Multiobjective performance-based designs in fault estimation and isolation for discrete-time systems and its application to wind turbines

ABSTRACT In this work, we develop a performance-based design of model-based observes and statistical-based decision mechanisms for achieving fault estimation and fault isolation in systems affected by unknown inputs and stochastic noises. First, through semidefinite programming, we design the observers considering different estimation performance indices as the covariance of the estimation errors, the fault tracking delays and the degree of decoupling from unknown inputs and from faults in other channels. Second, we perform a co-design of the observers and decision mechanisms for satisfying certain trade-off between different isolation performance indices: the false isolation rates, the isolation times and the minimum size of the isolable faults. Finally, we extend these results to a scheme based on a bank of observers for the case where multiple faults affect the system and isolability conditions are not verified. To show the effectiveness of the results, we apply these design strategies to a well-known benchmark of wind turbines which considers multiple faults and has explicit requirements over isolation times and false isolation rates.


Introduction
The importance of the reliability and maintainability of systems has increased over the last decades. Hence, much effort has been devoted to developing fault detection and isolation (FDI) and fault tolerant control (FTC) strategies (Gao, Cecati, & Ding, 2015). On the FTC framework, there are two possible approaches: active and passive FTC. The difference between them is that passive FTC is just an application of robust control that considers faults as uncertainties while active FTC relies on fault diagnosis outputs. The two main approaches regarding FDI are data-based and model-based techniques, see Ding (2014), Ding (2008) and , respectively. Broadly speaking, most FDI systems consist of residual generators and evaluators; however, research has shown that there are intrinsic difficulties in the use of residuals in active FTC due to the complexity derived from the reconstruction of the faults from the residuals. These reconstructions rely on discrete-event algorithms with complex decisions that entail delays and errors (Cieslak, Efimov, & Henry, 2015;Lan & Patton, 2016). Active FTC based directly on fault estimation (FE) rather than on FDI seems to provide more immediate and accurate results, see Lan and Patton (2016) and Li, Karimi, Wang, Lu, and Guo (2018). Among FE techniques, there is an CONTACT Ester Sales-Setién esales@uji.es upward trend in the use of advanced observers . Sliding mode observers are used in Wang, Tan, and Zhou (2017) and Yin, Gao, Qiu, and Kaynak (2017), adaptive observers are applied in Li, Yan, and Yang (2018) and Rodrigues, Hamdi, Theilliol, Mechmeche, and BenHadj Braiek (2015) and iterative observer schemes are studied in Huang, Zhang, Guo, and Wu (2018). Augmented observers, which consider the faults as additional states, have received considerable attention (Gao, 2015;Gao & Ho, 2004;Wu, Feng, & Duan, 2012). Especially, proportional integral (PI) observers have been intensively studied (Chang, 2006;Li & Zhu, 2015;Wu & Duan, 2007) and applied (Liu, Gao, & Zhang, 2018;Rotondo, Cristofaro, Johansen, Nejjari, & Puig, 2016) in the last two decades. One of the main problems in the use of common FE techniques for active FTC arises when the faults affecting a system are not isolable and it is not possible to build standard observers. Hence, most FE works conservatively consider that the faults verify isolability conditions, e.g.  and Witczak, Buciakowski, Puig, Rotondo, and Nejjari (2016). A solution to deal with non-isolable faults is the use of a bank of generalised observers Ding, 2008). However, these schemes are usually implemented from a FDI perspective and each observer in the bank is used to provide a residual signal which is sensitive to all but one fault, e.g. Dong, Wu, and Yang (2017). Thus, there is a need to develop more FE approaches based on banks of observers for systems with non-isolable faults.
Another problem in the use of FE for active FTC schemes is the misleading effect produced when feedforwarding non-zero fault estimates in fault-free scenarios. The residual signal in FDI and the fault estimation signal in FE are subjected not only to faults but also to disturbances, which may deviate the estimation outputs. In the FDI framework, in order to make the residual signal sensitive to faults but robust against disturbances, structural methods such as the parametric eigenstructure assignment approach (Patton & Chen, 2000) and the unknown input observer (UIO) approach (Hassanabadi, Shafiee, & Puig, 2016;Ziyabari & Shoorehdeli, 2017) are well-known. Alternatively, numerical approaches based on optimisation methods that use the H ∞ /H − and the H ∞ /H ∞ indices have gained more attention in FDI research owing to its wide applicability (Ahmadizadeh, Zarei, & Karimi, 2014;Aouaouda, Chadli, Shi, & Karimi, 2015;Li, Karimi, Zhong, Ding, & Liu, 2018). In the FE framework, multiobjective optimisation design approaches are also used in works as Witczak et al. (2016), Rodrigues et al. (2015) and Gao, Liu, and Chen (2016). In order to give further physical interpretation to the indices involved in the optimisation problem, Zhang and Ding (2008) and Chen, Khan, Abid, and Ding (2011) propose to use the trade-off between the fault detection rate (FDR) and the false alarm rate (FAR). This trade-off is used in recent works as Zhong, Zhang, Ding, and Zhou (2017) and Zhao, Shen, and Wang (2017) and it is of practical importance in FDI applications. However, although the FAR and the FDR are suitable for FDI methods based on residuals, these indices give little information about other important issues in estimationbased methods such as the size of the faults which are susceptible to occur, the dynamic behaviour or the steadystate accuracy of the results. Some initial approaches considering a few of these issues can be found in works as Dolz, Peñarrocha, and Sanchis (2015), Sales-Setién, Peñarrocha, Dolz, and Sanchis (2016) and Zhang, Hao, Chen, Ding, and Peng (2015). The iterative design procedures of FDI residuals in Dolz et al. (2015) involve bounds of the minimum size of the diagnosable faults (MDF), bounds of the FAR and a decay ratio representing the fault tracking ability of the residuals. In Sales-Setién et al. (2016) a non-iterative design procedure with the MDF, the FAR and the Cumulative Squared Error (CSE) of the residuals is proposed. For its part, the methods in Zhang et al. (2015) include new indices as the expected detection delay (EDD) for FDI in statistical processes. In all, as stated in Zhang, Jiang, and Shi (2012), more research on designs considering the performance of model-based FE is needed.
A well-known benchmark for FDI and FTC of wind turbines is developed in Odgaard, Stoustrup, and Kinnaert (2013). The benchmark takes account of a wide variety of the multiple and diverse faults to which a wind turbine is prone and it sets some FDI performance requirements. A wide variety of solutions based on residuals have been presented for this wind turbine FDI problem, see Odgaard and Stoustrup (2012). Data-based approaches are proposed in works such as Pashazadeh, Salmasi, and Araabi (2018). Nonetheless, model-based approaches, such as the ones presented in Sanchez, Escobet, Puig, and Odgaard (2015), , are more common. UIOs are presented in Sanchez et al. (2015) and Kalman filters are developed in . However, there are not solutions that provide a priori performance-based designs of the fault diagnosers to guarantee the requirements in the benchmark. Hence, the FDI performance is generally tested through an a posteriori analysis or simulations. Regarding FTC, both passive and residual-based active FTC strategies have been applied to wind turbines in Sloth, Esbensen, and Stoustrup (2011) and Blesa, Rotondo, Puig, and Nejjari (2014). In Liu, Gao, and Chen (2017), Lan, Patton, and Zhu (2018) and Shi and Patton (2015) active FTC strategies based on FE are applied to wind turbines. However, all these works assume that only certain faults among all the possible ones may affect the turbines. The same assumption is considered in the FE solution presented in Witczak, Rotondo, Puig, Nejjari, and Pazera (2017).

Contributions
In this work, FE is achieved by means of PI observers. The fault estimates are then evaluated in statisticalbased decision mechanisms to achieve fault isolation (FI). The main contribution of this work is the development of novel estimation performance-based design strategies of PI observers. In analogy to the integrated design of residual generators and evaluators in Zhang and Ding (2008) and , we also present novel co-design strategies in the FI framework. We formulate the co-design of PI observers and statistical-based decision mechanisms guaranteeing a priori isolation performance requirements. Compared to the relevant existing literature, the novelties of the proposed designs are the following.
• Designs with a priori performance requirements. In most cases, the performance of FE and FDI strategies is tested a posteriori (e.g. Blesa, Jiménez, Rotondo, Nejjari, & Puig, 2015;Chen, Patton, & Goupil, 2012). Hence, the satisfaction of estimation or isolation performance requirements entails iterative procedures. The designs proposed in this work guarantee a priori performance requirements and, thus, we avoid iterative design procedures. • Designs with individual performance requirements.
The designs proposed in this work deal with the performance of each single fault estimation/isolation channel. This increases the design flexibility compared with most existing FE and FI designs, where the performance is jointly fixed for all the fault estimation/isolation channels (e.g. Gao et al., 2016;Witczak et al., 2016). • Designs with time-domain performance indices. In an aim to bridging the gap between theory and practice, we use new performance indices providing further practical and physical interpretation to the norm bounds which are commonly used in FDI and FE designs Witczak et al., 2016). The proposed observer designs for FE deal with the trade-off between the tracking delays w.r.t. different fault signals and the covariances of the fault estimates due to noises. The proposed co-designs for FI deal with the following isolation performance indices: the false isolation rates, the minimum isolable faults and the isolation times. • Single-step numerical designs of observers guaranteeing unknown input and interfault decoupling. The wellknown design of UIOs requires algebraic constraints to achieve unknown input (UI) decoupling . Then, the remaining design freedom is used in a numerical second-step design to achieve certain requirements over other performance criteria (Li & Zhu, 2015;Liu et al., 2018;Witczak et al., 2016). In this work, we propose to use the concept of degree of UI decoupling in order to numerically achieve UI decoupling and other performance requirements in a single-step multiobjective optimisation problem. We also introduce the concept of degree of interfault decoupling to deal with the transient fault estimation error which occurs due to the appearance of faults in other channels (e.g. the simulation results in Salahshoor, Mosallaei, & Bayat, 2008). The observer performance indices (covariance due to noises, fault tracking delays and UI and interfault decoupling) are altogether formulated via matrix inequalities in a single-step optimisation problem.
We generalise these design strategies to a scheme based on a bank of PI observers and statistical-based decision mechanisms that allow achieving FI and FE in systems where isolability conditions of faults do not hold.
Assuming the non-simultaneity of certain number of faults, we extend the concept of residual-based generalised observers Dong et al., 2017) from a FE perspective.
To show the goodness of the proposed approaches, we apply the strategies presented in this work to the well-known benchmark for FDI and FTC of wind turbines (Odgaard et al., 2013). Unlike works as Witczak et al. (2017) and Lan et al. (2018), which just consider the occurrence of a reduced number of possible faults, we achieve the estimation of all the faults affecting the turbines. We also isolate these faults with a priori guaranteed isolation performance indices.

Structure and notation
The outline of this work is as follows. First, we state the problem in Section 2, where we propose a FE and FI strategy based on PI observers and decision mechanisms. In Section 3, we present a FE performance-based design of the observer. In Section 4, we include a co-design of the observer and decision mechanism for guaranteeing certain trade-off between isolation performance indices. In Section 5, we extend the problem to the case in which FI becomes necessary for FE because fault isolability conditions are not verified and standard augmented observers are not applicable. Finally, Section 6 presents the results of applying the proposed FE and FI techniques to the wind turbine problem. Section 7 summarises the main conclusions.
Throughout the paper, R denotes the set of real numbers. Expected value, probability and absolute value are denoted by E{·}, P{·} and | · |. Let A be some matrix and a be some vector. A ij denotes the element in the ith row and jth column of A and a i denotes the ith element in a. A 0 means that A is negative semidefinite and similar applies to . The rank of matrix A is represented as rank{A} and its trace is given by tr{A}. Let x be a stochastic process. We write x(k) 2 2 x(k) T x(k) for the Euclidean norm of vector x(k) and x(k) ∞ max i |x i (k)| for its max norm. x 2 2 ∞ k=0 x(k) 2 2 denotes the l 2 norm of process x, x 2 RMS lim k↔∞ (1/K) K−1 k=0 x(k) 2 2 denotes its RMS norm and x ∞ max k max i |x i (k)| denotes its l ∞ norm. I n is the identity matrix of size n × n or of appropriate size when the subindex is omitted; similar applies to 0 n×n .

Problem formulation
Let us consider the linear time-invariant (LTI) discretetime system defined by where x ∈ R n x , y ∈ R n y and u ∈ R n u are the state, output and known input vector; v ∈ R n v is the process and sensor noise vector and d ∈ R n d is the UI vector. Vector f ∈ R n f includes all the process, actuator and sensor faults f i (i = 1, . . . , n f ) that affect the system . 1 We define M i as the selection matrix verifying The following assumptions on the system (1) are made.
Assumption 2.1: The pair (A, C) is observable.
Remark 2.1: Augmented observers require the observability of the model (1) as detailed in works as Gao (2015) and Chang (2006). Hence, Assumption 2.1 is not restrictive from a FE perspective.

Assumption 2.2:
The faults are detectable, isolable among them and isolable from the UIs.

Remark 2.2:
The transfer matrix from a fault f i to the outputs is given by where E i and F i represent the ith column of E and F, respectively. The transfer matrix from the UIs to the outputs is given by According to Ding (2008), Assumption 2.2 implies that The detectability of the faults in Assumption 2.2 is a necessary condition for FDI and FE Ding, 2008). The isolability condition in Assumption 2.2 is also standard in these frameworks. However, this condition becomes more restrictive as the number of UIs and faults increases Ding, 2008). Section 5 includes estimation and isolation strategies for the case in which the isolability condition in Assumption 2.2 does not hold. . For its part, the UI vector can be also used to describe a number of different kinds of norm-bounded modelling uncertainties (Chen, Patton, & Zhang, 1996) Any fault signal verifying Assumption 2.4 (i.e. fault signals with norm-bounded fault discrete derivative δ) can be modelled as with Remark 2.4: Assumption 2.4 is fairly general because it allows considering a wide range of fault signals which are common in practical applications. For instance, a step (or abrupt) fault signal is generated through (2) with an impulse signal δ, and a ramp (or drift) fault signal is generated through (2) with a step signal δ. Note that Assumption 2.4 does not imply any restriction over the upper bound of the fault vector f, which reduces the conservatism compared with some other existing works (Liu & Shi, 2013;Rodrigues et al., 2015).

Remark 2.5:
An augmented observer is based on an augmented model including both the system dynamics and the fault dynamics (Gao, 2015;Gao & Ho, 2004). In the FE literature, fault dynamics verifying Assumption 2.4 are widely utilised leading to the so-called proportional integral (PI) observers (Chang, 2006;Liu et al., 2018), which are based on the fault model (2) Wu et al. (2012) and Gao and Ho (2004) for fault signals in the more general form of a polynomial of the time leading to proportional multiple integral (PMI) observers. Hence, the model (3) and the strategies developed in this work are easily extensible to fault signals which do not verify Assumption 2.4.
The model (1) is thus augmented as where z = x ξ denotes the extended state vector. The state-space matrices in (4) The following model-based PI observer is proposed to estimate the faults in (4) where the design observer gain matrices L and K are of appropriate dimensions. Define the estimation errors Applying the Z transform to (6), we get For isolation purposes, we set the following decision mechanisms (i = 1, . . . , n f ) evaluating the fault estimates provided by (5): where J i is the isolation threshold of the ith fault and must be designed.
Remark 2.7: For FI, it is not necessary to evaluate the fault estimatesf and appropriate simpler signals (i.e. isolation residuals) can be generated and evaluated instead, e.g. Wang, Ge, Zhou, Wu, and Jin (2017) and Hwang, Kim, Kim, and Seah (2010). In this work, the fault estimates are evaluated in isolation decision mechanisms in order to decide whether to feed or not an active FTC mechanism with these estimates.
In order to design the observer (5) and the decision mechanisms (8), one must choose the gain matrices L and K and the thresholds J i (i = 1, . . . , n f ). The main objective of this work is to solve the following problems • To provide a design strategy of the observer for guaranteeing certain a priori estimation performance requirements. • To provide a design strategy of the decision mechanisms for guaranteeing one a priori isolation performance requirement. • To provide a co-design strategy of the observer and the decision mechanisms for guaranteeing more than one a priori isolation performance requirement.

FE performance characterisation
The performance of the fault estimator (5) can be described using the following criteria: e.1 the fault tracking speed, e.2 the degree of interfault decoupling, e.3 the degree of UI decoupling and e.4 the noise attenuation.
Each element G δ ij (z) of the transfer matrix G δ (z) describes the fault tracking error that the ith fault estimate (i.e.f i ) experiences due to the variations of the fault in the channel j (i.e. δ j ). In particular, each diagonal element G δ ii (z) describes the errorf i due to δ i and each off-diagonal term G δ ij (z) with j = i describes the coupling effect that occurs whenf i increases due to the appearance of a fault in another channel j = i (i.e. δ j =i ). Since the fault tracking speed is strictly related to the fault tracking error, we make use of the H ∞ norm of the transfer functions G δ ii (z) (i = 1, . . . , n f ) to characterise the criterion e.1. Likewise, the criterion e.2, which refers to the degree of decoupling between faults, can be characterised through the H ∞ norm of the transfer functions Remark 3.1: There may also be a coupling effect when more than one fault vary simultaneously and it is also desirable to characterise this error. To cope with all these characterisations numerically, we bound each fault estimation errorf i due to δ as where the term i ii stands for the H ∞ norm of G δ ii (z), the terms i jj (j = i) stand for the H ∞ norm of G δ ij (z) and the off-diagonal terms i jl (j = l = i) explain the behaviour of the ith fault estimate towards simultaneous faults.
The dynamics in G d (z) determine the effect of the UIs on the fault estimates. Thus, the criterion e.3 can be characterised through the H ∞ norm of G d (z). Finally, we characterise the criterion e.4 through the covariance of the fault estimation error due to noises.

Remark 3.2:
In the absence of UIs and faults, the presence of zero-mean noises leads to zero-mean fault estimation errors. In this case, the covariance off , i.e.
which we obtained from (7) with δ(z) = 0, d(z) = 0 and using an internal realisation of G v (z).
The requirements over these criteria can be thus translated into requirements over different H ∞ norms and covariance bounds of the fault estimation errors. In order to set multiobjective designs with different requirements over these criteria, we use the formulation based on matrix inequalities which is shown in Theorem 3.1.
Theorem 3.1: Consider the observer (5) applied to the system (4). If there exist any matrices L and K, any positive scalar γ d , any symmetric matrices S, Q, , P i and any diagonal matrices the following statements hold: (i) In the absence of UIs, noises and faults, the extended state estimation error converges to zero. (ii) The fault estimation error due to UIs is bounded as 3 (iii) The covariance of the fault estimation error due to noises is bounded as .
(iv) The fault estimation error due to fault variations is bounded as 4 Proof: See Appendix 1.

Remark 3.3:
Optimization-based FE strategies usually characterise the performance of the fault estimation error vectorf w.r.t. the UIs d, the noises v and the fault variations δ, e.g. Gao et al. (2016), Witczak et al. (2016) and Lan and Patton (2017). In this work, we alternatively characterise the performance of each fault estimation errorf i w.r.t. the noises v (using the bound ii ) and w.r.t. each fault variation δ j (using the bound i jj ). This approach allows designing estimators satisfying in each fault channel different trade-offs between fault sensitivity and noise attenuation, which is of practical interest in engineering applications. For its part, we just characterise the performance of the entire fault estimation error vectorf w.r.t. the UIs d because we desire to design PI observers ensuring UI decoupling.

Observer design with FE performance requirements
Let us design the gain matrices L and K of the observer (5) for satisfying different requirements over the criteria e.1, e.2, e.3 and e.4.
From Theorem 3.1, we deduce that if i ii in (12) verifies the fault tracking error of the estimatef i w.r.t. the variations described by δ i is bounded by¯ i ii . The fault estimation error can be bounded using the constraint (16); however, from a reliability perspective, constraints over the criterion e.1 may be of more practical interest. Since the fault tracking speed depends not only on the fault tracking error but also on the fault signal form, we can choose¯ i ii to ensure certain fault tracking speed w.r.t. an specific fault signal form verifying Assumption 2.4. Conservatively, we consider a ramp fault of slope i = 0 occurring in the ith fault channel. 5 In this case, the fault tracking speed may be described by the steady-state To prove it, note that a ramp fault signal is generated through a constant signal δ i (i.e. δ i (k) = i ) and the steady-state fault estimation error is also constant and equal to Provided that δ i (k) = i , taking the limit when K → ∞, and computing the square root of the result leads to |f i | ≤ i ii i . Taking into account that the slope i describes the proportionality between the increase of f i and the time elapsed between two different samples, we get the previous bound. Then, if i ii verifies (16), the estimation delay T i under ramp faults is bounded as T i ≤ ¯ i ii .

Remark 3.4:
Other fault signal forms verifying Assumption 2.4 could be considered to achieve a constraint over the criterion e.1. For instance, consider a constant fault of sizef i = 0 occurring in the ith fault channel. In this case, the fault tracking speed may be described by the cumulative squared error defined Regarding the criterion e.2, if i jj in (12) certain degree of interfault decoupling betweenf i and δ j =i is guaranteed. We define perfect interfault decoupling as the characteristic of an estimator verifying i jj = 0 for all i and for all j = i. A numerically sound way of adding these constraints to a semidefinite programming problem involving (12) is to set the constraint (17) for all i and for all j = i and to fix¯ i jj := jj (18) with jj = ε tr{ }/f j , ε being a small number (e.g. ε ≤ 10 −6 ) andf j being the maximum expected value of the jth fault, which can be derived from the physical constraints of the system. The value (18) in the constraint (17) makes the estimation error due to fault variations in other channels negligible w.r.t. the estimation error due to noises and we claim that practical interfault decoupling is achieved whenever (17)-(18) is satisfied for all i and for all j = i. For its part, the use of diagonal matrices i cancels the errors due to simultaneous variations of faults (i.e. the fault estimation error due to the product δ j δ l with j = l is cancelled). Similarly, certain degree of decoupling from the UIs (criterion e.3) is guaranteed if γ d in (10) verifies We define perfect UI decoupling as the characteristic of an estimator verifying γ d = 0. Similarly to (18), we numerically address this issue through (20) is fulfilled, the fault estimation error due to UIs becomes negligible w.r.t the error due to noises and we claim that practical UI decoupling is achieved.
Remark 3.5: Note that certain degree of interfault and UI decoupling is achievable regardless of the isolability of the faults and UIs. Perfect interfault and UI decoupling are achievable because the system (1) verifies Assumption 2.2 (i.e. the faults are isolable among them and from the UIs). If perfect UI decoupling is achieved, claims (iii) and (iv) in Theorem 3.1 do also hold in the presence of UIs. We consider that they also hold when practical UI decoupling is guaranteed and the UIs are present in the system.

Remark 3.6:
The most extended strategy to build an observer guaranteeing perfect UI decoupling is the use of some algebraic constraints as the ones presented in Liu et al. (2018), Gao et al. (2016) and Ding (2008) for the design of UIOs. Then, the remaining design freedom can be used in a second-step observer design to achieve certain requirements over other performance criteria. Alternatively, we propose to use the numerical constraints (19)-(20) in a design problem involving (10) to achieve practical UI decoupling. The proposal leads to an homogeneous formulation of all the performance criteria and allows achieving practical UI decoupling together with other estimation performance requirements in a single-step multiobjective optimisation problem. Practical UI decoupling refers then to the numerical approach to achieve UI decoupling. In practice, numerical (or practical) UI decoupling is equivalent to structural (or perfect) UI decoupling, which is achieved using algebraic constraints.
Finally, if matrix in (11b) verifies certain noise attenuation (criterion e.4) is guaranteed in the ith fault estimation channel. Particularly, (21) implies that the marginal variance off i is bounded as ii ≤¯ ii . The following two multiobjective design strategies, summarised in Table 1, show a proposal of how to use these results for designing the fault estimator (5) guaranteeing different estimation performance requirements.

Conservativeness and solvability of the observer design
The multiobjective optimisation problems in Strategy 3.1 and Strategy 3.2 are based on the results of Theorem 3.1, whose conditions are standard in norm-based designs (Guerra, Márquez, Kruszewski, & Bernal, 2018;Zhou, Doyle, & Glover, 1996). The use of independent closed-loop Lyapunov functions Q and P i (i = 1, . . . , n f ), which are different from the matrix bound S, guarantee non-conservative designs based on the inequalities (10)-(12) because the estimation error model (6) is LTI. However, these designs become nonlinear optimisation problems entailing bilinear matrix inequalities (BMIs). These nonlinear problems can be solved using different solvers such as the ones presented in Henrion, Löfberg, Kočvara, and Stingl (2005) and Kočvara and Stingl (2003). Unfortunately, these solvers introduce certain degree of conservatism because they only guarantee local solutions. Alternatively, it is possible to iteratively solve the BMIs through a sequence of problems of linear matrix inequalities (LMIs) following different approaches such as the ones presented in El Ghaoui, Oustry, and AitRami (1997). Note that recovering convexity by enforcing Q = S = P i for all i is not suitable because this approach is too conservative. However, a compromise solution can be also adopted by introducing a slack variable as detailed in works as Guerra et al. (2018) andde Oliveira, Bernussou, andGeromel (1999).
Practical interfault and UI decoupling, which are required in Strategy 3.1 and Strategy 3.2, are achievable because the system (1) verifies Assumption 2.2. Hence, the solvability of the optimisation problems (22) and (24) depends on the restrictiveness of the values which are chosen for the performance requirements T * i and * ii (i = 1, . . . , n f ), respectively. The solvability limits of the performance requirements can be found using the following problems.
• The most restrictive requirements T * i (i = 1, . . . , n f ) guaranteeing the solvability of the design problem in Strategy 3.1 satisfy T * i := i ii , with i ii being the solution to the following problem:

FI performance characterisation
Motivated by the characterisation presented in  and Ding (2008), we describe the performance of the fault isolator (8) through the following indices: i.1. the false isolation rates (FIRs), i.2. the minimum isolable faults (MIFs), i.3. the acknowledgement times (ATs) and i.4. the isolation times (ITs).
Let us first define a persistent fault f i satisfying We define the false isolation rate of the fault i, which we denote as φ i , as the probability of rising an isolation alarm of the fault i when f i = 0: Provided f j =i = 0, v = 0 and d = 0, we define the minimum isolable fault i, which we denote as ψ i , as the smallest value f i that ensures the isolation of the fault (26): Under these conditions (i.e. f j =i = 0, v = 0 and d = 0), we define the acknowledgement time of the fault i, which we denote as ϑ i , as the time elapsed between k and the first sample of isolation of the fault (26): We define the isolation time of the fault i, which we denote as τ i , as the time elapsed between the appearance of the fault (26) at k 0 and the first sample of isolation of this fault:

Mechanisms design with FI requirements
Assume that the model-based observer (5) has been designed through the strategies presented in Section 3.2 and the fault estimatef i provided by such observer (with prefixed stabilising gains L and K) is used in the decision mechanism (8). In the following, we show how to design the threshold J i of the decision mechanism (8) for guaranteeing certain requirement over one isolation performance index. Regarding the index i.1, if f i = 0 and perfect UI and interfault decoupling are achieved, the fault estimatef i is zero-mean and its variance is given by the marginal variance ii , which can be computed through (9). Then, through Chebyshev's inequality 6 and the definition (27), we have that and we can set J i as to guarantee the bound φ i ≤ φ * i .

Remark 4.1:
Provided UI and interfault decoupling, if the noises v are Gaussian, we have thatf i ∼ N (0, ii ) and we can set J i to fix the index i.1 to φ * i as with −1 Z (·) being the inverse cumulative distribution function of a standard normal variable. 7 The minimum isolable fault i depends on the form of the fault signal f i , see the definition (28). Then, we can just ensure certain index i.2 w.r.t. an specific fault signal form verifying Assumption 2.4 and the conditions (26). The straightforward case is the occurrence of a non-zero step fault in the ith fault channel because the minimum isolable fault coincides with the threshold of the isolation mechanism, i.e.
Hence, we can fix the minimum isolable constant fault i to ψ * i by setting The time indices i.3 and i.4 do also depend on the form of the exogenous fault signal f i , see (29) and (30). Then, we can just ensure certain time indices w.r.t. an specific fault signal form verifying Assumption 2.4 and the conditions (26). In analogy to the estimation performance criterion e.1, we consider the occurrence of a ramp fault of slope i = 0 in the ith fault channel, see Figure 1. If the estimation error has achieved the steady state when the fault exceeds J i , the acknowledgement time of the fault i is the steady-state estimation delay T i (i.e. ϑ i ≡ T i ) and the isolation time of the fault i satisfies where J i / i characterises the time that the ramp fault requires to achieve J i . In all, ϑ i ≡ T i is determined by the observer and it cannot be modified by varying J i . Provided certain T i , we can set to fix the isolation time to τ * i (i.e. τ i ≡ τ * i ) if τ * i > T i and i is known. Note that the slope i is not generally known and requirements over the acknowledgement time ϑ i are more general.
The mechanism design strategies presented in this section are summarised in Table 2. Note that once J i is designed to guarantee one isolation performance index, the other indices can be computed through (31), (34) and (36).   (33) with Gaussian noises.

Co-design with FI requirements
The strategies presented in Section 4.2 show how to design the decision mechanism (8) to ensure one requirement over the index i.1, i.2 or i.4 when the gain matrices L and K of the observer (5) are prefixed (i.e. the gains are already designed). In order to achieve an isolator guaranteeing two or more requirements over these indices, it is necessary to perform a co-design of the observer (5) and the decision mechanisms (8). The following strategies, summarised in Table 3, show a proposal of how to perform this co-design for guaranteeing more than one isolation performance requirement. Strategy 4.1: Assume that we desire to ensure altogether certain false isolation rates φ * i (i = 1, . . . , n f ), certain minimum isolable constant faults ψ * i (i = 1, . . . , n f ) and minimum acknowledgement times under ramp faults (and thus minimum isolation times under ramp faults). To ensure these requirements, we first design the observer (5) through Strategy 3.2 with the value * in (25) for all i. Second, with the obtained gains L and K, we compute through (9) 8 and we set the isolation thresholds through (32) with φ * i for all i.

Remark 4.2:
If the noises v that affect the system (1) are Gaussian, the constraint (38) can be replaced by * and each isolation threshold can be set through (33) with φ * i .

Strategy 4.2:
Now, assume that we desire to ensure altogether certain false isolation rates φ * i (i = 1, . . . , n f ), certain acknowledgment times under ramp faults ϑ * i (i = 1, . . . , n f ) and we desire to minimise the minimum isolable faults. To ensure these requirements, we first design the observer (5) through Strategy 3.1 with the value in (23)   . . , n f ) and we desire to minimise the false isolation rates, we just have to design the observer (5) through Strategy 3.1 with the value T * i := ϑ * i and set J i := ψ * i for all i.

Remark 4.4:
In order to achieve an isolator which guarantees certain isolation times τ * i under ramp faults of slope i (i = 1, . . . , n f ), certain false isolation rates φ * i (i = 1, . . . , n f ) while it minimises the minimum isolable constant faults, we must design the observer (5) through (23) for all i. The constraint (23) becomes, then, nonlinear. Provided this nonlinearity and given that slope i is generally unknown, we use Strategy 4.2 whenever requirements over time isolation indices appear in the co-design.

FI and FE with a bank of observers
In this section, we address the case in which the faults and the UIs in the system (1) are not isolable (i.e. rank{G fd (z)} < n f i=1 rank{G f i (z)} + rank{G d (z)}) and, thus, it is not possible to build model-based observers that guarantee both decoupling from the UIs and appropriate fault estimates. Then, we design several observers (i.e. a bank of observers), each of them taking only into account a subset of all the faults to which the system is prone. Assuming that all the faults in the system are not simultaneous, we build a bank of decision mechanisms for the bank of observers which enhances, first, FI and, then, FE. Remark 5.1: As detailed in Remark 3.5, certain degree of UI decoupling is achievable regardless of the isolability of the faults from the UIs. In this section, we assume that practical UI decoupling is required and intermediate solutions guaranteeing certain degree of UI decoupling do not fulfil the required performance.
Remark 5.2: Consider the case in which certain requirements over estimation or isolation performance indices compromise FE or FI w.r.t. other performance indices.
Although not being necessary in terms of isolability conditions, the use of a bank of observers leads to a better performance w.r.t the compromised indices at the cost of new restrictions over the simultaneity of faults. This situation gives a further motivation to the strategies developed in this section.

Bank of observers and decision mechanisms for FI and FE
Let us denote the set of all possible faults as S = {f 1 , . . . , f n f } and the set of the corresponding ordered indices as π = {1, . . . , n f } (i.e. π i = i). We split the model (1) into a bank of m submodels. Each submodel b (with b = 1, . . . , m) takes account of a subset S b ⊂ S of n s < n f faults (with ordered indices π b ⊂ π ) while it ignores the other faults. Every fault of the system is at least considered by one submodel in the bank (i.e. S = b S b ) and S b = S c for b = c. The number of submodels in the bank is thus We denote the vector that stacks the faults which are taken into account by the bth submodel as f b and the vector that stacks the faults which are ignored by this submodel as f \b . The bth submodel is with E b and F b being the result of stacking the columns of E and F indexed by π b . The size n s of the subsets S b must be chosen in order to guarantee the isolability of all the fault vectors f b in the presence of UIs. For all b, we must have that Due to the additive nature of the faults and the UIs in (1), it is not possible to guarantee the condition (43) if n s > n y − n d . Then, we set n s as the maximum number less than or equal to n y − n d such that the condition (43) holds for all the submodels in the bank.
In analogy to (4), we augment each submodel (42) with the dynamics of the fault vector f b (i.e. A b F = I n s , B b F = I n s , C b F = I n s ). Then, likewise to (5), we build a bank of observers in the form of with L b and K b being the observer gain matrices of the bth observer of appropriate dimensions. Vectorf b is the estimated fault andẑ b is the estimated extended state. Note that (42) models the behaviour of the system (1) when the faults f \b are not present in the system (i.e. f \b = 0). Then,f b is only reliable when f \b = 0. We know that a fault f i is zero iff b l = 0 with π b l = i for some estimator b. If n s or more simultaneous faults occur, there are no zero-value fault estimates and all the estimates provided by the bank are thus corrupted. This means that it is only possible to discern reliable estimates when no more than n s − 1 simultaneous faults are present in the system and that FE and FI are only possible if n s > 1. In all, Algorithm 1 summarises the strategy to build the bank of observers guaranteeing the isolation and estimation of the maximum possible number of simultaneous faults.

Remark 5.3:
Assume that the condition (43) does not hold for all submodels b if n s > 1.
• If (43) holds at least for some submodels b when n s > 1 and all the faults f i (i = 1, . . . , n f ) are considered within these submodels, we extend them with A b F = I n s , B b F = I n s , C b F = I n s and we build the corresponding observers (44). We extend the other submodels which do not verify (43) with A b F = 0 n s ×n s , B b F = I n s , C b F = I n s and we build the corresponding observers (44). In this case, the latter observers are only used for FI purposes and allow discerning the reliability of the outputs provided by the first group of observers, which are used for FE purposes. See the details in Sales-Setién and Peñarrocha-Alós (2018). 9 Algorithm 1 Strategy to construct the bank of observers. In noisy environments, there are not zero-value fault estimates. This means that decision mechanisms based on thresholds are necessary for both FI and FE. Likewise to (8), we set the following decision mechanism which enables FI when no more than n s − 1 simultaneous faults occur with J b l being the isolation threshold of the lth fault in the bth bank.
For FE, we rely onf b l as an estimate of f π b l whilst no fault in f \b has been isolated through (45). If a set B of more than one estimator in the bank provides a reliable estimation of a fault f i , we definef i through the reliable estimator with better performance w.r.t. certain isolation performance index with b * = argmin b∈B α b l : π b l = i , and α b l certain isolation performance index reflecting and improved isolation performance as it decreases.

FI performance characterisation and co-design with FI requirements
The isolation index i.1 of a fault i, φ i , depends on the false alarms of every pairf b l and J b l with π b l = i, i.e.
when f i = 0. Note that the events X j = '∃k : |f b l (k)| ≥ J b l in (47) (with j = 1, . . . , n j and n j the number of pairs (b, l) satisfying π b l = i) are not independent and φ i depends on the conditional probability of each event X j subject to the occurrence of the others. Starting from event X 1 , we have that (48) This equality holds when starting from any event X j and, thus, we have that φ i ≤ P{X j } for j = 1, . . . , n j . The conditional probabilities in (48) are close to 1 because, in practice, the same noises affect all the observers simultaneously. Hence, we deduce that φ i is tightly bounded by where φ b l satisfies (27) for the bth estimator. Regarding the index i.1, the minimum isolable constant fault i, ψ i , is given by where ψ b l satisfies (28) for the bth estimator. Analogous definitions apply to the time indices i.3 and i.4.
In order to design the observers and decision mechanisms of the bank for satisfying global isolation performance requirements, we make use of these characterisations. The following two strategies show a proposal of how to perform the co-design of each observer and the corresponding thresholds for guaranteeing different isolation requirements.
Strategy 5.1: Assume that we desire to ensure altogether certain false isolation rates φ * i (i = 1, . . . , n f ), certain minimum isolable constant faults ψ * i (i = 1, . . . , n f ) and minimum acknowledgement times under ramp faults. To ensure these requirements, we perform m independent designs. In each of them, we design a different observer b of the bank and the corresponding thresholds J b l (l = 1, . . . , n s ) through Strategy 4.1 with requirements φ * i and ψ * i whenever π b l = i.

Strategy 5.2:
Assume that we desire to ensure altogether certain false isolation rates φ * i (i = 1, . . . , n f ), certain acknowledgement times under ramp faults ϑ * i (i = 1, . . . , n f ) and we want to minimise the minimum isolable constant faults. To ensure these requirements, we perform m independent designs. In each of them, we design a different observer b of the bank and the corresponding thresholds J b l (l = 1, . . . , n s ) through Strategy 4.2 with requirements φ * i and ϑ * i whenever π b l = i.

Case of study: FE and FI in a wind turbine
The benchmark in Odgaard et al. (2013) describes a three-bladed horizontal wind turbine which consists of four main systems: the generator and converter, the drive train, the blade and pitch and the controller. The strategies developed in this paper are independent of the control scheme and can be implemented regardless of the control law. In this section, we apply the proposed fault estimators and isolators to the first three systems.

State-space models
In the following, we model the wind turbine systems through the continuous model The sate-space matrices of the realizations are detailed in Appendix 2. Reference Odgaard et al. (2013), which is referred for further modelling details, specifies that the noises that affect the wind turbine benchmark are Gaussian.
Generator and Converter System. This system can be modelled as a first order closed-loop system between the torque reference, τ g,r , and the non-deviated torque τ g,n . The actual generator torque, τ g , is given by τ g = τ g,n + τ g,n , where τ g,n is the offset representing the converter fault. Let τ g,m and v τ g be the measurement of τ g and the corresponding additive noise; then, we have x τ g,n , u τ g,r , y τ g,m , f τ g,n , v v τ g , d ∅.
Drive Train System. The drive train dynamics is represented by a two-mass model involving the rotor speed, ω r , the generator speed, ω g and the torsion angle of the drive train, θ rg . This system is fed with the actual generator torque, τ g , and the aerodynamic torque from the wind, τ a . Provided that the real generator torque is not available, we model this input as the difference between its measurement, τ g,m , and the corresponding additive sensor noise, v τ g,m . The aerodynamic torque may be obtained through the wind speed and the power coefficient, C p , which is a nonlinear function of ω r , the wind speed and the pitch angles of the turbine. In practice, it is very difficult to know the real distribution of C p and the measurements of the wind speed provided by anemometers are rather inaccurate. Thus, we consider τ a to be an UI, which is a widely extended assumption in the bibliography, see Odgaard, Stoustrup, Nielsen, and Damgaard (2009). Both drive train speeds are measured by the redundant sensors ω r,m 1 , ω r,m 2 , ω g,m 1 and ω g,m 2 and we model their possible faults as the additive signals ω r,m 1 , ω r,m 2 , ω g,m 1 and ω g,m 2 . Similar applies to their corresponding sensor noise. In all, the state-space vectors are Blade and Pitch System. The hydraulic pitch system of each of the blades p = 1,2,3 is modelled as a second order closed-loop system between the reference angle provided by the wind turbine controller, β r , and the averaged measurement, β m(p) , provided by two redundant sensors, β m 1 (p) and β m 2 (p) . Both sensors entail measurement noises that disturb the closed loops. Provided that only the closed-loop indices (ω n 0 and ξ 0 ) are known, we model these disturbances as additive signals v β 1(p) and v β 2(p) which affect both the measurements and the reference. Similar applies to sensor faults, which we denote as β m 1 (p) and β m 2 (p) (See Figure 2). The pitch actuator may also suffer from dynamic changes. If we denote the deviations of ω n 0 and ξ 0 as ω n(p) and ξ (p) (i.e. ω n(p) = ω n 0 + ω n(p) and ξ (p) = ξ 0 + ξ (p) ), the actuator fault can be modelled as an additive signal in the form of f β a (p) = ( w 2 n(p) + 2w n 0 w n(p) )(β r − β (p) ) − 2(ξ 0 w n(p) + w n 0 ξ (p) + ξ (p) w n(p) )β (p) .
In all, the state-space vectors of each pitch system are

FE and FI architecture
We discretise the models (51)  in (1). The converter faults fulfil the necessary condition for fault isolability in Assumption 2.4; however, the drive train and the pitch faults do not verify it. Then, we split these two models as detailed in Section 5. For the drive train system, the strategy summarised in Algorithm 1 leads to n s = 3 and m = 4: then, FI is only guaranteed if no more than two simultaneous faults occur. For each pitch system, the strategy summarised in Algorithm 1 indicates that the procedure in Remark 5.3 must be applied. We get n s = 2 and m = 3: The isolability condition (43) holds for the subsets S 1 and S 2 , and all the faults of the pitch system are considered within these subsets. For the subset S 3 the condition (43) does not hold and we must use A b F = 0, B b F = I, C b F = I to extend this submodel.
For each of the resulting submodels, we define the observers (44) and the corresponding decision mechanisms (45). The signature matrices are presented in Tables 4 and 5, where indicates that the estimate f b l is devoted to the estimation of the fault f i and indicates that the fault f i is ignored by the observer b and it may corrupt the estimates f b l with l = 1, . . . , n s . For each of the resulting submodels, we define the observers (44) and the corresponding decision mechanisms (45).

FE and FI design
Let us first perform different observer designs to study the existing trade-offs between the estimation performance criteria detailed in Section 3.1. 10 Figure 3 (left) shows the estimation performance results for different observers designed through Strategy 3.1 for the converter system. One verifies that imposing more restrictive constraints over the ramp fault tracking delay T 11 leads to higher marginal variances due to noises 11 . Figure 4 includes the details on the frequency response of the closed-loop transfer function between f andf for some of these observers (Observer A with T 11 = 1 samples, Observer B with T 11 = 3 samples and Observer C with T 11 = 5 samples). Provided the physical proprieties of the converter system, the transfer function between f and f coincides with the transfer function between v andf . One verifies then that the observers with a higher bandwidth and a lower phase lag (i.e. fastest response under the appearance of faults) are characterised by higher magnitudes at high frequencies (i.e. higher noise influence). Figure 3 (left) also represents the effect of performing these designs in situations of amplified (i.e. 4V) and attenuated (i.e. 1/4V ) noises, where V denotes the noise covariance in the benchmark. When the noises affecting the systems increase in variance, the same fault tracking delays imply higher variances.  Now, we perform the observer and decision mechanism co-design in Strategy 4.2 with different acknowledgement time requirements. Figure 3 (right) depicts the trade-offs between the isolation performance indices defined in Section 4.1. Again, imposing more restrictive time constraints leads to higher minimum isolable constant faults for certain level of false alarms. For its part, increasing the false isolation rate reduces the value of the minimum isolable constant faults for certain acknowledgement time of ramp faults.
To fulfil the requirements in the benchmark (Odgaard et al., 2013), we now design the observers and decision mechanisms of the three wind turbine systems through Strategy 4.2. Although the benchmark (Odgaard et al., 2013) highlights the necessity of isolating the faults occurring in the wind turbine systems, it only explicitly specifies requirements over detection performance indices. Thus, we equal the requirements over the false detection rates and the detection times in the benchmark to the requirements over the false isolation rates and the isolation times, respectively. In order to directly apply our approach, we approximate the requirements over the isolation times to requirements over the acknowledgement times of ramp faults and we perform the co-design of each pair of observer and mechanism in the banks. In number of samples, we have ϑ * 1 = 3 for the converter, ϑ * {1,2,3,4} = 10 for the drive train system, and ϑ * 1 = 8, ϑ * {2,3} = 10 for the pitch system. The required false isolation rate is φ * i = 10 −5 for all the systems. We use the summation (i.e. n s l=1 ll ) as the function f ( 11 , . . . , n s n s ) being minimised in the optimisation problem. The obtained minimum isolable constant faults are indicated in Table 6.

Simulation results
The wind turbine benchmark presents an scenario of 4400 s in which different faults occur. Within the listing of the possible faults, the benchmark test sequences choose the subset of faults in Table 7. The benchmark  considers seven different test signal sets; they are formed by time-shifting the occurrence of the faults defined in the original test sequence (TS1), which is described in Table 7. Illustratively, let us first simulate the time response of the Observers A, B and C defined in Figure 4 to estimate the converter fault in the test set TS1. Let us also analyse the effect of the restrictiveness of the time constraints on the sensitivity to parameter changes in the model. Figure 6 shows the effect produced by a 5% relative change in the parameter defining the converter dynamics. We verify that the sensitivity to parameter changes increases as the time constraints become more restrictive. The reader is referred to Remark 2.3 and equation (7) to obtain the algebraic expression of the effect of the parameter changes on the fault estimation error. 11  Now, we test the behaviour of the observers and decision mechanics that we have designed with the isolation performance constraints in the benchmark. If we simulate the different test sets proposed in the benchmark through several Monte Carlo simulations for different noises, we verify that all the results verify the false isolation rate restriction tightly. The isolation times of the faults are summarised in Table 8. As an example, Figure 7 details the isolation times obtained for the fault DT1-1. Note that the minimum isolation times fulfil the requirements in the benchmark. The cases in which the time requirement is exceeded refer to scenarios with variable fault signals which do not always exceed the achieved minimum isolable fault. For instance, there are cases in which the fault P3-2 is present in the system but the pitch reference is barely zero. In such cases, there is no chance to detect or isolate the changes experienced by the pitch dynamics. Other proposals available in the bibliography provide similar results regarding this issue. In any case, if the designer decides that misisolating these small faults may be prohibitive, it would be possible to redesign the fault isolators through Strategy 5.1 as    explained in Section 5. Note that numerical comparisons with other strategies in the literature are difficult because most existing works are devoted to fault detection and fault isolation and estimation are not included. Moreover, they study indices as the FDR instead of the physically meaningful parameters required on the benchmark (i.e. isolation times, minimum isolable faults, etc.).
In the following, we include the figures showing the FE and FI results in the test set TS1 (described in Table 7). First, Figure 8 shows the estimation signal and the corresponding isolation threshold for the converter system, which is affected by GC-1. Figure 9 shows the outputs provided by the bank built for FE and FI in the drive train system, which is affected by DT-1 and DT-2. It Figure 11. Details of FE and FI in the third pitch system (test set TS1).
is straightforward to verify that applying (45)-(46), the isolation and the estimation of the faults DT-1 and DT-2 is achieved. Regarding the pitch system, Figure 10 (details in Figure 11) shows the results for the third pitch system, which is affected by both P3-1 and P3-2. The figure includes the fault estimates and the thresholds corresponding to the relied observers in the bank. Note that the observer which provides the estimate of the fault f 3 = β m 2 (p) (i.e. the pair with better isolation optimised performance index) becomes non-reliable when f 2 = β m 1 (p) is present in the system. In this case, the estimation is provided by another pair in the bank with a poorer minimum isolable fault. For ease of space, we do not include the results for the first and second pitch systems.

Conclusion
In this work, we have developed performance-based designs of model-based observes and statistical-based decision mechanisms for achieving FE and FI in systems affected by unknown inputs and stochastic noises. First, we have presented FE performance-based designs of PI observers taking into account the trade-off between the degree of UI and interfault decoupling, the delay to track fault variations and the covariance due to noises. Second, we have presented FI performance-based co-designs of the observers and decision mechanisms taking into account the trade-off between the false isolation rates, the minimum isolable faults and the isolation times. Finally, we have extended the results to a scheme based on a bank of observers and decision mechanisms which provides a solution for FI and FE in systems where fault isolability conditions do not hold and it is not possible to achieve FE through standard observers. We have applied this procedure to a well-known benchmark that has explicit isolation requirements and we have shown that we fulfil all these requirements by just including them as constraints in the designs.

Notes
1. The proposed method entails a more general approach compared with some other existing works that only consider either actuator faults (Rodrigues et al., 2015) or sensor faults (Aouaouda et al., 2015;Liu & Shi, 2013 6. If a > 0 and x is a random variable of mean μ and variance σ , then P{|x − μ| > a σ } ≤ 1/a 2 . 7. Note that the threshold J i defined as (33) ensures φ i ≡ φ * i in the case of Gaussian noises while the threshold J i defined as (32) ensures the bound φ i ≤ φ * i regardless of the statical distribution of the noises. 8. Strategy 3.2 guarantees practical UI and interfault decoupling and thus, in the fault-free scenarios, signalf i is zeromean and its variance is given by the marginal variance ii . 9. Once a fault is accommodated, the observers in the bank must be reset to avoid the existence of wrong initial conditions derived from the previous presence of ignored faults. 10. The problems are set up in YALMIP (Lofberg, 2004) and we successfully solve them with the PENBMI solver (Henrion et al., 2005). For sake of brevity, we do not include the value of the obtained gain matrices. 11. If the uncertainties regarding parameter changes lead to poor estimation results, these uncertainties must be modelled as UIs (see Remark 2.3) and certain degree of UI decoupling (i.e. constraint (19)) must be introduced as an additional requirement in the observer design.

Disclosure statement
No potential conflict of interest was reported by the authors.

Funding
This work has been supported by the