Piero Baraldi
email: piero.baraldi@polimi.it

Antonio Cammi
email: antonio.cammi@polimi.it

Francesca Mangili
email: francesca.mangili@mail.polimi.it

Enrico Zio
email: enrico.zio@polimi.it.

An ensemble

come

Introduction

When a fault occurs in a sensor whose measurements are used for the control of an industrial process, a repair action must be promptly initiated since the use of incorrect information by the controller could compromise the correct functioning of the process, with potential fallbacks both on production and safety. In this context, on-line monitoring methods can provide an indication of the health of the sensors and supply an early warning of incipient faults, thus enabling to assess the reliability of the measurement and to opportunely plan the sensor maintenance. Additionally, for continuing operation while reparation is performed, the erroneous measurements should be substituted by accurate estimates of the signal true values.

The main objective of this work is to devise an on-line monitoring scheme to reduce the effects of sensor faults on the process control, by detecting the faults and by reconstructing the correct signal values. Three steps are envisaged: (a) validate the sensor measurements, (b) detect and identify faults and (c) reconstruct the correct values of the faulty signals. Steps (a) and (c) can be performed by resorting to a model that generates estimates of the correct sensors signal values based on actual readings and correlations among them; step (b) can be performed by a fault detection and identification module which determines, as early as possible, whether the sensors are behaving anomalously and identifies the faulty ones among them.

Concerning the development of a signal validation and reconstruction model, a common approach is that of using auto-associative models [START_REF] Hoffmann | Signal Grouping Algorithm for an Improved On-line Calibration Monitoring System[END_REF][START_REF] Holbert | An Integrated Signal Validation for Nuclear Power Plants[END_REF][START_REF] Roverso | Solutions for plant-wide on-line calibration monitoring[END_REF]. The practical problem, however, is that a single auto-associative model cannot handle the multiplicity of signals measured on a real plant [START_REF] Baraldi | Genetic algorithms for signal grouping in sensor validation: a comparison of the filter and wrapper approaches[END_REF][START_REF] Fantoni | Multiple-Failure Signal Validation in Nuclear Power Plants using Artificial Neural Networks[END_REF]0Fantoni et al., 2003;[START_REF] Zio | Genetic Algoritms for Grouping of Signals for System Monitoring and Diagnostics[END_REF]. A possible way to overtake this limitation is to subdivide the signals into small overlapping groups, develop an ensemble of models, one for each group, and finally combine their outcomes. Key to building of the ensemble is the diversity of the individual models. In the approach investigated in this work, diversity is promoted by randomly generating the signals groups according to the Random Feature Selection Ensemble (RFSE) technique [START_REF] Bryll | Attribute bagging: improving accuracy of classifiers ensembles by using random feature subsets[END_REF]; this is a completely random technique in which no optimization of the composition of the individual groups is sought, i.e., no relevance is given, for example, to the correlation between the signals in the groups or to their capability of reconstruction. The groups thereby created are used to develop a corresponding number of signal validation and reconstruction PCA models [START_REF] Jolliffe | Principal Component Analysis[END_REF][START_REF] Diamantaras | Principal component neural networks: theory and applications[END_REF][START_REF] Scholkopf | Kernel principal component analysis[END_REF][START_REF] Moore | Principal component analysis in linear systems: Controllability, observability, and model reduction[END_REF]. The outcomes of different models are then aggregated using a LF method [START_REF] Baraldi | A procedure for the reconstruction of faulty signals by means of an ensemble of regression models based on principal components analysis[END_REF][START_REF] Bonissone | Fast meta-models for local fusion of multiple predictive models[END_REF]. To improve the accuracy of the reconstruction, past signal measurements are used as further input to the models and the reconstruction of the faulty signals is iterated until satisfactory convergence.

The detection and identification of a sensor fault can be achieved by comparing the actual sensor measurements with the signal values estimated by the signal validation and reconstruction model; in this work, the Sequential Probability Ratio Test (SPRT) which considers the statistical properties of the residual, i.e. the difference between the measurements and their estimation, is used.

The proposed approach has been applied to a case study concerning the level and pressure control in the pressurizer of a PWR nuclear power plant. In order to test the effectiveness of the described procedure, faults have been added to sensors whose signals are simulated using a Matlab SIMULINK model of the pressurizer. Upon fault detection, the reconstructed value of the faulty signal is used by the controller to decide the control action. A comparison is made of the control performance obtained when feeding the controller with the measurements coming from the faulty sensor or the reconstructed values.

The remaining parts of the paper are organized as follows. Section 2 states the problems of fault detection, identification and signal reconstruction in the frame of process control; Section 3 describes the signal validation module, recalling briefly the RFSE and LF techniques; Section 4 describes the SPRT technique implemented in the fault detection module; Section 5 presents the results from a set of experiments concerning the control of a simulated PWR pressurizer in presence of faults of the sensors; finally, Section 6

presents the conclusions and describes potential future directions of research.

Sensor fault detection, identification and signal reconstruction for process control

The objective of a controller is to correct the mismatch between the true values T

NO FAULT FAULT

Fault detection module

Signals time series

(t) (t) (t) n i 1 f ,..., f ,... f n i f f f ,..., ,... ˆ1 T i f î f I I 1 n i T f ,..., f ,..., f ˆn i T 1 f ,..., f ,..

., f ˆ

In order to catch the dynamic evolution of the system and increase the robustness of the method, the set of

) T t ( f ),..., t ( f i i  1
measured in a sliding window of T previous time instants (Fig. 2).

Fig. 2: inputs and outputs of the signal validation and reconstruction model. [START_REF] Chevalier | Assessment of statistical and classification models for monitoring EDF's assets[END_REF]: at each iteration j , the i -th input to the signal validation and reconstruction model is the reconstructed value

1 j i f  ˆ
of the faulty signal i f obtained at the previous iteration 1  j . After the iterations are completed, the reconstructed value ) t ( f ˆT i is used as corrected input to the signal validation and reconstruction model, and also to the controller if i f is one of its inputs, in substitution of the erroneous measurement until maintenance of the faulty sensor is performed.

3 Signal validation and reconstruction model

The Random Feature Selection Ensemble approach

Signal validation and reconstruction model

T) (t 2) (t 1) (t 1    1 1 f ,..., f , f T) (t 2) (t 1) (t    2 2 2 f ,..., f , f T) (t 2) (t 1) (t n n n    f ,..., f , f (t) n f (t) 2 f (t) 1 f (t) 1 f  (t) 2 f  (t) n f
Fig. 3 reports a sketch of the flow of modelling for signal reconstruction. A set of

) (T n n T 1    signals ) T t ( f ),..., t ( f ), t ( f i i i  1
, n ,..., i 1  is available for building the signal validation and reconstruction model.

Given the typically large value of T n , a single model cannot perform the reconstruction task with the desired accuracy and reliability; then, the signal set must be partitioned into subsets, for each of which a reconstruction model is built. Actually, in the ensemble approach here proposed the subsets of signals are overlapping (i.e., two subsets may contain signals which are the same), a PCA model is built for each subset and the reconstruction of a signal contained in different models is obtained by aggregating their outcomes, within an ensemble approach. , each constituted by m signals [START_REF] Bryll | Attribute bagging: improving accuracy of classifiers ensembles by using random feature subsets[END_REF]. This guarantees high signal diversity in the overlapping groups upon which the PCA models are built and allows for rapid construction of the signal groups. Furthermore, randomly selecting the signals in the groups with a reasonable choice of the group size parameters m and H , can basically guarantee coverage of all the signals in the ensemble with adequate redundancy (Aly and Atiya, 2006;[START_REF] Bryll | Attribute bagging: improving accuracy of classifiers ensembles by using random feature subsets[END_REF].

As mentioned above, the H diverse signal groups generated are used as bases for developing a corresponding number of PCA validation and reconstruction models. To do this, the data set X of N signal patterns available is partitioned into a training set TRN X (made of TRN N patterns) and a test set TST X (made of TST N patterns); the former is used to train the individual models, whereas the latter is used to verify the ensemble performance in the signal reconstruction task in order to determine the optimal values of parameters m and H (Baraldi et al., 2009a). The models thus obtained are then used online for the signal validation and reconstruction process.

Each signal i f is present in a number i H of groups and thus a corresponding number of individual PCA models provide its reconstruction. Different methods can be used to aggregate the outcomes of these individual models in the ensemble, in order to get the final reconstructed value. In this work a local fusion strategy has been adopted.

Local fusion strategies for models outcome aggregation

Different techniques have been proposed for the aggregation of the outcomes of multiple models (Baraldi et al., 2009b;[START_REF] Bonissone | Fast meta-models for local fusion of multiple predictive models[END_REF]. In general, the aggregation of the models outcomes requires to associate a

       h i h i f | h h i f | h h i h i h i i w ) b f ( w f ˆF F (1)
The most common technique is the simple mean which assigns the same value to all weights and set to zero the bias corrections, i.e. w w h i  and

0 b h i  ,  n ,.., i 1  and i H ,..., h 1  .
In (Baraldi et al., 2009b) it has been shown that the ensemble performance can be increased if both the bias corrections h i b and the weights The main steps of the local fusion process are:

1) Retrieve a set TRN Q of neighbours of the pattern under reconstruction from the set of training patterns.

According to the k -nn-based neighbourhood approach here adopted [START_REF] Bonissone | Fast meta-models for local fusion of multiple predictive models[END_REF], TRN Q is formed by the k training patterns nearest to the test pattern (Fig. 5). The optimal number k of nearest neighbours to be considered is obtained verifying the LF performance on the test set TST X . 2) Associate a weight and a bias to each individual model of the ensemble depending on its reconstruction accuracy on the retrieved neighbours. According to (Baraldi et al., 2009b), the local bias correction h i b and the local weight h i w to be assigned to model h in the reconstruction of signal i f are set equal to:

Time instant t { f 1 (t), …, f n (t) } w i h , b i h w i 17 , b i 17 w i 5 , b i 5
Mod. 17 estimate the weights will also account for the robustness of the model, thus keeping us from assigning high weights to models whose outstanding performance on the training set is not due to their real quality, but rather derives from overfitting.

      h i h i i i F f h h i F f h h i h h i w b f w f ) ( […] […] […] Signal f i (t) 5 i f ˆ17 i f ˆh i f Mod. 5 d x m x 2 x 1     TRN TRN Q i h i h Q , i h i ) f f ( me b (2)     TRN TRN Q i h i h i,Q h i f f mae
3) Aggregate the outputs by using eq. ( 1), which accounts for the models weights and bias.

Statistical decision logic for fault detection

The detection of a sensor fault is often achieved by comparison between the actual sensor measurement [START_REF] Gross | Sequential probability ratio test for nuclear power plant component surveillance[END_REF], for detecting a fault when the residual exceeds a threshold value previously set. To provide the earliest possible indication of a process anomaly, many techniques adopt the sequential probability ratio test (SPRT) [START_REF] Wald | Sequential Analysis[END_REF] to detect changes over time in the statistical characteristics of the residual signal i e [START_REF] Gross | Sequential probability ratio test for nuclear power plant component surveillance[END_REF].

The fault detection module implemented in this work also adopts the SPRT and not just for signalling the occurrence of a fault when the residual exceeds the threshold value, but also to return in output the condition of the sensors, by performing a statistical hypothesis test on the mean and variance of the residuals: at each time step t , the null hypothesis

0 i
Hp , corresponding to the normal, fault-free condition of the i -th sensor, is tested against the alternative hypothesis

1 i
Hp corresponding to the faulty sensor.

The residual signal i e has the Gaussian distribution

) ,σ m ( G j i j i
, where j i m and j i σ , 0,1 j  are respectively its mean and standard deviation under the hypothesis j i Hp . The decision logic which allows choosing between the two hypotheses 0 i Hp and

1 i
Hp is based on the value of the log-likelihood ratio ) t ( λ i in the following eq. ( 4); this is initialized to the value 0 1  ) ( λ i at the initial time and is updated as follows, as time proceeds [START_REF] Wald | Sequential Analysis[END_REF][START_REF] Yang | Monitoring and Uncertainty analysis of feedwater flow rate using data-based modeling method[END_REF]:

2 2 2 2 ) σ 2 ( ) m (t) e ( ) σ 2 ( ) m (t) e ( σ σ log 1) t ( λ ) (t λ 1 i 1 i i 0 i 0 i i 1 i 0 i i i                (4)
If the hypothesis

0 i
Hp is correct, the fourth term of eq. ( 4) dominates over the third one and the value of

) t ( λ i
decreases during time; vice versa, when the correct hypothesis is

1 i Hp the value of ) t ( λ i increases due
to the effect of the third term. In order to decide whether sensor i is faulty or not, a value  is fixed for the probability of false alarm (sensor i is considered faulty although it is in normal condition), and a value  is fixed for the probability of missed alarm (sensor i is considered in normal condition although it is faulty).

An upper U B and a lower L B thresholds for ) t ( λ i are obtained from  and  through eqs. ( 5) and ( 6

): ] 1 [ α β) ( log B U   (5) ] 1 [ α) ( β log B U   (6) When ) t ( λ i
exceeds the value U B a fault to sensor i is detected, whereas the normal condition is diagnosed when the value L B is reached. After one of the two boundaries is reached, the value of the log-likelihood

ratio ) t ( λ i
is kept constant until its trend is inverted.

Constant bias on the sensor measurement i f can be diagnosed by setting The fault detection and identification module here implemented is based on the sequential application of the SPRT to all sensors and all types of considered faults (in general bias or noise faults). Although in this work the case of multiple sensor failures is not considered, the proposed procedure can be extended to deal also with this important situation. Also, notice that a fault in the measurement i f may cause some other correlated signals to be incorrectly reconstructed and subsequently falsely identified as faulty too; this phenomenon is called fault propagation and can lead to a high rate of false alarms in signal validation. Then, in case of multiple faults detected by the SPRT, one should verify that they are not a consequence of fault propagation. Different techniques have been proposed to tackle the problem of fault propagation. Within an ensemble approach to signal validation, the technique proposed in [START_REF] Chenggang | Eliminating false alarms caused by fault propagation in signal validation by subgrouping[END_REF] based on a general sub-grouping technique that uses specially designed intersections between sub-groups to eliminate the false alarms caused by fault propagation seems promising.

0 i 1 i σ σ  and 0  0 i m ,

Case study

To verify the applicability of the proposed approach of fault detection, identification and signal reconstruction to the measurements used by a controller for deciding which actions to actuate, a simulation case study regarding the pressurizer of a PWR nuclear power plant has been considered.

Pressurizer model

Fig. 6 is a schematic representation of the pressurizer system for which a Matlab SIMULINK model has been developed, based on the application of the mass and energy conservation equations to the two regions of vapour and liquid; exchanges between the two regions, due to evaporation of liquid and condensation of steam, are taken into account [START_REF] Kuridan | A linearized non steady model for the pressurizer of the safe integral reactor concept[END_REF][START_REF] Todreas | Nuclear Systems 1[END_REF]. The system of non linear differential equations describing the model is detailed in the Appendix.

Q  V T P, vlv m  Sp m  Surge m  L fl m  ro m  V T f L T f Q f Sp f Surge f P f L f Vapour Liquid vlv m  surge m  sp m  fl m  ro m  Q  L P V T L T x f
x power; in particular, when the Primary Heat Transport (PHT) system pressure or temperature rise, the higher pressure or the increase of water volume in the PHT circuit push some coolant from this system into the pressurizer (in-surge flow); on the contrary, in case of low PHT system pressure, some liquid moves from the pressurizer into the PHT system circuit (out-surge flow). In this application, the transients have been generated by assuming surge mass flow rates in the range of [-10; +10] kg/s, positive values indicating insurge flow and negative values out-surge flow. In order to represent a realistic situation, the simulations have been carried out based on the operational parameters of a standard PWR pressurizer. Moreover the total mass of water entering or exiting the pressurizer during a surge line mass flow transient has been related to the temperature variations of the coolant in the PHT system. In order to test the method on pseudo-realistic data, white noise has been added to each signal according to engineering considerations on the sensors accuracy [START_REF] Hashemian | Sensor Performance and Reliability[END_REF][START_REF] Hashemian | Maintenence of Process Instrumentation in Nuclear Power Plants[END_REF][START_REF] Johnson | Nuclear Reactor Controls and Instrumentation[END_REF].

Table 3 reports the standard deviations of the considered noises.

Controller model

In this application, the control of the level L and the pressure P in the pressurizer is achieved through the feedback control scheme shown in Fig. 7, which reproduces the scheme used in a standard PWR pressurizer.

η Ψ  z  CONTROLLER surge m  cl m  sp m  Q  vlv m  L T L V T P surge f sp f Q f V T f L T f L f P f INPUTS STATE OF THE PRESSURIZER SENSORS OUTPUTS
Fig. 8 reports the noise-free evolution of the seven measured variables during one of the simulated transients.

The initial state of the system is varied by an out-surge mass flow rate 6   surge m  kg/s lasting for 175 s and removing from the pressurizer a total mass 970  M kg corresponding to a variation of the PHT system temperature of -2 °C. The out-surge flow produces a decrease in the pressure and consequently the heaters are turned on so that the pressure decrease is slowed down. When the out-surge flow ends, the heaters drive the pressure back to its reference value of Ref P f . The loss of liquid in the pressurizer causes the water level to decrease until a stabilized value of 68 6. L  m is reached. The controller intervenes only when the absolute value of difference

L Ref L L f f   
between the level reference value and level signal is greater than

a tolerated error band 2   L B
m, which is much larger than the pressure tolerated error band 2 0.

B P   bar.
In this case, the error L  is equal to 0.06m, as the reference value for the level is

74 6. f Ref L  m for a PHT temperature decrease of -2 °C; since   L L B 
and the control on the level does not intervene.

Simulation of sensor faults

When a fault affects the pressure or the level measurements, the controller receives incorrect input signals which may lead to an actuation decision different from the one it would take in absence of sensor faults. Let

) t ( f T i C
represent the evolution of the C i -th controlled signal if all sensors are in normal conditions and In this case study, pressure and level sensor faults are simulated by adding a constant bias of magnitude B M to the true value T i f of the signal. For the entire duration of the fault, the measurement produced by sensor , i which usually is given by noise f f

) t ( f T ) i ( F , i I C its evolution if
T i i   , will then be equal to noise M f f B T i i    .
To illustrate the consequences of a fault on a sensor measuring a controller input signal, the effects on the system of the fault reported in Table 4 are considered. Notice that at 50  t s, when there is the pressure sensor fault, the controller believes (wrongly) that the pressure has exceeded its reference value This example demonstrates that the controller can actually take wrong decisions when its inputs are altered by a sensor fault.

Application of the fault detection and signal reconstruction methodology

In this Section, the developed model for the fault detection, identification and signal reconstruction is described and applied to the case study under analysis.

Signal validation

Since the pressurizer operation strongly depends from the pressure and temperature of the PHT system, in order to build a more accurate signal validation model the information coming from the seven sensors of the pressurizer should be integrated by information related with the PHT system state. In this case study, since only the pressurizer and not the complete reactor has been simulated, the variations occurring outside the pressurizer are taken into account by considering an additional signal numerically computed as

  t surge M d ) ( f ) t ( f 0  
, which represents the transfer of mass between the PHT system and the pressurizer during a transient.

The set of

) T ( n n T 1   signals ) T t ( f ),..., t ( f ), t ( f i i i   1 , 9  T , n ,..., i 1  , 8  n
which are given as input to the validation model is made of current and past values of the measured signals listed in Section 5.1.1 plus the present and past values of M f (Fig. 12).

LEVEL (

L f ) LIQUID TEMPERATURE ( L T f ) VAPOR TEMPERATURE ( V T f ) PRESSURE ( P f )
t t-1 t-2 t-3 t-4 t-5 t-6 t-7 t-8 t-9 t t-1 t-2 t-3 t-4 t-5 t-6 t-7 t-8 t-9 t t-1 t-2 t-3 t-4 t-5 t-6 t-7 t-8 t-9 t t-1 t-2 t-3 t-4 t-5 t-6 t-7 t-8 t-9

SPRAY FLOW ( sp f ) HEATERS POWER ( Q f  ) SURGE LINE FLOW ( surge f ) TOTAL MASS OF LIQUID ( M f )
t t-1 t-2 t-3 t-4 t-5 t-6 t-7 t-8 t-9 t t-1 t-2 t-3 t-4 t-5 t-6 t-7 t-8 t-9 t t-1 t-2 t-3 t-4 t-5 t-6 t-7 t-8 t-9 t t-1 t-2 t-3 t-4 t-5 t-6 t-7 t-8 t-9 neighbouring training patterns. Notice that in order to reduce the computational time, redundancies higher than 10 have not been considered although they may increase the ensemble performance.

Fig. 13 illustrates how the signal validation strategy presented in Section 2 has been applied to the pressurizer case study. The set of seven current measured signals

L f , L T f , V T f , P f , sp f , Q f  , surge f of
Table 2 and Measured Signals

  Surge Q Sp P T T L V L f , f , f , f , f , f , f

The fault detection and identification module

The signal validation model produces a reconstruction 1 i f ˆ, 7 1,..., i  of each measured signal, which allows the fault detection and identification module to recognize the presence of sensor faults (bias or noise), by applying the SPRT sequentially to each sensor signal.

Since in this work we only consider constant bias faults, the standard deviations of all the residuals i e , n ,..., i 1

 are set at the same value 1

  0 i 1 i σ σ
whereas their mean values under the hypothesis 4 where a fault is added to the pressure sensor measurement.

The signal reconstruction module

Once again the pressure sensor fault of Table 4 is

Comparison of the results obtained with or without fault detection, identification and signal reconstruction

Assuming as reference the behaviour of the controller when all sensors are in normal conditions, the consequences of a fault to sensor I i with successive fault detection, identification and signal reconstruction are compared to those without. The deviation

) t ( f ) t ( f ) t ( d T ) i ( F , i T i i I C C C  
of the true value of the C i -th controlled signal in case of normal sensor conditions

T i C f and in case of fault T ) i ( F , i I C f is considered.
In particular two performance indicators are evaluated, providing local (eq.( 7)) and integral (eq.( 8)) information about the effects of the fault on the controlled system, respectively (the lower the indicators, the better the controller performance): To confirm these results a number of other system faults have been analyzed (Table 6 andTable 7 for

] [ ) t ( d max Md C C i t i  (7)    f C C t t i f i dt ) t ( d ) t t ( Id 0 2 0 ] [ 1 (8)
[ . . . . . . . . M B          m BEGINNING TIME 50  t s
In particular, two tests have been performed by considering: 1) the 16 sensor faults of Table 6 and Table 7 occur during each of the eight pressurizer transients;

2) as in 1) but applying fault detection, identification and signal reconstruction.

To evaluate the performance in test 2, the delay time  necessary to detect the fault after its occurrence is considered. Fig. 17 shows the mean value of the delay times obtained in the eight transients simulated for each fault magnitude, in case of pressure (left) or level (right) fault. One can notice that as the fault magnitude B M gets smaller, the detection time  increases until the fault is too small to be detected; in particular, faults to the pressure sensor with an absolute value of their magnitude lower than 50 1. M B  bar are not detected; similarly, faults of the level sensor with an absolute value of their magnitude lower than 75 0. M B  m are not detected. The numerical values of the mean time delays  before detecting the faults are reported in Table 8.

Results discussion

The results presented in this Section demonstrate that with the fault detection, identification and signal reconstruction approach proposed it is possible to effectively control the pressurizer when a fault occurs on the pressure or level sensors, in the sense that the controlled variables obtained using the reconstructed signals do not diverge from their setpoints and the system behaviour is kept similar to the one under normal, fault-free sensors operation. Faults of different magnitudes within a given range have been simulated to verify these results; larger faults magnitudes would not have been realistic. Only the results obtained for the constant bias fault type have been presented; nevertheless, similar results have been achieved also in the case of noise-type faults.

The entire fault detection, identification and reconstruction procedure requires about 0.3 s for the elaboration of each measurement performed with a standard personal computer; the delay thus introduced in the controller decision is compatible with the typical time constant of a pressurizer and does not affect the effective control of the system.

The constant values of +6 kg/s in case of in-surge or -6 kg/s for the out-surge assigned to the surge line mass flow rate have not been chosen too high in order to avoid falling in a region not represented by the training patterns used to train the model; if the surge line mass flow rate and at the same time the mass of liquid entering the pressurizer have high values, the pressure and level can take too high (in-surge) or too low (outsurge) values, which are not represented by any pattern of the training set. In this case, the measurements cannot be reconstructed properly by the model which would be extrapolating its reconstructions.

Another case in which the model looses its validity is when the charging/letdown mass flows rates are different from zero. During standard transients the controller does not need to act on the charging/letdown flows; as a consequence, all training patterns have charging/letdown mass flow rates equal to zero and thus the signal has not been used to build the model. In some particular cases, for example in case of level sensor faults, a controller action on the charging/letdown flows might take place; this situation is not handled by the current set up of the approach.

In all these cases, the diagnostic system should signal that the measurements are out of the range of validity of the model and that the methodology should not be applied.

For lower values of the surge line mass flow rate, it has been verified that the consequences of faults are smaller and at the same time the proposed approach work best because the measured signals fall in the region with the highest density of training patterns, where the signal validation model is more accurate.

Conclusions

An approach for the detection and identification of faulty sensors and the reconstruction of their erroneous measurements has been proposed. The effectiveness of the approach in increasing the performance of system control when a fault affects the controller input signals is confirmed by the results obtained from its application to the control of a PWR pressurizer.

The reconstruction provided by the signal validation and reconstruction model described in Section 3 provides good estimates of the true values of the measured variables and can be used for control.

The boundaries of operation of the proposed approach are defined by the region in which the training patterns fall; techniques exist to warn when the pattern under reconstruction is outside such region and is thus, no longer reliable [START_REF] Fantoni | A Neuro-Fuzzy Model Applied to Full Range Signal Validation of PWR Nuclear Power Plant Data[END_REF].

The case of simultaneous presence of multiple faults has not been considered: future work should test the approach in this situation. Also, the problem of fault propagation has not been tackled directly: the definition of a refined strategy for the distinction of false alarms will be considered in future research.

   ] ) ) ( log B U   1 [ Upper thresholds for ) t ( λ i    ] 1 [ ) ( log B L   Lower thresholds for ) t ( λ i  ) t ( i 
  i B Band of tolerated error i   C i d deviation ) t ( f ) t ( f T ) i ( F , i T i I C C



of the true C i -th signal in case of sensor fault and in case of normal sensor conditions.



 ] ) t ( d max Md C C i t i [ Local performance indicator computed for the C i -th signal     f C C t t i f i dt ) t ( d ) t t ( Id

Appendix B Pressurizer model equations:

The pressurizer model is designed to handle the four possible situations listed in Table B.1. , where Ψ is the coefficients matrix,  is the inputs vector and z is the state variables vector.

The elements of Ψ ,  and z are here detailed for each situation considered.

Case

A. F L h h  and G V h h                                  L V V V V V L L V L L V V V V V V V ) V V ( ) V V ( V V h ) V V ( P ) V V ( h V P V         0 0 0 0 0 0 Ψ ,              L V V h h V P z ,                                ) T T ( S Q ) h h ( m ) h h ( m ) h h ( m ) h h ( m ) T T ( S ) h h ( m m m m m m m L V h L G cs L cl cl L sp sp L surge surge L V h G V cs cl sp surge cs cs vlv                (B.1) Case B. F L h h  and G V h h                                         ) h h ( dP dh ) V V ( ) h h ( V V dP d ) V V ( h V P V F G F F V G V V V V F F V V V V V V V 0 0 1 0 1 0 1        Ψ ,              fl V V m h V P z ,                                ) T T ( S Q ) h h ( m ) h h ( m ) h h ( m ) h h ( m ) T T ( S ) h h ( m m m m m m m F V h F G cs F cl cl F sp sp F surge surge F V h G V cs cl sp surge cs cs vlv                (B.2) Case C. F L h h  and G V h h                                           L V F L V G F G G V L L V L L V G G V ) V V ( ) h h ( ) V V ( ) h h ( dP dh V h ) V V ( P ) V V ( dP d V        0 0 0 1 1 0 1 Ψ ,              L ro V h m V P z , (B.3)                               ) T T ( S Q ) h h ( m ) h h ( m ) h h ( m ) h h ( m ) T T ( S m m m m m m L G h L G cs L cl cl L sp sp L surge surge L G h cl sp surge cs cs vlv               Case D. F L h h  and G V h h                                               ) h h ( dP dh ) V V ( ) h h ( dP dh V dP d ) V V ( dP d V F G F F V G F G G V F L V G G V 0 0 1 0 0 1 1 1 1 1       Ψ ,              fl ro V m m V P z ,                           Q ) h h ( m ) h h ( m ) h h ( m ) h h ( m m m m m m m F G cs F cl cl F sp sp F surge surge cl sp surge cs cs vlv            0  (B.4)
Notice that the elements of the coefficients' matrix Ψ depend from the state variables so that the model is nonlinear. In practice at each time step the SIMULINK model checks in which one of the four possible cases the pressurizer is and evaluates the coefficients' matrix Ψ according to values of the state variables at the previous time step.

Appendix C Pressurizer control scheme:

The main function of a pressurizer is that of maintaining the pressure in the primary system of the plant at the reference value (150 bar) to give adequate overpressure, suppress pump cavitations and avoid bulk boiling. The pressurizer is also designed to accommodate normal volume surges. The level L of the liquid water contained in it must also be controlled in order to avoid emptying or overfilling its volume.

In order to allow this component to fulfil its functions, it is necessary to continuously control that the value of the water level L and the pressure P in the pressurizer agree with the desired reference value Ref m for the level. Notice that a stricter control condition is applied to the pressure than to the level. When one of the tolerated error band is exceeded, the difference

C C C i Ref i i f f    between
the measured signal and its reference value is given in input to a proportional-integral-derivative (PID) controller which generates the control signal for the corresponding actuator, i.e., the charging/letdown flows, the sprayers or the heaters.

The relief valve, instead, is a safety device which opens only when the pressure exceeds a limit value (here set equal to 165  max P bar) and has a constant mass flow rate.

In case of low pressure, the heaters are turned on. For a more precise control of the supplied power only one out of five heaters can deliver variable PID controlled power, whereas the other four units are back-up heaters run by control

  Fig. 1: fault detection, identification and signal reconstruction strategy in case of sensor faults; the black bullet indicates a fault.

Fig

  Fig.3: approach to the reconstruction of signal i f contained in groups

  locally, i.e., they vary as a function of the position of the pattern under reconstruction. In this way the two parameters h i b and h i w can account for the variation of models performances in the different regions of the signals space. Fig. 4 shows the overall framework for the reconstruction of the generic signal i f by local fusion of the models outcomes.

Fig. 4 :

 4 Fig. 4: framework of the locally weighted fusion of model outcomes.

Fig. 5 :

 5 Fig. 5: k -nn-based neighborhood. The black circle represents the test pattern; the other circles are training patterns.

σσ

  in the second depend on the magnitude of the fault one wishes to detect. can lead to false alarms due to the presence of measurement and reconstruction noises also in case of normal sensors conditions, whereas too high values lead to the detection of sensor faults only when they have high magnitudes. The calibration of the SPRT parameters  ,  , and error procedure looking for a trade off between a low rate of false alarms and a low rate of undetected faults.

Fig. 6 :

 6 Fig. 6: simplified model of a pressurizer.

  of the model identifying the inputs, state of the system, sensors outputs and controller variables is shown in Fig.7.

Fig. 7 :

 7 Fig. 7: inputs, state, controller outputs (gray), controller inputs (black) and sensors outputs of the SIMULINK model of the pressurizer.

Fig. 8 :

 8 Fig. 8: true noise-free values T i f of the seven measured variables evolving during a plant transient.

  [kg/s] The actual values of the signals i f measured by the seven sensors during this transient are shown in Fig.9.In this case the measurement noises received by the controller cause the irregular shape of the heaters power controller output signal. Notice that the controller inputs signals I i f are the pressure and level signals P f and L f of Fig.9and not those noise-free of Fig.8, that represent the true values T

Fig. 9 :

 9 Fig. 9: signal values i f actually measured (with noise) during the transient of Fig. 8.

  Fig. 11 compares, in the same case, the behaviours of the two controller output variables used to control the process, i.e. the sprayers mass flow rate (upper) and the heaters power (bottom).

Fig. 10 :

 10 Fig. 10: evolution of the pressure (upper) and of the level (bottom) in the pressurizer when all the sensors are in normal conditions (left), and when a constant bias fault of +4.5 bar on the pressure measurement is simulated and the measured signal I i f is used as input to the controller (right).

  Fig. 11: evolution of the sprayers mass flow rate (upper) and of the heaters (bottom) in the pressurizer when all the sensors are in normal conditions (left), and when a constant bias fault of +4.5 bar on the pressure measurement is simulated and the measured signal I i f is used as input to the controller (right).

  in normal sensors conditions (Fig.11, bottom left), it turns on the sprayers in order to decrease the pressure (Fig.11, upper right). Consequently, the undesired pressure decrease is accelerated by the wrong control decision. At the end of the plant transient, when the out-surge stops, the pressure stabilizes at a value which is lower than the reference of a quantity comparable with the amplitude of the sensor bias.At the same time, the total mass of liquid introduced in the pressurizer by the sprayers increases the level of the liquid water. At the end of the transient, the absolute value of the difference between the level reference value  is still lower than the tolerated error band  L B , and thus no action on the charging/letdown mass flows is started to correct this mismatch.

Fig. 12 :

 12 Fig. 12: input pattern used for the reconstruction of the current signal measurement.

  the additional artificial signal M f are completed with their past 9 measurements and sent to the signal validation model. For each one of the seven measurements, the reconstruction 1 ensemble model and compared with the measured value i f . The residual i e is sent to the fault detection module where it is processed by means of the SPRT technique. The faults eventually is memorized in place of the measurement i f . If the detected fault concerns the pressure or the level signals, the controller receives in input the corresponding reconstructed signal T In any case, the reconstruction T i f ˆ of the faulty signal is also included in place of the measured value i f into the patterns sent to the signal validation model during the next T time instants.

Fig. 13 :

 13 Fig. 13: signal reconstruction strategy for control of the pressurizer of a PWR in the case of a fault of the level sensor (black dot).

  calibrated by a trial and error procedure performed on the test set TST X after addition of artificial faults, with the goal of compromising between the objective of detecting faults of an as small as possible magnitude and in a short time after their occurrence, and that of achieving a low rate of false alarms. The values assigned to the mean values of the residuals under hypothesis . This choice implies a small sensibility of the fault detection module in case of faults affecting signals other than the pressure or the level, but it reduces the risk of false alarms due to fault propagation. Finally, the false and missed probabilities  and  are set to the

Fig

  Fig.14shows the evolution of) t ( P in the case of the pressure sensor fault of Table4, when the signal

Fig

  Fig. 14: evolution of ) t ( P 

Fig. 15 :

 15 Fig. 15: evolution of the pressure (upper) and of the level (bottom) in the pressurizer when all the sensors are in normal conditions (left), and when a constant bias fault of +4.5 bar on the pressure measurement is simulated and the measured signal T i I f ˆis used input to the controller (right).

  the performance indicators are significantly lower (better) in the case in which fault detection, identification and signal reconstruction is applied, thus indicating that the objectives of the control system are better satisfied, i.e. the controlled variables values are kept closer to their setpoints.

  the faults of the pressure and level sensors, respectively). To verify the controller performance under different operative conditions of the pressurizer, eight transients have been considered, keeping the surge line mass flow rate at the constant value 6 out-surge) for different time durations. For each transient, the total mass of liquid entering or exiting the pressurizer, i.e., the integral of the surge line mass flow rate over the entire duration of the transient, reflects a variation of the PHT water temperature ranging from -4 to +4 °C.

Fig. 17 :

 17 Fig. 17: mean fault detection time delay vs fault magnitude.

Fig

  Fig. 18 shows the values of the performance indicators

Fig

  Fig.18:

  Fig.19:

  fault detection, identification and signal reconstruction (test 1) Fault detection, identification and signal reconstruction (test 2) l l

w

  Estimate of the i -th sensor measurement provided by a model at the j -th iteration of the reconstruction  T i f True value of the physical quantity measured by the i -th sensor  True value of the C i -th controlled signal in case of fault of the I i -th controller input signal Number of signals in each subsets h F  H Total number of models  i H Number of models reconstructing the i -th signal  h i f ˆ Reconstruction made by the h -th model of the i -th signal  TRN Q Subset of training patterns similar to the test pattern, also called neighborhood of the test pattern  k Cardinality of the neighborhood TRN Q of the h -th model in the reconstruction of the i -th signal of the patterns in the set the h -th model in the reconstruction of the i -th signal of the patterns in the set TRN Q Bias correction associated to the h -th model for the reconstruction of the i -th signal  h i Weight associated to the h -th model for the reconstruction of the i -th signal Fault detection:



  Distance between the measured value of the C i -th controlled signal and its reference value

  Enthalpy of the vapour in saturation condition at pressure P Temperature of the liquid in saturation condition at pressure P

  Fig C.1: pressurizer control scheme

  relays. All units have a maximum power of 320 kW each. The pressure is increased as a consequence of the greater mass flow rate fl m  generated by liquid water flashes produced by warming up the liquid water. If the pressure is getting too high the control signal generated by the corresponding PID is sent to the sprayers which start injecting nebulised water into the pressurizer with a maximum mass flow rate of 7 kg/s. The flow of nebulised cold water coming from the sprayers causes the condensation of the steam, thus inducing a pressure decrease. In a similar way, the deviations of the level from the reference value Ref L f are controlled by regulating the charging/letdown mass flows rates.ReferencesAly, M.A.,Atiya, A.F., 2006. Novel methods for the feature subset ensembles approach, International Journal of Artificial Intelligence and Machine Learning, Vol. 6, No. 4.

Table 1 Initial conditions of the pressurizer.

 1

	I NITIAL CONDITION

Table 2 Measured signals.

 2

Table 3 Standard deviation of sensors noise.

 3

		N OISE STANDARD
		DEVIATION
	Level Sensor	±0.01 m
	Pressure Sensor	±0.5 bar
	Flow Sensor	±0.2 kg/s
	Power Sensor	±50 kW

  there is a fault of the controller input signal I indicate the true value of the C i -th controlled signal in a transient but they result from two different controller decision strategies, because based on fault-free and faulty information respectively.

	and	f T i C	F ,	(	i	I	)	(	t	)
	7.4										Level f L (t) [m]	343	Liquid Temperature f Tl (t) [°C]
	7.2											342
		7											341
	6.8											340
	6.6	0								200	400	600	800	339	0	200	400	600	800
	343									Steam Temperature f Tv (t) [°C]	155	Pressure f P (t) [bar]
	342
	341											150
	340
	339	0								200	400	600	800	145	0	200	400	600	800
		8									Spray Flow Rate f sp (t) [kg/s]	6	x 10 5	Heaters Power f Q (t) [W]
		6											4
		2 4											2
		0	0								200	400	600	800	0	0	200	400	600	800
											Surge Line Flow Rate f surge (t) [kg/s]
		0
		-2
		-4
		-6
		-8
		0								200	400	600	800
													i f ; notice that both signals	f T i C	(	t	)

Table 4 Pressurizer condition during the faulty transient simulated.

 4

	TRANSIENT TYPE					Out-surge [Fig. 8, Fig. 9]
	SURGE LINE MASS FLOW RATE				m 	surge		6 	kg/s
	FAULTY SENSOR					Pressure sensor
	TYPE OF FAULT					Constant bias
	FAULT MAGNITUDE					M B 	4.	5	bar
	BEGINNING TIME						t		50	s
	Fig. 10 compares the evolution of the pressure	f T P	(	t	)	(upper) and the level			f T L	(	t	)	(bottom) signals in
	normal sensor conditions (left) to the evolution of the same two signals	f T , F P	(	P	)	(	t	)	and	f T , F L	(	P	)	(	t	)	in the
	case of the pressure sensor fault of Table 4 (right).

  Table 4, when the signal validation strategy is applied; one can see that during the first time instants, the value of P

																		 resulting from
	the SPRT applied to the pressure sensor decreases until it reaches at	t		19	s the lower bound	B L  	5.	29
	and thus one can say that the pressure sensor is in normal condition with a degree of confidence
	(	1	 	)		. 99	5	%	; at time	t		50	s the value of P  quickly increases up to the upper bound	B U 	5.	29	and
	the fault is detected with a probability of			0	.5	%	of being a false alarm; from the detection time on, the
	controller receives in input the reconstructed value T P f ˆ of the pressure signal.

Table 5

 5 reports the performance indicators for the transient with a fault of the pressure sensor of Table4, in the case with or without fault detection, identification and signal reconstruction.

Table 5 Comparison of the performance indicators values in case the fault detection, identification and reconstruction is applied or not.

 5

			N O FAULT DETECTION,	FAULT DETECTION,
			IDENTIFICATION AND SIGNAL	IDENTIFICATION AND SIGNAL
			RECONSTRUCTION	RECONSTRUCTION
	Md	P	433 4.	bar	161 0.	bar

Table 6 Pressurizer condition during the simulated faulty transients.

 6

	FAULTY SENSOR						Pressure sensor
	TYPE OF FAULT	Constant bias with 16 different fault magnitude values
	FAULT MAGNITUDE	M B		[	45 . 0 	75 . 0 	1 . 	0	5 . 1 	0 . 3 	4 . 	5	6 . 	0	] 0 . 9 	bar
	BEGINNING TIME							t		50	s

Table 7 Pressurizer condition during the simulated faulty transients.

 7

	FAULTY SENSOR						Level sensor
	TYPE OF FAULT	Constant bias with 16 different fault magnitude values
	FAULT MAGNITUDE	0	10	0	20	0	35	0	50	0	75	1	0	1	2	1	] 5

Table 8 Mean fault detection time delay τ for the smallest detectable faults.

 8

  Hypothesis of i -th sensor being in faulty condition

	e	i	(	t	)		f	i	(	t		( ) f 1 i	t	)		Residual signal
	i m	j			Mean value of the residual i e under the hypothesis	j Hp , i	j 	1 0,
	  j  False alarm probability i  Standard deviation of the residual i e under the hypothesis   Missed alarm probability	j Hp , i	j 	1 0,

Table B .1 Liquid water and vapour conditions in the four situations tackled by the SIMULINK pressurizer model.

 B

					B	Saturated	Overheated
					C	Subcooled	Saturated
					D	Saturated	Saturated
	Each situation is represented by a different dynamic model of the pressurizer described by the system of differential
	equations	Ψ	 z 		
					CASE	LIQUID WATER CONDITION	VAPOUR CONDITION
					A	Subcooled	Overheated

Heaters Power f Q,F(P) T (t) [W]Failure of the pressure sensor

Acknowledgments

The authors are pleased to thank G. Gola, M. Hoffmann and D. Roverso of the Institute for Energy Technology (IFE), OECD Halden Reactor Project, Norway for supplying the tool implementing the SPRT.