank*A_h/A_r + Q_darhp=0
A sensor fault is detected if Residual(Q_h,Iift,pump, Q_r,lift,tank) is not equal to 0.
In this regard, the potential faulty sensors include Ps, Ph.lift, x_h.lift, Pt, P_r.lift,
x_r.lift. Also, "Not equal to" is defined with a threshold and the time window.
• (Load Oriented Constraint (LOC)) for overrunning condition is defined as
Residua _Overrun(Pt, PJi.lift, xji.lift, Ps, P_r.lift, x_r.lift, Pace, PJi.lift',
x_damp, xt, Pt, x_h,tilt, PJi.tilt, x_r.tilt, P_r.tilt)
Residual_Overrun(Q_h,lift,tank, Q_tcu_lift, Q_r,lift.pump, Q_damp):=
Q_h,lift,tank - (-Qjcujift + Q_r,lift,pump + A_r/A_h * Q_damp)/ (1 -
A_r/A_h) =0;
• Fault Detection: a fault is detected if Residual_Overrun is not equal to 0.
The possible faulty sensor include Pt, PJi.lift, xji.lift, Ps, Pj.lift, x_r.lift,
Pace, PJi.lift', x_damp, xt, Pt, x_h,tilt, PJi.tilt, x_r.tilt, P_r.tilt)
Q_h,lift,tank(Pt, PJi.lift, xji.lift)
Q_r,lift.pump(Ps,P_r.lift, x_r.Iift)

Q_damp: calculated by Q_damp = f(Pacc, P_h,lift', x_damp)
Q_tcu_lift: calculated by tcu flow Q_tcu(Pt, xt) minus tilt tank flow Q_tcu_tilt( Pt,
xh.tilt, Ph.tilt, x_r.tilt, P_r.tilt) by assuming that tilt service is not in anti-
cavitation mode.



If the sensors V*, V&, Vm and V|r have commanded anti-cavitation
mechanisms, then the same approach described above with respect to the passive
condition can be used to generate a relationship between components used to
identify a fault condition and provide means for reconfiguring an identified fault
condition. This approach can be used for both the passive and overrunning
conditions. Once a system fault has been detected and reconfigured, a summing
technique can be used for identifying a second sensor fault that may occur.
Specifically, if the combined flows from the tilt control module 30 and the lift
cylinder control node 32 directed toward the tank 77 are not equal the flow passing
through the valve Vt, then a fault has been detected and further reconfiguration can
be implemented as needed.
• Up stream flow: from supply pressure to work port head, Q_h,lift,pump
(>0)
• Down stream flow: from work port rod to tank pressure, Q_r,lift,tank (<0)
• Without loss of generality, flow can be estimated
• Q_h.lift.pump is estimated from Ps, P_h,lift, x_h,lift, or flow map
Q_h.lift.pump(Ps, P_h,lift, x_h,lift).
• Q_r.lift,tank(Pt, P_r,lift, x_r,lift)
• Qdamp is a function of P_h,lift\ P_acc, x_damp
According to the upstream and downstream flow correlation of a cylinder, we have
the following constraint (Load Oriented Constraint (LOC))
Residual_Pass_l(Ps, PJi.lift, xji.lift, Pt, P_r.lift, x_r.lift, P_acc, P_h,liftx_damp) =
Residual_Pass_l(Q_h,lift,pump, Q_r,lift,tank, Q_damp)
: = Q_h,lift,pump + Q_r,lift,tank* A_h/A_r + Q_damp =0
A sensor fault is detected if Residual_Pass_l is not equal to 0.
"Not equal to" is defined with a threshold and the time window.

XDI. OFF-LINE FAULT ISOLATION
In some applications and under certain scenarios, a fault condition will be
detected that cannot be isolated in real-time using the approaches described in other
portions of this disclosure. In such a case, the fault sensor must still be isolated and
located in order to determine whether any of the control algorithms should be
reconfigured for fault operation. Where real-time isolation is not possible, an off-
line approach may be used.
Referring to Figure 37, a method 600 for fault detection, isolation, and
controller reconfiguration (FDIR) is shown. In a first step 602 a fault is detected by
the control system. Fault detection may be accomplished with any of the approaches
described elsewhere in this disclosure. In a second step 604, it is determined
whether the fault can be isolated in real-time. If so, the method moves to step 602
where the fault is isolated in real-time and then to step 616 where the controller is
reconfigured. Real-time fault isolation and controller reconfiguration can be
implemented by using any of the approaches described elsewhere in this disclosure.
Additionally, steps 604 and 606 may be implemented simultaneously in that the
controller can initially attempt to isolate the fault in real-time upon detection of a
fault and, where the fault is not able to be isolated, the controller generates
determines that real-time fault isolation is not possible.
When the controller has determined that the fault cannot be isolated, the off-
line fault isolation process 608 is initiated. In a step 610, the system is placed into a
safe system state. For example, a wheel loader application, the bucket would be
lowered to the ground such that the process 608 does not cause the bucket to drop
from a raised position unexpectedly. If the lift control node of the system is not
faulty, the bucket can be lowered through normal operation, such as by positioning a
lever or joystick appropriately. Where the lift control node is faulty, an alternative
subsystem, such as a tank control unit, can be used to lower down the bucket.
Where the machine is equipped to incrementally lower the bucket by repeatedly
moving the joystick or lever between neutral and lowering positions, such an
approach can be used as well. Once the bucket is fully lowered to the ground, the
system will be in-a safe state. One skilled in the art will readily understand that
other types of work implements and system components may also need to be placed
in a safe state. For example, other types of work implements such as forks on a fork
lift or the boom on a telehandler.

Once the system is in a safe state, the controller can perform an off-line
isolation procedure in a step 612 and the diagnostics from the procedure can be
recorded into the controller in a step 614 to complete the off-line fault isolation
process 608. This information can then be used by the controller for reconfiguration
in step 616.
Referring to Figure 38, further details are shown for the off-line isolation
procedure 612 for an exemplary application where a fault is isolated for a hydraulic
system including multiple nodes, for example the systems shown in Figures 1, 4, and
24. However, it is noted that more or fewer nodes may exist on any particular
hydraulic system. As shown at Figure 38, the off-line fault isolation procedure is
first performed on the lift/tilt node in a step 620 node, then on the auxiliary work
circuit(s) node at step 622, then on the tank control unit node at step 624, then on the
electronic load sense control node at step 626, and finally on the boom suspension
system node at step 628. Each of these types of nodes is described in further detail
elsewhere in the disclosure. For a system having these nodes, the order of fault
isolation through the nodes is preferable to maximize information usage and
decision robustness.
Referring to Figure 39, an off-line procedure 629 having steps 630-638 is
shown that is applicable for implementing many of the off-line diagnostics required
for steps 620-628. Although a detailed description follows for implementing step
620, it should be understood that the general approach described for procedure 629
has broad applicability to many other systems and nodes.
At step 630 the pulse width modulation (PWM) signal to the control valve(s)
associated with the first work port is set to zero and the spool position of the valve(s)
is recorded (e.g. xl, center and x2, center where two valves are used in node). Spool
position is determined by a position sensor for each valve, such as an LVDT sensor.
At step 632, the PWM signal is set to a sufficient value to fully move the spool to
the pressure side of the valve, and the spool position (xl, pres; x2, pres) and work
port pressure (PI, pres; P2, pres) are recorded. Work port pressure is recorded by a
pressure sensor for each valve. At step 634, the PWM signal is set to a sufficient
value to fully move the spool to the tank side of the valve, and the spool position
(xl, tank; x2, tank) and work port pressure (PI,tank; P2,tank) are recorded.
Steps 630 to 634 are performed for each work port / valve in the node. There
are commonly two work ports in hydraulic lift circuits. In a step 636, additional

information is acquired relating to the node such as supply and tank pressures (Ps;
Pt), and for each valve: spool mechanical center (xl,mc; x2,mc), pressure side stop
position (xl,presstop; x2,presstop), and tank side stop positions (xl.tankstop;
x2,tankstop).
Once the above information has been acquired and stored, the control system
can then isolate the faulty sensor in a step 638 by making various diagnostic data
comparisons. For example, it can be determined that the spool position sensor for
valve 1 is faulty if xl,center is not equal to xl,mc; or if xl.pres is not equal to
xl.presstop; or if xl.tank is not equal to xl.tankstop. Likewise, the spool position
for valve 2 is fault if x2,center is not equal to x2,mc; or if x2,pres is not equal to
x2,presstop; or if x2,tank is not equal to x2,tankstop. The pressure sensor for the
first vale can be isolated as being faulty if Pl.pres is not equal to Ps and P2,pres is
equal to Ps; or if PI,tank is not equal to Pt and P2,tank is equal to Pt. Similarly, the
pressure sensor for the second valve is faulty if P2,pres is not equal to Ps and
PI,pres is equal to Ps; or if P2,tank is not equal to Pt and Pl.tank is equal to Pt. If
the faulty sensor has not been identified at this point, the supply pressure sensor Ps
can be identified as faulty if Pl.pres is equal to P2 and Pl.pres is not equal to Ps.
The tank pressure sensor Pt can be isolated as being faulty if PI,tank equals P2 and
PI,tank is not equal to Pt. It is noted that the above comparisons can be evaluated as
being true or false while taking into account a predefined threshold error value. As
stated above, the diagnostic results of the off-line isolation procedure are stored in
step 614.
If the faulty sensor has been isolated in step 620, the system can proceed to
step 616 for controller reconfiguration or continue through each node in steps 622-
628 to determine if further faults exist. If no fault is isolated in step 620, the
procedure moves to step 622 for evaluation of the auxiliary work circuits. As the
same principle used for the lift node applies to the auxiliary circuits, the isolation
procedure can be identical to that as defined in steps 636 to 638.
For the tank control unit evaluation at step 624, it will be already apparent
from the evaluation at steps 620 and 622 whether or not the supply pressure sensor
and the tank pressure sensor are faulty or not. Accordingly, steps 620 and 622 add
to the robustness of the diagnostic evaluation by providing cross-verification of the
faulty sensor. As such, it is not necessary to conduct further testing of the supply
and tank pressure sensors even though they may be associated with the tank control

unit, where one is supplied. Where a tank control unit is supplied with a control
valve, the fault isolation procedure for the valve position sensor is the same as that
outlined in steps 636-638.
With respect to the evaluation of the electronic load sense control system at
step 626, procedures similar to steps 636-638 can also be utilized to isolate spool
position sensor faults by setting the PWM output to the valves to various values for
each valve in the work and steering circuits. It is noted that the electronic load sense
control system (ELK) is shown at Figure 24. For the work circuit pressure sensor
(P4), if the PWM drives the valve spool to a high stand-by position and the work
circuit load-sense pressure is not equal to the relief valve pressure, then the work
circuit load-sense pressure sensor P4 can be isolated as being faulty. This sensor is
also faulty if the PWM drives the valve spool to a lower stand-by position and the
work circuit load-sense pressure sensor is not equal to the drain pressure. If the
work circuit load-sense pressure sensor has not been found to be faulty after the
previous two diagnostics, but the sensed pressure plus the pump margin is not equal
to the supply system pressure Ps, then the work circuit load-sense pressure sensor P4
can be isolated as being faulty.
Analysis for the steering circuit of the electronic load sense control system is
similar to that of the work circuit. If the PWM drives the spool to a high stand-by
position and the steering circuit load-sense pressure is not equal to the relief valve
pressure, then the steering circuit load-sense pressure sensor P3 is faulty.
Additionally, if the steering circuit load-sense pressure plus the pump margin is not
equal to the pressure at the outlet of the priority valve, then it can be determined that
either the steering circuit load-sense pressure sensor P3 is faulty or the pressure
sensor PI at the outlet of the priority valve is faulty. If the PWM drives the spool to
a lower stand-by position and if steering circuit load-sense pressure P3 is not equal
to the sensed pressure after the hydraulic steering unit at sensor P2, then it can at
least be determined that either P2 or P3 is faulty.
With respect to the off-line isolation procedure for the boom suspension
system (BSS) at step 628, the charge valve and damping valve pressure and position
sensors in this system can also be evaluated using a procedure generally similar to
that described for steps 630-638, with some modifications to account for an installed
accumulator system. For each of the commanded PWM positions, the BSS
accumulator pressures are recorded. When the PWM commands the charging valve

to move to the pressure side position, the accumulator pressure should be equal to
the supply pressure. When the PWM commands the charging valve to the tank side
position, the accumulator pressure should be equal to the drain pressure, although
this is generally a small value. If equality fails at either of the two valve positions,
and the supply pressure sensor is good from the previous evaluation(s), then the
accumulator pressure sensor in the BSS can be isolated as being faulty.
With respect to the damping valve in the BSS, the general approach
described is applicable. In the case where the spool is spring biased, then only two
PWM values are needed, 0 and 100%. The spool will be discretely moved to two
extreme positions. The recorded sensor values can be compared to the pre-
calibrated number stored in the controller. If the numbers do not match, then the
damping valve position sensor can be identified as being faulty. When the damping
valve is in the fully open position and the accumulator pressure sensor has not
already been found to be faulty, the pressure sensor associated with the damping
valve can be isolated as being faulty its output value does not match the accumulator
pressure sensor.
Once steps 620, 622, 624, 626, and 628 are completed, where applicable, the off-line
isolation procedure is completed and the results of the diagnostics can be recorded
into the controller. At this time off-line isolation step procedure 608 is complete and
the system can be returned to normal operation dependent upon recalibration steps
performed at step 616.
XIV. RECONFIGURATION AT LOW FLOW CONDITIONS
In some applications and under certain scenarios, calculations for providing
analytical redundancy through the estimating of flow rates (i.e. building a virtual
flow meter) will provide insufficient values for valve position and hydraulic pressure
at very low flow rates. This is primarily due to the loss of a good correlation
between flow rate, fluid pressure, and valve position below a certain flow rate into
or out of the valve. As such, the flow rate estimating methods described are not
applicable within a certain deadband of flows through the valve.
One solution for providing better estimation of the valve position and fluid
pressure at times when the flow rate is within the low flow deadband is to define a
low flow mode of operation wherein an alternative method is utilized to estimate
position and flow at these conditions.

In the low flow mode of operation, one way to provide an estimated valve
position is to define a flow threshold band having a positive threshold value and a
negative threshold value, as shown in Figure 40. This approach can provide for
three different estimated valve positions depending upon the relationship between
the demand flow rate and the bounds of the threshold band. For example, if the
demand flow rate is greater than the positive threshold value, then the position of the
valve can be estimated as a fixed value corresponding to the positive flow edge of
the deadband. Correspondingly, if the demand flow rate is less than the negative
threshold value, then the position of the valve can be estimated as a fixed value
being on the opposite edge of the deadband. If the demand flow rate is between the
positive and negative threshold values (i.e. within the threshold band), the PWM
signal to the valve can be disabled to avoid uncontrolled movements of the valve
and the position of the valve can be estimated as being zero.
Estimating position in the low flow mode of operation can be further
enhanced by adding a hysteresis between the modes of operation to avoid valve
chattering. Additionally, a configurable offset can be provided from the map edge to
increase the perceived position error and improve system speed in exiting the low
flow mode. This offset can be fixed or set as a function of flow demand. For
example a decreasing offset can be implemented as flow increases or decreases
depending upon the application. A hysteresis can also be provided on the offset to
avoid chattering.
In the low flow mode, it can be assumed that the valve poppets are closed
and that the pressure can be anything. One estimate for the pressure could simply be
the tank pressure. Another estimate for the pressure could be the supply pressure
minus the pressure margin. Depending upon which sensor is faulty in the system, it
may be preferable to use one or the other. For example, for a faulty rod side sensor
it is preferable to use the tank pressure as the estimated pressure value because this
side of the actuator will never be on the output side for an overrunning load. As
such, there is no danger of load drop. However, if this value is not made passive in
the control system, the system could get stuck in the low flow operating mode. If
the faulty sensor is the head side pressure sensor, then the estimated value should be
set to equal the system pressure minus the pressure margin. This is estimation is
equivalent to assuming an overrunning load in the downward direction which will
ensure that there is no load drop. It is assumed that the work implement will never

have an overrunning load in the upward direction. However, in other applications
where a load could be exerted from the rod side, the selection of which estimate to
use for the pressure value would be the reverse of what is described above. It is also
noted that the decision criteria for which estimate to use for the pressure sensor is
independent of the direction of the demand flow.
XV. FAULT DETECTION. ISOLATION. AND RECONFIGURATION
FOR A LOAD-SENSE PUMP APPLICATION
Referring to Figure 24, a schematic diagram is shown for a hydraulic system
500. As shown, hydraulic system 500 includes a steering circuit 502 and a work
circuit 520. Steering circuit 502 is for enabling a vehicle to be steered through the
operation of the hydraulic system, such as through a steering wheel, a joystick, or an
automated GPS based system. Work circuit 504 is for enabling any variety of work
type functions that could be performed by hydraulic actuators, such as cylinders or
hydraulic motors. For example, work circuit 504 could be used to operate hydraulic
actuators in a telehandler vehicle having lift, tilt, extend, and/or side shift functions.
As shown, steering circuit 502 includes a steering circuit pump 504 that
supplies pressurized fluid to a hydraulic steering unit 506. Hydraulic fluid pressure
and flow to the hydraulic steering unit 506 from the pump 504 are controlled
through a number of hydraulic components well known in the art. In the particular
embodiment shown, these components are: a pilot-operated main stage valve 510, a
solenoid-operated pilot stage valve 512, and a shuttle valve 514 for providing load
sense pressure to the pump 504. Steering circuit 502 additionally includes a priority
valve 508 for sharing fluid power with the work circuit 520 when excess fluid power
from pump 504 is available and needed.
As shown, work circuit 520 includes a work circuit pump 522 that provides
fluid power to a load work circuit 524. Load work circuit 524 is schematically
shown as being a fixed orifice for the purpose of simplicity. However, it should be
understood that load work circuit 524 can include single or multiple dynamic load
work circuits. For example, the load work circuit 524 could include any or all of the
circuits shown in Figure 4. Hydraulic fluid pressure and flow to the load work
circuit 524 from the pump 522 are controlled through a number of hydraulic
components well known in the art. In the particular embodiment shown, a pilot-

operated main stage valve 526 and a solenoid-operated pilot stage valve 512 are
provided.
The steering circuit 502 and work circuit 520 can also include a number of
sensors that are useful for optimizing the control of the hydraulic system 500. With
respect to the steering circuit 502, a first pressure sensor PI is provided after the
priority valve 508, a second pressure sensor P2 is provided after the hydraulic
steering unit 506, and a third pressure sensor P3 is provided after the shuttle valve
514. A position sensor XI, such as an LVDT sensor, is also provided on the main
stage valve 510. With respect to the work circuit 520, a fourth pressure sensor P4 is
provided upstream of the load work circuit 524 and a fifth pressure sensor P5 is
provided after the main stage valve 526. A position sensor X2, such as an LVDT
sensor, also provided on the main stage valve 526.
Hydraulic system 500 also includes an electronic controller 550. The
electronic controller comprises a non-transient storage medium 552, a processor
554, and one or more control algorithms 556 stored on the non-transient storage
medium and executable by the processor. The electronic controller is also
configured to communicate with a supervisory controller and/or with controllers in
other nodes of the vehicle operation system, and is referred to as an "ELK"
controller or node in other parts of the disclosure. In order to provide optimal
control of the pumps 504, 522, the aforementioned sensors PI to P4 and XI to X2
may be placed in communication with a controller 550, as can be the solenoid output
control signals to valves 512 and 528 and the output signals to pumps 504, 522. In
one embodiment, the control algorithm for the controller is configured to allow the
electronic controller to operate the hydraulic system between a non-share mode in
which pumps 504, 522 independently serve circuits 502, 520, respectively, and a
share mode in which pump 504 supplies additional fluid power to the work circuit
520.
FAULT DETECTION
In order to ensure that the hydraulic system 500 is operating sufficiently, the
electronic controller 550 can be configured to continuously or periodically monitor
for faults conditions within the system. A fault can occur is when a sensor(s)
provides a signal to controller 550 that is inaccurate, not reflective of actual
operating conditions, and/or that indicates the system is not achieving desired

performance levels. Common types of sensor faults are: noise, out of range on the
high end, out of range on the low end, stuck position, offset tracking high, and offset
tracking low (see Figures 8-11). These types of faults are applicable to both
pressure and position sensors. One way in which these types of faults can be
detected is to define conditions within the controller which will trigger a general
fault signal. Many conditions of this type can be defined that are useful for fault
detection.
The following paragraphs define fifteen exemplary conditions that constitute
a non-exclusive, exemplary list of potential conditions that could be used by
controller 550 for fault detection.
A first fault condition CI can be detected when the absolute difference
between the desired position (X_des) for valve 526 and the received signal from
sensor X2 exceeds a maximum error value for a period of time. For example, where
the maximum error value is 50 micrometers and the period of time is 0.5 seconds, a
fault will be detected if (abs(X_des - X2) > 50) for more than 0.5 seconds.
A second fault condition C2 can be detected when the absolute difference
between a calculated velocity of valve 526 based on sensor X2 signal (VEL_1) and a
calculated velocity of valve 526 based on the PWM output signal to valve 528
(VEL_2) exceeds a maximum value for a period of time. For example, where the
maximum error value is and the period of time is 0.5 seconds, a fault will be
detected where abs(VEL_l - VEL_2) > for more than 0.5 seconds.
A third fault condition C2 can be detected when the absolute value of
pressure at P4 minus pressure at P5 minus a pressure margin exceeds a maximum
error value for a period of time. For example, where the pressure margin is 15 bars
and the maximum error value is 3 bars, a fault will be detected where (abs(P4 - P5 -
15) > 3) for more than 0.5 seconds.
A fourth fault condition C4 can be detected when the pressure at P4 is less
than pressure at P5. For example, a fault will be detected if P4 > P5 for any amount
oftime.
A fifth fault condition C5 can be detected when the difference between
desired pressure (P_des) and pressure at P4 exceeds a maximum error value for a
period oftime. For example, where the maximum error value is 3 bars and the
period oftime is 0.5 seconds, a fault will be detected where abs(P_des - P4) > 3 for
more than 0.5 seconds.

A sixth fault condition C6 can be detected when the absolute difference
between design position (X_des) for valve 510 and the received signal from sensor
XI exceeds a maximum error value for a period of time. For example, where the
maximum error value is 50 micrometers and the period of time is 0.6 seconds, a fault
will be detected if (abs(X_des - XI) > 50) for more than 0.6 seconds.
A seventh fault condition C7 can be detected when the absolute difference
between a calculated velocity of valve 510 based on sensor XI signal (VEL_1) and a
calculated velocity of valve 510 based on the PWM output signal to valve 512
(VEL_2) exceeds a maximum error value for a period of time. For example, where
the maximum error value is and the period of time is 0.5 seconds, a fault will be
detected where abs(VEL_l - VEL_2) > for more than 0.5 seconds.
An eighth fault condition C8 can be detected when the pressure at P3 is less
than pressure at P2 (P3 > P2). For example, a fault will be detected if P3 > P2 for
any amount of time.
A ninth fault condition C9 can be detected when the difference between
pressure at P3 and the sum of the pressure at P2 and a pressure margin exceeds a
maximum error value for a period of time. For example, where the pressure margin
is 8 bars, the maximum error value is 2 bars, and the period of time is 0.5 seconds, a
fault will be detected if ((P3 - P 2 + 8) >= 2) for more than 0.5 seconds.
A tenth fault condition C10 can be detected when the pressure at P3 plus a
pressure margin is less than or equal to the pressure at PI for a period of time. For
example, where the pressure margin is 15 bars and the period of time is 0.2 seconds,
a fault will be detected when ((P3 + 15) <= PI) for more than 0.2 seconds.
An eleventh fault condition CI 1 can be detected when the absolute value of
pressure at P3 plus a pressure margin minus the pressure at PI is greater than a
maximum error value for a period of time. For example, where the pressure margin
is 15 bars, the maximum error value is 5 bars, and the period of time is 0.2 seconds,
a fault will be detected when (abs(P3 + 15 - PI) <= 5) for more than 0.2 seconds.
A twelfth fault condition CI2 can be detected when the pressure at PI minus
the pressure at P2 minus a pressure margin is less than zero for a period of time. For
example, where the pressure margin is 15 bars and the period of time is 0.2 seconds,
a fault will be detected when (PI - P2 - 15) < 0 for more than 0.2 seconds.
A thirteenth fault condition C13 can be detected when the pressure at PI is
more than a maximum pressure value or less than a minimum pressure value

indicating that the pressure signal is out of range. For example, where the maximum
pressure value is 300 bars and the minimum pressure value is 0 bar, a fault will be
detected when PI > 300 or when PI < 0.
A fourteenth fault condition C14 can be detected when the pressure at P2 is
more than a maximum pressure value or less than a minimum pressure value
indicating that the pressure signal is out of range. For example, where the maximum
pressure value is 300 bars and the minimum pressure value is 0 bar, a fault will be
detected when P2 > 300 or when P2 < 0.
A Fifteenth fault condition CI5 can be detected when the pressure at P3 is
more than a maximum pressure value or less than a minimum pressure value
indicating that the pressure signal is out of range. For example, where the maximum
pressure value is 300 bars and the minimum pressure value is 0 bar, a fault will be
detected when P3 > 300 or when P3 < 0.
As stated above, any number of fault conditions may defined for the
hydraulic system 500. Additionally, the fault conditions may be stored in a table or
matrix 560 within controller 550, as shown in Figure 25. A detailed example of
table 560 is provided at Figure 26. This map can be referred to by controller 550
such that the appropriate fault condition code may be generated when a fault
condition is detected.
FAULT ISOLATION
Once a fault condition has been detected and a fault code has been generated,
the sensor responsible for causing the fault can be isolated during the normal
operation of the vehicle associated with hydraulic system 500 without interruption.
Where only one sensor is associated with a particular fault condition code and where
that particular fault condition is the only condition for which a fault is indicated, the
responsible sensor will be readily apparent. For example, where only fault
conditions CI3, CI4, or CI 5 are detected, it can be ascertained that the fault can be
isolated to sensors PI, P2, or P3, respectively. However, where fault conditions
involve multiple sensors and/or where multiple fault conditions are detected, fault
isolation becomes more complicated. Additionally, certain sensor failure types from
a single sensor can trigger multiple fault conditions.
Referring to Figure 25, primary fault isolation matrices 562, 564 are shown.
These matrices correlate sensor faults, for example faults relating to PI - P5 and XI

- XI, to the defined fault conditions codes, for example C1 to C15. Detailed
examples of matrix 562 and matrix 564 are presented at Figures 26 and 27,
respectively. For each sensor, faults for noise, out of range on the high end, out of
range on the low end, stuck position, offset tracking high, and offset tracking low are
shown. Two different primary matrices are utilized because the system, as
configured, is capable of running in the non-flow share mode (matrix 562) and in the
flow share mode (matrix 564) which changes the relationship among the sensors.
As such, the controller 550 will refer to the appropriate matrix based on the current
operating mode of the hydraulic system 500. It should be noted that fewer or more
primary fault isolation matrices may be provided based on the number of systems
and subsystems that are interacting with each other, and that the disclosure is not
limited to using two matrices.
Using the primary matrix it is possible to identify certain faults when a fault
condition is detected. For example, and as stated above, where only condition CI3
is detected, the matrix shows that sensor PI is responsible for the fault. Further
resolution as to the nature of the fault can be provided by using sensor level fault
detection (discussed in other portions of this disclosure) in combination with the
fault conditions identified in the matrices.
However, other cases require a more refined analysis. For example, in the
case where fault conditions CI 1 or CI2 are detected when the system is in the non-
flow share operating mode, it can be seen that the fault could be due to up to any of
the four sensors associated with the steering circuit, PI, P2, P3, or XI. The analysis
is further complicated where multiple fault conditions are simultaneously detected.
As such, the primary fault isolation matrix may be unable to isolate certain faults
depending upon how the fault conditions are defined. Where such a condition
exists, a further analysis is required.
Referring to Figure 25, secondary fault isolation matrices 566, 568 are
provided for the non-flow and flow share modes, respectively. A detailed example
of matrix 566 can be found at Figure 29 while a detailed example of matrix 568 can
be found at Figure 30. The secondary fault isolation matrix is for isolating those
faults that cannot be isolated by the primary fault isolation matrix by correlating the
fault isolation codes, for example CI-CI 5 to a plurality of scenarios consisting of
different patterns of detected fault conditions. In the embodiments shown, thirteen
scenarios of different fault patterns are included. However, it should be appreciated

that more or fewer scenarios could be included to provide coverage over fewer or
more potential fault patterns.
By operating the system under various conditions with known faults in the
system, or through modeling, certain patterns of fault conditions can be associated
with a specific sensor fault. For example, and with reference to Figure 29
specifically, it can be seen that scenario 2 reflects the state where fault conditions
C8, C9, CI 1, CI2, and C14 have been detected and are correlated to a fault
condition with sensor P2. Accordingly, some faults for which isolation by the
primary isolation matrix is indeterminate can be isolated with matrices 566, 568 if
the matrices include the same pattern of detected fault conditions. It is noted that
matrices 566 and 568 do not include scenarios for which faults can be isolated
through the use of the primary fault isolation matrices 564, 565.
Where a fault cannot be isolated using the above described approach, an off-
line fault isolation procedure may be implemented. A detailed description for off-
line fault isolation for hydraulic systems, including for the hydraulic system 100
shown in Figure 24 is provided in another portion of the disclosure. Accordingly,
fault detection and reconfiguration for hydraulic system 100 be implemented in
conjunction with either the real-time isolation approach described in this section or
the off-line approach described elsewhere. Furthermore, the real-time isolation
approach may be utilized first, and if found to be indeterminate, the off-line
approach may be then used. Also, a residual based isolation approach (e.g. see
Figures 22 and 23) may also be used in conjunction with or instead of the fault
isolation matrices discussed above.
RECONFIGURATION
Once a fault has been detected and isolated, it is possible to reconfigure the
nominal control algorithms stored in controller 550 of the hydraulic system 500 such
that adverse effects of the faulted sensor can be mitigated. In one embodiment,
analytical redundancy (discussed in further detail in other sections of this disclosure)
is utilized to develop a virtual signal for a faulted sensor. This virtual signal can
then be used as a replacement value in the nominal control algorithms present in
controller 550. In one embodiment, the nominal control algorithm is replaced with a
reconfigured control algorithm that does not rely upon a value relating to the faulted
sensor.

In one embodiment, and as shown at Figure 31, a first nominal control
algorithm 570 is stored on controller 550 for controlling the steering circuit.
Algorithm 570 is utilized when there are no faults detected in relation to the sensors
relating to the steering circuit 502. The following paragraphs describe potential
reconfigurations to the nominal control algorithm based on various fault conditions.
Still referring to Figure 31, a first reconfigured control algorithm 572 is
shown. When a fault condition is detected and isolated to sensor P2, the nominal
steering circuit control algorithm 570 will provide inadequate control as the Pen-
equation explicitly relies upon the input value for sensor P2. Accordingly, the first
reconfigured control algorithm 572, which does not rely upon a value for sensor P2,
can be utilized for the steering circuit control instead of the nominal control. When
this occurs, the steering circuit 502 is operating in a reconfigured state.
In the event that a fault is detected and isolated to sensor P3, the nominal
control algorithm 570 may be replaced by a second reconfigured control algorithm
574, as shown at Figure 107. Second reconfigured control algorithm 574 does not
explicitly rely upon a value for sensor P3, and therefore will provide better
performance for the steering circuit 502 in the event of a fault with sensor P3.
Where a fault condition occurs with sensor XI, a third reconfigured control
algorithm 576 can be utilized. Algorithm 576 can use the same control as for
algorithm 570, but slower response times will occur. Alternatively, the reconfigured
algorithm 576 can place the steering circuit 502 into a low stand-by mode in which
lower a lower level of functionality is provided, but with better assurance of steering
stability and performance. Where a fault condition occurs with sensor PI, no
reconfiguration is necessary and the nominal control algorithm 570 can continue to
. be used. Reconfiguration for this sensor, in the embodiment shown, is not necessary
since the output from the signal is not a variable in the nominal algorithm 570. It is
noted that any number of reconfigured control algorithms may be placed in
controller 550, and that the use of a particular reconfigured control algorithm may be
based on a number of variables and conditions that can be defined within the
controller 550.
The work circuit 504 may also utilize reconfigured control algorithms
instead of the nominal control where a fault is detected and isolated to sensor P4 or
X2. With reference to Figure 32, a nominal work circuit control algorithm 580 is
shown. If a fault is detected and isolated to sensor P5 a fourth reconfigured control

algorithm 582 may be utilized. Although reconfiguration is not required for a fault
with sensor P5, the value from sensor P4, in combination with the pump margin
value, may be used in the DP equation to provide an alternative means of providing
an estimated value for the P5. This reconfiguration strategy will provide a response
time that is close to that achieved during normal operation.
If a fault is detected and isolated to sensor X2, a fifth reconfigured control
algorithm 584 may be utilized. Algorithm 584 includes the same Perr calculation,
however the value for X2 is estimated through the use of an estimation algorithm.
In one embodiment, the estimation algorithm includes a calculating a discrete
derivative, a flow estimate, an area estimate, and utilizing an map to correlate area
and position. As an estimating calculation introduces a time delay into the control
system, a Smith Predictor may be utilized for enhanced control. Various other
estimating algorithms known in the art may be used for estimating a value for sensor
X2 in algorithm 584.
Referring to Figures 33 to 36, example graphs are provided to show the
result of the above described fault detection, isolation, and reconfiguration approach.
The graphs shown in Figures 33-36 relate to a fault occurring with sensor X2.
Figure 33 shows normal operation in which no faults are detected and control
algorithm 580 is being relied upon. Figure 34 shows a fault occurring at 1.25
seconds where it can be seen that control performance is significantly degraded
when algorithm 580 is still in place. Figure 35 shows enhanced performance once
the controller 550 has detected and isolated the fault with sensor X2 and has
accordingly switched to operation with control algorithm 584 wherein XI is
estimated using an estimation algorithm. Figure 36 shows further enhanced
performance where the estimation algorithm further includes the use of a Smith
Predictor.
As can be readily appreciated, the above described fault detection, isolation,
and reconfiguration approach can result in significantly improved performance in a
fault condition, as compared to a system that continues to operate in the same mode
when a fault occurs. Furthermore, this approach provides a real-time solution in
which the operation of the vehicle is not interrupted during any part of the process.
It is also noted that different reconfiguration algorithms may be defined for the same
sensor fault and utilized in different modes of operation, such as the flow sharing
and non-flow sharing modes.

We Claim:
1. A control system for controlling a hydraulic actuation system of a
construction vehicle, the control system comprising:
supervisory controller adapted to interface with a main controller of the
construction vehicle, the supervisory controller being at a supervisory control level
of the hydraulic actuation system;
a plurality of control nodes that interface with the supervisory controller, the
control nodes including pressure and position sensors, the plurality of control nodes
including:
a first actuator control node for controlling operation of a first
hydraulic actuator;
a second actuator control node for controlling operation of a second
hydraulic actuator;
a pump control node; and
wherein the control system has a fault detection architecture in which faults
are detected within the control nodes at: a) a sensor level; b) a component level; and
c) a subsystem level.
2. The control system of claim 1, wherein at least some faults are isolated at the
supervisory control level.
3. The control system of claim 1, wherein the construction vehicle is an
excavation vehicle having a boom with a pivotal component, wherein the first
hydraulic actuator comprises a boom lift cylinder for raising and lowering the boom,
and wherein the second hydraulic actuator comprises a pivot cylinder for pivoting
the pivotal component of the boom.
4. The control system of claim 3, wherein the excavation vehicle is a wheel
loader.
5. The control system of claim 3, wherein the plurality of control nodes
includes a boom suspension system control node.

6. A method of operating a control system for a hydraulic circuit in a vehicle
comprising the steps of:
a. receiving input signals from a plurality of sensors in the hydraulic
circuit;
b. executing a first control algorithm to generate output signals to a
plurality of control components in the hydraulic circuit, the first
control algorithm incorporating at least some of the sensor input
signals;
c. detecting a fault condition in the control system relating to a sensor or
control component associated with the execution of the first control
algorithm;
d. isolating the fault condition by identifying a faulty sensor or control
component responsible for the fault condition; and
reconfiguring the controller to execute a second control algorithm instead of
the first control algorithm, the second control algorithm excluding the faulty sensor
or control component, wherein the second algorithm uses analytical redundancies to
create a virtual sensor or control component that replaces the faulty sensor or control
component.
7. A method for controlling a hydraulic actuation system, the method
comprising:
generating a first operating parameter for a first component;
generating a second operating parameter for one or more second
components, the second operating parameter being mathematically related to the
first operating parameter; and
comparing the first and second operating parameters to identify a fault
condition.
8. The method of claim 7, wherein if a sensor corresponding to the first
component fails, further comprising using the second operating parameter as a
reference parameter in place of the first operating parameter to reconfigure the
hydraulic actuation system.

9. The method of claim 8, wherein the second operating parameter is used to
generate a virtual signal that replaces a signal from the failed sensor in a control
algorithm that controls operation of the first component.
10. The method of claim 7, wherein the first and the one or more second
components are operationally related by a common hydraulic actuator.
11. The method of claim 10, wherein the first and the one or more second
components are meter-in and meter-out valves of the common hydraulic actuator,
and wherein the first and second operating parameters include calculated flow
values.
12. The method.of claim 7, wherein the first and the one or more second
components include an accumulator and a valve that controls flow to and from the
accumulator.
13. The method of claim 7, wherein the first component includes a first valves,
and the one or more second components include multiple valves that cooperate to
provide flow to the first valve, wherein a combined flow of the multiple valves is the
second operating parameter and a calculated flow through the first valve.
14. A method of configuring a controller for a hydraulic system, the method
comprising:
a. defining a plurality of sensor inputs in the controller;
b. defining a nominal control algorithm in the controller for operating
the hydraulic system that relies upon the plurality of sensor inputs;
c. defining a plurality of fault conditions in the control system, each
fault condition having predefined parameters for allowing the controller
to detect a fault in one of the plurality of sensor inputs;
d. defining a correlation between the plurality of fault conditions to the
plurality of sensors such that a fault caused by one of the plurality of
sensors can be isolated upon the detection of the fault condition without
interrupting execution of the nominal control algorithm; and

e. defining a reconfigured control algorithm in the controller for
replacing the nominal control algorithm when a faulty sensor is
isolated by the controller, the reconfigured control algorithm
excluding input from an isolated faulty sensor.
15. The method of claim 14, wherein the step of defining a correlation between
the plurality of fault conditions to the plurality of sensors includes defining a
primary fault isolation matrix for which at least some fault conditions can be
isolated.
16. The method of claim 15, wherein the step of defining a correlation between
the plurality of fault conditions to the plurality of sensors further includes defining a
secondary fault isolation matrix for which at least some fault conditions that cannot
be isolated by the primary fault isolation matrix can be isolated.
17. The method of claim 16, wherein the secondary fault isolation matrix
correlates unique patterns of fault condition scenarios to a fault relating to a
particular sensor.
18. The method of claim 14, wherein the hydraulic system includes a work
circuit and a steering circuit.
19. A method of configuring a controller for a hydraulic system, the method
comprising:
a. defining a plurality of sensor inputs in the controller;
b. defining a nominal control algorithm in the controller for operating
the hydraulic system that relies upon the plurality of sensor inputs;
c. defining a plurality of fault conditions in the control system, each
fault condition having predefined parameters for allowing the controller
to detect a fault in one of the plurality of sensor inputs;
d. defining a real-time fault isolation procedure by correlating the
plurality of fault conditions to the plurality of sensors such that a fault
caused by one of the plurality of sensors can be isolated upon the

detection of the fault condition without interrupting execution of the
nominal control algorithm;
e. defining an off-line fault isolation procedure for interrupting the
operation of the hydraulic system and isolating a faulty sensor when the
faulty sensor cannot be isolated by the real-time fault isolation procedure;
and
f. defining a reconfigured control algorithm in the controller for
replacing the nominal control algorithm when a faulty sensor is
isolated by either of the real-time or off-line fault isolation
procedures, the reconfigured control algorithm excluding input from
the faulty sensor.
20. The method of claim 19, wherein the step of defining a correlation between
the plurality of fault conditions to the plurality of sensors includes defining a
primary fault isolation matrix for which at least some fault conditions can be
isolated.
21. The method of claim 20, wherein the step of defining a correlation between
the plurality of fault conditions to the plurality of sensors further includes defining a
secondary fault isolation matrix for which at least some fault conditions that cannot
be isolated by the primary fault isolation matrix can be isolated.
22. The method of claim 21, wherein the secondary fault isolation matrix
correlates unique patterns of fault condition scenarios to a fault relating to a
particular sensor.
23. The method of claim 19, wherein the hydraulic system includes a work
circuit and a steering circuit.
24. A method of operating a control system for a hydraulic circuit in a vehicle
comprising the steps of:
a. receiving input signals from a plurality of sensors in the hydraulic
circuit;

c. detecting a fault condition in the control system relating to a sensor or
control component associated with the execution of the first control
algorithm;
d. implementing a real-time isolation procedure to identify a faulty
sensor or control component responsible for the fault condition without
interruption into the execution of the first control algorithm; and
e. reconfiguring the controller to execute a second control algorithm
instead of the first control algorithm, the second control algorithm
excluding the faulty sensor or control component, wherein the second
algorithm uses analytical redundancies to create a virtual sensor or
control component that replaces the faulty sensor or control component.
25. The method of claim 24, further comprising implementing an off-line fault
isolation procedure for interrupting execution of the first control algorithm when the
faulty sensor after the step of implementing the real-time isolation procedure when
the real-time isolation procedure fails to isolate a faulty sensor.
26. A hydraulic actuator control system for a piece of construction equipment
including a boom and a bucket pivotally connected to the boom, the piece of
construction equipment including a lift cylinder for raising and lowering the boom
and a tilt cylinder for pivoting the bucket relative to the boom, the actuator control
system comprising:
a tilt cylinder control node including a head side tilt valve adapted to
be in fluid communication with a head side of the tilt cylinder and a rod side tilt
valve adapted to be in fluid communication with a rods side of the tilt cylinder, the
tilt cylinder control node further including a first head side spool position sensor
corresponding to the head side tilt valve, a first rod side spool position sensor
corresponding to the rod side tilt valve, a first head side pressure sensor for sensing a
pressure of the head side of the tilt cylinder, and a first rod side pressure sensor for
sensing a pressure of the rod side of the tilt cylinder;
a lift cylinder control node including a head side lift valve adapted to
be in fluid communication with a head side of the lift cylinder and a rod side lift
valve adapted to be in fluid communication with a rods side of the lift cylinder, the
lift cylinder control node further including a second head side spool position sensor

corresponding to the head side lift valve, a second rod side spool position sensor
corresponding to the rod side lift valve, a second head side pressure sensor for
sensing a pressure of the head side of the lift cylinder, and a second rod side pressure
sensor for sensing a pressure of the rod side of the lift cylinder;
a control system that uses a first fault detection algorithm for
detecting a fault in the tilt cylinder control node, the first fault detection algorithm
including a first flow value corresponding to flow through the head side tilt valve
and a second flow value corresponding to flow through the rod side tilt valve; and
the control system also using a second fault detection algorithm for
detecting a fault in the lift cylinder control node, the second fault detection
algorithm including a third flow value corresponding to flow through the head side
lift valve and a fourth flow value corresponding to flow through the rod side tilt
valve.
27. The hydraulic actuator control system of claim 26, further comprising a
boom suspension system control node including an accumulator in selective
communication with the head side of the lift cylinder, wherein a fifth flow value
corresponding to flow between the accumulator and the head side of the lift cylinder
is used in the second fault detection algorithm.
28. The hydraulic actuator control system of claim 27, further comprising a tank
control node for controlling flow between a tank and the lift cylinder and tilt
cylinder control nodes, wherein a sixth flow value corresponding to flow through a
tank valve of the tank control unit is included in the second algorithm, and wherein a
seventh flow value corresponding to flow between the tilt cylinder control node and
the tank valve is included in the second algorithm.
29. The hydraulic actuator control system of claim 28, wherein the fourth flow
value is calculated from the third flow value, the sixth flow value and the seventh
flow value.
30. The hydraulic actuator control system of claim 29, wherein the rod side lift
valve includes a non-command actuated anti-cavitation feature.

31. The hydraulic actuator control system of claim 26, wherein the control
system uses a first re-configuration algorithm for the head side tilt valve that
includes the second flow value, and wherein the control system uses a second re-
configuration algorithm for the rod side tilt valve that includes the first flow value.
32. The hydraulic actuator control system of claim 31, wherein the control
system uses a third re-configuration algorithm for the head side lift valve that
includes the fourth flow value, and wherein the control system uses a fourth re-
configuration algorithm for the rod side lift valve that includes the third flow value.
33. The hydraulic actuator control system of claim 26, wherein after a fault has
been re-configured, the control system uses a third fault detection algorithm
including a fifth flow value corresponding to flow through a tank valve fluidly
connected to the tilt cylinder control node and the lift cylinder control node.