Panayiotis M. Papadopoulos,, Vasso Reppa,,Marios M. Polycarpou,, and Christos G. Panayiotou, Senior

Abstract—The enormous energy use of the building sector and the requirements for indoor living quality that aim to improve occupants’ productivity and health, prioritize Smart Buildings as an emerging technology. The Heating, Ventilation and Air-Conditioning (HVAC) system is considered one of the most critical and essential parts in buildings since it consumes the largest amount of energy and is responsible for humans comfort. Due to the intermittent operation of HVAC systems, faults are more likely to occur, possibly increasing eventually building’s energy consumption and/or downgrading indoor living quality. The complexity and large scale nature of HVAC systems complicate the diagnosis of faults in a centralized framework. This paper presents a distributed intelligent fault diagnosis algorithm for detecting and isolating multiple sensor faults in large-scale HVAC systems.Modeling the HVAC system as a network of interconnected subsystems allows the design of a set of distributed sensor fault diagnosis agents capable of isolating multiple sensor faults by applying a combinatorial decision logic and diagnostic reasoning. The performance of the proposed method is investigated with respect to robustness, fault detectability and scalability. Simulations are used to illustrate the effectiveness of the proposed method in the presence of multiple sensor faults applied to a 83-zone HVAC system and to evaluate the sensitivity of the method with respect to sensor noise variance.

I. Introduction

A. Motivation

ACCORDING to the National Human Activity Pattern Survey (NHAPS), an average person in USA spends 86.9% of his/her life indoors [1]. The motivation for the development of smart buildings is the need to increase the energy efficiency of buildings [2], and the reliability of building’s automation process [3], while decreasing the risk of safetycritical conditions [4], [5]. Since humans spend so much of their time indoors, health and living quality highly depends on the indoor conditions related to humidity, temperature, quality of air and many more. These factors are closely related to the safe and reliable operation of the Heating, Ventilation and Air-Conditioning (HVAC) system.

HVAC systems are complex machines that consist of a large number of interconnected components. Faults in electrical and mechanical equipment such as sensors, wires, fans, valves,pumps of the HVAC system are inevitable due to its continual operation. Faults can increase the energy consumption and create discomfort conditions for occupants. The feedback control performance of the HVAC system depends on the availability and reliability of sensor measurements. Advances in wireless network technology and Internet of Things (IoT)technology have enhanced the availability of data in buildings[6]. However, data unreliability due to potential sensor faults can be a major drawback for the performance of the feedback control process.

B. Literature Survey

Fault diagnosis is a well-established procedure to discover anomalies in systems [7]. Currently, the industry of HVAC control systems usesruled-basedalgorithms to diagnose anomalies during the operation of HVAC systems. The rules are formed by comparing sensor data or relations of sensor data with predefined constant thresholds obtained by experts;sometimes these are also called expert systems. Some examples of ruled-based fault diagnosis schemes for HVAC systems are: 1) the performance assessment rules that identify the mode of operation using specific relationships of measured information [8], [9]; and 2) the cause-effect graphs where the various operation modes of the system (both healthy and faulty modes) are represented as discrete events [10], [11].The main weaknesses of rule-based fault diagnosis methods are that they are very specific to the system, can fail beyond the boundaries of the expertise incorporated in them, and are difficult to update [12]; in other words, ruled-based fault diagnosis methods do not employ any adaptability when the algorithm is applied to HVAC systems and buildings with different properties and/or parameters.

Intelligent fault diagnosis algorithms can be divided into two categories;data-driven/data-miningandmodel-basedfault diagnosis algorithms. The former category includes traditional computational intelligence algorithms that originate from machine learning and pattern recognition. Most of the datadriven methods require historical data (i.e., database of sensor data) for training the fault decision rules. Amongst the popular data-driven methods are: principal component analysis (PCA)[13], [14], support vector machines (SVM) [15]–[18], neural networks (NN) [19], [20], genetic algorithms (GA) [21], [22],fuzzy logic models [23], [24], etc.

Model-based fault diagnosis methods can be classified according to the type of model, that is;statisticalandstatespacemodels. Statistical models use data to identify a simple model such as: autoregressive model with exogenous inputs(ARX) [25], autoregressive moving average model with exogenous inputs (ARMAX) [26], [27], fast Fourier transform(FFT) model [28]. The statistical models try to predict the output of the system during operation using techniques such as average error of residuals. Statistical analysis employs simplistic models that require a training interval to obtain the corresponding model parameters and the state of the system(e.g., temperature). The state is represented as a random variable that is a linear combination of its previous values. In order to obtain a valid prediction of system’s state using statistical models, an adequate training and knowledge of the initial state of the system are required. The latter subcategory corresponds to the state estimation models that perform online learning of the state based on the real-time data of the system.Some examples of fault diagnosis algorithms based on state estimation models are: the Kalman filtering approach [29] and the observer-based estimation schemes [30], [31]. State estimation techniques allow the utilization of nonlinear representations of the system dynamics that provide a more realistic characterization of the heat transfer processes,compared to the aforementioned methods that employ an approximated model.

The utilization of analytical models describing the physical environment of the building and the HVAC system is challenging because of: 1) the possibly unknown thermal properties; 2) the large number of physically interconnected building zones; and 3) the complexity of the electromechanical part of the HVAC system. A recently established European legislative framework about energy performance of buildings directive, includes the issuing of buildings energy performance certificates. Thermal quality of the building envelope (e.g., structure, material values) and energy efficiency of building equipment (such as heating and cooling systems) are required for the certificate, thus building’s and HVAC system’s thermal properties can be available for the state-space representation of system’s dynamics.

Model-based fault diagnosis algorithms can be applied without necessitating any training period compared to datadriven methods that cannot guarantee the robustness of the decision outcome (i.e., detection, isolation), since the decision highly depends on the training set, that may no cover all the possible sensor fault scenarios. Data-driven methods commonly use a fixed, pre-designed detection threshold calculated using a training set [14], [32]–[34]. Hence, false alarms may be triggered in the presence of an event that was not included in the training set. Further, with respect to the fault isolation procedure, data-driven methods necessitate historical data of faulty situations (that are typically difficult to obtain) in order to build the isolation logic.

Most works in the literature of model-based fault diagnosis address the problem of fault diagnosis for single-zone HVAC systems [22], [35]–[37]. Only few of them deal with fault diagnosis in multi-zone HVAC systems, instead assuming that there is no heat transfer between zones [38]–[41], or assuming that there is heat transfer between zones only through walls(no doors) [40], [42]. Albeit simpler, these models may be unrealistic in practice because they cannot capture the variant heat transfer between building zones due to the presence of doors, which is a stronger physical interconnection than the heat transfer through walls. Ignoring the strong physical interconnections between building zones can result in high modeling errors, which may cause false alarms or missed fault detection.

In large-scale buildings, the utilization of a global model describing the entire building system can be prohibitive for the design of a model-based fault diagnosis technique.Exploiting the distributed topology of the building system,every fault diagnosis agent can be designed to monitor a single building zone and to execute the fault isolation process locally, while taking into account faults that affect part of the building system and not the entire system [43]. This strategy is effective for handling the problem of the occurrence of multiple homogeneous or heterogeneous faults [31], [41].Moreover, the distributed architecture can be scalable in the case that the building topology evolves, since a new fault diagnosis agent dedicated to the new building part can be augmented, similar to a plug-and-play approach [44]. With the spatially distributed deployment of the fault diagnosis agents,there is no central point for executing the fault diagnosis process that corresponds to a “single point of failure.” This is especially important in safety-critical buildings such as hospitals, schools, and other public buildings.

In previous works, the authors designed and evaluated a distributed approach for sensor fault detection and isolation[39], [40] and distributed sensor fault accommodation [42],[45] in HVAC systems. More recently, the authors proposed a distributed methodology to identify and isolate actuator and sensor faults [31]. However, the performance of the fault diagnosis methods in the aforesaid studies was evaluated in small-scale buildings. Moreover, the analysis of the detectability was only examined in a HVAC system with separated zones where the heat transfer between zones(through walls and/or doors) was not considered in system’s dynamics [41]. Modeling the heat transfer between zones leads to non-linear, non-Lispschitz dynamic terms that can create a more realistic model and thus less conservative fault detection thresholds. This can improve the detectability aspect of the algorithm since the modelling error is reduced and moreover can avert any false alarms caused by the event of an opened door. However, dealing with hard nonlinearities creates challenges with the design and analysis.

C. Contribution

The goal and main contribution of this work is the design of a scalable distributed model-based method for diagnosing multiple sensor faults in large-scale HVAC systems, while taking into account interconnected building zones through walls and doors. Based on the topology of the HVAC system and the building zones, the overall system is divided into interconnected subsystems. A sensor set S(i)collects the measurements of each subsystem. A local sensor fault diagnosis agent M(i)is designed to monitor the corresponding sensor set S(i)and to detect and isolate single and multiple sensor faults based on local state estimation obtained using local information and information transmitted from its neighboring agents (e.g., control inputs, sensor measurements)as illustrated in Fig. 1. Each dedicated sensor fault diagnosis agent M(i)is comprised of a distributed sensor fault detection module and a distributed sensor fault isolation module. The former is responsible for detecting the occurrence of sensor faults in the monitored subsystem and/or its neighboring interconnected subsystems. A local detection signal is generated by comparing the residual (that corresponds to the discrepancies between the output and the expected output)with the corresponding adaptive threshold (designed to bound the residual under healthy conditions).

Fig. 1. Architecture of the distributed sensor fault diagnosis scheme for smart buildings.

Based on the local state estimation, each agent can detect sensor faults affecting either the local or the neighbouring subsystems. The distributed sensor fault isolation module,which is activated based on the local detection decision, takes into consideration the connectivity (due to the exchange of information between the distributed diagnosis agents) in order to construct a fault signature matrix that can eliminate a number of possible sensor faults and under some conditions can pinpoint the exact location of sensor faults. The performance analysis of the proposed method is provided with respect to robustness, fault detectability and scalability, taking into account modelling uncertainties and strong physical interconnections between the building zones that can improve the fault detectability of the algorithm since the modelling error is reduced and moreover can avert false detection alarms caused by the event of an opened door. Finally, simulation results generated by the application of the proposed method to a large-scale HVAC building system show its effectiveness.

D. Paper Organization

The paper is organized as follows. Section II presents the problem formulation that consists of the description of the HVAC system and the network configuration. In Section III the architecture of the distributed sensor fault diagnosis methodology is given. The performance of the method is analyzed in Section IV. Section V presents some simulation results of a multiple sensor fault scenario for 83-zone HVAC system, followed by some concluding remarks in Section VI.

E. Nomenclature

Tst(t) (°C) water temperature in the storage tank

Tzi(t) (°C)i-th zone air temperature

Nnumber of zones

Tpl(t) (°C) plenum (duct) temperature

To(t) (°C) source heat temperature of the heat pump

Ps(Tst(t)) performance coefficient of the heat pump

Pmaxrated maximum value ofPs(Tst(t))

?Tmax(°C) maximum temperature difference for the heat pump

Cst(kJ/°C) heat capacity of the storage tank

Ui,max(kg/h) maximum mass flow rate of hot water through the coil placed at thei-th zone

Ust,max(kJ/h) heat pump rated capacity

asz(kJ/kg °C) effectiveness of the heating coil

ast(kJ/kg °C) heat loss coefficient of storage tank from exterior surfaces

ui(t) mass flow rate of hot water flowing in the coil ofi-th zone

ust(t) normalized energy in the heat pump

Ti1(t) (°C) known temperature of the surface node of the mass wall in thei-th zone

Tamb(t) (°C) known ambient temperature

h(W/m2°C) heat transfer coefficient due to the presence of walls

Awi(m2) surface area of the mass wall

Czi(kJ/°C) air heat capacity of thei-th zone

azi(kJ/h °C) heat loss coefficient of thei-th zone

azi,j(kJ/h °C) inter-zone heat loss coefficient betweeni-th andj-th zone due to the presence of walls

Adi,j(m2) area of the door connectingi-th andj-th zone

linearized parts of subsystems

ΣsΣ(i)bilinear terms of subsystems ,

ΣsΣ(i)interconnection terms of subsystems ,

ΣsΣ(i)uncertainty terms of subsystems ,

Kiset of indices of zones that are interconnected with thei-th zone

reference signals for the statesTst,Tzi

unknown measurement noise of sensors

fs,f(i)unknown sensor faults of sensors Ss,S(i)

ys,y(i)measurements of sensors Ss,S(i)

εs,ε(i)residuals of fault diagnosis agents Ms,M(i)

II. Problem Formulation

This section first presents the dynamics of a multi-zone HVAC system and then characterizes the multi-zone HVAC model as a network of interconnected subsystems that will be used to design the distributed sensor fault diagnosis scheme.

A. HVAC System Description

This subsection presents the modeling of a multi-zone HVAC system, which is an extended version of the model presented in [46], [47] using terms from [48]. The overall modeling approach is illustrated in Fig. 2(a) using a simple example of a 5-zone HVAC system with heating operation.The electromechanical part of the system consists of a hot water unit, e.g., heat pump, condenser, storage tank (orange box in Fig. 2(a)). The hot water from the storage tank is circulated in the fan-coil units located in the plenum of each zone (black boxes in Fig. 2(a)) and then returns back to the storage tank. The same structure of the HVAC system can be used also for cooling operation by replacing the heat pump with a chiller. The water temperature in the storage tank is described by the thermal-mass balance equation expressed as

where

withi∈N, N ={1,...,N}.

Thei-th zone temperature dynamics can be described as

withj∈Ki,. It is noted that Kiis the set that consists of the indices of zones that are interconnected with thei-th zone.

The objective is to develop a distributed estimation scheme using real-time sensor information for detecting and isolating abnormal behavior in the operation of the HVAC systems produced by the presence of sensor faults. The aforementioned thermal-mass balance equations are used in order to incorporate available modelling information in the estimation scheme (instead of using completely black-box methods). Also, it is important to note that the thermal-mass balance equations are not assumed to be completely accurate since the dynamics are characterised by unknown or uncertain terms.

B. Network Configuration

The constantAsis defined asandThe defined function χscollects all the dynamics ofTst. Each subsystem Σ(i)for alli∈N, is interconnected with subsystems Σsand Σ(j),j∈Ki, described by

Fig. 2. The distributed sensor fault diagnosis architecture for a 5-zone HVAC system. From: (a) the physical system; (b) the mathematical model of the system; and (c) The distributed sensor fault diagnosis architecture. Specifically each subfigure shows: (a) Schematic representation of a multi-zone HVAC system that consists of the hot water unit (orange box) and the 5 building zones that are interconnected through walls and doors. The black rectangular boxes located in each zone represent the fan-coil units; (b) The subsystems network configuration of the 5-zone HVAC system. The black arrows denote the shared states between the interconnected subsystems; (c) the distributed sensor fault diagnosis agents M s and M (1),...,M(5). The black arrows denote the exchange of information between the diagnosis agents.

The water temperature of Σs(storage tank) is measured by the sensor Ss, characterized by

whereys(t) is the sensor output andns(t) is the unknown measurement noise. The output of the sensor S(i)used to measure the air temperature of subsystem Σ(i)(zonei), i.e.,

wherey(i)(t) is the sensor output andn(i)(t) is the unknown measurement noise. The signalsf sandf(i)denote unknown sensor faults, defined as

wheremodel the first time instants of fault occurrence,are the fault functions and βs, β(i)denote their time profiles wherewith

where αs, α(i)being the time evolution rate of sensor faultsf s,f(i), respectively. Note that α →∞ models an abrupt fault,while α →0 describes a fault that evolves gradually.

The objective of this work is to design a scalable distributed methodology for detecting the faulty operation of the temperature sensors in the multi-zone HVAC system and isolating the location of the faulty sensors. Faults may occur at an unknown time in one or more building zones or in the electromechanical part of HVAC. The proposed methodology is designed taking into account the following assumption.

Assumption 1: For allt≥0 , the modeling uncertaintiesrs(t),r(i)(t) and measurement noisens(t),n(i)(t) are uniformly bounded such thatandfor alli∈N.

Remark 1:The above assumption characterizes known bounds on the modeling uncertainty and measurement noise,which are required in order to distinguish between the occurrence of sensor faults and the presence of modeling uncertainties and measurement noise.

III. Distributed Sensor Fault Diagnosis Architecture

Based on the network ofN+1 interconnected subsystems presented in Section II-B, a bank of distributed monitoring agents is developed. Fig. 2(c) illustrates the distributed structure of the sensor fault diagnosis agents (red boxes),dedicated to subsystem Σs(left) and to each subsystem Σ(i),i∈{1,...,5}(right). Every distributed sensor fault diagnosis agent is composed by the following two modules.

1)Sensor Fault Detection Module: Using the available(local and shared) sensor measurements and control inputs, an estimatorisdesigned basedontheknown nonlineardynamics of itsmonitoredsubsystem.Aresidual,whichcorrespondsto thedeviationof the measured(observed)outputof the monitoredsubsystemfrom theexpectedoutput,isgenerated on-line.BasedonAssumption1andconsideringahealthy system,anadaptivethresholdisdesignedto bound the residualateverytimeinstant.Boththe residualand the adaptivethresholdaremonitoredon-line.The violationof the adaptive thresholdindicatesthepresenceof sensorfaultsand activates the sensor fault isolation module.

2)Sensor Fault Isolation Module:Thelocaldecisionabout theoccurrenceofsensorfaultsisprocessedincombination withthedecisionsof the neighboringagents,aimingat isolating multiplesensor faults.

A. Distributed Sensor Fault Detection Module

Thedesignof thedistributedsensorfaultdetection module includesthecomputationof residualsandadaptivethresholds,andtheformulationofthesensorfaultdetectiondecision logic.

1) ResidualGeneration:Theresidualεsgenerated bythe agent Msisdefined as

where

whereistheestimationofthestateTstwithandLsisthe observer gain selected such that (As?Ls) isnegative.Let usdefinetheestimationerror asthen based on (4)and (16),satisfies

wherePsisdefinedin(2).Basedon(10),the residualεsdefined in (15)can bere-written as

Remark2:Given(10),(11),and(17)–(19),ityieldsthat εscan beaff ected byafaultinsensor Ssand/oranysensorfault in S(i),i∈N.

The residual ε(i)generated bythemonitoringagentM(i),i.e.,

where

whereistheestimation of thestate(i-th zone airtemperature),andL(i)istheobservergainselectedsuchthatisnegativeforalli∈N.Letusdefinetheestimationerrorasthensatisfies

with

Basedon(11), theresidual ε(i)definedin(21)can berewritten as

Remark 3:Given(10),(11),and(23)–(25),ityieldsthat the residual ε(i)can beaffected by asensor fault in S(i)and/or any sensor fault in S(j),j∈Ki(sensorsof neighboring subsystems)and/or sensor faultsin Ss.

2) AdaptiveThreshold Design:Theadaptivethresholdassociated withtheagent Msisdesignedto bound the residualunderhealthyconditions(allsensorsare healthy),which is denoted byParticularly,isdefined as

By bounding thesolution of (17)and using (30),it yields

Similarly, the adaptive thresholdassociated with the agent M(i)is designed to boundthat denotes the residual under healthy conditions, defined as

By bounding the solution of (23) and using (34), it yields

whereysandy(i)are described by (10) and (11), respectively.The implementation ofandcan be realized using linear filtering techniques; i.e.,can be implemented asthat corresponds to the output of the stable, linear filter ρ /(s+ζ) with inputz(t).

Remark 4:Note that under the occurrence of sensor faults,may be affected by a fault in sensor Ssandmay be affected by faults in sensor S(i)and S(j)for allj∈Ki.process performed by the agents Msand M(i)is based on

3) Sensor Fault Detection Logic: The sensor fault detection checking online whether the following analytical redundancy relations (ARR), denoted by Esand E(i), are satisfied

where εsandare defined in (15) and (36), while ε(i)andare given in (21) and (37). Hence, the boolean decision signalDs(correspondinglyD(i)) indicates the violation of Es(correspondingly of E(i)) such asDs(D(i)), i.e., when the thresholdis violated by the absolute value of the corresponding residual εs( ε(i),i∈N).

The distributed isolation procedure applied by each agent involves the comparison of the observed pattern of sensor faults that may affect the neighborhood of the agent to a number of theoretical patterns, represented by the columns of a sensor fault signature matrix. In the case of the agent Ms,the observed pattern of sensor faults, denoted by Φs(t)∈[0,1]N+1, where [0,1]N+1denotes a binary vector ofN+1 length, defined as Φs(t)=[Ds,D(1),...,D(N)]. Note thatD(i)is transmitted to Msby the agent M(i)for alli∈N. The sensor fault signature matrixFsconsists ofN+1 rows, which correspond to the set of ARRsandNc=2N+1?1columns that correspond to all possible sensor fault combinations that may affect the building zones and the storage tank, where thek-th combination is indicated byk∈{1,...,Nc} . Thek-th column corresponds to the theoretical pattern, denoted byand defined as

In the case of agent M(i), the observed pattern of sensor faults, denoted by, is a vector made up of the detection decisionsDs(t),D(i)(t), andD(j)(t) for allj∈Ki.The sensor fault signature matrix consists of |Ki|+2 rows,which correspond to the set of ARRsandcolumns that correspond to all possible sensor fault combinations that may affect the storage tank, thei-th building zone and its |Ki| neighboring zones. Thek-th column corresponds to the theoretical pattern, denoted byFor example, taking into account the 5-zone HVAC system shown in Fig. 2(c), based on which the observed pattern of agent Msis defined asMoreover, the sensor fault signature matrixFsof the agent Mspresented in Fig. 2(c), is comprised of 6 rows and 63 columns as shown Table I, which illustrates a part of the sensor fault signature matrixFsconsidering 6 single sensor faults, and one possible combination of two simultaneous sensor faults, {f s,f(1)}. The assignment=1 implies thatf(1)necessarily discloses its occurrence by provoking the violation of E(1), whileimplies thatf(1)may justify the violation of Es, but Esmay be satisfied in spite of the occurrence of the sensor faultf(1). Otherwise,sincef(5)is not involved in E(1)[43].

TABLE I Part of the Sensor Fault Signature Matrix of the Agent Ms Showing in Fig. 2(c)

TABLE II Part of the Sensor Fault Signature Matrix of the Agent M(4) Showing in Fig. 2(c)

Remark 5:The sensor fault isolation process of the agent M(4)is realized in the neighborhood of M(4)(see Fig. 2(c))since the sensor faultsf(1)andf(2)do not affect the residual generation of M(4)(see (23)–(27) with K4={3,5}).

The outcome of the online comparison of the observed fault pattern Φsto theNctheoretical fault patterns∈{1,...,Nc} , and the observed pattern Φ(i)to thetheoretical patternsis the diagnosis sets Υs(t) and Υ(i)(t), which are determined as

IV. Performance Analysis

In this section we study the performance of the proposed sensor fault diagnosis architecture with respect to robustness(i.e., the ability to avoid false alarms in the presence of modeling uncertainty and measurement noise), detectability(i.e., the ability to detect faults in the presence of modeling uncertainty and measurement noise), and scalability (i.e., the ability to be easily modified in the case of increasing the number of zones).

A. Robustness Analysis

The property of robustness refers to the ability of the agents Msand M(i),i∈N to avoid false alarms in the presence of the modeling uncertaintiesrs,r(i), and measurement noisens,n(i),in the absence of either local and propagated sensor fault. The robustness is accomplished by guaranteeing that the ARRs Esand E(i), respectively defined in (38) and (39), are satisfied,i.e., the magnitude of the residual remains below the adaptive threshold, under healthy conditions.

Lemma 1:If there are no faults affecting the sensor in the storage tank and all the sensors in the building zones, the ARR Esis guaranteed to be satisfied and the agent Msdoes not raise any false alarm in the presence of the modeling uncertaintyrsand measurement noisensandn(i)for alli∈N.

Proof:Iff s(t)=0 andf(i)(t)=0 for alli∈N then the residual εs(t) is equal todefined in (28) and the adaptive thresholdis equal todefined in (31). Therefore,(30) is valid and the ARR Esdefined in (38) is guaranteed to be satisfied. The robustness property is guaranteed based on the design of the fault diagnosis architecture.

Lemma 2:If there are no faults affecting the sensors in the storage tank and the building zonei, as well as the | Ki| sensors in the neighboring building zones, the ARR E(i)is guaranteed to be satisfied and the agent M(i)does not raise any false alarm in the presence of the modeling uncertaintyr(i)and measurement noisensandn(i)for alli∈{Ki∪{i}}.

Proof:Iff s(t)=0 andf(i)(t)=0 for alli∈{Ki∪{i}} then the residual ε(i)(t) is equal todefined in (32) and the adaptive thresholdis equal todefined in (35).Therefore, (34) is valid and the ARR E(i)defined in (39) is guaranteed to be satisfied.

B. Detectability Analysis

This section contains the analysis on the detectability of the proposed distributed sensor fault diagnosis architecture where we analyze the ability of the agents to detect local and propagated sensor faults. Specifically, certain conditions are derived, under which we characterize the class of faults affecting the sensors in (10) and (11) that can be detected. It is important to note that the class of detectable sensor faults satisfying these conditions is obtained under worst-case assumptions, in the sense that they are valid for any modeling uncertainty and measurement noise satisfying Assumption 1.The analysis is divided into two parts; the sensor fault detectability analysis of agent Msand the sensor fault detectability analysis of agent M(i),i∈N.

1) Sensor Fault Detectability of AgentMs: The residualεsdescribed by (15) (or (20)) and the corresponding adaptive thresholdof (36) are sensitive to any fault that may occur in the sensor of the storage tank (local sensor fault) at the time instantor in the sensors of the building zones (propagated sensor faults) that may occur at the time instancesi∈N.Under faulty conditions, εsandcan be expressed as

Condition (43) guarantees the violation of ARR Esgiven in(38). The sensor fault effectsandcan be characterized taking into account the occurrence of

3) both localf s(t) and propagated sensor faultsf(i)(t) for

Lemma 3:A sensor faultf saffecting the temperature sensor Ssat the time instantis guaranteed to be detected by Ms, if there exists a time instantsuch that

whereis defined in (29).

Proof:Under healthy conditions the residual εsequals todefined in (28), where the state estimation error under healthy conditionscorresponds to the solution of (17), taking into account thatf s(t)=0 andf(i)(t)=0 for alli∈N andwhereis defined in (29); i.e.,

Combining (20), (28), and (41) result in

By introducing (47) in (48), we obtain

The effects of sensor faults on the adaptive threshold can be determined using (31), (36), and (42) as

Based on (12) and (14),f s(t)=0 forimplying thatThus(50) becomes

Introducing (49) and (51) in (43) leads to (44).

The conditions for guaranteeing the detection of (possibly multiple) propagated faults that affect the sensors located in the building zones by the agent Msis analyzed in Lemma 4. It is worth noting that the propagated sensor faultsf(i)can affect the residual εsdefined through (17)–(20) and not the adaptive thresholdsdefined in (36).

Lemma 4:Sensor faultsf(i)affecting the temperature sensors S(i)in the building zones at the time instancesare guaranteed to be detected by Ms, if there exists a time instantwithsuch that

Proof:Under healthy conditions the residual εsequals todefined in (28), where the state estimation error under healthy conditionsis defined in (45). Let us consider two propagated sensor faults in, e.g., zones 1 and 2, where sensor faultf(1)occurs atand sensor faultf(2)occurs atwithBased on the state estimation error dynamics given in (17),foris given by

while for is expressed as

By using (45) forin (53), and then using (53) forin (54) it yields

Equation (55) is also valid in the case thatIf we perform the same mathematical manipulations, we can obtain that the state estimation errorforwithis described by

By combining (48) withf s=0 and (56), the eff ects of propagated sensor faults on the residual are described by

Lemma 5:The sensor faultsf sandf(i)that occur at the time instantsandrespectively are guaranteed to be detected by Ms, if there exist a time instantsuch that

The proof of Lemma 5 is not provided, but it can be obtained similarly as in Lemmas 3 and 4. Lemmas 3–5 provide certain conditions that characterize analytically the class of local and propagated sensor faults that are guaranteed to be detectable by the agent Ms.

2) Sensor Fault Detectability Analysis of AgentM(i): The residual ε(i)given in (21) (or (27)) and the corresponding adaptive thresholdof (37) are sensitive to any faults that may occur in the building zonei(local sensor fault) at the time instantor in the sensor of the storage tank at the time instantor in theneighboring zones (propagated sensor faults) that may occur at the time instancesUnder faulty conditions,andcan be expressed as

Condition (61) guarantees the violation of ARR E(i)given in(39).The sensor fault effectsandcan be characterized taking into account the occurrence of

The proofs of the following Lemmas 6–8 are not given, but they can be obtained similarly as the proofs of Lemmas 3 and 4.

Lemma 6:The sensor faultf(i)affecting the temperature sensor S(i)at the time instantis guaranteed to be detected by M(i)under worst-case conditions, if there exist a time instantsuch that

Lemma 7:The sensor faultsf sandf(j)occur at the time instantsandrespectively are guaranteed to be detected by M(i)under worst-case conditions, if there exist a time instantwithsuch that

Lemma 8:The sensor faultsf(i),f s, andf(j)occur at the time instantsandrespectively are guaranteed to be detected by M(i)under worst-case conditions, if there exist a time instantsuch that

Lemmas 6–8 provide certain conditions that characterize analytically the class of local and propagated sensor faults that are guaranteed to be detectable by the agent M(i).

The above issue can be addressed by creating a Monte-Carlo analysis, examining the detectability performance by varying the sensor noise, modeling uncertainty, and observer design parameters (see simulation-based analysis presented in the Section V.)

C. Scalability Analysis

This subsection provides a discussion on the scalability of the proposed distributed sensor fault diagnosis technique in the case that the multi-zone HVAC system is enlarged with respect to the number of building zones. For example, a new building zone may be constructed, whose temperature is monitored by a sensor and controlled by a fan-coil unit. In the following analysis we consider the aforementioned example.A similar discussion can be considered for the case that some buildings zones are removed.

Consider that a 6-th zone is constructed next to the 5-th zone of the HVAC system shown in Fig. 2(a), while there is a door (and walls) connecting the two zones as shown in Fig.3(a). The 6-th zone is comprised of a temperature sensor and a fan-coil unit connected to the central electromechanical part.Given the architectural/thermal parameters and the manufacturing properties of the fan-coil unit installed in the new zone, the subsystem Σ(6)(green box in Fig. 3(b)) is defined according to (7) withi=6 and K6={5}. The equations in Table III describe the modification of the existing HVAC model according to the physical variation of the HVAC system fort

V. Simulation Results

Fig. 3. Reconfiguration of the distributed sensor fault diagnosis architecture for the enlarged HVAC system. The 6-th zone (green floor) is added to (a) which is connected to the 1-st zone; In (b) and (c) the reconfiguration of the network of interconnected subsystems and the reconfiguration of the sensor fault diagnosis agents are presented, respectively. Green color denotes the added components/subsystems/agents while the purple color denotes the modified components/subsystems/agents.

TABLE III Model Variations After the Enlargement of the HVAC System

TABLE IV Design Plug-In Blocks to the Sensor Fault Diagnosis Scheme

Fig. 4. The gray boxes and arrows denote the plugin blocks and signals added to the existing agent M (5) at t ≥ten, with y K5={y(2),y(3),y(4)}.

The objective of this section is the evaluation of the proposed distributed fault diagnosis method applied to a largescale building. Let us consider a 83-zone HVAC system whose down-view is presented in Fig. 5. Table V provides a list of parameters for the 83-zone HVAC system. As shown in Fig. 5 the building consists of 16 apartments (5-zones each), 2 stair halls and 1 corridor. The structural properties of each apartment are the same, hence the Table V contains the parameters of one apartment (i.e., zones 1–5), one stair hall(i.e., zone 81), and the corridor (i.e., zone 83). The remainder parameters of the 83-zone HVAC system are:ast=12 kJ/kg °C,asz=0.6 kJ/kg °C,Ust,max=27.36×105kJ/°C,Pmax= 3.5, ?Tmax= 45 °C,h=8.26 W/m2°C,= 20 °C,To= 5 °C,Tamb= 5 °C, andTi1= 10 °C,i∈{1,...,83}.isCp=1.004 kJ/kgK, the specific heat capacity of air at constant volume isCv=0.717 kJ/kgK, and the air density is ρa(bǔ)ir=1.225kg/m3. The modeling uncertainty associated with each subsystem is modeled asrs(t)=5%Tplsin(0.1t) °C andr(i)(t)=5%Tambsin(0.1t) °C,i∈{1,...,83}. For simulation purposes, the noise corrupting the sensor output is simulated by a uniform random variable withandwhereandare the set points of temperatures selected asandi∈N={1,...,83}. The design parameters of the fault diagnosis methodology are selected as follows:Ls=5,ρs=1, ζs=40,L(i)=5, for alli∈N , ρ(j)=1.1, ζ(j)=22,j∈D={i|5i,i∈{1,...,16}}, ζ(j)=15,j∈N{D∪{81,82,83}}andζ(81)=ζ(82)=ζ(83)=12. The 83-zone HVAC system is simulate d for 4 hours with initial conditionsTst(0)=30 °C andTzi(0)=22 °C,i∈{1,...,83} and a single fault scenario is Moreover, the specific heat capacity of air at constant pressure executed with multiple simultaneous sensor faults such asatt(j)=2h,j∈J={2, 18, 27, 42, 57, 58,60, 73, 83} , wherecontains the indices of the faulty temperature sensors. The zones with the faulty sensors are indicated with a red square in Fig. 5.

Fig. 5. Down-view of a 83-zone building. Red squared boxes denote the zones with the faulty sensors.

TABLE V Parameters of the 83- Zone HVAC System: Zones 1 ?5 (1- st Apartment), 81 (Left Stair Hall), and 83 (Corridor)

In Fig. 6 the ARRs of the sensor fault diagnosis agentsMsand M(j),j∈M={2, 17, 18, 27, 42, 43, 57, 58, 59, 60, 72, 73,81, 83} are presented. Note that due to space limitation we have not included the results of all 83 agents. Specifically,each plot of Fig. 6 contains the residuals εs, ε(j), the adaptive thresholdsand the decision detection signalsDs,D(j),j∈M. Note that sensor fault diagnosis agents M(2), M(18),and M(83)detected the corresponding local sensor faults, while the remainder agents Msand M(j),j∈NJ do not detect any sensor fault.From Fig. 6 it can be noticed that the adaptive threshold in(36) is affected by the local sensor faults, while the adaptive thresholds in (37) are affected by both local and neighboring sensor faults.

Every agent that detects sensor fault activates the isolation process (see Section III-B). For example, for the sensor fault i solation process executed by the agent M(60)the sensor fault signature matrixF(60)is designed and a part of it is presented in Table VI. The observed pattern Φ(60)att=2.015 h is

and is compared to all theoretical patterns given by the columns of the sensor fault signature matrixF(60)and the agent M(60)contracts the diagnosis set Υ(60)

wher ef(i,j)representsf(i,j)={f(i),f(j)} . Note that M(60)can be affected bycombinations of sensor faults,however the diagnosis set Υ(60)narrows down the combinations to 13.

Fig. 7 presents the reference points(black dashed line), the sensor measurementsys,y(j)(green solid line), the actual temperaturesTst,Tzj(red dashed-doted line) and the estimations(blue dotted line) of the subsystems Σs,, respectively. It is noted that for those subsystems that the sensor fault occurs locally (e.g.,f(1)is the local sensor fault of Σ(1)) the actual temperature (red dashed-dotted line)deviates from their corresponding reference point (black dashed line). Furthermore, it can be observed that also some zones with healthy local sensor are affected by sensor faults occurring in sensors of neighboring subsystems. For example,the temperature in subsystems Σ(17), Σ(43), and Σ(59)deviate from their corresponding reference point although there is no local sensor fault. This is due to the distributed control scheme that is implemented, where each controller aggregates local and neighboring sensor measurements in order to obtain the local control input, thus the temperature of a zone can be affected also by neighboring sensor faults. Also it is worth mentioning that the corresponding neighboring monitoring agents of the affected subsystems (i.e., Σ(17), Σ(43), Σ(59)) as illustrated in Fig. 6 do not detect the sensor faults occurred in their neighboring subsystems (i.e., Σs, Σ(j),j∈M). This is due to the fact that the ARR of each distributed sensor fault diagnosis agent is more sensitive to the occurrence of the local sensor fault and less sensitive to the occurrence of a propagated sensor fault. Further, we can observe that even if the a ctual temperatures of Σ(17), Σ(43), Σ(59)are affected by neighboring faults (i.e., do not track their corresponding reference temperature), both the estimation and measurements of the temperatures are close to the actual temperature. We may infer that the residuals of the neighboring agents are not severely affected from propagated sensor faults, and thus it is more possible to detect a local sensor fault that to detect a sensor fault occurred in a neighboring subsystem. To conclude, the design of the proposed methodology allows to detect and isolate sensor faults even if the use of a distributed control scheme is affected by the propagation a sensor fault.

Fig. 6. ARRs of agents M s and The residuals εs and ε (j) (blue line), adaptive thresholds and (red line) and boolean decision signals Ds and D(j) (green dotted line) for j ∈M are presented.

TABLEVI The Sensor Fault Signature Matrix of the Agent M(60)

In order to investigate the effectiveness of the proposed sensor fault diagnosis method, we implemented numerous simulation scenarios modifying the range of noise corrupting the sensor measurements; i.e.,n(i)(t) satisfies Assumption 1 withfor alli∈{1,...,83}. For the multiple sensor fault scenario denoted with the red squared boxes in Fig. 5, we run 100 times the same simulation while keeping the sensor noise magnitude of all 83 air temperature sensors the same. The simulated sensor faults occur ath withforj∈{2,18,27,42,57,58,60,73,83} and the simulation time is 1 h. Fig. 8 shows the percentage of detected local sensor faults (%), given by

for each agent with respect to the local sensor noise variancen(i)(t). Specifically, each blue dot in Fig. 8 corresponds to the instances (from the 100 simulations obtained for each sensor noise variancen(i)(t)) that the corresponding sensor fault diagnosis agent detected the presence of the local sensor fault. As illustrated, the percentage of detected local sensor faults of the sensor fault diagnosis agents is decreasing as the variance of sensor noise is increasing. Note that detection decision of each agent is not only affected by the noise from its local sensor but it is also affected by sensor noise from its neighbouring subsystems (see (23)–(27) and (37)). Therefore, the agents that monitor zones that have the same number of neighbouring zones (i.e., same | Ki|) and same design properties (see Table V)(see M(2)with M(42)). However, agents that have the same|Ki|and same design properties, may not have a similar permay have a similar percentage of detected local sensor faults centage of detected local sensor faults (see M(18)with M(58)),since due to the distributed topology of the agents, the detection decision can be affected by sensor fault from neighbouring subsystems (i.e., S(57)and S(60)).

Fig. 7. The temperature reference points (black dashed line), the sensor measurements (green solid line), the temperatures (red dashed-doted line) and the estimations (blue dotted line) of subsystems Σs and Σ (j) for all j ∈M.

Fig. 8. Percentage of detected local sensor faults with respect to local sensor noise variance n(i)(t). Each blue dot corresponds to the times that the corresponding diagnosis agent detected the presence of the local sensor fault from the 100 simulations obtained for each sensor noise variance n(i)(t). Note that the percentage of sensor noise variance is the same for all sensors in the building.

VI. Conclusions

The formulation of large-scale, complex HVAC systems as networks of interconnected subsystems allows the design of scalable distributed model-based sensor fault diagnosis methodologies. The design process of each distributed agent consists of: 1) the sensor fault detection that is based on the generation of ARRs constructed by residuals (resulted by discrepancies of the output and the estimated output of each subsystem) and thresholds that bound the residuals under healthy conditions; and 2) the sensor fault isolation that is obtained using a sensor fault signature matrix which is constructed based on the connectivity of the fault diagnosis agents and allows to eliminate the number of possible locations of the sensor faults. The distributed design of the proposed fault diagnosis method is analyzed in terms of robustness, detectability, and scalability. The methodology is evaluated under a multiple sensor fault scenario for a largescale HVAC system consists of 83 building zones. Further,the sensitivity of the proposed method is evaluated with numerous simulation scenarios modifying the sensor noise variance.

It is important to note that the proposed distributed sensor fault diagnosis algorithm can be also applied for diagnosing process or actuator faults. Specifically, the same algorithm is able to detect process and actuator faults, however, the isolation process needs to be modified or extended in order to distinguish between the different types of faults, i.e., process,actuator or sensor faults.

Appendix A

with λ=(Pmax?1)/?Tmaxand κ=?Tmax+To. The variableTstis unknown but belongs to a known interval; i.e., under healthy conditions (f s=0), (29) is valid, so based on Assumption 2,Due to this inclusion, by applying interval arithmetic we have the following cases

1) ifthenTst≤κ and

4) if

Appendix B

whereandBased on (71),(72), and (74), it yields