The threshold selection issue is considered in a fault detection system which is a part of an active fault tolerant control scheme. The proposed approach takes explicitly into account the closed-loop performance of the regulated system. Indeed, the threshold is selected to ensure optimal regulation performance over a specified time horizon, while taking into account possible malfunctions affecting the system. More specifically sensor faults, like bias or drift, are considered in combination with a reconfiguration scheme made of software sensors. A numerical algorithm based on randomization techniques is provided and its running is illustrated on a numerical example of FTC for a winding machine.

Threshold Selection Based on Closed-loop Performance for Fault Detection Schemes S. Aberkane * M. Kinnaert * *

INTRODUCTION

Fault tolerant control (FTC) systems aim at guaranteeing that a process or device keeps fulfilling its mission even in the presence of faults, although possibly in a degraded mode. It involves automatically detecting and isolating the faulty components thanks to an appropriate diagnosis systems, and then reconfiguring the control law on-line in response to the information provided by the diagnosis system [START_REF] Blanke | Diagnosis and Fault-Tolerant Control, Second Edition[END_REF]. Despite the evident interaction between fault detection and isolation (FDI) and reconfiguration algorithms, the research on FDI and reconfiguration methods has often evolved separately, certainly because of the difficulty of each of these problems. Typically, in the reconfiguration literature, it is assumed that a perfect FDI device is available (i.e. no detection delay, no false alarm, no missed detection ...etc.) [START_REF] Gao | Stability of the pseudoinverse method for reconfigurable control systems[END_REF], [START_REF] Lunze | Control reconfiguration after actuator failures using disturbance decoupling methods[END_REF]. On the other hand, the figures of merit used for FDI algorithms are the detection delay and false alarm rate, and an algorithm is judged satisfactory if it detects failures quickly and generates few false alarms, regardless of the performance of the reconfigured closed loop system [START_REF] Basseville | Detection of Abrupt Changes: Theory and application[END_REF]. Some results addressing this interaction issue have appeared recently. For instance [START_REF] Gani | Fault-tolerant control of a polyethylene reactor[END_REF] presents an approach that combines a fault detection filter, to detect actuator faults, and a reconfiguration policy based on stability region. The latter allows to switch to an appropriate controller upon occurrence of a fault. However, the design of the threshold in the detection system is not linked to closed-loop performance in that paper. This is probably due to the fact that total actuator failures are considered, although it is not explicitly mentioned in the text, so that sufficiently fast detection is always achieved and reconfiguration is compulsory. Other approaches rely on estimates of loss of control effectiveness of the actuators or estimates of the bias of the sensors to either retune the control law [START_REF] Wu | Detection and accommodation of loss of control effectiveness International Journal of adaptive Control and Signal Processing[END_REF] or compensate for the bias [START_REF] Edwards | Sensor fault tolerant control using sliding-mode observers[END_REF]. However, since the fault estimate is never totally accurate, its use in a compensation scheme under healthy conditions actually deteriorates closed-loop performance, and it is thus important to complement such approaches with an appropriate decision scheme to determine when the fault estimate should be used for compensation as indicated in [START_REF] Edwards | Sensor fault tolerant control using sliding-mode observers[END_REF]. This goes in the direction of the research reported in the present paper. Indeed, our aim is to address a question involving the interplay between FDI systems and reconfiguration mechanisms, namely the tuning of the threshold of the FDI systems based on the closed-loop performance of the FTC system. To keep the setting sufficiently simple, a system subject to sensor faults is considered, and the reconfiguration mechanism consists in substituting a software sensor for a faulty hardware sensor. Typically, closed-loop performance will be better with the hardware sensor than with the software sensor, however, the presence of a fault on the hardware sensor will also degrade the closed-loop performance. One should thus determine at what fault level switching to the software sensor is recommended in order to achieve the best closed-loop performance over a given mission time. The latter may correspond to the time interval between two maintenance operations for instance. Setting the fault level actually amounts to setting the threshold for the FDI algorithm which triggers the reconfiguration mechanism. This paper is organized as follows. The fault tolerant (FTC) system is described in section 2. The threshold selection problem is stated in section 3, and an algorithm to solve it is presented. Finally, a winding machine example is used in section 4 to illustrate the approach.

DESCRIPTION OF THE FTC SYSTEM

System modeling

Consider the following class of discrete-time dynamical systems:

ϕ :    x k+1 = A x x k + B u u k + B w w k y k = C y x k + ν k + E f f k z k = C z x k + D z u k (1)
where x k ∈ R n is the state, u k ∈ R r is the input, y k ∈ R q is the measured output, w k is the process noise, ν k is the measurement noise, z k is the controlled output, and f k represents sensor faults. The sequence {w k } k is white and Gaussian (w k ∼ N (0, R w ) with R w a symmetric positive definite matrix). ν k is the output of the linear system

ϕ ν : ν k+1 = A ν ν k + η k (2)
where 2) corresponds to a band limited noise. Such a noise model is needed to ensure the existence of a solution to the H 2 control problem stated in section 2.2. Besides, the initial state x 0 is assumed to be a Gaussian random vector with zero mean and variance Σ 0 , and similarly ν 0 has zero mean and variance Σ ν 0 .

{η k } k is a Gaussian white noise sequence (η k ∼ N (0, R η ) with R η > 0) independent of {w k } k . Thus ν k is sequentially correlated. Model (
A parameterized class of functions will be considered for

f k : f k = 0 if k < k 0 f k = f (k; k 0 , β) otherwise (3)
with k 0 , the fault occurrence time, and β a parameter linked to fault magnitude. Both parameters are assumed to be random variables. The function f (k; k 0 , β) is also assumed to be linear w.r.t. parameter β. It is further supposed that the probability mass function (pmf), p k0 (k 0 ) of k 0 over the mission time is known, including the probability that no fault occurs during the mission, p nf , and that the probability density function p β (β) of β is also known. β and k 0 are supposed to be independent.

Controller synthesis

In the absence of fault (f k = 0), process (1) is controlled by static output feedback. Upon occurrence of a fault, the faulty sensor will be replaced by a software sensor that relies on the non faulty sensors. In the following, one single sensor fault is considered for the sake of simplicity.

The nominal and the reconfigured control laws are successively presented in the next two subsections.

Nominal case

The nominal controller is based on the model of the fault free system (1), and it has the form:

ϕ s : u k = Ky k (4)
Combining (1)-( 2) we obtain the following dynamical model:

   χ k+1 = Āχ χ k + Bu u k + Ēw w k + Ēη η k y k = Cy χ k z k = Cz χ k + D z u k (5)
where

χ k = [x k ν k ] and Āχ = A x 0 0 A ν , Bu = B u 0 , Ēw = B w 0 , Ēη = 0 I , Cy = [ C y I ] , Cz = [ C z 0 ] .
Our goal is to compute a static output feedback controller ϕ s that stabilizes the closed loop system and ensures H 2 performance, as specified below.

Applying the controller ϕ s to (5), we obtain the following closed loop system:

ϕ cl    χ k+1 = Ãχ χ k + Ẽ wk y k = Cy χ k z k = Cz χ k (6)
where

wk = w k η k , Ãχ = Āχ + Bu K Cy , Ẽ =
Ēw Ēη , Cz = Cz + D z K Cy . Letting T wz denote the discrete transfer matrix between w and z, the H 2 control problem can be stated as follows. Determine a stabilizing gain K such that T wz 2 is minimum. This can be achieved by finding the minimum value of γ 2 for which there there exist a positive definite matrix P 2 and a matrix K such that tr( Ẽ

P 2 Ẽ) < γ 2 2 Ã χ P 2 Ãχ -P 2 + C z Cz < 0 Then K is a stabilizing gain such that T wz 2 < γ 2 .
For synthesis purpose we use the LMI methods based on cone complementary techniques described in El [START_REF] Ghaoui | A Cone Complementary Linearization Algorithm for Static Output-Feedback and Related Problems[END_REF].

Reconfiguration Let us consider, without loss of generality, that sensor 1 is faulty, then the proposed reconfigured control law is given by

u rk = K 1 ŷ1k + K 2 ỹk (7) with K = [ K 1 K 2 ], ỹk = [ y 2k . . . y qk ]
where ỹk = My k are the "healthy" outputs, and ŷ1k is an estimation of y 1k obtained from the state estimate of the following Kalman filter (based on model (5) with measured output ỹk ):

ϕ F : χk+1 = Āχ χk + Bu u rk + K fr (ỹ k -ŷk ) ŷk = M Cy χk (8)
where ŷk is the estimation of ỹk . This yields ŷ1k = M 1 Cy χk .

(9) where M 1 simply selects the first component of vector Cy χk . In accordance with the standard Kalman filter theory, the initial state χ0 is assumed to be a Gaussian random vector with zero mean and variance Σ0 = diag (Σ 0 Σ ν 0 ). Note that the filter (8) only uses the healthy outputs ỹk to provide robust estimation (robustness w.r.t sensor faults) of the faulty output. When writing (8), it is implicitly assumed that the required detectability and stabilizability conditions are verified to be able to compute a unique stabilizing Kalman filter gain K fr . Remark: In order to avoid a transient due to the initialization of the filter (8) upon reconfiguration, this filter is running both in faulty and in fault free conditions. In the latter case, u k as given by ( 4) is substituted for u rk .

In the next section, the fault detection system that decides when to switch from control law (4) to control law ( 7)-( 9) is described.

Fault detection (FD)

The two parts that constitute the FD system, namely the residual generator and the decision module are successively described. The first generates fault indicators, called residuals, which have zero mean in the absence of fault and nonzero mean upon occurrence of a fault. The decision module then performs a test of hypothesis to determine the possible presence of a fault.

Residual generation

A Kalman filter for system (1)-(2) will be used as a residual generator. However, for a system made of the concatenation of equations ( 1) and ( 2), the Kalman filtering problem is singular [START_REF] Jazwinski | Stochastic Processes and Filtering Theory[END_REF], pages 212-215. One way to solve such a problem is to consider the following modification of the measurement equation. From ( 1), ( 2) with f k = 0, we have

y k -Aν y k-1 = [CyAx -Aν Cy] x k-1 + CyBuu k-1 + CyBww k-1 + η k-1 = Ĉy x k-1 + Bu u k-1 + Bw w k-1 + η k-1 (10)
Combining ( 10) with (1) gives the following state space representation with modified output:

ϕ mod : x k+1 = A x x k + B u u k + B w w k ȳk = (y k+1 -Aν y k ) = Ĉyxk + Buuk + Bwwk + η k (11)
in which the measurement noise variance is now nonsingular.

Under standard detectability and stabilizability conditions, a steady state Kalman filter for system (11) can be determined. It takes the form

ϕ F D : xk+1 = A x xk + B u u k + K f (ȳ k -ŷk ) ŷk = Ĉy xk + Bu u k ( 12
)
where x0 is a Gaussian random vector with zero mean and variance ΣFD = Σ 0 . Let us define e k = x k -xk , then (11), ( 12) yield

e k+1 = Ȃe k + Bw k -K f η k (13) where Ȃ = A x -K f Ĉy , B = B w -K f Bw . (14)
The residual r k is the innovation of the Kalman filter:

r k = ȳk -ŷk = Ĉy e k + Bw w k + η k (15)

Decision module

Given the Gaussian assumption for the noise sequences {w k } k and {η k } k , r k is normally distributed with zero mean in the absence fault. A fault normally induces a change in the mean of the residual [START_REF] Blanke | Diagnosis and Fault-Tolerant Control, Second Edition[END_REF], chapter 6. Therefore, considering the vector

R k = r k r k-1 . . . r k-l
, obtained by stacking up (l + 1) residual samples, the residual evaluation problem can be stated as the following hypothesis testing problem: Given a realization of the random vector R k , choose between the following two hypotheses

H 0 : L(R k ) = N (0, Q) H 1 : L(R k ) = N (µ k , Q)
where µ k is an unknown non-zero vector.

A standard χ 2 -test is used to solve this problem, based on the decision function

ξ k = R k Q -1
R k which has a χ 2 distribution with non centrality parameter equal to zero under hypothesis H 0 . Specifically,

if ξ k < h, decide H 0 , otherwise, decide H 1 , (16)
where the threshold h is a tuning parameter.

The variance of R k ,denoted Q, can be computed as indicated in [START_REF] Aberkane | Threshold selection based on closed-loop performance for fault detection[END_REF].

In typical FD systems, the threshold h used for the χ 2 -test is adjusted in such a way that, in the absence of fault, Prob(ξ k > h) = α (17) where α is a specified false alarm (FA) probability. However, in a fault tolerant control context, it is not clear what value to choose for α. A low FA probability would a priori be beneficial; but it implies a large value for h, and hence a large value for the smallest detectable fault. This is the classical trade off between false alarm and missed detection. In FTC, what really matters is closed-loop performance. Therefore, in the next section an optimization problem is stated, for the determination of h, on the basis of this criterium.

THRESHOLD OPTIMIZATION

Consider system (1) subject to fault f k described by the specific family of functions (3). Let the mission time (for instance the time interval between two sensor maintenance operations) be equal to H, and assume, for the sake of simplicity, that a single switching from control law (4) to control law ( 7)-( 9) can take place. Such a switching is triggered by the FD system either upon occurrence of a fault or due to a false alarm. Our aim is to determine the threshold h of test ( 16) in such a way that a closedloop performance measure, averaged over all possible faults within family (3), over all possible noise realizations and all possible reactions of the FD system (accounting for the false alarms and detection delay), is minimized. A mathematical expression for this optimization problem is:

min h E H k=0 z k z k = min h J (18)
where the expectation operator E carries over the noise sequences, the initial state and the fault sequence.

The difficulty in the evaluation of this cost function stems from the decision system which nonlinear function and threshold impose switching between the nominal and the reconfigured control law at a random time instant that depends on the realizations of the different random vectors and processes appearing in the problem statement. A simple way to evaluate the cost would be to resort to standard Monte Carlo simulation. However, this would not exploit the linearity property of the closed-loop dynamical system both in fault free and in faulty operation. The algorithm presented next attempts to combine Monte Carlo simulation and classical results on stochastic linear dynamical systems to limit the computation time of the cost function J for a given threshold h.

The contributions of the fault free trajectories and the trajectories subject to fault occurrence are successively considered. Next, the way to combine these results in order to evaluate J is explained.

Contributions of the fault free trajectories

A two step approach is used. First Monte Carlo simulation allows to determine,at each time instant, the mean and variance of the trajectories that yield no false alarm or that yield a false alarm. Next the contribution to the cost after a false alarm is triggered is computed.

The following algorithm is used for Monte Carlo simulation:

• Obtain N realizations of χ 0 , χ0 , x0 , say χ n 0 , χn 0 , xn 0 , n = 1, • • • , N.
• For i ranging from 1 to H

Step 1 Obtain N realizations of w i-1 and η i-1 , say

w n i-1 , η n i-1 , n = 1, • • • , N.
Step 2 Perform, for each n, one simulation step of the dynamic system (4),( 5), ( 8), ( 13), ( 15), and evaluate the associated decision variable

ξ n i . Step 3 Let ξ nj i , j = 1, • • • , N i (j = N i +1, • • • , N i + Ñi ) denote
(i) = (χ nj i ) ( χnj i ) (e nj i
) be the associated state of the concatenated dynamical system (4), ( 5), ( 8), ( 13), then the mean and variance of the distribution of the state that yields a false alarm at time instant i is evaluated as

           m fa nom (i) = 1 N i N i j=1 χ n j nom (i) Q fa nom (i) = 1 N i -1 N i j=1 (χ n j nom (i) -m fa nom (i)) (19)
where the index "nom" indicates that the nominal control law is used, and the symbol indicates the transpose element, i.e., X = XX , and X is any given matrix. The mean and variance of the distribution of the state that yields no false alarm at time instant i, m nf a nom (i) and Q nf a nom (i) are estimated in a similar way as (19) from the Ñi relevant trajectories.

The mean and variance of z i , upon occurrence of a false alarm, m fa nom,z (i) , Q fa nom,z (i) or in the absence of false alarm, m nf a nom,z (i) , Q nf a nom,z (i) are deduced from

z i = C nom χ nom (i) (20) with C nom = Cz + D z K Cy 0 0
Once a false alarm occurs, say at time k fa , the controller is automatically reconfigured, and the closed-loop dynamics is described by equations ( 5), ( 7),( 8). The mean, m rec (i; k fa ) and variance Q rec (i; k fa ) of the state of the reconfigured system, χ rec (i) = χ i χ i can be computed from the following equations.

       m rec (i + 1; k fa ) = A rec m rec (i; k fa ) Q rec (i + 1; k fa ) = A rec Q rec (i; k fa )A rec +B rec R w 0 0 R ν B rec (21)
with initial conditions determined from (19) as

m rec (k fa ; k fa ) = I 0 0 0 I 0 m fa nom (k fa ) and Q rec (k fa ; k fa ) = I 0 0 0 I 0 Q fa nom (k fa ) I 0 0 0 I 0 where Arec = ( Āχ + BuK2M Cy) BuK1M1 Cy ( BuK2M Cy + K rf M Cy) ( Āχ -K rf M Cy + BuK1M1 Cy) Brec = Ēw Ēη 0 0
characterize the closed-loop system. The resulting mean and variance of z are deduced from m rec,z (i;

k fa ) = C rec m rec (i; k fa ) Q rec,z (i; k fa ) = C rec Q rec (i; k fa )C rec ( 22
)
with

C rec = ( Cz + D z K 2 M Cy D z ) K 1 M Cy .

Contribution of the faulty trajectory

Let us assume that a fault occurs at time k 0 , in the interval [1, H]. Considering the same N trajectories as in the fault free case, there will be k 0 -1 =1 N trajectories for which a false alarm will arise in the time interval [1, k 0 -1]. Since reconfiguration will take place before fault occurrence, the contribution of these trajectories to the cost function can be computed using the same approach as above. For the remaining Ñk0-1 trajectories, the fault occurring at time k 0 is possibly detected at some time k fd > k 0 . A reconfiguration then takes place at time k fd . Small faults are not necessarily detected, which can be associated to a situation where k fd > H. The detection delay is a stochastic variable which distribution can only be estimated by Monte Carlo simulation in the present context. However, in the study of on-line change detection algorithms, one often characterizes performance in terms of the average run length (ARL) function [START_REF] Basseville | Detection of Abrupt Changes: Theory and application[END_REF], namely the average time the algorithm runs before an alarm is generated (in the fault free case) and the mean time for detection (in the faulty case). The ARL depends upon the initial value of the decision function and the fault magnitude. It has been studied for the EWMA chart and the CUSUM algorithm in [START_REF] Wieringa | Statistical Process Control for Serially Correlated Data[END_REF] and [START_REF] Basseville | Detection of Abrupt Changes: Theory and application[END_REF], and its computation is quite involved. In this paper, we resort to a simpler decision method for which the ARL function upon occurrence of fault with magnitude β will be estimated from the mean of the decision function. Letting ARL h (β) denote the estimated ARL function for a decision system with threshold h, one can write:

ARL h (β) = E(k fd -k 0 ) k m fd -k 0 (23)
where k m fd is the time instant at which the mean of the decision function becomes greater than the threshold, namely:

k m fd = min k (E(R k Q -1 R k ) > h) (24)
Here

E(R k Q -1 R k ) is computed from: E(R k Q -1 R k ) = tr Σ R (k)Q -1 + m R (k)Q -1 m R (k)
where m R (k) and Σ R (k) are respectively the mean and the variance of R k that can be computed as detailed in [START_REF] Aberkane | Threshold selection based on closed-loop performance for fault detection[END_REF]. For a fault at time k 0 with magnitude β, we shall approximate the trajectory z k , k > k 0 by assuming that the system operates with the faulty sensor and the nominal control law from time k 0 to time k 0 + ARL h (β) -1, and that reconfiguration takes place at time k 0 + ARL h (β).

In the time interval [k 0 , k 0 + ARL h (β)-1], the contribution E(z k z k ) associated to such trajectories, for a given fault magnitude β, takes the form:

E(z k z k ) = tr Q nom,β (k; k 0 )C nom C nom +C nom m nom,β (k; k 0 )m nom,β (k; k 0 ) C nom (25)
where m nom,β (k; k 0 ) and

Q nom,β (k; k 0 ) are computed from            m nom,β (k + 1; k 0 ) = Anomm nom,β (k; k 0 ) + Fnomf k Qnom(k + 1; k 0 ) = AnomQnom(k; k 0 )A nom +B nom R w 0 0 R η B nom k 0 -1 ≤ k ≤ k 0 + ARL h (β) -1 (26)
with

Anom = ( Āχ + BuK Cy) 0 ( BuK Cy + K fr M Cy) ( Āχ -K fr M Cy) , Bnom = Ēw Ēη 0 0 , Cnom = ( Cz + DzK Cy) 0 , Fnom = BuKEf BuKEf + K fr ME f (27)
and with initial conditions

m nom,β (k 0 -1; k 0 ) = I 0 0 0 I 0 m nf a nom (k 0 -1) and Q nom (k 0 -1; k 0 ) = I 0 0 0 I 0 Q nf a nom (k 0 -1) I 0 0 0 I 0 . At time k r (β) = k 0 + ARL h (β)
, the reconfiguration takes place, and the mean and variance of (χ

k χ k ), for k ≥ k r (β)
are then given by equations of the same form as ( 21), namely:

       m rec (k + 1; k r (β)) = A rec m rec (k; k r (β)) Q rec (k + 1; k r (β)) = A rec Q rec (k; k r (β))A

Global expression for cost J

This expression is obtained by grouping the above results and accounting for the pmf of the fault occurrence time and the pdf of the fault magnitude β. One actually computes

J M = E H k=0 z k z k . Then J = tr(J M ). J M = p nf N H k=1 N k (m fa nom,z (k) +Q fa nom,z (k)) + Ñk m nf a nom,z (k) +Q nf a nom,z (k) + k-1 i=1 N i (m rec,z (k; i) +Q rec,z (k; i)) + H k 0 =1 p k 0 N k 0 -1 i=1 N i i-1 k=1 (m nf a nom,z (k) +Q nf a nom,z (k)) + H k=i (m rec,z (k; i) +Q rec,z (k; i)) + Ñk 0 -1 k 0 -1 k=1 (m nf a nom,z (k) +Q nf a nom,z (k))+ p β (β) kr (β)-1 k=k 0 (m nom,β,z (k; k 0 ) +Q nom,z (k; k 0 )) + H k=k r (β) (mrec,z(k; kr(β)) +Qrec,z(k; kr(β)))   dβ     (29)
The first three lines correspond to the contribution of the fault free trajectories. The fourth and fifth lines account for the faulty case in which a reconfiguration takes place before the fault occurrence time k 0 , due to a false alarm.

Finally the remaining lines account for the faulty situation in the absence of false alarm. From a computational point of view the integral over β will have to be evaluated by Monte Carlo simulation by considering a set of values β i , i = 1, • • • , N β drawn from the distribution described by p β (β).

Algorithm for computing J

To solve the optimization problem (18), an appropriate numerical optimization software should be used, based on the computation of the cost function for a given value of h. Questions regarding properties of the cost, like convexity, are open at this stage. The computations of ( 29) can be performed using the following 6 step procedure. 13) and ( 15)) for fault magnitude β = 1; by linearity the values of m nom,β (k; k 0 ) and m r (k; k 0 ) for an arbitrary value of β can be obtained directly from the case β = 1. 4. For each β i , compute ARL h (β i ) by ( 23), ( 24) on the basis of step 3. 5. Solve (28) for k = k r (β i ) up to H, for each β i , and deduce m rec,z (k; k r (β i )), Q rec,z (k; k r (β i )) 6. Compute J M by introducing the results of steps 1 to 5 into (29).

A significant simplification in the computation of the cost function can be obtained if it is assumed that the transient due to the initialization of the process equipped with its controller and supervision system has vanished, so that the state of system ( 6), ( 8), ( 12) is a weakly stationary random process. In this situation, m fa nom,z (k), Q fa nom,z (k), m nf a nom,z (k), Q nf a nom,z (k) are identical for all k and N k = N fa , a constant independent of k, while Ñk = N -kN fa . Besides m rec,z (k; i) and Q rec,z (k; i) only depend on the difference (ki), and similarly for m nom,β,z (k; i) and Q nom,β,z (k; i) (see [START_REF] Aberkane | Threshold selection based on closed-loop performance for fault detection[END_REF]).

NUMERICAL EXAMPLE

In this section, the proposed performance based threshold selection scheme will be illustrated using a winding machine example. The winding process is composed of a plastic web and three reels, respectively called the unwinding, pacer and rewinding reels. Each reel is coupled with a DC-motor via gear reduction. The angular speed of each reel and both tensions between the reels are measured by tachometers and tension meters. Each motor is driven by a local controller. The first control loop adjusts the motor current, while the second loop controls the angular speed. This system is linearized around the operating point U 0 = [ -0.15 0.6 0.15 ], X 0 = [ 0.6 0.5 0.4 ] and we obtain the following state space representation The state vector x t ∈ R 3 is composed of the unwinding tension, the angular speed and the winding tension, respectively. The command vector is composed by the current set point of the inner loop for the unwinding reel, the voltage command of the pacer motor and the current set point the inner loop for the winding reel.

For illustration purpose, we will consider the linear quadratic performance index given by:

J = 100 k=0 E(z k z k )
We assume that sensor 1 is subject to faults with a profile given as f (k) = β {min(α(kk 0 ), f max)}, where f max = 1, α = 0.5 and β is an uniformly distributed random variable in [0, 1]. The fault time occurrence k 0 is also assumed to be uniformly distributed random variable. The residual vector R k is obtained by stacking up (2 + 1) residual samples, i.e. l = 2. Figure 1 represents the evolution of the performance index J with respect to threshold h. This figure was obtained using the algorithm of section 3.4 with N = 10000. It can be seen that the optimal threshold, corresponding to the minimal value of J is given by h opt = arg min J = 13. This value is significantly lower than the threshold of a standard χ 2 test designed for a 95% or 99% false alarm probability which would respectively correspond to h = 16.9 or 21.7.

CONCLUSION

The optimization of the threshold of a fault detection system, on the basis of the closed-loop performance of the FTC system in which it is included, is considered. A simple situation where a sensor fault is accommodated by introduction of a software sensor in place of the hardware sensor is considered. The closed loop performance is computed by resorting to a combination of Monte Carlo simulation and standard tools from stochastic system theory in order

  initial conditions m rec (k r (β); k r (β)) = m nom,β (k r (β); k 0 ), Q rec (k r (β), k r (β)) = Q nom,β (k r (β); k 0 ).The mean and variance of z in the presence of a fault for the relevant values of k, m nom,β,z (k; k 0 ), Q nom,z (k; k 0 ), and m rec,z (k; k r (β)), Q rec,z (k; k r (β)) are deduced in a straightforward way.

  a sampled data model at sampling period T s = 0.1s. The covariance matrices of the noise signals are given as follows: Rw = 0.04 × I, Rη = 0.01 × I

Figure 1 .

 1 Figure1. Performance index J in function of h to limit the computational load. The proposed algorithm is illustrated on a fault tolerant controller for a winding machine.

  the set of values of the decision variable that cross (are below) the threshold h at time instant i, and let χ

	n j
	nom

Acknowledgment This work was performed in the framework of a Concerted Research Action supported financially by the "Ministère de la Communauté française -Direction générale de l'Enseignement non obligatoire et de la Recherche scientifique". Support by the IUAP Programme, initiated by the Belgian State, Science Policy Office, through the Belgian Network DYSCO is also gratefully acknowledged. The scientific responsibility rests with the authors.


Samir Aberkane
email: samir.aberkane@cran.uhp-nancy.fr

Ellipsoidal Output-Feedback Sets for H ∞ Control of a Class of Stochastic Hybrid Systems with State-Dependant Noise

Keywords: Active Fault Tolerant Control, Stochastic Hybrid Systems, Markovian Jumping Parameters, H∞ Control, Static Output Feedback, Ellipsoidal Sets, Linear Matrix Inequalities (LMI)

. It is also shown that the obtained results can easily be applied to the problematic of mode-independent static output feedback H∞ control of another class of stochastic hybrid systems known as Markovian Jump Linear Systems. Results are formulated as matrix inequalities one of which is nonlinear. A numerical algorithm based on nonconvex optimization is provided and its running is illustrated on classical examples from literature.

Introduction

As performance requirements increase in advanced technological systems, their associated control systems are becoming more and more complex. At the same time, complicated systems could have various consequences in the event of component failures. Therefore, it is very important to consider the safety and fault tolerance of such systems at the design stage. For these safety-critical systems, Fault Tolerant Control Systems (FTCS) have been developed to meet these essential objectives. FTCS have been a subject of great practical importance, which has attracted a lot of interest for the last three decades. A bibliographical review on reconfigurable fault tolerant control systems can be found in [START_REF] Zhang | Bibliographical review on reconfigurable fault-tolerant control systems[END_REF]. Active fault tolerant control systems are feedback control systems that reconfigure the control law in real time based on the response from an automatic fault detection and identification (FDI) scheme. The dynamic behaviour of Active Fault Tolerant Control Systems (AFTCS) is governed by stochastic differential equations and can be viewed as a general hybrid system [START_REF] Srichander | Stochastic stability analysis for continuous-time fault tolerant control systems[END_REF]. A major class of hybrid systems is Markovian Jump Linear Systems (MJLS). In MJLS, a single jump process is used to describe the random variations affecting the system parameters. This process is represented by a finite state Markov chain and is called the plant regime mode. The theory of stability, optimal control and H 2 /H ∞ control, as well as important applications of such systems, can be found in several papers in the current literature, for instance in [START_REF] Boukas | Static Output Feedback Control for Stochastic Hybrid Systems : LMI Approach[END_REF][START_REF] Boukas | Stabilization of Stochastic Nonlinear Hybrid Systems[END_REF][START_REF] Boukas | Exponential stabilizability of stochastic systems with Markovian jumping parameters[END_REF][START_REF] Costa | Continuous-time state-feedback H2-control of Markovian jump linear systems via convex analysis[END_REF][START_REF] De Farias | Output Feedback Control of Markov Jump Linear Systems in Continuous-Time[END_REF][START_REF] De Souza | H∞ Control For Linear Systems With Markovian Jumping Parameters[END_REF][START_REF] Chizeck | Controllability, stabilizability, and continuous-time Markovian jump linear quadratic control[END_REF][START_REF] Chizeck | Jump linear quadratic Gaussian control in continuous time[END_REF]. To deal with AFTCS, another class of hybrid systems was defined, denoted as AFTCSMP. In this class of hybrid systems, two random processes are defined : the first random process represents system components failures and the second random process represents the FDI process used to reconfigure the control law. This model was proposed by Srichander and Walker [START_REF] Srichander | Stochastic stability analysis for continuous-time fault tolerant control systems[END_REF]. Necessary and sufficient conditions for stochastic stability of AFTCSMP were developed for a single component failure (actuator failures). The problem of stochastic stability of AFTCSMP in the presence of noise, parameter uncertainties, detection errors, detection delays and actuator saturation limits has also been investigated in (Mahmoud et al., 1999a[START_REF] Jiang | Stochastic Stability Analysis of Active Fault-Tolerant Control Systems in the Presence of Noise[END_REF][START_REF] Jiang | Active Fault Tolerant Control Systems : Stochastic Analysis and Synthesis[END_REF]. Another issue related to the synthesis of fault tolerant control laws was also addressed by (Mahmoud et al., 1999b[START_REF] Shi | H∞-Control for Markovian Jumping Linear Systems with Parametric Uncertainty[END_REF][START_REF] Shi | Robust disturbance attenuation for discrete-time active fault tolerant control systems with uncertainties[END_REF]. In (Mahmoud et al., 1999b), the authors designed an optimal control law for AFTCSMP using the matrix minimum principle to minimize an equivalent deterministic cost function. The problem of H ∞ and robust H ∞ control was treated in [START_REF] Shi | H∞-Control for Markovian Jumping Linear Systems with Parametric Uncertainty[END_REF][START_REF] Shi | Robust disturbance attenuation for discrete-time active fault tolerant control systems with uncertainties[END_REF] for both continuous and discrete time AFTCSMP. The authors showed that the state feedback control problem can be solved in terms of the solutions of a set of coupled Riccati inequalities. The dynamic/static output feedback counterpart was treated by (Aberkane et al., 2005b[START_REF] Aberkane | H∞ Stochastic Stabilization of Active Fault Tolerant Control Systems : Convex Approach[END_REF], Aberkane et al., 2005a) in a convex programming framework. Indeed, the authors provide an LMI characterization of dynamical/static output feedback compensators that stochastically stabilize (robustly stabilize) the AFTCSMP and ensures H ∞ (robust H ∞ ) constraints. In addition, it is important to mention that the design problem in the framework of AFTCSMP remains an open and challenging problematic. This is due, particulary, to the fact that the controller only depends on the FDI process i.e. the number of controllers to be designed is less than the total number of the closed loop systems modes by combining both failure an FDI processes. The design problem involves searching feasible solutions of a problem where there are more constraints than variables to be solved. Generally speaking, there lacks tractable design methods for this stochastic FTC problem. Indeed, in (Aberkane et al., 2005b[START_REF] Aberkane | H∞ Stochastic Stabilization of Active Fault Tolerant Control Systems : Convex Approach[END_REF][START_REF] Jiang | Active Fault Tolerant Control Systems : Stochastic Analysis and Synthesis[END_REF][START_REF] Shi | H∞-Control for Markovian Jumping Linear Systems with Parametric Uncertainty[END_REF][START_REF] Shi | Robust disturbance attenuation for discrete-time active fault tolerant control systems with uncertainties[END_REF], the authors make the assumption that the controller must access both failures and FDI processes. However, this assumption is too restrictive to be applicable in practical FTC systems. In this note, the assumption on the availability of failure processes, for the synthesis purposes, is stressed. On the other hand, one of the most challenging open problems in control theory is the synthesis of fixed-order or static output feedback controllers that meet desired performances and specifications [START_REF] Syrmos | Static Output Feedback : A Survey[END_REF]. Among all variations of this problem, this note is concerned with the problem of static output feedback H ∞ control of continuous time AFTCSMP with state-dependent noise. This problematic is addressed under a new framework, based on the synthesis of ellipsoidal sets of controllers, introduced in [START_REF] Peaucelle | Ellipsoidal Sets for Static Output-Feedback[END_REF][START_REF] Peaucelle | Ellipsoidal Sets for Resilient and Robust Static Output-Feedback[END_REF]. The problematic resulting from the fact that the controller only depends on the FDI process is shown to be naturally dealt with in this context. It is also shown that the obtained results can easily be applied to the problematic of mode-independent static output feedback H ∞ control of MJLS. Results are formulated as matrix inequalities one of which is nonlinear. A numerical algorithm based on nonconvex optimization is provided and its running is illustrated on classical examples from literature. This paper is organized as follows : Section 2 describes the dynamical model of the system with appropriately defined random processes. A brief summary of basic stochastic terms, results and definitions are given in Section 3. Section 4 addresses the internal stochastic stabilization of the AFTCSMP. Sections 5 considers the H ∞ control problem for the output feedback. In Section 6, a numerical algorithm based on nonconvex optimization is provided and its running is illustrated on classical examples from literature. Finally, a conclusion is given in Section 7.

Notations. The notations in this paper are quite standard. R m×n is the set of m-by-n real matrices and S n is the subset of symmetric matrices in R n×n . A ′ is the transpose of the matrix A. The notation X ≥ Y (X > Y , respectively), where X and Y are symmetric matrices, means that X -Y is positive semi-definite (positive definite, respectively) ; I and 0 are identity and zero matrices of appropriate dimensions, respectively ; E{•} denotes the expectation operator with respect to some probability measure P ; L 2 [0, ∞) stands for the space of square-integrable vector functions over the interval [0, ∞) ; • refers to either the Euclidean vector norm or the matrix norm, which is the operator norm induced by the standard vector norm ; • 2 stands for the norm in L 2 [0, ∞) ; while • E2 denotes the norm in L 2 ((Ω, F, P ), [0, ∞)) ;

(Ω, F, P ) is a probability space. In block matrices, ⋆ indicates symmetric terms :

A B B ′ C = A ⋆ B ′ C = A B ⋆ C .

Dynamical Model of the AFTCSMP with Wiener Process

To describe the class of linear systems with Markovian jumping parameters that we deal with in this paper, let us fix a complete probability space (Ω, F, P ). This class of systems owns a hybrid state vector. The first component vector is continuous and represents the system states, and the second one is discrete and represents the failure processes affecting the system. The dynamical model of the uncertain AFTCSMP with Wiener Process, defined in the fundamental probability space (Ω, F, P ), is described by the following differential equations :

ϕ :          dx(t) = A(ξ(t))x(t)dt + B(η(t))u(y(t), ψ(t), t)dt +E(ξ(t), η(t))w(t)dt + v l=1 W l (ξ(t), η(t))x(t)d̟ l (t) y(t) = C 2 x(t) + D 2 (ξ(t), η(t))w(t) z(t) = C 1 x(t) + D 1 (η(t))u(y(t), ψ(t), t) [1]
where x(t) ∈ R n is the system state, u(y(t), ψ(t), t) ∈ R r is the system input, y(t) ∈ R q is the system measured output, z(t) ∈ R p is the controlled output, w(t) ∈ R m is the system external disturbance, ξ(t), η(t) and ψ(t) represent the plant component failure process, the actuator failure process and the FDI process, respectively. ξ(t), η(t) and ψ(t) are separable and mesurable Markov processes with finite state spaces Z = {1, 2, ..., z}, S = {1, 2, ..., s} and R = {1, 2, ..., r}, respectively.

̟(t) = [̟ 1 (t) . . . ̟ v (t)]
′ is a v-dimensional standard Wiener process on a given probability space (Ω, F, P ), that is assumed to be independent of the Markov processes. The matrices A(ξ(t)), B(η(t)), E(ξ(t), η(t)), D 2 (ξ(t), η(t)), D 1 (η(t)) and W l (ξ(t), η(t)) are properly dimensioned matrices which depend on random parameters. Remark 1 : For the existence and uniqueness of the solution of (1), we refer the reader to [], and the references therein. In AFTCS, we consider that the control law is only a function of the mesurable FDI process ψ(t). Therefore, we introduce a static output feedback compensator (ϕ s ) of the form :

ϕ s : u(t) = K(ψ(t))y(t) [2]
Applying the controller ϕ s to the AFTCSMP ϕ, we obtain the following closed loop system :

ϕ cl :          dx(t) = Ā(ξ(t), η(t), ψ(t))x(t)dt + Ē(ξ(t), η(t), ψ(t))w(t)dt + v l=1 W l (ξ(t), η(t))x(t)d̟ l (t) y(t) = C 2 x(t) + D 2 (ξ(t), η(t))w(t) z(t) = C1 (η(t), ψ(t))x(t) + D1 (ξ(t), η(t), ψ(t))w(t) [3]
where

Ā(ξ(t), η(t), ψ(t)) Ē(ξ(t), η(t), ψ(t)) C1 (η(t), ψ(t)) D1 (ξ(t), η(t), ψ(t)) = A(ξ(t)) E(ξ(t), η(t)) C 1 0 + B(η(t)) D 1 (η(t)) K(ψ(t)) C 2 D 2 (ξ(t), η(t))
2.1. The FDI and the Failure Processes ξ(t), η(t) and ψ(t) being homogeneous Markov processes with finite state spaces, we can define the transition probability of the plant components failure process as [START_REF] Jiang | Active Fault Tolerant Control Systems : Stochastic Analysis and Synthesis[END_REF][START_REF] Srichander | Stochastic stability analysis for continuous-time fault tolerant control systems[END_REF] :

   p ij (∆t) = π ij ∆t + o(∆t) (i = j) p ii (∆t) = 1 - i =j π ij ∆t + o(∆t) (i = j)
The transition probability of the actuator failure process is given by :

   p kl (∆t) = ν kl ∆t + o(∆t) (k = l) p kk (∆t) = 1 - k =l ν kl ∆t + o(∆t) (k = l)
where π ij is the plant components failure rate, and ν kl is the actuator failure rate. Given that ξ = k and η = l, the conditional transition probability of the FDI process

ψ(t) is :    p kl iv (∆t) = λ kl iv ∆t + o(∆t) (i = v) p kl ii (∆t) = 1 - i =v λ kl iv ∆t + o(∆t) (i = v)
Here, λ kl iv represents the transition rate from i to v for the Markov process ψ(t) conditioned on ξ = k ∈ Z and η = l ∈ S. Depending on the values of i, v ∈ R, k ∈ Z and l ∈ S, various interpretations, such as rate of false detection and isolation, rate of correct detection and isolation, false alarm recovery rate, etc, can be given to λ kl iv [START_REF] Jiang | Active Fault Tolerant Control Systems : Stochastic Analysis and Synthesis[END_REF][START_REF] Srichander | Stochastic stability analysis for continuous-time fault tolerant control systems[END_REF]. For notational simplicity, we will denote

•(ξ(t)) = • i when ξ(t) = i ∈ Z, •(η(t)) = • j when η(t) = j ∈ S, •(ξ(t), η(t)) = • ij , when ξ(t) = i ∈ Z, η(t) = j ∈ S and •(ψ(t)) = • k when ψ(t) = k ∈ R. We also denote •(t) = • t and the initial conditions •(t 0 ) = • 0 .

Definitions

In this section, we will first give some basic definitions related to stochastic stability notions and then we will summarize some results about exponential stability in the mean square sense of the AFTCSMP with Wiener process. Without loss of generality, we assume that the equilibrium point, x = 0, is the solution at which stability properties are examined.

Stochastic Stability

Definition 1 : System (3) is said to be (i) stochastically stable (SS) if there exists a finite positive constant K(x 0 , ξ 0 , η 0 , ψ 0 ) such that the following holds for any initial conditions (x 0 , ξ 0 , η 0 , ψ 0 ) :

E ∞ 0 x t 2 dt ≤ K(x 0 , ξ 0 , η 0 , ψ 0 ) [4]
(ii) internally exponentially stable in the mean square sense (IESS) if it is exponentially stable in the mean square sense for w t = 0, i.e. for any ξ 0 , η 0 , ψ 0 and some γ(ξ 0 , η 0 , ψ 0 ), there exists two numbers a > 0 and b > 0 such that when x 0 ≤ γ(ξ 0 , η 0 , ψ 0 ), the following inequality holds ∀t ≥ t 0 for all solution of (3) with initial condition x 0 :

E x t 2 ≤ b x 0 2 exp [-a(t -t 0 )] [5]
The following theorem gives a sufficient condition for internal exponential stability in the mean square sense for the system (ϕ) coupled with (ϕ s ).

Theorem 1 : The solution x = 0 of the system (ϕ) coupled with (ϕ s ) is internally exponentially stable in the mean square for t ≥ t 0 if there exists a Lyapunov function ϑ(x t , ξ t , η t , ψ t , t) such that

K 1 x t 2 ≤ ϑ(x t , ξ t , η t , ψ t , t) ≤ K 2 x t 2 [6]
and

Lϑ(x t , ξ t , η t , ψ t , t) ≤ -K 3 x t 2 [7]
for some positive constants K 1 , K 2 and K 3 .

A necessary condition for internal exponential stability in the mean square for the system (ϕ) coupled with (ϕ c ) is given by theorem 2.

Theorem 2 : If the solution x = 0 of the system (ϕ) coupled with (ϕ s ) is internally exponentially stable in the mean square, then for any given quadratic positive definite function W (x t , ξ t , η t , ψ t , t) in the variables x which is bounded and continuous ∀t ≥ t 0 , ∀ξ t ∈ Z, ∀η t ∈ S and ∀ψ t ∈ R, there exists a quadratic positive definite function ϑ(x t , ξ t , η t , ψ t , t) in x that satisfies the conditions in theorem 1 and is such that Lϑ(x t , ξ t , η t , ψ t , t) = -W (x t , ξ t , η t , ψ t , t).

Remark 2 : The proofs of these theorems follow the same arguments as in [START_REF] Jiang | Active Fault Tolerant Control Systems : Stochastic Analysis and Synthesis[END_REF][START_REF] Srichander | Stochastic stability analysis for continuous-time fault tolerant control systems[END_REF] for their proposed stochastic Lyapunov functions, so they are not shown in this paper to avoid repetition.

The following proposition gives a necessary and sufficient condition for internal exponential stability in the mean square sense for the system (3).

Proposition 1 : A necessary and sufficient condition for internal exponential stability in the mean square of the system (3) is that there exist symmetric positive-definite matrices P ijk , i ∈ Z, j ∈ S and k ∈ R such that :

Ã′ ijk P ijk + P ijk Ãijk + v l=1 W ′ lij P ijk W lij + h∈Z π ih P hjk + l∈S ν jl P ilk + v∈R λ ij kv P ijv = ג ijk < 0 [8]
∀i ∈ Z, j ∈ S and k ∈ R, where

Ãijk = A i + B j K k C 2 [9]
Proof : The proof of this proposition is easily deduced from theorems 1 and 2.

Proposition 2 : If the system (3) is internally exponentially stable in the mean square sense, then it is stochastically stable.

Proof : The proof of this proposition follows the same lines as for the proof of proposition 4 in (Aberkane et al., 2005a).

Matrix Ellipsoids

Through this note, a particular set of matrices is used. Due to the notations and by extension of the notion of R n ellipsoids, these sets are referred to as matrix ellipsoids of R (m×p) .

Definition 2 : [START_REF] Peaucelle | Formulation générique de problèmes en analyse et commande robuste par des fonctions de Lyapunov dépendant des paramètres[END_REF][START_REF] Peaucelle | Ellipsoidal Sets for Static Output-Feedback[END_REF][START_REF] Peaucelle | Ellipsoidal Sets for Resilient and Robust Static Output-Feedback[END_REF] Given three matrices X ∈ S q , Y ∈ R q×r and Z ∈ S r , the {X, Y, Z}-ellipsoid of R r×q is the set of matrices K satisfying the following matrix inequalities :

Z > 0 I K ′ X Y ⋆ Z I K ≤ 0 [10]
By definition, K 0 = -Z -1 Y ′ is the center of the ellipsoid and R = K ′ 0 ZK 0 -X is the radius. Inequalities [START_REF] Aberkane | Output Feedback H∞ Control of a Class of Stochastic Hybrid Systems with Wiener Process via Convex Analysis[END_REF] can also be written as

Z > 0 (K -K 0 ) ′ Z(K -K 0 ) ≤ R [11]
This definition shows that matrix ellipsoids are special cases of matrix sets defined by quadratic matrix inequality. Some properties of these sets are i) A matrix ellipsoid is a convex set ;

ii) the {X, Y, Z}-ellipsoid is nonempty iff the radius (R ≥ 0) is positive semi definite. This property can also be expressed as

X ≤ YZ -1 Y ′ [12]

Stochastic Stabilization

In this section, we shall address the problem of finding all static compensators (ϕ s ), as defined in section 2, such that the system (ϕ) coupled with (ϕ s ) becomes internally exponentially stochastically stable in the mean square. To this end, we use proposition 1 to get the following necessary and sufficient conditions for the internal exponential stability in the mean square of the system (3).

Proposition 3 : System (3) is internally exponentially stabilisable in the mean square by static output-feedback if and only if there exist matrices P ijk = P ′ ijk > 0, X k ∈ S q , Y k ∈ R q×r and Z k ∈ S r that simultaneously satisfy the following LMI constraints

Z k > 0 P ijk > 0 [13] I 0 A i B j ′ Θ ijk P ijk P ijk 0 I 0 A i B j < C 2 0 0 I ′ X k Y k ⋆ Z k C 2 0 0 I [14]
and the nonlinear inequalities constraints

X k ≤ Y k Z -1 k Y ′ k [15]
∀i ∈ Z, j ∈ S and k ∈ R, where

Θ ijk = v l=1 W ′ lij P ijk W lij + h∈Z π ih P hjk + l∈S ν jl P ilk + v∈R λ ij kv P ijv [16] Let {P ijk , X k , Y k , Z k } be a solution, then the nonempty {X k , Y k , Z k }-ellipsoids are sets of stabilizing gains.
Proof : The proof of this proposition follows essentially the same arguments as in [START_REF] Peaucelle | Ellipsoidal Sets for Resilient and Robust Static Output-Feedback[END_REF] : Sufficiency Assume that the constraints ( 13)-( 15) are satisfied for some {P ijk , X k , Y k , Z k } matrices. Due to the properties of matrix ellipsoids, the {X k , Y k , Z k }-ellipsoids are nonempty. Take any element K k . The LMI ( 14) implies that for all

x ′ t u ′ t = 0 x t A i x t + B j u t ′ Θ ijk P ijk P ijk 0 x t A i x t + B j u t < C 2 x t u t ′ X k Y k ⋆ Z k C 2 x t u t [17]
Definition 2 implies that for all nonzero trajectories

x ′ t ג ijk x t < y ′ t I K ′ k X k Y k ⋆ Z k I K k y t ≤ 0 [18] ∀i ∈ Z, j ∈ S and k ∈ R.
Then, the closed-loop exponential stochastic stability is assessed by proposition 1 for the quadratic stochastic Lyapunov function ϑ(ξ t , η t , ψ t ) = x ′ t P (ξ t , η t , ψ t )x t . Necessity Assume K k are stabilizing static output feedback gains and ϑ(ξ t , η t , ψ t ) = x ′ t P (ξ t , η t , ψ t )x t is a stochastic Lyapunov fonction. Then from proposition 1, we have

K k C 2 -I x t u t = 0 ⇒ x t u t ′ I 0 A i B j ′ Θ ijk P ijk P ijk 0 I 0 A i B j x t u t < 0 [19]
∀i ∈ Z, j ∈ S and k ∈ R.

Applying the well known Finsler Lemma [START_REF] Skelton | A Unified Algebraic Approach to Linear Control Design[END_REF], there exist scalars τ ijk such that

I 0 A i B j ′ Θ ijk P ijk P ijk 0 I 0 A i B j < τ ijk K k C 2 -I ′ K k C 2 -I ≤ ε k K k C 2 -I ′ K k C 2 -I [20]
where

ε k = max i,j
(τ ijk ). The inequality ( 14) is obtained with

X k = ε k K ′ k K k , Y k = -ε k K ′ k , Z k = ε k I
The bottom-right block implies 0 < Z k . Hence the proof is complete.

Remark 3 : The results developed above can be easily applied to the modeindependent static output feedback stochastic stabilization of MJLS. Indeed, let us consider the following closed loop dynamical model

ϕ cl :      dx(t) = Ā(φ t )x(t)dt + Ē(φ t )w(t)dt + v l=1 W l (φ t )x(t)d̟ l (t) y(t) = C 2 (φ t )x(t) + D 2 (φ t )w(t) z(t) = C1 (φ t )x(t) + D1 (φ t )w(t) [21]
where

Ā(φ t ) Ē(φ t ) C1 (φ t ) D1 (φ t ) = A(φ t ) E(φ t ) C 1 (φ t ) 0 + B(φ t ) D 1 (φ t ) K C 2 (φ t ) D 2 (φ t )
The process φ t represents a continuous time discrete state Markov process with values in a finite set H = {1, ..., h} with transition probability rate matrix Ξ = [Φ] i,j=1,...,h . In this case, the transition probability for the jump process, φ t , can be defined as :

p kj (∆t) = Φ kj ∆t + •(∆t) (k = j) [22] with j∈H j =i Φ ij = -Φ ii = Φ i .
Then, the following corollary can be stated

Corollary 1 : System ( 21) is internally exponentially stabilisable in the mean square by static output-feedback if and only if there exist matrices P i = P ′ i > 0, X ∈ S q , Y ∈ R q×r and Z ∈ S r that simultaneously satisfy the following LMI constraints

Z > 0 P i > 0 [23] I 0 A i B i ′ Θ i P i P i 0 I 0 A i B i < C 2i 0 0 I ′ X Y ⋆ Z C 2i 0 0 I [24]
and the nonlinear inequalities constraints

X ≤ YZ -1 Y ′ [25]
∀i ∈ H, where

Θ i = v l=1 W ′ li P i W li + v∈H Φ iv P v [26]
Let {P i , X, Y, Z} be a solution, then the nonempty {X, Y, Z}-ellipsoid is a set of stabilizing gains. ♦

The H ∞ Control Problem

Let us consider the system (3) with

z(t) = z ∞ (t) = C ∞1 x(t) + D ∞1 (η(t))u(y(t), ψ(t), t)
z ∞ (t) stands for the controlled output related to H ∞ performance.

In this section, we deal with the design of controllers that stochastically stabilize the closed-loop system and guarantee the disturbance rejection, with a certain level γ ∞ > 0. Mathematically, we are concerned with the characterization of compensators ϕ c that stochastically stabilize the system (3) and guarantee the following for all w ∈ L 2 [0, ∞) :

z ∞ E2 = E ∞ 0 z ′ ∞t z ∞t dt 1/2 < γ ∞ w 2 [27]
where γ ∞ > 0 is a prescribed level of disturbance attenuation to be achieved. To this end, we need the auxiliary result given by the following proposition.

Proposition 4 : If there exist symmetric positive-definite matrices P ∞ijk , i ∈ Z, j ∈ S and k ∈ R such that

Υ ijk C′ 1jk D1ijk + P ∞ijk Ēijk ⋆ D′ 1ijk D1ijk -γ 2 ∞ I = Φ ijk < 0 [28]
where

Υ ijk = Ã′ ijk P ∞ijk + P ∞ijk Ãijk + v l=1 W ′ lij P ∞ijk W lij + C′ 1jk C1jk + h∈Z π ih P ∞hjk + l∈S ν jl P ∞ilk + v∈R λ ij kv P ∞ijv ∀i ∈ Z, j ∈ S and k ∈ R.
then the system (3) is stochastically stable and satisfies

z ∞ E2 = E ∞ 0 z ′ ∞t z ∞t dt 1/2 < γ ∞ w 2 [29]
Proof : See (Aberkane et al., 2005a).

Using the previous proposition, the following H ∞ control result can be stated.

Proposition 5 : If there exist matrices P ∞ijk = P ′ ∞ijk > 0, X k ∈ S q , Y k ∈ R q×r and Z k ∈ S r that simultaneously satisfy the following LMI constraints

Z k > 0; P ∞ijk > 0 [30] M ′ 1ij Θ ijk P ∞ijk P ∞ijk 0 M 1ij < M ′ 2j -I 0 0 γ 2 ∞ I M 2j + M ′ 3ij X k Y k ⋆ Z k M 3ij [31]
and the nonlinear inequalities constraints

X k ≤ Y k Z -1 k Y ′ k [32]
∀i ∈ Z, j ∈ S and k ∈ R, where

M 1ij = I 0 0 A i E ij B j , M 2j = C ∞1 0 D ∞1j 0 I 0 , M 3ij = C 2 D 2ij 0 0 0 I . then the {X k , Y k , Z k }-ellipsoids are sets of stabilizing gains such that z ∞ E2 = E ∞ 0 z ′ ∞t z ∞t dt 1/2 < γ ∞ w 2 [33]
Proof : The proof of this proposition follows the same arguments as for the proof of proposition 3.

Remark 4 : As for the internal stochastic stabilization problematic, the modeindependent static output feedback H ∞ control of MJLS can be solved in the same way as for AFTCSMP. This result is illustrated by corollary 2.

Corollary 2 : If there exist matrices P ∞i = P ′ ∞i > 0, X ∈ S q , Y ∈ R q×r and Z ∈ S r that simultaneously satisfy the following LMI constraints

Z > 0 P ∞i > 0 [34] M ′ 1i Θ i P ∞i P ∞i 0 M 1i < M ′ 2i -I 0 0 γ 2 ∞ I M 2i + M ′ 3i X Y ⋆ Z M 3i [35]
and the nonlinear inequalities constraints

X ≤ YZ -1 Y ′ [36]
∀i ∈ H, where

M 1i = I 0 0 A i E i B i , M 2i = C ∞1i 0 D ∞1i 0 I 0 , M 3i = C 2i D 2i 0 0 0 I .
then the {X, Y, Z}-ellipsoid is a set of stabilizing gains such that

z ∞ E2 = E ∞ 0 z ′ ∞t z ∞t dt 1/2 < γ ∞ w 2 [37]
♦ 6. Computational Issues and Examples

A Cone Complementary Algorithm

The numerical examples are solved using a first order iterative algorithm. It is based on a cone complementary technique [START_REF] Ghaoui | A Cone Complementary Linearization Algorithm for Static Output-Feedback and related Problems[END_REF], that allows to concentrate the non convex constraint in the criterion of some optimisation problem.

Lemma 1 : The problem ( 30)-( 32) is feasible if and only if zero is the global optimum of the optimisation problem

                   min tr(TS) s.t. (30), (31)
X k ≤ X k S k = X k Y k ⋆ Z k ≥ 0 T 1k ≥ I T k = T 1k T 2k ⋆ T 3k ≥ 0 [38]
where

S = diag{S 1 , . . . , S r }, T = diag{T 1 , . . . , T r } Proof :
The proof of this Lemma follows the same arguments as in [START_REF] Peaucelle | Ellipsoidal Sets for Resilient and Robust Static Output-Feedback[END_REF]. With the constraints T k ≥ 0 and S k ≥ 0, we have that T ≥ 0 and S ≥ 0 which induce the following implications

tr(TS) = 0 ⇒ TS = 0 ⇒ T k S k = 0, ∀k ∈ R [39]
Therefore, after some manipulations, one gets

X k = -T -1 1k T 2k Y ′ k = -T -1 1k (-T 1k Y k Z -1 k )Y ′ k = Y k Z -1 k Y ′ k
Thus the nonlinear constraints is satisfied

X k ≤ X k = Y k Z -1 k Y ′ k The converse implication is proved taking X k = Y k Z -1 k Y ′ k and T k such that T k S k = 0, ∀k ∈ R.
As in [START_REF] Ghaoui | A Cone Complementary Linearization Algorithm for Static Output-Feedback and related Problems[END_REF][START_REF] Peaucelle | Ellipsoidal Sets for Resilient and Robust Static Output-Feedback[END_REF], the optimisation problem (38) can then be solved with a first order conditional gradient algorithm also known as the Franck and Wolfe feasible direction method. Its properties are not reminded here. Not only that the nonlinear objective tr(TS) is relaxed as the linear objective tr(T h S + TS h ). The obtained LMI optimisation is repeated iteratively with matrices T h and S h computed from each previous optimisation step. The obtained sequence, tr(T h S h ), is strictly decreasing. However, there is no guarantee that the algorithm converges to the global optimum.

Remark 5 : [START_REF] Peaucelle | Ellipsoidal Sets for Resilient and Robust Static Output-Feedback[END_REF] The stoping criteria of the usual gradient algorithm is either related to slow progress of the optimisation objective or to the achievement of tr(TS) = 0. In the first case, the algorithm fails due to "plateauing" behavior or because it found a non satisfactory local optimum. The second case corresponds to the expected success of the algorithm. Unfortunately, due to the constraints T ≥ 0 and S ≥ 0 the algorithm is more often stopped while tr(TS) = ǫ where ǫ is a chosen accuracy level. The exact non linear constraint may then not be exactly satisfied which is a significant weakness of the algorithm. As a matter of fact, since the equality constraints involving X k are not the goal of the original problem ( 30)-(32), in the numerical example below we adopted the following stoping criteria for the conditional gradient algorithm.

• If tr(T h-1 S h-1 -T h S h ) is below a chosen level, then STOP, the algorithm failed. • As soon as X k ≤ Y k Z -1 k Y ′ k , ∀k ∈ R, STOP
, required ellipsoids are found.

Numerical Examples a) Fault Tolerant Control

In this section, the proposed H ∞ static output feedback control of AFTCSMP is illustrated using a flight control example. Consider the nominal system with

A =       -0.0565
29.072 -175.610 9.6783 1.6022 -0.0601 -0.7979 -0.2996 0 0 9.218 × 10 -3 -0.0179 -0.1339

0 0 0 1 0 0 0 0 0 1 0 0       , B =      
-0.1339 0.1339 2.0092 2.3491 -2.3491 0.7703 0.0444 -0.0444 -1.3575

0 0 0 0 0 0       , E =       1.0 0.0 0.0 0.5 0.1 0.1 0.1 0.0 0.0 0.1       , C 2 = 0 0 0 0 1 , C ∞1 =   0 1 0 0 0 0 0 1 0 0 0 0 0 0 0   , W 1 = 0.1 × I, D 2 = 0.1 0.1 , D ∞1 =   1 0 0 0 1 0 0 0 1   .
This model is adapted from [START_REF] Maki | A Stability Guaranteed Active Fault Tolerant Control System Against Actuator Failures[END_REF]. It represents the lateral-directional dynamics of McDonnell F-4C Phantom flying at Mach 0.6 at an altitude of 35000 ft. The states x i , i = 1, . . . , 5 denote the lateral velocity (ft per second), the roll rate (radian per second), yaw rate (radian per second), roll angle (radian) and yaw angle (radian), respectively. The control inputs u 1 , u 2 and u 3 correspond to the left aileron, the right aileron and the rudder surface displacement, respectively.

For illustration purposes, we will consider two faulty modes : i) Mode 2 : A 50% power loss on the left aileron ;

ii) Mode 3 : Right aileron outage.

From above, we have that S = {1, 2, 3}, where the mode 1 represents the nominal case. The failure process is assumed to have Markovian transition characteristics. The FDI process is also Markovian with three states R = {1, 2, 3}. The actuator failure rates are assumed to be :

[π ij ] =  
-0.002 0.0010 0.0010 0.0010 -0.002 0.0010 0.0010 0.0010 -0.002

 

The FDI conditional transition rates are : For the above AFTCSMP, several numerical experiments are performed using the cone complementary algorithm. These tests are realised for various specifications on the H ∞ performance (γ ∞ ). Here are presented some cases described in Table 1, where iter is the number of the algorithms iterations, time is the computation time (LMIs solved with LMI toolbox, Matlab 6.5.1), Tr(TS) is the value of the optimisation criteria trace (T k S k ) at the step when the algorithm stopped, and K k0 , k = 1, 2, 3 are the controllers obtained as the centers of the stabilising ellipsoids.

Conclusion

In this paper, the static output feedback H ∞ control of continuous time AFTCSMP was considered within a new framework. This last one is based on the synthesis of ellipsoidal sets of controllers and was introduced by [START_REF] Peaucelle | Ellipsoidal Sets for Static Output-Feedback[END_REF][START_REF] Peaucelle | Ellipsoidal Sets for Resilient and Robust Static Output-Feedback[END_REF]. The problematic resulting from the fact that the controller only depends on the FDI process is shown to be naturally dealt with in this context. It was also shown that the obtained results could easily be applied to the problem of mode-independent static output feedback H ∞ control of Markovian Jump Linear Systems. The numerical resolution of the obtained results was done using a cone complementary algorithm and its running was illustrated on classical examples from literature.

  We applied the proposed static output feedback H ∞ control to a VTOL helicopter model adapted from[START_REF] De Farias | Output Feedback Control of Markov Jump Linear Systems in Continuous-Time[END_REF]. The dynamics can be written asdx t = A(φ t )x t dt +B(φ t )u(y t , t)dt +Ew t dt + W 1 x t d̟ t y t = C 2 x t + D 2 w t z ∞t = C ∞1 x t + D ∞1 u(y t , t)where φ t indicates the airspeed. The parameters are given by A(φ t ) = -0.0366 0.0271 0.0188 -0.4555 0.0482 -1.01 0.0024 -4.0208 0.1002 a 32 (φ t ) -0.

	test	γ 2 ∞	iter	time(s)	Tr(TS)		K ′ 10			K ′ 20			K ′ 30
	1	20	3	28.9060	615.7093	-0.7589	0.9560	0.6559	-0.7007	1.1969	0.6718	-1.2359	-0.1512	0.6826
	2	10	3	28.8750	810.2702	-0.7694	1.0038	0.6897	-0.7056	1.2640	0.7075	-1.2744	-0.1605	0.7129
	3	5	3	28.0620	4.1924e+003	-0.7843	1.1103	0.7451	-0.7187	1.3857	0.7645	-1.3583	-0.1397	0.7706
	4	1	10	126.6410	1.4087e+006		fails			fails			fails
				Tableau 1. Numerical experiments
				  
				 
					
					  
				b) Mode-Independent Control of MJLS

  The behavior of φ t is modelled as a Markov chain with three different states, corresponding to airspeeds of 135 (nominal value), 60, 170, Knots. The values of parameters a 32 , a 34 , and b 32 are shown in Table2. As for the previous example, several numerical experiments are performed using the cone complementary algorithm. These tests are realised for various specifications on the H ∞ performance (γ ∞ ). Here are presented some cases described in Table3, where K 0 is the controller obtained as the center of the stabilising ellipsoid.

	The transition matrix is given by
			-0.0907 0.0671	0.0236	
	Ξ =		0.0671 -0.0671	0	
			0.0236	0	-0.0236
	test γ 2 ∞ 1 10	iter time(s) Tr(TS) 3 2.2810 15.2404	K ′ 0 0.4321 -0.4037
	2		5	3	1.8750	3.6171	0.2692 -0.3942
	3		1	3	4.1250	0.2235	0.2465 -0.3116
	4		0.5	11	10.9060 751.6071	fails
	Tableau 3. Numerical experiments
				Airspeed (Knots)	a 32	a 34	b 21
				135		0.3681 1.4200 3.5446
				60		0.0664 0.1198 0.9775
				170		0.5047 2.5460 5.1120
	Tableau 2. Parameters

ANNEXE POUR LE SERVICE FABRICATION