EWEA 2011 Scientific Proceedings 63 It is clear that this approach basicly differs from cur- rent isolated production and supervisory control. The subsequent sections of this paper describe the different types of methods and the switching mecha- nisms, give a survey of conceived monitoring and con- trol methods, address typicalities that relate to im- plementation, and show experimental and simulation results. 2 Sustainable control Figure 2 gives a more detailed view on the functional layout, in which a symbiosis of fault diagnosis, pro- duction control and shutdown control is pursued. Assume that currently no severe failure has occurred and that no extreme condition applies that requires immediate shut-down (hyper extreme condition). The wind turbine will then run in production operation. The main arbiter, that is to say the operation gover- nor, will retransmit the control signals from the pro- duction platform to the actuators. Further, the shut- down platform receives the current control signal val- ues in order to tune its internal condition for smooth ‘take-over’ when required. All the time, the shutdown platform’s unit for detec- tion of hyper extreme conditions will be active. Their detection is signaled to the operation governer. It wil react by retransmitting the control signals from the shutdown platform instead of the production plat- form. The subequent subsections describe the internal work- ing mechanism of the platforms for fault diagnosis and control. This includes the functionality of the meth- ods that are part of the platforms. The working of the methods itself is explained in the next section. 2.1 Fault diagnosis platform Sensor and actuator faults are identified with model- based fault detection and isolation (FDI) methods. The detection is based on the residues from Kalman filters. These filters are arranged such that the be- haviour of the residues in regular conditions can be distinghuised from that in faulty conditions. The sen- sor/actuator governor translates a fault into the sta- tus of the sensor/actuator topology. This status is read out by the operation governer and the control platforms through the S/A-status flag. In case of a non-severe failure, the operation governer will take no action. However, the production assembly governer may reconfigure the active extreme detection method and or control methods as well as the retransmission of measurement signals. A non-severe failure can be the drop-out of a redun- dant blade root moment sensor, or even the drop-out of a non-redundant blade root moment sensor. In the first case, only the retransmission of measurement sig- nals is adapted; in the second case, the detection of extreme production conditions will no more be based on all blade root moments, and individual pitch con- trol will be excluded from production control or based on other measurement signals. Severe failures concern strongly deteriorated function- ing of pitch and yaw actuators, grid drop-out and combinations of sensor faults. In that case, the op- eration governer will signal to the shutdown platform to take over the control. The shutdown assembly manager in turn will reconfigure the shutdown con- trol methods for appropriate use of control signals. 2.2 Production control platform The production assembly governor combines methods for detection of extreme events and production control as allowed by the current status of the sensor/actuator topology. Extreme events are detected from the out- puts of Kalman filters that are arranged for this pur- pose. Optimal production control includes collective pitch angle adjustment and generator torque setting. The control actions result from a trade-off between objec- tives for rotor speed regulation, optimal energy yield and damping of drive-train torsion and tower bend- ing. Further, optimal production is pursued through cyclo-stochastic individual pitch control (IPC). This IPC is centered around one and two times the rota- tional frequency (1p, 2p). It reduces the loads on the blades around these frequencies as well as the loads on the nacelle and tower around 3p and in very low fre- quencies. In addition, very low-frequent IPC is added for the sake of aerodynamic rotor balancing. A priori- tisation algorithm divides available actuator capacity over collective and individual pitch control. As long as the optimal production control unit ap- plies, its internal condition is messaged to the unit for extreme production. The latter unit becomes active after the detection of an extreme event that still al- lows continuation of production operation. As from now, a completely different trade-off between control objectives will apply: extreme production control will focus on rotor speed limitation and reduction of ex- treme loads; energy yield and fatigue related damp- ing are of minor importance. Further, the unit for extreme production control now messages its internal condition to the unit for optimal production control. This enables a smooth switch-back after the extreme conditions have ceased. 2.3 Shutdown control platform The shutdown assembly governor combines methods for detection of hyper extreme events and shut down control as allowed by the current status of the sen- sor/actuator topology. Events that require shut down control are detected from gross values of direct mea- surement signals, the current status of sensors and ac- tuators, and the residues of Kalman filters arranged Fault tolerant wind turbine production operation and shutdown(Sustainable Control) Tim van Engelen (1) , Jan Schuurmans (2) , Stoyan Kanev (1) , Jianfei Dong (3) , Michel Verhaegen (3) , Yoshiyuki Hayashi (4) (1) ECN Petten The Netherlands; vanengelen@ecn.nl, kanev@ecn.nl (2) DotX Control Solutions Alkmaar The Netherlands; info@dotxcontrol.com (3) Delft University of Technology Delft The Netherlands; j.dong@tudelft.nl, m.verhaegen@tudelft.nl (4) Mitsubishi Heavy Industries Nagasaki Japan; yoshiyuki hayashi@mhi.co.jp Abstract Extreme environmental conditions as well as system failure are real-life phenomena. Especially offshore, extreme environmental conditions and system faults are to be dealt with in an effective way. The project Sustainable Control, a new approach to operate wind turbines (Agentschap NL, grant EOSLT02013) pro- vides the concepts for an integrated control platform. This platform accomplishes fault tolerant control in regular and extreme conditions during production op- eration and shutdown. The platform is built up from methods for the de- tection of extreme conditions and faults and from methods for operation and shut-down. The detec- tion methods are largely model-based, which implies that event detection is derived from anomalous be- haviour of outcomes from an observer, which can be an Kalman fiter. Various types of control approaches are included in the control methods. Often, more scalar feedback loops work together, the validity of which is motivated through frequency separation or orhogonality. The detection and handling of extreme conditions and sensor failures elongates the operation. The applica- tion of optimizing techniques during production op- eration and during shut down can reduce the loads on the turbine significantly. A proof of principle on a multi MW wind turbine for optimzied production op- eration showed a typical reduction of fatigue damage equivalent loads between 10% and 30%. Keywords: fault detection, gust detection, individ- ual pitch control, fault tolerance, NMPC, optimal shutdown control. 1 Introduction Nowadays, control has been well established as a driver for cost reduction of wind energy conversion. Usually, the associated control algorithms relate to production operation in stationary turbulent con- ditions without any deteriorated wind turbine be- haviour (regular conditions). Unfortunately, extreme environmental conditions as well as system failure are real-life phenomena. Especially offshore, the need arises to deal in an effective way with [short-tem] ex- treme environmental conditions and with minor or more severe types of system failure. With this in mind, the project Sustainable Control, a new ap- proach to operate wind turbine is being performed under grant EOSLT02013 of Agentschap NL (2006- 2011). This project includes the development and in- tegration of cornerstones that relate to control in four types of conditions: • Optimised Feedback Control, for load reduction by advanced control methods when operation is in regular conditions; • Fault Tolerant Control, for avoidance of stand- still by controller reconfiguration in case of minor system failure; • Extreme Event Control, for avoidance of high loads and shut-down under extreme conditions; • Optimal Shut-down Control, for avoidance of un- necessary high loads and serial damage after se- rious system failure. Figure 1 shows a functional layout of Sustainable Con- overall set of sensors overall set of actuators sensor/actuator topology operation governor S/A status SUSCON CONCEPT fault diagnosis platform shutdown control platform production control platform measurement signals Figure 1: Functional layout Sustainable Control trol. It includes platforms for production control, shutdown control and fault diagnosis. The dashed lines represent signals that govern the operation. The production and shutdown control platforms include monitoring and control methods; the fault diagnosis platform only monitoring methods. Sustainable Con- trol is achieved by synchronized alternate operation of the methods: a combination of active methods on the platform relates to one of the listed cornerstones.