Theory and Practice of Energy-directed Passive Fault-tolerant Control Systems for Safety-critical Applications

事故的真正原因是什么？这是储存能量的“不受控制”的释放。人们滑倒，这是一种不受控制的势能释放。两辆汽车相撞，这是一种不受控制的动能释放。随着技术的进步，人造系统储存的能量越来越多，因为我们建造了更大的飞机，更大的核反应堆和超高层建筑。这些系统中的任何事故通常都可以追溯到储存能量的不可控制的释放。多年来，已经提出了不同类型的容错控制系统的概念，以保持这种系统的安全性，但不幸的是，很少有人研究问题的核心，即如何有效地重新引导存储的能量通过安全的方式，使系统边界的完整性得到维护。目前的许多容错控制系统依赖于外部能源来“压倒”存储的能量以改变其路线。这不仅增加了设计和实施的复杂性，而且使系统的安全性更容易受到外部能源故障的影响。具有讽刺意味的是，我们可以问：福岛核电站灾难的原因是什么？答案很简单，由于衰变热，反应堆堆芯中留下了太多的“能量”，而我们没有足够的外部“能量”来快速从衰变热中获得能量，这是由于地震破坏了电网，海啸摧毁了现场应急柴油发电机。一个值得提出的问题是：我们能否通过安全控制系统的创新设计，有效地利用堆芯中的能量来保持自身冷却？

What is the true cause of any accident? It is an 'uncontrolled' release of the stored energy. People slip and fall; it is an uncontrolled release of potential energy. Two cars collide; it is an uncontrolled release of kinetic energy. As technology advances, man-made systems store increasingly more energy, as we build bigger planes, larger nuclear reactors, and ultra-tall buildings. Any accident involved in these systems can often be traced back to an uncontrollable release of the stored energy. Over the years, different types of fault-tolerant control system concepts have been proposed to maintain the safety of such systems, but unfortunately, few have examined the heart of the problem, i.e. how to effectively re-direct the stored energy through safe ways so that integrity of the system boundaries are maintained. Many of the current fault-tolerant control systems rely on external energy sources to 'overpower' the stored energy to change its course. This not only increases the complexity of the design and implementation, but also makes the safety of the system more vulnerable to failures of the external energy sources. Ironically, we can ask: what is the cause of the disaster at the Fukushima nuclear power plant? The answer is simply that there is too much 'energy' left in the reactor core due to decay heat, and we do not have sufficient external 'energy' to get the energy from the decay heat out quickly, due to earthquake ruined power grids and tsunami shattered on-site emergency diesel generators. A worthy question to ask is: Can we effectively use the energy in the core to keep itself cool through innovative design of safety control systems?