Fault Tolerant Flight Control: A Benchmark Challenge (Lecture Notes in Control and Information Sciences, 399)

Lecture Notes in Control and Information Sciences 399 Editors: M. Thoma, F. Allgöwer, M. Morari Christopher Edwards, ...

Author: Christopher Edwards | Thomas Lombaerts | Hafid Smaili

71 downloads 1750 Views 27MB Size Report

This content was uploaded by our users and we assume good faith they have the permission to share this book. If you own the copyright to this book and it is wrongfully on our website, we offer a simple DMCA procedure to remove your content from our site. Start by pressing the button below!

Report copyright / DMCA form

DOWNLOAD PDF

Lecture Notes in Control and Information Sciences 399 Editors: M. Thoma, F. Allgöwer, M. Morari

Christopher Edwards, Thomas Lombaerts, and Haﬁd Smaili (Eds.)

Fault Tolerant Flight Control A Benchmark Challenge

ABC

Series Advisory Board P. Fleming, P. Kokotovic, A.B. Kurzhanski, H. Kwakernaak, A. Rantzer, J.N. Tsitsiklis

Editors Christopher Edwards

Haﬁd Smaili

University of Leicester University Road Leicester LE1 7RH United Kingdom E-mail: [email protected]

National Aerospace Laboratory NLR Anthony Fokkerweg 2 1059 CM Amsterdam The Netherlands E-mail: [email protected]

Thomas Lombaerts Delft University of Technology Kluyverweg 1 P.O. Box 5058 2600 GB Delft The Netherlands E-mail: [email protected]

ISBN 978-3-642-11689-6

e-ISBN 978-3-642-11690-2

DOI 10.1007/978-3-642-11690-2 Lecture Notes in Control and Information Sciences

ISSN 0170-8643

Library of Congress Control Number: 2010924939 c 2010

Springer-Verlag Berlin Heidelberg

This work is subject to copyright. All rights are reserved, whether the whole or part of the material is concerned, speciﬁcally the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microﬁlm or in any other way, and storage in data banks. Duplication of this publication or parts thereof is permitted only under the provisions of the German Copyright Law of September 9, 1965, in its current version, and permission for use must always be obtained from Springer. Violations are liable for prosecution under the German Copyright Law. The use of general descriptive names, registered names, trademarks, etc. in this publication does not imply, even in the absence of a speciﬁc statement, that such names are exempt from the relevant protective laws and regulations and therefore free for general use. Typeset & Cover Design: Scientiﬁc Publishing Services Pvt. Ltd., Chennai, India. Printed on acid-free paper 543210 springer.com

Preface

The European Flight Mechanics Action Group FM-AG(16) on Fault Tolerant Control, established in 2004 and concluded in 2008, represented a collaboration involving thirteen European partners from industry, universities and research establishments under the auspices of the Group for Aeronautical Research and Technology in Europe (GARTEUR) program1. In FM-AG(16) the following organizations participated: • Research Establishments – – – –

Centro Italiano Ricerche Aerospaziali (CIRA, Capua, Italy) Deutsches Zentrum fur Luft-und Raumfahrt (DLR, Oberpfaffenhofen) Defence Science and Technology Laboratory (DSTL, United Kingdom) Netherlands National Aerospace Laboratory (NLR, Amsterdam)

• Industry – QinetiQ (Bedford, United Kingdom) – Airbus (Toulouse, France) • Universities – Bordeaux University (LAPS, Bordeaux, France) – Delft University of Technology (DUT, Delft, the Netherlands) · Faculty of Aerospace Engineering (DUT-AE) · Delft Center of Systems and Control (DUT-DCSC) – Lille University (USTL, Lille, France) – University of Cambridge (UCAM, Cambridge, United Kingdom) 1

The Group for Aeronautical Research and Technology in EURope (GARTEUR) was formed in 1973 and has as member countries: France, Germany, the Netherlands, Spain, Sweden and the United Kingdom. According to its Memorandum of Understanding, the mission of GARTEUR is to mobilize, for the mutual beneﬁt of the GARTEUR member countries, their scientiﬁc and technical skills, human resources, and facilities in the ﬁeld of aeronautical research and technology.

VI

Preface

– University of Hull (UHUL, Hull, United Kingdom) – University of Leicester (ULES, Leicester, United Kingdom) The Action Group was chaired by Jon King (QinetiQ); Jan Breeman (NLR) was vice-chairman and acting chairman during the last months of the program. Ten meetings were held in total: Bedford (September 2004), Capua (February 2005), Oberpfaffenhofen (July 2005), Lille (February 2006), Toulouse (Mid-Term Workshop, 4-5 April 2006), Bordeaux (October 2006), Leicester (January 2007), Delft (April 2007), Cambridge (July 2007) and again Delft (20-21 November 2007), which was the venue for the Final Workshop and SIMONA Demonstration, giving an extra inter-cultural dimension to the project. The demonstration on the SIMONA Research Simulator at the Faculty of Aerospace Engineering at Delft University during the Final Workshop helped to provide a strong focus to develop the methods and provided a human appreciation of the problem. In a subsequent evaluation in the SIMONA Research Simulator, conducted in 2008, professional airline pilots were invited as an external expert group. This provided supporting information on the practical and operational implications of advanced ﬂight control systems integration from a human factors perspective. The editors would like to emphasize that this book is the result of a joint effort by the Action Group. With respect to the contents, it was considered to be important that as many FM-AG(16) organizations as possible were given the opportunity to present their work, in order to cover a wide variety of design approaches. Hence the contributions in this book have not been selected by the editors. The book consists of ﬁve parts. Part I contains the introduction and motivation of this research project and a state-of-the-art overview in Fault Tolerant Flight Control (FTC). Part II includes the description of the benchmark challenge, consisting of details of the benchmark simulation model and the assessment criteria used to evaluate the performance of the Fault Tolerant Controllers. Part III covers all the different FDI/FTC design methods which have been applied to the benchmark simulation model. There are two different evaluation methods for these FDI/FTC designs, namely an off-line evaluation using the assessment criteria in the benchmark simulation model in Matlab, and an on-line evaluation on Delft’s SIMONA Research Simulator. The off-line evaluations are described in the individual chapters in part III, whereas the latter is treated extensively in part IV where the real time assessments on the SIMONA Research Simulator are introduced and discussed. Finally part V focuses on a review of the applied methods from an industrial perspective together with some concluding remarks. The work underpinning this book was undertaken by the participating organizations of GARTEUR FM-AG(16). These organizations, which are listed above, are thanked for their conﬁdence in the group and their full support throughout the project. In some cases national agencies and other research funding bodies, such as STW in the Netherlands and EPSRC from the UK, gave direct ﬁnancial help through the provision of grants. Without their ﬁnancial support this project would not have been possible.

Preface

VII

FM-AG(16) also wishes to express its gratitude to the Netherlands Aerospace Laboratory NLR for supplying the high-ﬁdelity nonlinear simulation model based on realistic failure scenarios validated against ﬂight data, which is a unique facility. Also Delft University deserves thanks for offering the SIMONA Research Simulator as an evaluation platform for the FTFC methods. This re-invigorated the programme considerably. The contribution of the test pilots who participated in the FM-AG(16) simulator campaign, and provided professional feedback on the evaluated control designs, is gratefully acknowledged. The group also thanks the GARTEUR organization, in particular the Flight Mechanics Group of Responsables and the Executive Committee, for making the publication of this book possible. John Keirl from QinetiQ and Dennis Fryer from DSTL, who acted as the GARTEUR Monitoring Responsables of FM-AG(16), have provided key contributions behind the scenes. They were an indispensable link between the Action Group and the GARTEUR organization. The editors would like to thank all those who kindly provided their approval to use the pictures and illustrations in this book. The authors have taken into account to their best capacity the copyrights of the illustrations and these remain the property of the cited copyright holders. Not all the results of GARTEUR Action Group FM-AG(16) could be presented in this book. Several research teams did not submit designs for the ﬁnal workshop, and there were other reasons why their work could not be included. In this respect Marcel Staroswiecki and Cyrille Christophe (Lille University), Sven Lorenz (DLR-BS), Stuart Runham (DSTL), Ron Patton (Hull University) and Youmin Zhang (Aalborg University) and all their colleagues are acknowledged for their valuable contributions during the program. Finally, special thanks to Airbus and Delft University for organizing and hosting the Mid-Term and Final Workshops respectively. December 2009

C. Edwards T.J.J. Lombaerts M.H. Smaili

Contents

Part I Surviving the Improbable: Towards Resilient Aircraft Control 1

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Thomas Lombaerts, Haﬁd Smaili, Jan Breeman 1.1 Towards More Resilient Flight Control . . . . . . . . . . . . . . . . . . . . . . 1.2 History of Flight Control Systems, Source: [40] . . . . . . . . . . . . . . . 1.2.1 Mechanical [33], [35] . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.2.2 Hydro-mechanical [33], [35] . . . . . . . . . . . . . . . . . . . . . . . 1.2.3 Fly-By-Wire Flight Control [33], [35], [34] . . . . . . . . . . . 1.2.4 Fault Tolerant Control in Fly-By-Wire Systems, Sources: [40] . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.2.5 Airbus Philosophy, Sources: [22], [30] . . . . . . . . . . . . . . . 1.2.6 Boeing Philosophy, Sources: [24], [42] . . . . . . . . . . . . . . 1.2.7 Short Case Study of Other Fault Tolerant Systems, Source: [24] . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.2.8 A Final Note on Fault Tolerance Properties Incorporated in Current Fly by Wire Flight Control Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.3 Rationale of Damage Tolerant Control - Aircraft Accident Survey . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.3.1 American Airlines Flight AA191, Source: [27] . . . . . . . . 1.3.2 Japan Airlines Flight JL123, Source: [27] . . . . . . . . . . . . 1.3.3 United Airlines Flight UA232, Source: [27] . . . . . . . . . . . 1.3.4 EL AL Cargo Flight LY1862, Source: [40] . . . . . . . . . . . 1.3.5 USAir Flight 427 and United Airlines Flight 585, Sources: [4], [9], [5] . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.3.6 DHL Cargo Flight above Baghdad, Sources: [31], [32] . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.3.7 Final Note on Accident Analysis . . . . . . . . . . . . . . . . . . . . 1.4 Earlier Accomplishments in This Field, Source: [40] . . . . . . . . . . .

3 3 4 6 6 7 10 11 12 14

20 21 22 26 28 30 32 36 38 40

X

Contents

1.4.1

Self-Repairing Flight Control System (SRFCS) Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.4.2 MD-11 Propulsion Controlled Aircraft (PCA) . . . . . . . . . 1.4.3 NASA Intelligent Flight Control System (IFCS) F-15 Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.5 Research Challenges and Objectives . . . . . . . . . . . . . . . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

3

Fault Tolerant Flight Control - A Survey . . . . . . . . . . . . . . . . . . . . . . Michel Verhaegen, Stoyan Kanev, Redouane Hallouzi, Colin Jones, Jan Maciejowski, Haﬁd Smail 2.1 Why Fault Tolerant Control? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2 Fault Classiﬁcation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.3 Modelling Faults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.3.1 Multiplicative Faults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.3.2 Additive Faults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.3.3 Component Faults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.4 Main Components in an FTC System . . . . . . . . . . . . . . . . . . . . . . . . 2.5 FTC Problem Formulation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.5.1 Passive Fault Tolerant Control . . . . . . . . . . . . . . . . . . . . . . 2.5.2 Active Fault Tolerant Control . . . . . . . . . . . . . . . . . . . . . . . 2.6 State-of-the-Art in Fault Tolerant Flight Control . . . . . . . . . . . . . . . 2.6.1 Classiﬁcation of Reconﬁgurable Control . . . . . . . . . . . . . 2.6.2 Multiple Model Control . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.6.3 Control Allocation (CA) . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.6.4 Adaptive Feedback Linearization via Artiﬁcial Neural Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.6.5 Sliding Mode Control (SMC) . . . . . . . . . . . . . . . . . . . . . . 2.6.6 Eigenstructure Assignment (EA) . . . . . . . . . . . . . . . . . . . . 2.6.7 Model Reference Adaptive Control (MRAC) . . . . . . . . . . 2.6.8 Model Predictive Control . . . . . . . . . . . . . . . . . . . . . . . . . . 2.6.9 Model Following . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.6.10 Adaptive Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.7 Comparison of Fault Tolerant Flight Control Methods . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

40 41 41 42 43 47

47 49 51 51 53 54 55 58 61 62 63 63 64 69 71 74 75 78 80 81 82 83 85

Fault Detection and Diagnosis for Aeronautic and Aerospace Missions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 David Henry, Silvio Simani, Ron J. Patton 3.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 3.2 Fault Detection and Diagnosis Approaches . . . . . . . . . . . . . . . . . . . 94 3.2.1 The Parity-Space Methods . . . . . . . . . . . . . . . . . . . . . . . . . 94 3.2.2 Particle Filtering Approach . . . . . . . . . . . . . . . . . . . . . . . . 97 3.2.3 Nonlinear EKF Approaches . . . . . . . . . . . . . . . . . . . . . . . . 99 3.2.4 Observer-Based Approaches . . . . . . . . . . . . . . . . . . . . . . . 101 3.2.5 Norm-Based Approaches . . . . . . . . . . . . . . . . . . . . . . . . . . 103

Contents

3.2.6 H∞ Fault Estimation Approach . . . . . . . . . . . . . . . . . . . . . 3.2.7 Non-linear FDD Method . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2.8 Sliding Mode Observer . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.3 Application Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.3.1 Application to ‘Oscillatory Failure Case’ (OFC) . . . . . . . 3.3.2 Simulated Aircraft Model FDD . . . . . . . . . . . . . . . . . . . . . 3.3.3 Aerospace Mission Application Examples . . . . . . . . . . . . 3.3.4 Robust Diagnosis for Mars Express Satellite Thruster Faults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.4 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

5

Real-Time Identiﬁcation of Aircraft Physical Models for Fault Tolerant Flight Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ping Chu, Jan Albert (Bob) Mulder, Jan Breeman 4.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.2 History of Aircraft Model Identiﬁcation at Delft University of Technology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.3 The Two Step Method . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.3.1 Decomposition of Aircraft State and Parameter Estimation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.3.2 Estimation Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.3.3 Techniques to Cope with Estimation Biases . . . . . . . . . . . 4.4 On-Line Parameter Estimation Using Least Squares and Total Least Squares Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.4.1 Preliminaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.4.2 Sequential Total Least Squares (Ref. [34]) . . . . . . . . . . . . 4.4.3 Summary of TLS Method . . . . . . . . . . . . . . . . . . . . . . . . . . 4.5 Real-Time Identiﬁcation of Aircraft Physical Model for Fault Tolerant Flight Control, [13] . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.6 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Industrial Practices in Fault Tolerant Control . . . . . . . . . . . . . . . . . . . Philippe Goupil 5.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.2 Aircraft Development Process - The V-Cycle . . . . . . . . . . . . . . . . . 5.3 Some ‘Golden Rules’ for Designing a Highly Dependable System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.4 Flight Control Computer Functional Speciﬁcation . . . . . . . . . . . . . 5.5 System Validation and Veriﬁcation . . . . . . . . . . . . . . . . . . . . . . . . . . 5.6 An Example of Monitoring: A380 Oscillatory Failure Case Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.7 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

XI

104 107 109 109 110 110 113 116 120 121 129 129 130 135 136 144 146 146 147 148 149 149 152 153 157 157 157 158 161 162 163 166 166

XII

Contents

Part II RECOVER: The Benchmark Challenge 6

7

RECOVER: A Benchmark for Integrated Fault Tolerant Flight Control Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Haﬁd Smaili, Jan Breeman, Thomas Lombaerts, Diederick Joosten 6.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.2 Flight 1862 Accident Reconstruction and Simulation . . . . . . . . . . 6.2.1 Sequence of Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.2.2 Analysis of Flight 1862 . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.2.3 Failure Mode Conﬁguration . . . . . . . . . . . . . . . . . . . . . . . . 6.2.4 Flight Data Reconstruction and Simulation . . . . . . . . . . . 6.3 GARTEUR RECOVER Benchmark . . . . . . . . . . . . . . . . . . . . . . . . . 6.3.1 Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.3.2 Implementation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.3.3 Fault Scenarios Speciﬁcation . . . . . . . . . . . . . . . . . . . . . . . 6.3.4 Graphical User Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.3.5 Aircraft Visualisation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.3.6 User Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.3.7 Aircraft Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.4 GARTEUR RECOVER Benchmark Applications . . . . . . . . . . . . . 6.5 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Assessment Criteria as Speciﬁcations for Reconﬁguring Flight Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Thomas Lombaerts, Diederick Joosten, Haﬁd Smaili, Jan Breeman 7.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.2 Speciﬁcation Modelling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.2.1 General Evaluation Criteria . . . . . . . . . . . . . . . . . . . . . . . . 7.2.2 Test Manoeuvres for Qualiﬁcation . . . . . . . . . . . . . . . . . . 7.3 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

171

171 172 173 176 180 181 194 194 197 200 206 209 210 212 218 219 220 223

223 224 225 227 239 243

Part III Design Methods and Benchmark Analysis 8

Fault Tolerant Control Using Sliding Modes with On-Line Control Allocation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Halim Alwi, Christopher Edwards 8.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.1.1 Sliding Mode Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.1.2 Sliding Mode Control and Control Allocation . . . . . . . . . 8.2 Controller Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.2.1 Problem Formulation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.2.2 Design Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

247 247 247 248 249 249 254

Contents

XIII

8.3

254 256

Controller Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.3.1 Fault Tolerant Controller Design . . . . . . . . . . . . . . . . . . . . 8.3.2 Heading and Altitude Control and EPR Control Mixing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.3.3 ILS Landing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.3.4 Fault Tolerant Control Simulation Results . . . . . . . . . . . . 8.4 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

An Adaptive Fault-Tolerant FCS for a Large Transport Aircraft . . . Adolfo Sollazzo, Gianfranco Morani, Andrea Giovannini 9.1 Fault-Tolerant FCS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.1.1 Adaptive Model-Following . . . . . . . . . . . . . . . . . . . . . . . . 9.1.2 The SCAS Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.1.3 Limitations and Practical Solutions . . . . . . . . . . . . . . . . . . 9.2 The Classic A/P . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.3 Numerical Validation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4 Future Development . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

10 Subspace Predictive Control Applied to Fault-Tolerant Control . . . . Redouane Hallouzi, Michel Verhaegen 10.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.2 Architecture of the Fault-Tolerant Control System . . . . . . . . . . . . . 10.2.1 Control Loops . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.2.2 Fault Isolation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.3 Closed-Loop Subspace Predictive Control . . . . . . . . . . . . . . . . . . . . 10.3.1 Closed-Loop Subspace Predictor (CLSP) . . . . . . . . . . . . . 10.3.2 Closed-Loop Subspace Predictor Integrated with a Predictive Control Law . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.4 SPC (Re-)conﬁguration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.5 Simulation Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.5.1 Trajectory Following for the Nominal Case . . . . . . . . . . . 10.5.2 Trajectory Following for Elevator Lock-in-Place . . . . . . 10.5.3 Trajectory Following for Rudder Runaway . . . . . . . . . . . 10.5.4 Trajectory Following for “Bijlmerramp” Condition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.5.5 Discussion of the Simulation Results . . . . . . . . . . . . . . . . 10.6 Real-Time Implementation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10.7 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

260 261 264 270 270 273 273 274 277 279 280 280 287 289 290 293 293 295 295 296 297 297 301 303 305 306 307 309 310 312 313 315 315

XIV

Contents

11 Fault-Tolerant Control through a Synthesis of Model-Predictive Control and Nonlinear Inversion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D.A. Joosten, T.J.J. van den Boom, M. Verhaegen 11.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.2 Overall Control-Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.2.1 Model Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.2.2 Nonlinear Dynamic Inversion . . . . . . . . . . . . . . . . . . . . . . 11.2.3 Model Predictive Control . . . . . . . . . . . . . . . . . . . . . . . . . . 11.2.4 Control Allocation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.3 Modeling and Dynamic Inversion of the Benchmark Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.4 Simulation Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.4.1 Reference Tracking: Stabiliser Runaway . . . . . . . . . . . . . 11.4.2 Right Turn and Localiser Intercept . . . . . . . . . . . . . . . . . . 11.5 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 A FTC Strategy for Safe Recovery against Trimmable Horizontal Stabilizer Failure with Guaranteed Nominal Performance . . . . . . . . J´erome Cieslak, David Henry, Ali Zolghadri 12.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12.2 Nomenclature . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12.3 Problem Statement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12.4 Model-Based FDI Schemes: Some Assumptions for an Integrated FDI/FTC Design Approach . . . . . . . . . . . . . . . . . . . . . . . 12.4.1 Analysis of the FTC Loop . . . . . . . . . . . . . . . . . . . . . . . . . 12.4.2 Some Outlines for the Design . . . . . . . . . . . . . . . . . . . . . . 12.4.3 The Case of an Observer-Based FDI Scheme . . . . . . . . . 12.5 Important Issues about Stability and Performance in Faulty Situations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12.6 FM-AG16 FTC Problem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12.6.1 Modelling the Aircraft Dynamics . . . . . . . . . . . . . . . . . . . 12.6.2 Modeling the Autoﬂight and FCS Systems . . . . . . . . . . . 12.6.3 Design of K(s) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12.6.4 Nonlinear Simulation Results . . . . . . . . . . . . . . . . . . . . . . 12.7 Concluding Remarks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Appendix A: Bumpless Switching Scheme . . . . . . . . . . . . . . . . . . . . . . . . . ˆ ˆK + Appendix B: Computed Controller K(s) = CˆK (sI − AˆK )−1 B ˆ DK . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

319 319 320 322 322 324 327 327 331 331 332 335 335 337 337 339 340 344 344 345 346 346 347 347 350 350 354 356 356 359 360

13 Flight Control Reconﬁguration Based on Online Physical Model Identiﬁcation and Nonlinear Dynamic Inversion . . . . . . . . . . . . . . . . . 363 Thomas Lombaerts, Ping Chu, Jan Albert (Bob) Mulder 13.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 363

Contents

On Line Nonlinear Damaged Aircraft Model Identiﬁcation: Two Step Method . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13.2.1 Aircraft State Estimation . . . . . . . . . . . . . . . . . . . . . . . . . . 13.2.2 Aerodynamic Model Identiﬁcation . . . . . . . . . . . . . . . . . . 13.3 Real Time Aerodynamic Model Identiﬁcation . . . . . . . . . . . . . . . . 13.4 Application on the Boeing 747 Simulator . . . . . . . . . . . . . . . . . . . . 13.4.1 Trim Horizontal Stabilizer (THS) Runaway . . . . . . . . . . . 13.4.2 Loss of the Vertical Tail . . . . . . . . . . . . . . . . . . . . . . . . . . . 13.4.3 Feedback of Aircraft Stability and Control Effector Information to the Pilot . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13.5 Trigger for Reconﬁguration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13.6 Reconﬁguring Control: Adaptive Nonlinear Dynamic Inversion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13.6.1 Autopilot Control: Assessment Criteria . . . . . . . . . . . . . . 13.7 Computational Load . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13.8 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13.9 Current and Future Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

XV

13.2

14 A Combined Fault Detection, Identiﬁcation and Reconﬁguration System Based around Optimal Control Allocation . . . . . . . . . . . . . . . Nicholas Swain, Shadhanan Manickavasagar 14.1 Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14.1.1 Control Allocation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14.1.2 Fault Detection and Identiﬁcation . . . . . . . . . . . . . . . . . . . 14.1.3 Software and Hardware Testing . . . . . . . . . . . . . . . . . . . . . 14.2 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14.3 Fault Tolerant Control System Overview . . . . . . . . . . . . . . . . . . . . . 14.3.1 Sensors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14.3.2 Outer-Loop Controller/Autopilot . . . . . . . . . . . . . . . . . . . . 14.3.3 Non-linear Dynamic Inversion . . . . . . . . . . . . . . . . . . . . . . 14.3.4 Direct Control Allocation . . . . . . . . . . . . . . . . . . . . . . . . . . 14.3.5 Aerodynamic FDI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14.3.6 Actuator FDI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14.3.7 Flight Envelope Protection . . . . . . . . . . . . . . . . . . . . . . . . . 14.4 Benchmark Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14.4.1 Longitudinal Control Failure Test . . . . . . . . . . . . . . . . . . . 14.4.2 Lateral Control Failure Test . . . . . . . . . . . . . . . . . . . . . . . . 14.4.3 El-AL Case . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14.5 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

364 366 368 371 372 373 373 375 376 377 382 395 395 396 396 399 399 399 402 403 403 405 405 406 406 407 411 414 416 418 418 419 420 421 422

XVI

Contents

15 Detection and Isolation of Actuator/Surface Faults for a Large Transport Aircraft . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Andras Varga 15.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15.2 Design of Least Order Scalar Output Detectors . . . . . . . . . . . . . . . 15.3 Solving Fault Isolation Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . 15.4 Computational Aspects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15.5 Monitoring Actuator Failures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15.5.1 Component Level Monitoring . . . . . . . . . . . . . . . . . . . . . . 15.5.2 System Level Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . 15.5.3 Pitch Axis Fault Monitoring . . . . . . . . . . . . . . . . . . . . . . . . 15.5.4 Gear and Roll Axes Fault Monitoring . . . . . . . . . . . . . . . . 15.6 Summary of Achieved Results and Needs for Further Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

423 423 424 426 429 430 431 433 435 439 441 442

Part IV Real-Time Flight Simulator Assessment 16 Real-Time Assessment and Piloted Evaluation of Fault Tolerant Flight Control Designs in the SIMONA Research Flight Simulator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Olaf Stroosma, Thomas Lombaerts, Haﬁd Smaili, Mark Mulder 16.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16.2 Evaluation Method . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16.2.1 Experiment Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16.2.2 Dependent Measures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16.2.3 Participants . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16.2.4 Simulator Conﬁguration . . . . . . . . . . . . . . . . . . . . . . . . . . . 16.2.5 Procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16.3 Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16.4 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Appendix 1: Failure mode test matrix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Appendix 2: Cooper Harper Handling Qualities Rating Scale . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Piloted Evaluation Results of a Nonlinear Dynamic Inversion Based Controller Using Online Physical Model Identiﬁcation . . . . . . Thomas Lombaerts, Ping Chu, Haﬁd Smaili, Olaf Stroosma, Jan Albert (Bob) Mulder 17.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17.2 Fly-by-Wire ANDI Control Law Design . . . . . . . . . . . . . . . . . . . . . 17.3 Fly-by-Wire ANDI Control Law Evaluation . . . . . . . . . . . . . . . . . . 17.4 Analysis Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17.4.1 FTC and Pilot Performance Analysis Results: Time Histories . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

451 451 453 453 455 457 457 463 468 471 472 474 475 477

477 478 479 481 481

Contents

XVII

17.4.2

Handling Qualities Analysis Results: CH Ratings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17.4.3 Pilot Workload Analysis Results . . . . . . . . . . . . . . . . . . . . 17.5 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Model Reference Sliding Mode FTC with SIMONA Simulator Evaluation: EL AL Flight 1862 Bijlmermeer Incident Scenario . . . . Halim Alwi, Christopher Edwards, Olaf Stroosma, Jan Albert (Bob) Mulder 18.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18.2 A Model Reference Sliding Mode Control Allocation Scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18.3 Controller Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18.3.1 Lateral Controller Design . . . . . . . . . . . . . . . . . . . . . . . . . . 18.3.2 Longitudinal Controller Design . . . . . . . . . . . . . . . . . . . . . 18.4 SIMONA Implementation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18.5 SIMONA Flight Simulator Results with Experienced Pilots . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18.5.1 SMC Controller Evaluation . . . . . . . . . . . . . . . . . . . . . . . . 18.6 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

486 491 498 499 501

501 502 506 507 508 510 510 511 517 517

Part V Conclusions 19 Industrial Review . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Philippe Goupil, Andres Marcos 19.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19.2 Considerations for Commercial Aircraft - AIRBUS . . . . . . . . . . . . 19.2.1 Industrial Limitations and Constraints . . . . . . . . . . . . . . . 19.2.2 An Aircraft Manufacturer Perspective . . . . . . . . . . . . . . . 19.2.3 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19.3 Perspectives for Aerospace Applications - Deimos Space . . . . . . . 19.3.1 Context and Signiﬁcance of the FM-AG16 for Space Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19.3.2 Assessment of the Techniques and Results . . . . . . . . . . . . 19.3.3 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

521 521 522 523 524 528 528 530 532 535 535

20 Concluding Remarks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 537 Christopher Edwards, Thomas Lombaerts, Haﬁd Smaili 20.1 Summary of Achievements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 537 20.2 Future Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 538 Appendix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 541

List of Contributors

Halim Alwi Control and Instrumentation Research Group, Department of Engineering, University of Leicester, University Road, Leicester, LE1 7RH, United Kingdom, e-mail: [email protected] Jan Breeman National Aerospace Laboratory NLR, P.O. Box 90502, 1059 CM Amsterdam, The Netherlands, e-mail: [email protected] Ping Chu Delft University of Technology, Faculty of Aerospace Engineering, Kluyverweg 1, 2629 HS Delft The Netherlands, e-mail: [email protected] Jerome Cieslak IMS laboratory - Automatic control group - Bordeaux university, 351 cours de la liberation, 33405 Talence, France, e-mail: jerome.cieslak@ ims-bordeaux.fr

Christopher Edwards Control and Instrumentation Research Group, Department of Engineering, University of Leicester, University Road, Leicester, LE1 7RH, United Kingdom, e-mail: [email protected] Andrea Giovannini Italian Aerospace Research Center - CIRA, Via Maiorise, 81043 Capua (CE), Italy, e-mail: [email protected] Philippe Goupil Airbus France, EDYC-CC Flight Control Systems, 316 Route de Bayonne, 31060 Toulouse Cedex 09, e-mail: [email protected] Redouane Hallouzi ReliaCon, Rotterdamseweg 145, 2628 AL Delft, The Netherlands, e-mail: [email protected] David Henry IMS laboratory - Automatic control group - Bordeaux university,

XX

List of Contributors

351 cours de la liberation, 33405 Talence, France, e-mail: [email protected]

Cambridge CB2 1PZ, United Kingdom, e-mail: [email protected]

Colin Jones ETH Zurich, Automatic Control Laboratory, ETL I28, Physikstrasse 3, 8092 Zurich, Switzerland, e-mail: [email protected]

Shadhanan Manickavasagar QinetiQ, Cody Technology Park, Farnborough, Hampshire, GU14 0LX, United Kingdom, e-mail: [email protected]

Diederick Joosten Delft University of Technology, Delft Center for Systems and Control, Mekelweg 2, 2628 CD Delft, The Netherlands, e-mail: [email protected]

Andres Marcos Advanced Projects Division, Simulation & Control Section, Deimos Space S.L., Ronda de Poniente 19, Ediﬁcio Fiteni VI, Madrid, 28760, Spain, e-mail: andres.marcos@ deimos-space.com

Stoyan Kanev ECN Wind Energy, P.O.Box 1, 1755ZG Petten, The Netherlands, e-mail: [email protected]

Gianfranco Morani Italian Aerospace Research Center - CIRA, Via Maiorise, 81043 Capua (CE), Italy, e-mail: [email protected]

Anthony A. Lambregts Advanced Control Systems, Federal Aviation Administration, Northwest Mountain Region, 1601 Lind Ave., SW, Renton, WA 98057, USA, e-mail: [email protected]

Jan Albert (Bob) Mulder Delft University of Technology, Faculty of Aerospace Engineering, Kluyverweg 1, 2629 HS Delft, The Netherlands, e-mail: [email protected]

Thomas Lombaerts Delft University of Technology, Faculty of Aerospace Engineering, Kluyverweg 1, 2629 HS Delft, The Netherlands, e-mail: [email protected] Jan Maciejowski University of Cambridge, Engineering Department, Trumpington Street,

Mark Mulder Delft University of Technology, Faculty of Aerospace Engineering, Kluyverweg 1, 2629 HS Delft, The Netherlands, e-mail: [email protected] Ron Patton University of Hull, Department of Engineering, Cottingham Road, Hull HU6 7RX,

List of Contributors

XXI

United Kingdom, e-mail: [email protected]

GU14 0LX, United Kingdom, e-mail: [email protected]

Silvio Simani University of Ferrara, Department of Engineering, 1 Via Saragat, 44100 Ferrara, Italy, e-mail: [email protected]

Ton van den Boom Delft University of Technology, Delft Center for Systems and Control, Mekelweg 2, 2628 CD Delft, The Netherlands, e-mail: [email protected]

Haﬁd Smaili National Aerospace Laboratory NLR, P.O. Box 90502, 1059 CM Amsterdam, The Netherlands, e-mail: [email protected] Adolfo Sollazzo Italian Aerospace Research Center - CIRA, Via Maiorise, 81043 Capua (CE), Italy, e-mail: [email protected] Olaf Stroosma Delft University of Technology, Faculty of Aerospace Engineering, Kluyverweg 1, 2629 HS Delft, The Netherlands, e-mail: [email protected] Nicholas Swain QinetiQ, Cody Technology Park, Farnborough, Hampshire,

Andras Varga German Aerospace Center, DLR-Oberpfaffenhofen, Institute of Robotics and Mechatronics, Munchner Strasse 20, 82234 Wessling, Germany, e-mail: [email protected] Michel Verhaegen Delft University of Technology, Delft Center for Systems and Control, Mekelweg 2, 2628 CD Delft, The Netherlands, e-mail: [email protected] Ali Zolghadri IMS laboratory - Automatic control group - Bordeaux university, 351 cours de la liberation, 33405 Talence, France, e-mail: [email protected]

XXII

Fig. 1 Delft University, April 2007

List of Contributors

Chapter 1

Introduction Thomas Lombaerts, Hafid Smaili, and Jan Breeman

1.1 Towards More Resilient Flight Control Within the aviation community, especially for commercial transport aircraft design, all developments focus on ensuring and improving the required safety levels and reducing the risks that critical failures occur. Recent airliner accident and incident statistics (published in 2008), [8], show that about 16% of the accidents between 1993 and 2007 can be attributed to Loss of Control In-flight (LOC-I), caused by a piloting mistake (e.g. due to spatial disorientation), technical malfunctions or unusual upsets due to external disturbances. Loss of flight control is a subcategory of Loss of Control In-flight (LOC-I), where a technical malfunction is the initial event which causes control loss. LOC-I remains the second largest accident category after Controlled Flight Into Terrain (CFIT) which accounts for 23% of air accidents. However, a short term study for the year 2008 shows that loss of control comes at the top in the list of catastrophic accidents, according to the UK Civil Aviation Authority (UK-CAA). Data examined by the international aviation community shows that, in contrast to CFIT, the share of LOC-I occurrences is not significantly decreasing. Resilient flight control, or fault tolerant flight control (FTFC), allows improved survivability and recovery from adverse flight conditions induced by faults, damage Thomas Lombaerts Delft University of Technology, Faculty of Aerospace Engineering, Kluyverweg 1, 2629 HS Delft, The Netherlands e-mail: [email protected] Hafid Smaili National Aerospace Laboratory NLR, P.O. Box 90502, 1059 CM Amsterdam, The Netherlands e-mail: [email protected] Jan Breeman National Aerospace Laboratory NLR, P.O. Box 90502, 1059 CM Amsterdam, The Netherlands e-mail: [email protected] C. Edwards et al. (Eds.): Fault Tolerant Flight Control, LNCIS 399, pp. 3–45. c Springer-Verlag Berlin Heidelberg 2010 springerlink.com

4

T. Lombaerts, H. Smaili, and J. Breeman

and associated upsets. This can be achieved by ‘intelligent’ utilisation of the control authority of the remaining control effectors in all axes consisting of the control surfaces and engines or a combination of both. In this technique, control strategies are applied to restore stability and manoeuvrability of the vehicle for continued safe operation and a survivable recovery. The aim of the GARTEUR Flight Mechanics Action Group FM-AG(16) on Fault Tolerant Flight Control, of which this book is the culmination, was to facilitate the proliferation of new developments in fault tolerant control design within the European aerospace research community in practical and real-time operational applications. This addresses the need to improve the resilience and safety of future aircraft and aiding the pilot to recover from adverse conditions induced by (multiple) system failures and damage that would otherwise be potentially catastrophic. Up until now, faults or damage on board aircraft have been accommodated by hardware design using duplex, triplex or even quadruplex redundancy of critical components. However, the approach of the research presented in this book is to focus on new control law design methods to accommodate (unanticipated) faults and/or damage that dramatically change the configuration of the aircraft. These methods take into account a unique combination of robustness, reconfiguration and (real-time) adaptation of the control laws.

1.2 History of Flight Control Systems, Source: [40] Shortly after the German aviation pioneer Otto Lilienthal (1848-1896) left the ground for the first time in his self-made glider from the Windmuhlenberg (windmill hill) of Derwitz (Germany) in the summer of 1891, the problem of flight in a heavier-than-air vehicle created a new challenge: namely that of controlled flight. The Wright Brothers stated in 1912 that no one else grasped the basics of human flight as clearly and thoroughly as Lilienthal did. Based on his basic understanding of the principles of the curved wing, enabling it to produce more lift, Otto Lilienthal realized during his numerous experimental flights that leaving the ground was easier than staying in the air. For controlling his flights, he invented the first means of lateral stabilization using a vertical rudder. Just before crashing to his death in 1896, he characterized the complexity and importance of aircraft flight control by stating:

Fig. 1.1 Otto Lilienthal (1848-1896) glider showing vertical tail for lateral stabilisation (1894), source: Otto Lilienthal Museum

To design one is nothing, to build one is easy, to fly one is everything.

Following the first successful motorised flight of the Wright Brothers in 1903, the first artificially controlled flight was demonstrated in 1914 by Lawrence Sperry (1892-1923), the third son of the gyrocompass co-inventor Elmer Ambrose Sperry, by flying his Curtiss-C-2 airplane hands-free in front of a speechless crowd. The

1

Introduction

5

Fig. 1.2 Commercial and military aircraft that include modern fly-by-wire technologies (Airbus A380, Dassault Falcon 7X, Eurofighter Typhoon, Joint Strike Fighter, Boeing 777), sources: Creative Commons Attribution License, Kevin Koske, Naddsy, Keta

autopilot, or as it was nicknamed Metal Mike, consisted of three gyroscopes and a magnetic compass both linked to the pneumatically operated flight control surfaces. The autopilot enabled stabilized flight by holding the pitch, roll and yaw attitudes constant while maintaining the compass course. During the next decades, Sperry and other engineers further improved the concept of automatic stabilized flight for aircraft stabilization to improve weapon targeting accuracy. By the 1950s, analog flight control computers allowed artificial modification of the aircrafts handling qualities on top of the basic stabilization functions of the autopilot. The Canadian Avro CF105 Arrow interceptor, which flew in 1958, and the inherently unstable Lockheed Martin F-16 fighter, which entered service in the late 1970s, were the first aircraft utilizing an analog flight control computer demonstrating impressive manoeuvering capabilities. On the civil front, the Aerospatiale-BAC Concorde supersonic transport (SST) made its first flight in 1969 equipped with a commercial version of an analog flight control system. In 1972, NASA performed flight experiments with a modified F-8C Crusader to investigate the potential of software controlled flight, instead of analog circuits, by means of digital fly-by-wire flight control (DFBW) technology. Allowing better and safer airplane manoeuvering and control while providing substantial cost reductions, DFBW technology as a full-time critical digital control system, was made commercial in 1987 with the first flight of the Airbus A320. Although, in 1982, the Airbus A310 and then the A300-600 flew with digital FBW technology on the spoilers, the A320 was the first commercial use of digital FBW on the primary control surfaces. During the evolution of aircraft flight control systems, several versions have been developed, dependent upon the moment in history and on the type of aircraft where they have been applied. In the following, three categories of aircraft flight control systems are described in more detail: • mechanical systems • mechanical-hydraulic systems • fly-by-wire systems

6

T. Lombaerts, H. Smaili, and J. Breeman

1.2.1 Mechanical [33], [35] The most elementary design of a flight control system is a mechanical one, consisting of cables, pulleys, capstans, levers and other mechanical devices. This kind of flight control system was used in early aircraft and is still used in current light aircraft, like the Cessna Skyhawk. Figure 1.3 illustrates a mechanical type of control system.

(a) roll, pitch and yaw channel of an early c BAE Systems, Reproduced military jet with permission

(b) roll channel of a transport aircraft

Fig. 1.3 Illustrations of mechanical flight control systems, source: ref. [37]

In larger aircraft, the control loads due to the aerodynamic forces acting on the control surfaces are too excessive for simple mechanical control. Therefore, two mechanical solutions have been developed. One option is to attempt to extract the maximum possible mechanical advantage through the levers and pulleys, however the maximum reduction in forces is limited by the inherent strength of the mechanical components in this system. One example of this type of application can be found in the Fokker 50. The alternative is to rely on so-called control tabs or servo tabs that provide aerodynamic assistance to reduce complexity. These are small surfaces hinged at the end of the control surfaces which reduce the required control force exerted by the pilot by exploiting the aerodynamic forces which act on the tabs themselves. The pilot controls are directly linked to these control tabs, and the aerodynamic force generated by the tab then in turn moves the main control surface itself. The Boeing 707 used the concept of control tabs in its flight control system.

1.2.2 Hydro-mechanical [33], [35] Due to the ever increasing size and flight envelopes of aircraft, mechanical flight control systems are not sufficient. Due to the increasing speed of the aircraft, it becomes more difficult to move the control surfaces as a result of high aerodynamic forces. This led to the application of hydraulic power. A hydro-mechanical control system consists of two parts: • a mechanical circuit, essentially the same as the mechanical flight control system • a hydraulic circuit

1

Introduction

7

Compared to the mechanical flight control system, the hydraulic part takes over the interface between the conventional mechanical circuit and the control surfaces. More precisely, the hydraulic system generates the forces for the actuators which move the aerodynamic surfaces, but it still receives its signals from the mechanical circuit which is steered by the pilot. The Boeing 727 and 737, Trident, Caravelle and the Airbus A300, used such a flight control system, including a mechanical backup, despite the fact that a total loss of the flight control system is extremely improbable. The Boeing 747 was the first aircraft in the Boeing series to have a fully powered actuation system, because the control forces required for any flight condition would have been too large to be generated by the pilot. The benefits of the hydro-mechanical flight control system compared to the purely mechanical one are the reduction in drag and the increase of control surface effectiveness due to the omission of the servo tabs. Moreover, the higher mechanical stiffness of the hydraulics leads to better flutter characteristics of the control surfaces. The main drawbacks of the hydro-mechanical control systems are its structural complexity and weight.

1.2.3 Fly-By-Wire Flight Control [33], [35], [34] In more recent civil airliners, military transport aircraft and especially military jets, the mechanical linkage between control column and control surface has been omitted and replaced by electrical wirings (hence the name fly-by-wire). All these wirings are connected to each other by means of the flight control computer (FCC). Figure 1.4 shows the situation for the General Dynamics F-16 Fighting Falcon aircraft. The computer sends electronic signals to all actuators, in this specific case flaperons and slats. Figure 1.5 shows the hierarchy of the wiring network for the Eurofighter Typhoon. The FCC bridges the gap between measurement signals (from the inertial measurement unit and the air data transducers) and pilot inputs (such as the pilot’s stick, pedal and throttle displacements) on one hand, and control surface actuators

Fig. 1.4 Illustration of the Fly-By-Wire principle on the F-16, source: ref. [23]

8

T. Lombaerts, H. Smaili, and J. Breeman

Fig. 1.5 Flight Control System architecture of the Eurofighter Typhoon, source: ref. [37] c BAE Systems, Reproduced with permission

(such as flaperons, rudder and canards) on the other. Based upon the pilot control inputs and the available measured signals, the computer calculates independently the required surface deflections and gives the appropriate commands to the servos. Note the quadruplex implemented FCC. This is the fail safety principle and the approach adopts a vote by majority principle. The same procedure is applied for the most essential components. The advent of Fly-By-Wire Flight Control With the invention of the computer it became possible to control an aircraft electronically. The major initial advantages of the fly-by-wire FCS is that there is no longer a complex and heavy mechanical linkage needed between the pilot and the hydraulic system. But it is also possible to control the aircraft more accurately, flight safety is enhanced, a safe flight envelope can be defined with so-called flight control law protection, and finally this setup offers greater flexibility for evolution and for implementations of improvements in the system. During the subsequent evolution of the fly-by-wire concept, additional advantages arose, such as increased flexibility in setting the flight control characteristics of an aircraft. Another important benefit of Fly-By-Wire Flight Controls is that they define identical handling characteristics for all members of an aircraft family, from the smallest twinjet to the long-range widebody jetliners. This commonality does not only apply for the normal flight envelope, but also under extreme emergency conditions. With such a computer-based flight control system, other major advantages are that its design and maintenance are much simpler, while significantly reducing aircraft weight. Both commercial and military aircraft are now being developed with fly-by-wire flight control systems. For military aircraft, the benefits include increased agility and reduced supersonic trim drag (in conjunction with reduced static stability) and carefree handling. For commercial aircraft, the benefits include lower weight (attributed to flight controls),

1

Introduction

9

lower maintenance costs as well as passenger comfort and carefree handling. In both categories, the provision of flight envelope protection is another important benefit of fly-by-wire flight control systems. How Fly-By-Wire Control works In contrast to mechanical and hydro-mechanical control systems, in a fly-by-wire system the pilot’s commands are fed into computers, which in turn route electrical signals along wires to the actuators driving the control surfaces. Sometimes there is a mechanical backup to keep the aircraft under manual control when control of the aircraft becomes impossible with the nominal flight control system (electricity loss, the loss of all flight control computers, etc.). The computers controlling the fly-by-wire system provide multiple backup or redundancy. In the Airbus A340 for example, there are five computers in all, and a single one can fly the plane. All five computers work together. If one fails, another automatically takes over. Moreover, each of the five fly-by-wire computers is composed of two independent units which are constantly monitoring each other. Furthermore, these computers are made by different manufacturers, using different software and components. They are also programmed by independent teams, using different computer languages. This means that it is virtually impossible for the same problem to affect all computers simultaneously. It should be noted that the number of computers and units etc. differs for other aircraft in the Airbus family and also the Boeing philosophy is significantly different. The Airbus fly-by-wire system operates according to three control laws: normal, alternate and direct. • The normal law applies when all systems are working correctly, or during a single failure of a computer or peripheral. It requires a high level of integrity and redundancy of the computers, the peripherals (i.e. sensors, actuators and servoloop), and the hydraulics. When operating in normal mode, a forward or backward movement of the sidestick corresponds to a vertical load factor command by the pilot. The computers translate this demand into a pitch change, immediately moving the aircraft’s nose up or down to the desired attitude. Once the sidestick is released, the aircraft will maintain this flight path until the next pilot input. Lateral control is similar to pitch control except that the pilot sets a roll rate command. Operation under normal laws provides flight envelope protection against excessive load factors, overspeed, stall, extreme pitch attitude and extreme bank angle. • The alternate law applies when at least two failures occur. Within the normal flight envelope, the handling characteristics under alternate control laws are the same as under normal laws, if the integrity and redundancy are not enough to achieve the normal law with its protections. Out of the normal flight envelope, the pilot must take proper preventive action to avoid loss of control or high speed excursions, just as he/she would on a non-protected aircraft, but this holds only for manoeuvres corresponding to the protection that is lost. • The direct law applies when more than two failures occur, if the alternate law can not be safely achieved. In the unlikely event of a multiple system failure,

10

T. Lombaerts, H. Smaili, and J. Breeman

direct control laws provide the same handling characteristics as a good-handling conventional aircraft, almost totally independently of configuration and centre of gravity. The sidestick and control surfaces move in a direct relationship to each other. Pitch trim is no longer automatic and must be manually controlled using the trim wheel. Flight Envelope Protection All aircraft have physical limits they must not exceed. For example, if the airspeed is too slow the aircraft may stall, if the speed is too high or a manoeuvre too violent, excessive loads can be generated, with the risk of damaging the structure. These limits define the flight envelope, not to be exceeded during normal operation. The fly-by-wire concept offers inherent flight envelope protection, which is an additional guarantee against crossing these limits. Thanks to this built-in protection, pilots can count on their aircraft providing maximum performance and safety under any circumstances. The flight envelope protection function also protects against wind shear. These are strong, sudden downdrafts that may occur during storms or even in clear weather, and have caused many accidents. With a flight envelope protection system, the pilot can utilize maximum climb performance, escaping wind shear and other conditions in complete safety. It also increases the aircraft’s agility. For example, the pilot can act much more quickly when he has to carry out a sudden avoidance manoeuvre, while keeping the aircraft under perfect control. Flight envelope protection does not limit the pilot’s options, but rather allows him to use the aircraft’s maximum safe performance capacity. At the same time, the system minimizes the risk of losing control of the aircraft or subjecting it to loads it was not designed to handle.

1.2.4 Fault Tolerant Control in Fly-By-Wire Systems, Sources: [40] In aviation, all developments focus on the improvement of safety levels and reducing the risks that critical failures occur, on all possible system levels. Although most civil transport fly-by-wire aircraft are fitted with a backup system, the basic FBW system integrity is considered as critical. In Boeing and Airbus aircraft, where a total loss of the FCS is already very improbable, and beyond the certification requirements, see [20] and [19], there is a mechanical or electrical back-up system. To further improve the levels of integrity, new aircraft configurations have a degree of redundancy in terms of controls, sensors and computing. Control effector redundancy means that there are more than the minimum required control effectors, or motivators, to control the pitch axis on one hand, and the combined roll/yaw axis on the other, although the full set of controls is required to satisfy the normal performance requirements. The combination of these features provides the opportunity to reconfigure the control system in the event of failures with the aim of increasing the survivability of the aircraft. As a result, the digital fly-by-wire flight control

1

Introduction

11

system is a safety driven design built to very stringent dependability requirements. These requirements ensure that the system will not generate erroneous or faulty signals compromising flight safety and that the system remains available even in faulty conditions. The certification requirements state that all potentially catastrophic failure scenarios should have a probability rate of less than 10−9 per flight hour and no single failure should be catastrophic. Potentially catastrophic failures include control surface runaways (elevator, rudder and horizontal stabiliser), loss of control in pitch, oscillatory failures at frequencies which are critical to the aircraft’s structure and insufficient lateral control during engine failures. Failure detection and reconfiguration is performed via self-tests, signal comparison and hardware and software redundancy. Self-tests are performed by the hardware equipment to prevent any undetected failures (latent failures) and to ensure that the probability of a failure remains low.

1.2.5 Airbus Philosophy, Sources: [22], [30] In Airbus aircraft, comparison of signals from both control and monitoring channels enables detection of failures in the case that one of the signals differs from the other above a certain threshold. The detection threshold should be sufficiently robust against sensor inaccuracies and system tolerances to prevent false alarms but tight enough to detect unwanted failures. Hardware reconfiguration in the Airbus family is performed at system level whereby for each function one computer operates in active mode, and the remaining computers are in standby Fig. 1.6 Hainan Airlines A340-642 c Thomas Lombaerts mode. When the active computer fails, one of B-6510, the standby computers changes to active mode and immediately takes over the function. This holds for example for servo-loops in the case of a duplex architecture. Flight control law reconfiguration is performed in the case when sensor information, processed by the control laws, becomes unavailable or no longer trustworthy (for example, one source failed, followed by a disagreement between the two remaining sources). This control law reconfiguration is also performed in the case of flight control surface or hydraulic circuit loss. In this situation, the flight control computer switches to alternate control laws providing less protection depending on the remaining sensory information and equipment. A FBW system architecture showing its redundancy components and reconfiguration scheme (Airbus A340 [13], [30], [22]) is illustrated in fig. 1.7. Moreover, the flight control computer (FCC) architecture is a so-called COM/MON architecture where the fail-safe computers consist of a control and monitoring channel, ensuring the permanent monitoring of all the FCS components. The control channel executes the relevant function (e.g. a pilot command to a surface) while the monitoring channel

12

T. Lombaerts, H. Smaili, and J. Breeman

Fig. 1.7 Modern fly-by-wire system architecture including redundancy components and reconfiguration scheme (A340), source: [30]

guards against any faults in the control channel and ensures permanent monitoring of all the components in the flight control system (sensors, actuators, other computers, etc. ...). The monitoring (MON) channel is designed to detect failure cases and to trigger reconfiguration by pointing out the failure detection to the command (COM) channel and to the other computers. Fault mitigation is achieved by means of redundancy and software and hardware dissimilarities. In the case of the Airbus A340, the redundancy components include five FBW computers and three power sources for surface actuation. Dissimilarity is achieved through the use of two completely different types of computers and two independently developed software packages designed by different teams. It should be noted that these numbers vary for other aircraft as well as for other manufacturers. Reconfiguration, for instance in pitch, consists of switching from the Primary computer (P1) to the second Primary computer (P2). In this situation, elevator actuation switches from the green system for both elevators to the blue system for the left elevator and the yellow system for the right elevator. Following a possible failure of P2, reconfiguration can be performed up to the second Secondary computer (S2).

1.2.6 Boeing Philosophy, Sources: [24], [42] A completely different fault tolerance approach has been adopted by Boeing in the Boeing 777 for example. The heart of its FBW concept is the use of triple redundancy for all hardware resources, varying from the computing system through

1

Introduction

13

electric and hydraulic power to the communication path. The 777 FBW design philosophy for safety considers the following constraints: 1. Common mode/common area faults: by designing the systems to both component and functional separation requirements. 2. Separation of FBW (line replaceable unit LRU) components: isolation and separation of redundant flight control elements to the greatest extent possible in order to minimize the possibility of loss of function. 3. FBW functional separation: allocation of electrical power to the primary flight computer (PFC) and the actuator control electronics (ACE) LRUs to provide maximum physical and electrical separation between the flight control electrical buses. The ACE functional actuator control is distributed to maximize controllability in all axes after loss of function of any ACE or supporting subsystem. The hydraulic systems are also aligned with the actuator functions to provide maximum controllability after the loss of hydraulics in one or two systems. 4. Dissimilarity: various combinations of dissimilar hardware, different component manufacturers, dissimilar control/monitor functions, different hardware and software design teams, and different compilers are considered at the level of PFCs, ACEs, inertial data, the Autopilot Flight Director Computer (AFDC) and ARINC bus. 5. The FBW effect on the structure: FBW component failures can result in oscillatory or hardover control surface motion. Structural requirements are analyzed and apportioned to all FBW components. (This constraint is a safety consideration in the Airbus philosophy too.) The system is designed to provide uninterrupted control following any two failures. Although the flight control function is necessary for safe flight and landing of the aircraft, the system includes a direct backup mode that allows the pilot to electrically position flight control surfaces without using the flight control computers. The flight control computers are configured as a Triple Modular Redundancy (TMR) system. Because of concerns about generic hardware or software failures, Fig. 1.8 KLM Boeing 777-206/ER each of the three computers is itself a TMR c PH-BQD, Tommy Desmet, via airunit. These TMR computers use three inter- liners.net nal channels that use different processor hardware from different manufacturers. Within each TMR computer, the choice of which output is to be the output of the computer is determined using the so-called principle of median value select. Each PFC lane operates in two roles: a command role or monitor role. Only one lane in each channel is allowed to be in the command role. The command lane will send the proposed surface commands, its own, together with those received from two other PFC channels, to its ARINC 629 bus. The hardware device residing in the

14

T. Lombaerts, H. Smaili, and J. Breeman

Fig. 1.9 Boeing 777 PFC Lane Redundancy Management (Output Signal Monitoring), source: [42]

PFC lane will perform a median select of these three inputs of each variable. The output of the median select hardware is sent in the same wordstring as the ‘selected’ surface commands. The PFC lanes in the monitor role perform a ‘selected output’ monitoring of their command lane. The PFC command lane, meanwhile, performs ‘selected output’ monitoring of the other two PFC channels. The median value select provides fault blocking against PFC faults until the completion of the fault detection and identification and reconfiguration via PFC cross-lane monitoring. Should any of the three dissimilar processors produce an output different from the other two, it will not be selected. The three dissimilar processors are kept tightly synchronized and receive bit identical input data from the system data buses. The three channels of computers at the next level of TMR are also kept in synchronization and exchange data to keep state data consistent between the channels. The 777 actuators rely on the vote by majority principle.

1.2.7 Short Case Study of Other Fault Tolerant Systems, Source: [24] Many fault-tolerant control systems have been produced and used successfully for other aerospace applications. The following is a brief survey of a few of these other systems with a discussion of the requirements they satisfy and the design approach that was used. The systems described were selected based on the availability of information and the personal experience of the author of ref. [24]. These are believed

1

Introduction

15

to be representative of the many excellent systems in use. Table 1.1 is a summary of the systems surveyed and captures the primary attributes of these systems. F-16 Analog Fly-by-Wire Flight Control [1] Early production F-16A/B aircraft used an analog electronic FBW flight control system. From Block 25 F-16C/D onward, a digital system has been used. The F-16 is an inherent unstable aircraft that requires continuous stability augmentation. In case of problems with the flight control system, the F-16 aircraft can fail catastrophically. The system was designed to deal with two failures. The analog FBW used a quadredundant N-fold Modular Redundancy (NMR) Fig. 1.10 Belgian Air Component Fcomputer architecture with approximate con- 16AM FA-126, Dirk c Voortmans, sensus Middle Value Selection (MVS) electron- via Airliners.net ics to determine which computers’ signals are transmitted to the flight control actuators. The hydraulic actuators include voting to reject possible faulty outputs from any computer MVS or its servo amplifier. Both the computer MVS electronics and the hydraulic actuators make use of fault down logic to disengage a known, faulty signal. The analog computers use MVS on the sensor inputs to provide the same inputs to the redundant computers. Analog control integrators, the only state data involved, are held in agreement between the redundant channels by means of cross-connecting signals. The design uses neither design diversity (identical hardware) nor software. F-16 Digital Fly-by-Wire Flight Control [10] Experience with a triplex digital system on the AFTI/F-16 gave General Dynamics the confidence to abandon the proven analog FBW system of the earlier Fighting Falcon and adopt the quadruplex digital FBW system for the Block 25 and beyond F-16C/D. This choice resulted in capability and integration advantages with other Fig. 1.11 AFTI/F-16, source: NASA Multimedia Gallery aircraft systems, e.g. displays via 1553 buses. The quad-redundant analog NMR computers used in earlier production F-16A/Bs were replaced by quad-redundant digital computers. These digital computers also include simple analog backups in each computer to protect against generic hardware or software design error failures. Digital data exchange is used between computers for various reasons, namely to mechanize computer output voting, to ensure identical inputs, to keep the computers synchronized, and to maintain consistent state data.

16

T. Lombaerts, H. Smaili, and J. Breeman

Table 1.1 Survey of typical in-service fault-tolerant systems, source: ref. [24] Application Vehicle & System Type Military F-16 FBW Aircraft flight control, analog

Military Aircraft

F-16 FBW flight control, digital

Impact of Impact of Fault-Tolerant System Description Loss of MalfuncFunction tion loss of loss of 4-channel analog computer NMR idenaircraft aircraft tical hardware, approx. agreement MVS control control computer selection, MVS on computer inputs, voting hydraulic actuators, analog integrator states held consistent loss of loss of 4-channel digital computer NMR idenaircraft aircraft tical hardware and software, simple control control analog backup control, voted computer selection, voted computer inputs, voting hydraulic actuators, digital state data exchanged and kept consistent shutdown mechanical Dual standby system engine, overspeed land using protection, one engine shutdown engine

Commercial B-757, Aircraft Pratt & Whitney PW2037 jet engine control Manned Space loss of loss of 4-channel NMR, identical hardware Space Shuttle vehicle and vehicle and and software, 5th channel backup using crew crew same hardware but dissimilar software, identical inputs by data bus monitoring, computer outputs compared for crew annunciation only, computer selection by external voters (hydraulic voting actuators, pyro fire electronic discrete voting), exchange and vote of some state data Commercial B-777, Limp home potentially Two separate units, one for pilot and aircraft AIMS on backup hazardous one for copilot displays, each unit uses instruments faulty 3 sets of selfchecking dual processors, display Arinc-659 Safebus to distribute identidata cal inputs, select output from a healthy pair, exchange state data, identical hardware and software in all processing pairs Unmanned Inertial destruction destruction Dual self-checking pair processing, no space upper of vehicle of vehicle dissimilar hardware or software, both stage, flight by range by range pairs must send same critical actuation controller safety safety signals Manned X-33 destruction destruction TMR 3 identical COTS hardware and space Ex- Reusable of vehicle of vehicle software channels, RMS provides same perimental Launch by range by range inputs by exchange and MVS, voting of Vehicle safety safety outputs and some state data, dual actuation, transient fault recovery Manned X-38 Crew loss of ve- loss of ve- NMR 4 identical hardware and softspace Ex- Return Ve- hicle hicle ware channels, identical inputs by experimental hicle change and voting, voting of outputs transient fault and state data recovery, any 2 FCCs can control single fault tolerant actuation.

1

Introduction

17

Pratt and Whitney PW2037 Electronic Engine Control [29] The PW2037 was the first production commercial jet engine to use a Full-Authority Digital Electronic Control (FADEC) system with no mechanical backup control. It was introduced on the Boeing 757 civil airliner and remains representative of state of the art commercial engine controls. Because all commercial transport aircraft have at least two engines, loss of thrust from one engine is not catastrophic. An Fig. 1.12 Pratt & Whitney PW2037, engine control malfunction leading to a poten- source: Pratt & Whitney tially catastrophic engine overspeed is mitigated by mechanical overspeed protection. Because of this, electronic engine controls are capable of meeting FAA safety requirements using a dual standby system. In the worst case scenario, an engine control failure not detected by BIT (Built-In-Test) will trip the overspeed protection, resulting in the shutdown and loss of thrust from one engine only. Also this set-up does not rely on hardware design diversity. The risk of a common design error affecting both channels of one engine or all engines on the aircraft is addressed through exhaustive testing. Boeing 777 Airplane Information Management Systems (AIMS) [18] The B-777 AIMS system is used to command all cockpit displays and to interact with the crew via keyboards to provide flight management functions. Total loss of cockpit displays, a system loss of function, is potentially hazardous, particularly in adverse weather, but is not by itself a catastrophic event. A malfunction resulting in erroneous display information to the crew is possibly a greater hazard, which is mitigated somewhat by requiring that pilot and copilot displays are driven by different sources, allowing the crew to detect faulty display data by proper cross-checking. In addition to requiring fault tolerance for safety, airline operators of transport aircraft desire systems that can be operated safely with known failures until repairs can be made without interruption to revenue-generating aircraft service. For this purpose, the so-called Minimum Equipment List (MEL) has been defined, which is specific for every aircraft and type of operation, and approved by the appropriate authority. The AIMS is required to fail operationally only after two failures and must provide very robust protection against malfunctions that would produce erroneous crew displays. AIMS uses a triple, self-checking pair architecture. The complete system actually consists of two separate triple self-checking units in separate cabinets, separately driving the pilot’s and copilot’s displays. This allows the flight crew to manually compare displays. The AIMS uses the same hardware and software in both systems and in all self-checking pairs, so they do not provide dissimilarity for protection against a generic software error. A unique type of backplane bus, the

18

T. Lombaerts, H. Smaili, and J. Breeman

Arinc-659 ‘Safebus’, is used to mechanize switchover between the redundant selfchecking pairs and to provide a robust method for transferring state data between the processor pairs. Switchover to backup occurs when the backup processor pair detects that the primary processor pair has failed to transmit its data on the Safebus. US Space Shuttle FBW Flight Control [25] Together with the McDonnell Douglas F/A-18 Hornet, the Space Shuttle was one of the first digital FBW flight control systems and remains a representative example of today’s systems. The Space Shuttle is a very demanding control problem throughout an extensive flight envelope, requiring a single system that provides uninterrupted control of a space launch vehicle, control of an orbiting spacecraft, and both space and atmospheric flight control during the return to Earth. The shuttle uses a four-channel NMR approach, with a fifth computer used as a backup system. The fifth computer uses no hardware design diversity compared to the other four, but is programmed with dissimilar software. The fifth channel can be engaged manually by the crew in case the primary system fails, but this has never been necessary during the hundred or so Shuttle flights to date. The Shuttle operates the four primary computers as a redundant set, providing them with identical input data by monitoring the same data buses and holding the computers in close synchronization. The computers are programmed with the same software and should produce the same outputs. No attempt is made by the computers to select the correct output, but instead, these redundant outputs are transmitted to external voting devices. On one hand, these external voters include voting hydraulic Fig. 1.13 Space Shuttle, source: actuators for control surfaces and thrust vector NASA Multimedia Gallery control. On the other hand, there are electronic discrete command voters that control pyrotechnic ignition of the Shuttles engines and the separation of the solid rockets and the external tank. The redundant computers do exchange and compare outputs in order to alert the crew if a computer is producing a different output from the others. The crew may then choose to remove power from a faulty computer to configure the system to operate following additional failures. In fact, this is a manual fault down. Boeing Inertial Upper Stage (IUS) Guidance and Control System [12] The IUS is an example of a typical high-value unmanned space launch vehicle guidance and control system. This IUS has been used to launch the spacecraft Ulysses, Galileo and Magellan in the right orbit for interplanetary missions

1

Introduction

after they have been brought to space in the cargo bay of the Space Shuttle. Space launch vehicles must provide a high level of reliability to be economical and must not malfunction in a manner that endangers human safety or property. In the event of a malfunction, ground crews can monitor the vehicle and command destruction thanks to the incorporation of a vehicle self-destruct system and range safety systems. The control system for the IUS uses four processors configured as a dual self-checking pair. The switchover from the primary processor pair to the backup pair will occur if there is disagreement between the processor pairs. A form of electronic voting is used for critical pyrotechnic signals, requiring both processor pairs produce the same command to these actuators.

19

Fig. 1.14 Boeing Inertial Upper Stage (IUS), source: Boeing Multimedia Gallery

X-33 Reusable Launch Vehicle Control System [11] The X-33 program was a technology demonstrator for the next generation of single stage to orbit reusable launch vehicles. This prototype was unmanned. Thus, a control system failure would have primarily economic consequences. A TMR (Triple Modular Redundancy) fault-tolerant computer with dual standby actuation was selected to guarantee a high probability of successfully completing a series of sub-orbital test flights. The system used commercial-off-the-shelf (COTS) computers with custom Redundancy Management System (RMS) hardware and software to form the TMR fault-tolerant Fig. 1.15 X-33 Reusable computer. It was planned to expand from TMR to quad Launch Vehicle, source: NMR and to increase the level of actuation redundancy NASA Multimedia Gallery for the manned, operational system, for which even higher safety requirements would be imposed, however budget cuts and technical troubles have led to the cancellation of these plans. The TMR computers used MVS to vote outputs, maintain identical inputs, and to maintain consistent state data. Voting was selectively applied to some, but not to all data, to minimize the data exchange and voting required. The TMR computers were designed in order to fault down to a self-checking pair after one persistent failure. The system was designed to recover the use of a computer that had experienced a transient fault. The COTS computers and the software that runs on them are identical: no dissimilarity was used to protect from generic design errors. X-38 Prototype Crew Return Vehicle (CRV) Control System [2] The X-38 program was an unmanned technology demonstrator for a re-entry vehicle that would be used for emergency return from the International Space Station.

20

T. Lombaerts, H. Smaili, and J. Breeman

However, budget cuts have led to the cancellation of this development program after a few unmanned demonstrator test flights. The demonstration system was required to operate following any two Flight Control Computer (FCC) failures and following any one non-computer failure. A four channel NMR FCC with dual standby actuation was selected to meet these requirements. Sensors and actuators were connected to the FCCs such that Fig. 1.16 X-38 Prototype any two operating FCCs can control the vehicle. The Crew Return Vehicle, FCCs were COTS computers and were interconnected source: NASA Multimedia Gallery by special network element hardware and fault tolerant systems serviced software to form a Fault Tolerant Parallel Processor (FTPP). The FTPP was designed to provide resilience to Byzantine failures. A Byzantine fault is an arbitrary fault that occurs during the execution of an algorithm by a distributed system. It encompasses those faults that are commonly referred to as ‘crash failures’ and ‘send and omission failures’. When a Byzantine failure has occurred, the system may respond in any unpredictable way, unless it is designed to have Byzantine fault tolerance. These arbitrary failures may be loosely divided into three categories, namely a failure to take another step in the algorithm (crash failure), a failure to correctly execute a step of the algorithm, and arbitrary execution of a step other than the one indicated by the algorithm. The FTPP was also designed to discriminate between transient and permanent faults, allowing recovery of an FCC that had a transient fault. The COTS computers and the software that ran on them were identical, no dissimilarity was used to protect from generic design errors.

1.2.8 A Final Note on Fault Tolerance Properties Incorporated in Current Fly by Wire Flight Control Systems Based upon this information, it is clear that up to now, faults or damage on board an aircraft like computer failures, power/hydraulic failures, engine failures, linkage breaks and sensor failures, have been accommodated by hardware design. Critical components (flight control computers, actuators and sensors) have been implemented duplex, triplex or even quadruplex redundantly. Additionally, one can choose distributed systems and alternate controls or sensors. As a consequence, today’s research efforts are gradually shifting from correcting additive failures (sensors and actuators) towards dealing with parametric failures (major structural and engine failures). The approach discussed in this book is to focus on control law design such that more severe kinds of faults and/or damage, like aerodynamic changes (damage), control surface damage and actuator failures can be tackled. This can be done by means of robustness, reconfiguration and adaptation of the control laws. This method of control law design is motivated by a survey of recent LOC-I

1

Introduction

21

accident cases in which the control and performance capabilities of the aircraft were compromised due to the failure of one or more critical systems and structural damage.

1.3 Rationale of Damage Tolerant Control - Aircraft Accident Survey Recent flight control research activities are currently exploring the potential benefits of fault tolerant flight control (FTFC) techniques, in particular the mitigation of (severe) damage to the aircraft and its systems using reconfiguration methods. The reason for this is the observation that a considerable number of aircraft accidents over the last thirty years could possibly have been prevented in one way or another if considered from an aeronautical-technical point of view. A reconfigurable flight control system might have prevented the loss of two Boeing 737s due to rudder actuator hard overs and of a Boeing 767 due to inadvertent asymmetric thrust reverser deployment. The 1989 Sioux City DC-10 incident is an example of the crew performing their own reconfiguration using asymmetric thrust from the two remaining engines to maintain limited control in the presence of total hydraulic system failure. The crash of a Boeing 747 freighter in 1992 near Amsterdam, the Netherlands, following the separation of the two right-wing engines was potentially survivable given adequate knowledge about the remaining aerodynamic capabilities of the damaged aircraft. New forms of threat within the aviation community have recently come into play from deliberate hostile attacks on both commercial and military aircraft. A surface-to-air missile (SAM) attack has recently been demonstrated to be survivable by the crew of an Airbus A300B4 freighter performing a successful emergency landing at Baghdad International Airport after suffering from complete hydraulic system failures and severe structural wing damage. Apart from system failures and hostile actions against commercial and military aircraft, recent incident cases also show the destructive impact of hazardous atmospheric weather conditions on the structural integrity of the aircraft. In some cases, clear air turbulence (CAT) has resulted in aircraft incurring substantial structural damage and loss of engines. An increasing number of measures are currently being taken by the international aviation community to prevent LOC-I accidents due to failures, damage and upsets for which the pilot was not able to recover successfully despite available performance and control capabilities. This not only includes improvements in procedures training and human factors, but also finding measures to better mitigate system failures and increase aircraft survivability in the case of an accident or degraded flight conditions. Six recent airliner LOC-I accidents will be described in detail which demonstrate that better situational awareness or guidance would have recovered the impaired aircraft and improved survivability if unconventional control strategies were used. In some of the cases described, the crew was able to adapt to the unknown degraded flying qualities by applying control strategies (e.g. using the engine effectors to achieve stability and control augmentation) that are not part of any standard airline training curriculum. A selection of the accident cases as described

22

T. Lombaerts, H. Smaili, and J. Breeman

in this chapter formed the basis for the reconstruction of realistic and validated aircraft accident scenarios as part of the FM-AG(16) simulation benchmark. This was partly based on available flight data of the accident cases, simulation models and results from earlier studies. Although the accident survey in this chapter shows that the aircraft propulsion system can be used as the only effective means of controlling and landing a damaged aircraft when the complete flight control system is lost, within FM-AG(16) this control strategy has not been investigated (despite having evaluated some control options using differential thrust for stabilisation). This is mainly due to the additional design requirements on engine performance (e.g. response time) and health monitoring to allow them to be used as an integrated part of the flight control system. This subject is currently the topic of other proposed research initiatives in the area of damage tolerant flight control [7]. The majority of documentation and supporting graphics of the aircraft accidents cases, described in this chapter, are based on reference [27]. Selected graphics and diagrams used in this book have been reproduced from the original artwork created by Matthew Tesch for the Air Disaster series of books published by the-then Aerospace Publications (Canberra) and appear here by kind permission of the artist and the publisher. To distinguish these from other graphic material used in this document, the shorter acknowledgement (MT/AA) appears at the end of each caption.

1.3.1 American Airlines Flight AA191, Source: [27] On May 25 1979, the American Airlines widebody DC-10-10, registered N110AA, was preparing at Chicago O’Hare International Airport for departure with 271 people aboard on the transcontinental flight AA191 to Los Angeles, California. At the start on the runway, the DC-10’s acceleration and takeoff roll seemed perfectly normal at a flap setting of 10 degrees and left rudder with right aileron use as compensation for the right crosswind. But at 6000 Fig. 1.17 AA DC-10-10 N110AA, c Fischdick feet down the runway, just before rotating Werner into the takeoff attitude, pieces of the port (No 1) engine pylon fell away from the aircraft, and white vapour began to stream from the mounting. A moment later, during the rotation itself, the entire No 1 engine and pylon tore themselves loose from the aircraft, flew up over the top of the wing, and smashed back onto the runway behind the still accelerating DC-10 as it lifted into the air. The aircraft’s port wing had dropped slightly as the DC-10 lifted off, but this was quickly picked up by application of aileron and rudder and the DC-10 continued to climb out with its wings level while accelerating to a maximum speed of 172 knots. The nose up attitude of about 14 ◦ , as well as the aircraft’s heading, appeared stable with the right aileron and right rudder being used

1

Introduction

23

Fig. 1.18 Main developments in the DC-10’s disastrous takeoff, from engine separation to impact, (MT/AA)

to maintain equilibrium and it seemed that, despite the loss of its port engine, the DC-10 was responding well to control. But 10 seconds later, when the DC-10 had climbed to about 300 feet, the speed decreased to 159 knots and it began to roll to the left at an increasing rate, despite the crew’s application of right aileron. The roll quickly steepened alarmingly, even though increasing amounts of opposite rudder and aileron were being applied, and it began yawing to the left as well. Simultaneously, the nose lowered and the aircraft began to loose height, despite increasing the up elevator. At the same time, the bank increased still further. Finally, the DC-10’s wings were past the vertical in a 112 degree left roll and a 21 degree nosedown attitude, with full opposite aileron and rudder, and almost full up elevator being applied. At this point the wingtip struck the ground, pivoting the DC-10 into the ground, nose first, with enormous impact. The aircraft exploded in an enormous flash of flames and a cloud of black smoke. The DC-10 had been airborne for only 31 seconds, and none of the occupants survived. The trajectory of this ill-fated flight is illustrated in fig. 1.18. During the subsequent investigation by the National Transportation Safety Board NTSB, two key questions dominated the investigators’ minds: What had caused the engine pylon to break away so unexpectedly from the aircraft’s wing under perfectly normal operating conditions? And why had this led to such a complete loss of control? In theory, the DC-10 should certainly have been aerodynamically capable of climbing away successfully after the physical loss of the engine, and returning for

24

T. Lombaerts, H. Smaili, and J. Breeman

a safe landing. The overall investigation therefore concentrated primarily on two major areas: 1. Identifying the structural failure which led to the engine-pylon separation and determining its cause; 2. Determining the effects of the structural failure on the aircraft’s performance and systems, and identifying what led to the loss of control. The following observations in these areas were made during the analysis: 1. The analysis of the pylon structural failure revealed that fractures in the upper flange of the pylon rear bulkhead at the joint between the pylon and wing resulted in this structural failure. Moreover, a subsequent fleetwide grounding and inspection of all US registered DC-10’s revealed that in total six other American Airlines and Continental aircraft had similar fractures. All six had been subjected to the same maintenance procedures, involving removal and reinstallation of the engines and pylons. Both airlines had individually devised a procedure which they believed to be more efficient than that one recommended by the manufacturer, involving the removal of the engine and pylon as a single unit instead of removing the engines from the pylons before the pylons are removed from the wing. Altogether the evidence was compelling that the cracks in the rear bulkhead upper flanges were being introduced as a result of these irregular maintenance practices, which were unauthorized by the manufacturer as well as the FAA. 2. During the wreckage analysis, it was found that a three metre section of the port wing’s leading edge, just forward of the join between the No 1 engine pylon and the wing, was torn away with the pylon, severing the hydraulic system’s lines for the port wing’s outboard slats. Thirty five of the 36 leading edge slat tracks were subsequently examined, disclosing that, at impact, the port wing’s outboard slats were retracted, while its inboard slats, together with the starboard wing’s inboard and outboard slats, were in an extended position, as illustrated in fig. 1.19. This retraction of the port wing’s outboard slats was caused by the combination of a lack of hydraulic pressure and the air loads. This retraction was critical since it had a profound effect on the aerodynamic performance and controllability of the aircraft. The lift on the port wing was reduced and its stalling speed increased to 159 knots. Since the aircraft’s speed reduced to 159 knots during the 14◦ pitch attitude climb1 , the port wing stalled and the roll to the left was initiated. With the loss of engine No 1, all other accessories driven by this engine were lost, namely the pressure pumps of hydraulic system No 1 and the No 1 AC generator2 . The separation also severed electrical wiring, resulting in the loss of power to the captain’s instrument panel, the slat disagreement warning system, stall warning system and its stick-shaker function. This implied that there was little or 1 2

In accordance with the airline’s prescribed engine failure procedures. These accessories would have remained operational when an engine ceased to operate, but these were severed in this situation because of the physical separation of the engine from the aircraft and the damage to the hydraulic power and other lines.

1

Introduction

(a) Artist impression of the damaged aircraft during its 31 second flight, note the retracted outboard slats on the port wing, (MT/AA)

25

(b) Picture of the damaged aircraft just before impact, source: [3]

(c) Picture of the damaged aircraft just after impact, source: airdisasters.com

Fig. 1.19 Drawings and pictures of heavy damage to AA DC-10-10 N110AA

no warning to the pilot of the onset of the stall on the outboard section of the port wing. The loss of control of the DC-10 was thus the result of a combination of three events: the retraction of the port wing’s outboard leading edge slats, the loss of the slat disagreement warning system, and the loss of the stall warning system. All were consequences of the separation of the engine and pylon assembly. Each on its own would not have resulted in the crew losing control. But together, during a highly critical phase of flight, they posed a problem that gave the crew insufficient time to recognize and correct. The National Transportation Safety Board finally determined the cause of the accident to be the asymmetric stall and ensuing roll of the aircraft because of the retraction of the port wing outboard leading edge slats, and the loss of stall warning and slat disagreement indicator systems resulting from the separation of the No 1 engine and pylon assembly, at a critical point during takeoff. The separation resulted from damage inflicted by improper maintenance procedures which led to the failure of the pylon structure. Contributing to the cause were: • The vulnerability of pylon attachment points to maintenance damage and of the leading edge slat system to the damage which produced asymmetry; • Deficiencies in the FAA’s surveillance and reporting systems in failing to detect improper maintenance procedures; • Deficiencies in communication between the aircraft operators, the manufacturer and the FAA in failing to disseminate details of previous maintenance damage; • The inadequacy of prescribed engine failure crew procedures to cope with unique emergencies. Post accident analysis has indicated that the pilot had about 15 seconds to react to the failure before control was completely lost. If corrective action had been taken, the plane could have been saved [26]. Obviously, under such emergency conditions, an automatic fault-tolerant control system could have been extremely useful to assist

26

T. Lombaerts, H. Smaili, and J. Breeman

the pilots, and on-line generated diagnostic information could have been useful to recover the plane. However, it should be noted that once the pilot let the speed decrease to V2, the angle of attack of the affected left wing exceeded its stall limit thus causing a non recoverable loss of control. It is important to realize that the main contribution fault tolerant control could most probably provide in this situation, was to improve the reaction time of the pilot to recover and stabilize the aircraft and to prevent the speed to decay by taking into account the minimum speed limit. Once the stall limit was exceeded, fault tolerant control could not recover from this fatal condition anymore as there would not be enough control authority by the remaining effectors to recover from the loss of control. From an operational standpoint, a too low airspeed combined with a very low altitude leads to a lack of sufficient energy to escape from this catastrophic situation.

1.3.2 Japan Airlines Flight JL123, Source: [27] On August 12 1985, the Japan Airlines short range Boeing 747SR with registration JA8119 departed as domestic flight JL123 from Tokyo Haneda towards Osaka. Despite the usual meticulous maintenance, an ill-accomplished fuselage repair more than seven years before was in effect a time bomb which unfortunately went off during this flight. The repair was necessary because of a tail strike at a landing performed by the aircraft at Osaka in 1978. The damage required repair to the aft fuselage and Fig. 1.20 JAL B747SR JA8119, c Fischdick Collection even the rear pressure bulkhead, which sus- Werner tained heavy damage from the impact on

(a) Illustration of explosive decompression, (MT/AA, with acknowledgement to Flight International/John Marsden & Time magazine/Joe Lertola)

(b) Picture of crippled tailless aircraft

Fig. 1.21 Illustrations of heavy damage to JAL Boeing 747 JA8119, (MT/AA)

1

Introduction

27

Fig. 1.22 Trajectory of flight JL123, (MT/AA)

the fuselage hull. Unfortunately, the repair work on the bulkhead involved rivet numbers and placement which was not optimized for long term fatigue, as explained in [27]. The repaired pressure dome held for seven years. Unfortunately, on flight JL123 the repaired dome joint broke and resulted in an explosive decompression, as illustrated by fig. 21(a). The volume of air escaping violently from the passenger cabin through the ruptured bulkhead, the failure of which in itself did not destroy the aircraft, had the same impact on the tailcone and tail surfaces as an explosion. Almost the complete vertical fin was blown off, together with components of all four independent hydraulic systems powering the primary flight controls. This meant

28

T. Lombaerts, H. Smaili, and J. Breeman

that all hydraulics were lost and the crew was left with no means to control the aircraft except for the engines. An amateur photographer took a picture of the crippled tailless aircraft, as seen in fig. 21(b). The loss of the vertical tail rendered the heavy aircraft de facto laterally unstable and led to a hopeless situation for the crew. The loss of hydraulics halted the functioning of all stability augmentation equipment, resulting in the appearance of phugoid as well as Dutch roll behaviour3. The only way for the crew to stabilize the aircraft, was to apply differential thrust by handling the four throttle levers separately. In this way the experienced crew succeeded in stabilizing the aircraft for half an hour, and almost managed to bring the aircraft back to Haneda’s airport. Unfortunately, they did not make it to the airport and crashed on Mount Osutaka. According to [27], it is widely accepted that the aircraft crashed because of crew fatigue and experts believe they would never have succeeded in performing a successful landing even if they had managed to bring the crippled aircraft back to the airport. A sketch of the aircraft trajectory can be found in fig. 1.22. From the flown trajectory shown in fig. 1.22, the aircraft was still controllable to some degree through differential thrust from its engines: the only problem is that this was not an efficient way to do so by the crew. With the available controls, they did not have the necessary capabilities to bring the aircraft and the passengers back to safety.

1.3.3 United Airlines Flight UA232, Source: [27] On July 19 1989, United Airlines flight UA232 going from Denver to Chicago was operated by one of the company’s McDonnell Douglass DC-10-10’s. The aircraft involved had the registration N1819U. A little more than an hour after departure from Denver, when the DC-10 was flying above the state of Iowa, North of the town Alta, it attempted to make a heading change from 15◦ to 95◦ at an airway intersection point. Close to the end of that turn, at 80◦ , the fan Fig. 1.23 UA DC-10-10 N1819U, c Fischdick disk of engine number two, which is placed Werner on the aircraft’s tail, fractured due to a disk forging flaw. The debris of this explosive engine failure punctured the horizontal stabilizer as well as the tailcone. Also the tubes of all three independent hydraulic systems powering the flight controls were damaged, which resulted in the loss of all hydraulics, just like the situation with the 3

After this accident, the manufacturer included some safety measures in the hydraulic circuit to prevent the total loss of all hydraulics in future in similar scenarios. This led to the choice to include the vertical tail loss in the RECOVER accident scenarios list without considering the total loss of hydraulics, see chapter 6.

1

Introduction

(a) Bad quality picture of the aircraft with arrows indicating the damage locations on elevator and tailcone, source: NTSB

29

(b) Picture of re-assembled stabilizer wreckage after crash, source: [3]

Fig. 1.24 Illustrations of heavy damage to UA DC-10-10 N1819U

JAL jumbo jet four years before. This event is illustrated by some pictures. Figure 24(a) is a picture of the aircraft, where the small arrows indicate the punctured areas on the right elevator. Note the large hole in the elevator leading edge, and the missing tailcone. Note that the major damage is clearly situated in the plane of the No. 2 fan disk. Finally, fig. 24(b) shows a picture of the stabilizer on the re-assembled wreckage after the crash. This is a top view, the structure on the top left is the tail engine housing. It is clear where the No. 2 fan disk is located in that housing, since the skin is completely missing there. With regard to the stabilizer, it is clear that the inner part was damaged to a significantly larger extent than the outer one. Since the aircraft was swinging through a gradual right turn at the airway intersection at the moment the tail-mounted engine disintegrated, its ‘frozen’ control surfaces left it with the tendency to continue the turn. Figure 1.25 shows a map of the aircraft’s radar-plotted track. The post failure ground track clearly shows the right hand turn tendency. In their fight to retain control with engine power alone, the DC-10 crew had small but crucial advantages over the hapless Japanese Boeing 747 crew in a similar predicament four years before, as described above. The undamaged fin gave the aircraft some measure of directional stability, moreover a ‘dead-heading’ check pilot joined the United crew on the flight deck. The check pilot’s remarkable skills in handling the power levers undoubtedly allowed the operating crew to concentrate more closely on their crucial individual tasks. Thanks to the joint efforts of the highly experienced crew, they managed to divert the aircraft to the airport closest in the vicinity, namely the Sioux Gateway Airport. As can be clearly seen in fig. 1.25, they succeeded only once to make a left turn, but this was sufficient to line the crippled DC-10 up with one of the airport’s runways. Unfortunately, since the flaps were stuck at their ‘in’-position, the crew was forced to make their approach at high speed. Moreover, the sluggish aircraft responses to the throttle setting changes made it particularly difficult to make changes in the aircraft final approach path and speed close to the runway. This resulted in the final seconds of flight being in a nearly unsurvivable situation. Any throttle change induced some very badly damped phugoid oscillations, which are extremely dangerous at this altitude. Moreover it was impossible to set the throttles to idle at finals,

30

T. Lombaerts, H. Smaili, and J. Breeman

Fig. 1.25 Map of the aircraft trajectory, (MT/AA)

because this would result again in the natural tendency of the aircraft to make a gradual right hand turn. All this resulted in the situation whereby the aircraft made extremely hard and rough contact with the ground, rolling and tumbling upside down as it broke up. Despite this dramatic end, and although 111 people died in the valiant landing attempt, the superb airmanship of the crew to nurse the aircraft back to the closest airport led to the survival of 185 passengers, including all the four crew on the flight deck. It is clear that the survival of a considerable number of the passengers depended entirely on the magnificent skills of the crew. Without these highly experienced pilots, this situation would have been definitely unsurvivable.

1.3.4 EL AL Cargo Flight LY1862, Source: [40] On October 4 1992, a Boeing 747-200F freighter aircraft operated by Israel’s national airline EL AL (registration: 4XAXG) departed from Amsterdam airport on cargo flight 1862 towards Tel Aviv. Unfortunately, while the aircraft was climbing over the most southern part of the IJsselmeer, the pylon of engine No. 3 broke off due to metal fatigue. Without the usual heavy aircraft inertia, the engine raced in Fig. 1.26 EL AL B747-200F 4X-AXG, c front of the aircraft, but due to the moment Werner Fischdick of the rotating parts it started tumbling and impacted on engine No. 4. This resulted in the loss of both right-wing engines, including serious damage to the wing leading edge resulting in the loss of lift force

1

Introduction

31

Fig. 1.27 Illustration of aircraft damage, source: [40]

and a significant drag increase. Due to this extensive damage, the aircraft was rendered considerably asymmetric. Moreover, this damage resulted in a partial loss of the hydraulics, and hydraulic systems 3 and 4 became unavailable. As illustrated in fig. 1.27, a significant number of control surfaces were paralysed after the engine separation. The outboard (low speed) ailerons, outboard flaps, spoilers No. 1, 4, 5, 6, 7, 8, 9, 12 as well as the inner left and outer right elevator were lost completely, while the inner (high speed) ailerons suffered a 50% hinge moment loss and the functionality of the horizontal stabilizer was reduced to half trim rate. After experiencing the limping behaviour of the crippled aircraft, the crew decided to return to the airport. In an attempt to make an emergency landing, the aircraft flew several right-hand circuits in order to lose altitude and to line up with runway 27. During the second line-up, the aircraft entered an unrecoverable rolldive. As a result, the aircraft crashed, 13 km east of the airport, into an eleven-floor apartment building in the Bijlmermeer, a suburb of Amsterdam. The trajectory of the aircraft is shown in fig. 1.28. Since the crew was not aware of the actual scale of the damage, they decided to return to the airport as quickly as possible. However, this resulted in the fact that they attempted to make an emergency landing with the heavy take off weight of 317 tons. This would have required such a high approach speed of 133.8m/s, that no safe landing would have been possible. Jettisoning fuel in order to reduce the aircraft weight to a more acceptable 263 tons would have resulted in a lower minimum speed of 108m/s that possibly would have led to a more survivable emergency landing, even with the flaps stuck at position 1. The official analysis from this investigation concluded that given the performance and controllability of the aircraft after the separation of the engines, a successful landing was highly improbable. In 1997, the division of Control and Simulation in

32

T. Lombaerts, H. Smaili, and J. Breeman

Fig. 1.28 Trajectory of EL AL flight 1862

the Faculty of Aerospace Engineering at the Delft University of Technology (DUT), in collaboration with the Netherlands National Aerospace Laboratory NLR, performed an independent analysis of the accident. In contrast to the analysis performed by the Netherlands Accident Investigation Bureau, the DFDR flight parameters were reconstructed using modelling, simulation and visualisation techniques in which the DFDR pilot control inputs were applied to detailed flight control and aerodynamic models of the accident aircraft. The purpose of the analysis was to acquire an estimate of the actual flying capabilities of the aircraft and to study alternative control strategies for a successful recovery. The application of this technique resulted in a simulation model of the impaired aircraft that could reasonably predict the performance, controllability effects and control surface deflections observed on the DFDR. Analysis of the reconstructed model (later used for the simulation benchmark in Chapter 6), indicated that from a technical point of view the damaged aircraft was recoverable if unconventional control strategies were used. Further results of this investigation, including detailed qualitative results of the analysis, can be found in [38] and [39]. Comparing this aircraft accident analysis with the previous two, shows that differential thrust is not the only way of recovering a crippled aircraft. It is possible that a limited number of control surfaces are still operative, and these should be taken into account when attempting to apply a form of unconventional control in order to bring the aircraft back to safety.

1.3.5 USAir Flight 427 and United Airlines Flight 585, Sources: [4], [9], [5] On March 3, 1991, a United Airlines (UAL) Boeing 737-200, registration number N999UA, operating as flight 585, was on a scheduled passenger flight from Denver, Colorado, to Colorado Springs, Colorado. Visual meteorological conditions (VMC) prevailed at the time, and the flight was on an instrument flight rules (IFR) flight

1

Introduction

33

plan. Numerous witnesses reported that shortly after completing its turn onto the final approach course to runway 35 at Colorado Springs Municipal Airport (COS), at about 0944 Mountain Standard Time, the airplane rolled steadily to the right and pitched nose down until it reached a nearly vertical attitude. In the last 8 seconds, the pilot requested 15 degrees of flaps, which was confirmed by the first officer and it has Fig. 1.29 United Airlines B737-200 c Fischdick been noted in the recorded cockpit sounds N999UA, Werner of the CVR that both engines were accelerating just prior to impact. This selection of 15-degrees flaps, in combination with increased thrust, is consistent with the initiation of a go-around. Despite this crew effort, the altitude continued decreasing rapidly, the indicated airspeed increased to over 200 knots, and the normal acceleration increased to over 4 G, before hitting the ground in an area known as Widefield Park, less than four miles from the runway threshold. Figure 1.30 shows a plot of United flight 585s ground track based on FDR and radar data. The airplane was destroyed completely by the impact forces and post-crash fire, and the 2 flight crew-members, 3 flight attendants and 20 passengers aboard were fatally injured. The subsequent investigation by the NTSB lasted one year and 9 months. Despite extensive damage to the flight data recorder (FDR), all the data was extractable. The

Fig. 1.30 Trajectory of United Airlines Flight 585, source: [5].

34

T. Lombaerts, H. Smaili, and J. Breeman

FDR only recorded five parameters4. The flightpath, pitch and roll angles were determined by calculations using the heading and normal acceleration (G-loads) data. The direct availability of roll attitude data would have provided direct information about sideslip angles when the roll angle and heading data were compared, thus permitting a more accurate analysis to determine the nature of the airplane’s final manoeuvre. Had rudder, aileron and spoiler deflection data been available, investigators would have been able to compare the airplane’s theoretical performance with other data that described the airplane’s flight profile to determine with a high level of confidence the effect of external (atmospheric) forces. The direct evidence provided by the parameters would also have permitted an analysis of the flight control system and engine function. Consequently, the data proved insufficient to establish why the plane suddenly went into the fatal dive. The NTSB did not rule out the possibilities of a malfunction of the rudder PCU servo (possibly causing a rudder reverse) and the effect that powerful rotor winds coming off the Rocky Mountains might have had, but there simply was not enough evidence to judge the expected cause. In the first NTSB report (issued on December 8, 1992) no ‘probable cause’ could be given. Instead, it said ‘The National Transportation Safety Board, after an exhaustive investigation effort, could not identify conclusive evidence to explain the loss of United Airlines flight 585.’ Sadly enough, three years later, a highly similar accident occurred... On September 8, 1994, at about 1903 local time, USAir flight 427, a Boeing 7373B7 (737-300), N513AU, crashed while manoeuvring to land at Pittsburgh International Airport, Pittsburgh, Pennsylvania. Flight 427 was operating as a scheduled domestic passenger flight from Chicago-O’Hare International Airport, Chicago, Illinois, to Pittsburgh. The flight departed at about 1810, with 2 pilots, 3 flight attendants, and 127 passengers on board. FDR data indicated that the accident airplane was rolling out of a left bank to its assigned heading of 100◦, after which it began to yaw and roll; the airplane’s heading moved left past 100◦ at an increasing rate. Thereafter, the airplane’s heading moved left at a rate of at least 5◦ per second. The airplane’s heading continued to move left at least at this rate until the stickshaker activated5 . The airplane’s left roll angle was also increasing rapidly during this time: the airplane’s left roll angle was about 28◦ and 5 seconds later the airplane’s left roll angle Fig. 1.31 USAir B737-300 N513AU, c Fischdick Collection exceeded 70◦ . All this happened in less than Werner 15 seconds. The airplane kept rolling to the 4 5

Since 1994, FDRs are required to have more parameters, including those to provide roll and pitch attitude data, as well as thrust data. This system warns the pilot when the aircraft is critically close to stalling.

1

Introduction

(a) Drawing of the Boeing 737 main rudder power control unit (PCA)

35

(b) Drawing of the Boeing 737 main rudder PCU servo valve

Fig. 1.32 Drawings of the faulty rudder PCU equipment on both Boeing 737s, source: [5].

left and finally entered an uncontrolled descent and impacted terrain near Aliquippa, Pennsylvania, about 6 miles northwest of the destination airport. All 132 people on board were killed, and the airplane was destroyed by impact forces and fire. The Safety Board therefore considered various scenarios that could have resulted in such an abrupt heading change, including asymmetric engine thrust reverser deployment, asymmetrical spoiler/aileron activation, transient electronic signals causing uncommanded flight control movements, yaw damper malfunctions, and a rudder cable break or pull. At the end, the Safety Board ruled out each of these scenarios as a possible factor or cause of the left yaw/roll and heading change for various reasons. After this second accident, similar to the USAir Flight 427, the NTSB reopened the investigation of Flight 585, discussed earlier6 , and came up with the following identical conclusion for both accidents: ‘The National Transportation Safety Board determines that the probable cause of the United Airlines flight 585 and USAir Flight 427 accidents was a loss of control of the airplane resulting from the movement of the rudder surface to its blowdown limit. The rudder surface most likely deflected in a direction opposite to that commanded by the pilots as a result of a jam of the main rudder power control unit servo valve secondary slide to the servo valve housing offset from its neutral position and overtravel of the primary slide’, see fig.1.32. Comparing this aircraft accident analysis with the previous ones, shows that not only a (partial) loss of hydraulics can lead to disastrous situations. Here, all hydraulics were still operational, but the rudder actuator suffered from a malfunction, leading to an extreme deflection up to its blowdown limits. Since all other control effectors, surfaces and engines, were still operative, their control authority could have been exploited by a form of unconventional control in order to bring the aircraft back to safety. In this scenario of a rudder hardover, the ailerons and differential thrust on both engines would be the steering channels par excellence to compensate for the failure. 6

And even another related accident with the same type of aircraft, namely Eastwind Flight 517.

36

T. Lombaerts, H. Smaili, and J. Breeman

Finally, flight tests conducted in a Boeing 737-300 aircraft, following the accident, demonstrated that an airspeed of 190 KIAS was close to the crossover speed for the weight and configuration of USAir Flight 427. At this speed, it was found that the ailerons and spoilers were sometimes unable to stop the roll induced by a (faulty) full rudder deflection. Moreover, the investigation by NTSB showed that if a B-737300 aircraft cruising at an airspeed of 190 knots with flaps 1 encountered a rudder hardover, recovery was impossible if altitude was maintained by the pilot. In these conditions, aircraft recovery was only possible if the pilot descended to gain airspeed, which decreases the effectiveness of the rudder and increases aileron/spoiler authority enough to compensate for the rolling moment. However, the natural reaction of the pilot would be to maintain altitude while analyzing a control problem as was the case for this accident. Simulations have shown that a roll/yaw upset is almost likely to be unrecoverable due to the surprise reaction of the pilot and the aircraft being below the crossover speed and/or close to the ground. However, a rudder hardover of a Northwest Airlines Boeing 747-400 aircraft (Flight 85) in 2002 showed that the remaining control capabilities of the aircraft, including the engines, could be used to recover the aircraft and reduce speed to conduct a successful landing. Also for these scenarios, fault tolerant control could assist to recover correctly and timely from a fault induced upset and stabilize the aircraft for an emergency landing.

1.3.6 DHL Cargo Flight above Baghdad, Sources: [31], [32] On November 22 2003, the DHL Airbus A300B4-203F freighter, registered OODLL, took off from Baghdad, bound for Bahrain. While in initial climb, at about 8000 ft, the aircraft was hit by a surfaceto-air missile. The missile entered the aircraft’s left wing from below at approximately half span. By perforating the wing skin, the projectile entered the outer wing fuel tank 1A. After it ignited, it destroyed the tank so comprehensively that the fuel Fig. 1.33 DHL A300-B4 OO-DLL, just drained out. This tank was full of fuel Werner c Fischdick Collection and luckily contained no fuel-air vapour, otherwise the wing would have been blown off the aircraft. However, it still proceeded to burn away at the rear spar. The fuel tank ribs in the area directly in front of the outboard flap burnt almost 50% through, but the front spar remained intact. Besides destroying tank 1A, the missile also pierced the inboard left wing tank 1, so it too was losing fuel. Since this inboard tank feeds directly the left engine, this led to a very time critical situation. Once the left inboard tank lost all its fuel content, the left wing engine would have stopped working. The crew knew they had to land quickly because the wing was trailing

1

Introduction

37

(a) Picture of the flying (b) Picture of damaged trail- (c) Picture of missile hole in aircraft with the left wing ing edge wing structure lower skin of wing structure on fire, the flames eating slowly their way through the wing structure Fig. 1.34 Pictures of heavy damage to DHL A300B4-203F OO-DLL

a 50m flame, see fig.34(a). They also knew that if a part of the wingtip separated they would lose all control of the aircraft. Despite the fact that the leading edge of the wing was complete along almost its entire length, unknown to the crew, the fire was gradually destroying the outer wing, creeping forward from the trailing edge. At some stage before they landed, the rear wing spar separated and the remaining structure was held together by the forward spar only, see fig.34(b). The impact hole where the surface to air missile (SAM) entered the wing box is visible in fig.34(c). Within a few seconds after impact, the aircraft lost all pressure in the three separate hydraulic systems. Consequently, the primary flight control surfaces (ailerons, rudder, elevators) and the spoilers were no longer powered and went limp as their actuators drained, trailing in the slipstream. The aircraft was rendered uncontrollable by conventional means and adopted a rapid phugoid motion. The horizontal stabilizer setting was frozen at the trim position for 215 KIAS, while flaps and slats were unavailable. Fortunately, it was a short flight with a light load, the total weight being only 220 klb, well below maximum landing weight. This was a clear and essential advantage compared with the EL AL scenario described earlier, since the aircraft was in an acceptable configuration in order to perform immediately a relatively safe landing with acceptable approach speed. Because of the expanding left wing damage, the only way to control the aircraft, namely by applying differential thrust, had also a time critical issue which ruled out any option of fuel jettison before switching over to the landing. If they had taken too long to return to the airport, the no 1 engine could have fallen dry of fuel due to the leaking no 1 fuel tank, or the structural integrity of the left wing could have been compromised because of the expanding fire, slowly ‘eating’ its way through the structure. Both would lead to unsurvivable additional damage. As the aircraft climbed towards a maximum altitude of about 12,000 feet, within 10 minutes, the crew essentially managed to apply an adaptive control strategy’ regaining control and understanding the basic principles of the flying characteristics induced by the phugoid motion. In addition to controlling pitch and roll of the aircraft by the engine throttles only, the additional drag and lift loss due to the damaged left wing needed to be compensated for. A welcome help was the fact that

38

T. Lombaerts, H. Smaili, and J. Breeman

Fig. 1.35 DHL A300 flight trajectory, acknowledgement to Flight International

deploying the gear during the descent increased the damping of the phugoid. After a first unsuccessful attempt to land the aircraft using the engines only, the crew made a go-around and finally made a successful landing at Baghdad International Airport, see fig.1.35. This was a tremendous achievement, and the crew made the most of the little chance they were given. It was a remarkable premiere. This failure resulted in additional challenges with respect to the previous situations. This time, there was not only a sudden failure, but it was also developing and expanding. This is an additional challenge for the identification routine, as it has to be continuously monitoring, even after failure detection. Also some kind of indication of time critical issues to the crew could be interesting to contribute to their situational awareness. Finally, it should be noted that this incident is an extreme situation which only serves as one of the incidents motivating the need for a fault tolerant flight control system. It is not our goal to discuss this failure specifically.

1.3.7 Final Note on Accident Analysis Only a few aircraft accidents have been analysed in detail above. Three of the above examples concern the total loss of the hydraulic circuits, leaving thrust control as the only way to steer the crippled aircraft. It should be noted that these accidents just serve as a general introduction and motivation for FTFC. Thrust control only was not a specific point of research within FM-AG(16), since it has been explored already in depth (see section 1.4.2). Moreover, there are many other examples of loss of control in flight. For example, there was an unintentional asymmetric thrust reverser deployment in flight on a Lauda Air Boeing 767 above Thailand, which left the crew a ‘recovery window’ of only 4 to 6 seconds. This failure was very improbable to survive with the current autopilot systems, but the presence of an automatic adaptive control strategy would have compensated for this. Also the crash of an Air Florida Boeing 737 due to ice accretion would probably have been

1

Introduction

39

Fig. 1.36 Accident statistics, source: [8]

avoidable with this strategy, as well as the American Airlines DC-10 accident at Chicago O’Hare International Airport, described earlier. Moreover, there have been several other engine separation incidents on Boeing 747’s and DC-8’s, similar to the EL AL situation. There is even the documented story of a McDonnell Douglas F15 performing an emergency landing with only one wing due to a mid-air collision with another aircraft. After some attempts, the pilot succeeded in regaining control over the aircraft, and nursed the crippled vehicle back to the airport. Key aspects were the fact that the aircraft kept flying and even landed at high speed and that the F-15 fuselage is quite wide, containing two engines, so that it has some lifting body behaviour. After landing, the pilot acknowledged that he was not aware of missing his entire right wing, and if he had been, he would certainly have ejected... A recent worldwide civil aviation accident survey for the period 1993 to 2007, conducted by the Civil Aviation Authority of the Netherlands (CAA-NL) and based on data from the National Aerospace Laboratory NLR [8], indicates two major categories of accidents which can be attributed to a common initial event, ‘controlled flight into terrain’ where an aircraft, despite being fully controllable and under control, hits terrain due to the loss of situational awareness of the crew, counting for as much as 23% of all the accidents. This percentage is decreasing over the years thanks to the enormous international attention given to CFIT with respect to crew resource management training and development and implementation of new systems in the cockpit. The second major category is ‘loss of control in flight’, which can be attributed to mistakes made by the pilot or a technical malfunctioning. This category counts for 16% of all aircraft accidents and is not decreasing. Figure 1.36 shows a table from this survey. According to the research team of this project, a reconfiguring flight control system would make the success of the United Airlines and DHL examples less dependent on the extreme skills of the pilots. Moreover, the other examples explained above, and a significant part of this 16% of aircraft accidents due to loss of control in flight could be prevented if some form of reconfiguring control was implemented in the aircraft. It is important to acknowledge that these accidents

40

T. Lombaerts, H. Smaili, and J. Breeman

could not have been prevented at the time when they occurred, since computer capabilities at that time were not at the level they are now. From this perspective, it is very clear that research on fault tolerant flight control is in the interest of the civil as well as military aviation industry.

1.4 Earlier Accomplishments in This Field, Source: [40] Motivated by several aircraft accidents at the end of the 1970s, including the crash of American Airlines Flight 191 DC-10 at Chicago in 1979, research on reconfigurable fault tolerant flight control (RFTFC) was initiated to accommodate in-flight failures and to improve the safety and reliability of onboard avionics and flight control system equipment. Reconfigurable control aims to utilise all remaining control effectors on the aircraft (control surfaces and engines) after an unanticipated mechanical or structural failure, to recover the performance of the original system by automatic redesign of the flight control system in order to resemble the unfailed aircraft design. The first objective of reconfiguration is to guarantee system stability while the original performance is reconstructed as much a possible. Due to limitations of the control allocation scheme caused by, for instance, actuator position and rate limits, the system performance of the unfailed aircraft may not be fully achieved. In this case, the failed aircraft would be flown in a degraded mode but with sufficiently acceptable handling qualities for a successful recovery. Reconfigurable flight control systems have been successfully flight tested [21], [17], [6] and evaluated in manned simulations [21], but up to date, no RFTFC has been certified or applied in both commercial and military aircraft. Passive design approaches are robust control techniques that can handle model uncertainties, flight condition changes and several types of faults and failures without on-line fault information within the robust boundary region. Unanticipated failures that occur outside the stability region of the robust controller may result in catastrophic system instability or performance degradation. For the mitigation of mechanical or structural failures that occur outside the stability region of the robust controller, the use of active reconfigurable control becomes necessary. Fault detection and isolation (FDI) modules are necessary to deliver on-line fault information for control reconfiguration. Active fault accommodation may then be performed based on off-line predetermined (a-priori) fault scenarios, control law switching, or by means of on-line and real-time control law restructuring (architecture changes) or reconfiguration (parameter recalculation).

1.4.1 Self-Repairing Flight Control System (SRFCS) Program The earliest flight tests of reconfigurable flight control systems were performed during the Self-Repairing Flight Control System (SRFCS) program [17], sponsored by the US Air Force Wright Research and Development Center in 1984. Using a categorised pre-determined set of failure modes, the states of the system were estimated, based on the known list of failures, to determine the failed component. Residual

1

Introduction

41

errors were generated by comparison with a nominal model to isolate failures and estimate the control derivatives of the failed damaged surface for use in a control allocation scheme. The probability of the pre-defined failure cases was estimated and used to determine the weighted average for the control inputs. The limitation of this method is that modelling errors can be interpreted as a failure while the only failures that can be identified ‘correctly’ are those that fall into the predetermined fault list. The SRFCS was successfully flight tested by NASA in 1989 and 1990 on a F-15 aircraft at the Dryden Flight Research Center [17]. Real-time control reconfiguration was demonstrated for fault cases that included loss of control surfaces due to battle damage.

1.4.2 MD-11 Propulsion Controlled Aircraft (PCA) Following the Sioux City incident in 1989, the SRFCS project was followed by a program at the NASA Dryden Flight Research Center on Propulsion Controlled Aircraft (PCA). The system aims to provide a safe landing capability using only augmented engine thrust for flight control. Throughout the 1990s, the system has been successfully tested on several aircraft, including both commercial (Figure 1.37) and military, but the acceptance of PCA technology in the commercial and military field has still not been achieved. Ref. [15] provides more background on PCA.

Fig. 1.37 A McDonnell Douglas MD-11 lands at Dryden Flight Research Center equipped with a computer-assisted engine control landing system developed by a NASA-Industry team. NASA Dryden Flight Research Center Photo Collection, photo by J. Ross

1.4.3 NASA Intelligent Flight Control System (IFCS) F-15 Program In 1992, the Intelligent Flight Control (IFC) research program was established to explore the possibilities of utilising adaptive flight control technology to accommodate unanticipated failures through self-learning neural networks. Within the 19992004 Intelligent Flight Control System (IFCS) F-15 program [6] [41], sponsored by NASA Dryden, pre-trained and on-line learning neural networks were flight tested on the NASA IFCS F-15 testbed (Figure 1.38). The pre-trained neural networks

42

T. Lombaerts, H. Smaili, and J. Breeman

Fig. 1.38 NASA Drydens highly modified F-15B, tail number 837, performing Intelligent Flight Control System (IFCS) project flights. NASA Dryden Flight Research Center Photo Collection, photo by C. Thomas

provide estimates of the stability and control characteristics for model inversion. The on-line learning neural networks provide on-line compensation of errors in the estimates and from the model inversion. In addition, the adaptive neural networks compensate for changes in the aircraft dynamics due to failures or damage. Piloted simulation studies have been performed at NASA Ames of Integrated Neural Flight and Propulsion Control Systems (INFPCS) in which neural flight control architectures are combined with PCA technology. The evaluation successfully demonstrated the benefits of intelligent adaptive control [28]. Subsequent evaluations are planned to further validate the IFC technologies in a C-17 testbed [28]. Adaptive neural network based technology was further investigated in the Reconfigurable Control for Tailless Aircraft (RESTORE) program in which reconfigurable control design methods were applied to a tailless aircraft [14], [16]. Within the Active Management of Aircraft System Failures (AMASF) project, as part of NASA’s Aviation Safety Program, several issues in the area of FTFC technology were addressed. These include detection and identification of failures and icing, pilot cueing strategies to cope with failures and icing, and control reconfiguration strategies to prevent extreme flight conditions following a failure of the aircraft. In this context, a piloted simulation was conducted early in 2005 of a Control Upset Prevention and Recovery System (CUPRSys). Despite a few limitations, CUPRSys provided promising fault detection, isolation and reconfiguration capabilities [21].

1.5 Research Challenges and Objectives The objective of this Action Group was to demonstrate the capability and viability of modern fault detection, isolation and reconfiguration (FDIR) methods when applied to a realistic, nonlinear design problem and to assess their contribution to flight safety. The research group aims to further integrate the latest developments in fault detection and isolation techniques with reconfigurable control technology which has only been done by a few studies so far [36], [43]. In particular, most of the fault detection and isolation methodologies are developed independently as diagnostic or monitoring tools and not as an integral part of a reconfigurable fault tolerant control system. Most of the current reconfigurable control systems are developed

1

Introduction

43

under the assumption of perfect information from the FDI system. Furthermore, the group addressed the need for high-fidelity nonlinear simulation models, relying on accurate failure modelling, to improve the prediction of reconfigurable system performance in degraded modes. Several realistic failure modes have been considered in this research project. The most important scenarios are the engine separation (inspired by the El Al accident, see 1.3.4) and the rudder hardover (inspired by the US Airways and United Airlines accidents, see 1.3.5) cases. However, it should be noted that the scenario ‘total loss of hydraulics’, leading to the need of ‘thrust control only’ has not been considered explicitly in this research. An important motivation for this is the fact that this case has been considered intensively in the PCA project of NASA, discussed in 1.4.2. The focus of this research project is more general and not focussed on this specific strategy.

References 1. Ammons, E.: F-16 flight control system redundancy concepts. In: Guidance and Control Conference, Boulder, Colorado (August 1979) 2. Anderson, B., Bedos, T.: X-38 v201 avionics architecture. Technical Report N20000086667, NASA (February 1999) 3. Anonymous. Applying lessons learned from accidents, http://faalessons.workforceconnect.org/ 4. Anonymous. Aircraft accident report united airlines flight 585 boeing 737-291, N999UA uncontrolled collision with terrain for undetermined reasons 4 miles south of Colorado Springs municipal airport Colorado Springs, Colorado March 3, 1991. Technical report, National Transportation Safety Board, NTSB (1992) 5. Anonymous. Aircraft accident report uncontrolled descent and collision with terrain Usair flight 427 boeing 737-300, n513au near aliquippa, pennsylvania, September 8, 1994. Technical report, National Transportation Safety Board, NTSB (1999) 6. Anonymous. Intelligent flight control: Advanced concept program. Final Report BOEING-STL 99P0040, The Boeing Company (1999) 7. Anonymous. Integrated resilient aircraft control - stability, maneuverability and safe landing in the presence of adverse conditions. Technical report, National Aeronautics and Space Administration, Aeronautics Research Mission Directorate, Aviation Safety Program (April 2007) 8. Anonymous. Civil aviation safety data 1993-2007. Technical report, Civil Aviation Authority of the Netherlands, CAA-NL (2008) 9. Anonymous. Aircraft accident report: Uncontrolled descent and collision with terrain united airlines flight 585 boeing 737-200, n999ua 4 miles south of colorado springs municipal airport colorado springs, colorado, March 3, 1991. Technical report, National Transportation and Safety Board (March 27, 2001) 10. Arabian, A.: Afti/f-16 digital flight control computer design. In: NAECOn 1983, Dayton, Ohio (1983) 11. Boldue, L.: Redundancy management for the X-33 vehicle and mission computer. In: 19th Digital Avionics Systems Conference, Philadelphia, Pennsylvania (October 2000) 12. Brekke, D., Giere, N., Schlosser, R., Slavich, M., Tabor, D., Turner, B.: Next generation fault-tolerant guidance and navigation unit for the inertial upper stage. In: Rocky Mountain Guidance and Control Conference, Keystone, Co (February 1995)

44

T. Lombaerts, H. Smaili, and J. Breeman

13. Briere, D., Traverse, P.: Airbus a320/a330/a340 electrical flight controls - a family of fault tolerant systems. In: IEEE Conference (1993) 14. Brinker, J.S., Wise, K.A.: Nonlinear simulation analysis of a tailless advanced fighter aircraft reconfigurable flight control law. In: AIAA Guidance, Navigation and Control Conference and Exhibit, Portland, OR, AIAA-99-4040 (August 1999) 15. Burken, J.J., Maine, T.A., Burcham, F.W., Kahler, J.A.: Longitudinal emergency control system using thrust modulation demonstrated on an md-11 airplane. In: AIAA, ASME, SAE, and ASEE, Joint Propulsion Conference and Exhibit, 32nd, Lake Buena Vista, FL (July 1996) 16. Calise, A.J., Lee, S., Sharma, M.: Development of a reconfigurable flight control law for the x-36 tailless fighter aircraft. AIAA Journal of Guidance, Control and Dynamics 24(5), 896–902 (2001) 17. Corvin, J.H., Havern, W.J., Hoy, S.E., Norat, K.F., Urnes, J.M., Wells, E.A.: Selfrepairing flight control systems, volume i: Flight test evaluation on an f-15 aircraft. Final Report WL-TR-91-3025 (1991) 18. Driscoll, K., Hoyme, K.: The airplane information management system, an integrated real-time flight deck control system. In: Real-Time System Symposium (December 1992) 19. EASA. Certification Specifications for Large Aeroplanes. EASA. CS-25 20. Federal Aviation Administration FAA. Airworthiness Standards: Transport Category Airplane. Federal Aviation Administration FAA. title 14, part 25 21. Ganguli, S., Papageorgiou, G., Glavaski, S., Elgersma, M.: Piloted simulation of fault detection, isolation and reconfiguration algorithms for a civil transport aircraft. In: AIAA Guidance, Navigation and Control Conference and Exhibit, San Francisco, CA, AIAA2005-5936 (August 2005) 22. Goupil, P.: Airbus overview of fault tolerant control. In: Garteur AG-16 Workshop, April 4-5 (2006) 23. Gunston, B.: Modern Fighters. Salamander Books Ltd., London (1988) 24. Hammett, R.: Design by extrapolation: an evaluation of fault tolerant avionics. IEEE Aerospace and Electronic Systems Magazine 17(4), 17–25 (2002) 25. Jarvis, C.R., Szalai, K.J.: Ground and flight test experience with a triple redundant digital fly by wire control system. Technical Report 19810010480, NASA (1981) 26. Jiang, J.: Fault-tolerant Control Systems – An Introductory Overview. ACTA Automatica Sinica 31(1), 161–174 (2005) 27. Job, M.: Air Disaster, vol. 2. Aerospace Publications Pty Ltd. (1996) 28. KrishnaKumar, K., Gundy-Burlet, K.: Intelligent control approaches for aircraft applications. Technical report, NeuroEngineering Laboratory, NASA Ames Research Center 29. Kuhlberg, J.F., Kniat, J., Newirth, D.M., Jamison, J.C., Switalski, J.R.: Transport engine control design. In: AIAA, SAE and ASME, Joint Propulsion Conference, 18th, Cleveland, Ohio (June 1982) 30. Le Tron, X.: Airbus fly-by-wire: An integrated system design. In: Garteur AG-16 Workshop, April 4-5 (2006) 31. Learmount, D.: Missile attack, great escape. In: Flight International, pp. 34–38 (21/12/2004 - 03/01/2005) 32. Lemaignan, B.: Flying with no flight controls: Handling qualities analyses of the baghdad event. AIAA-2005-5907 (2005) 33. Lombaerts, T.J.J., Chu, Q.P., Mulder, J.A.: Lecture Notes AE4-301, Automatic Flight Control System Design. Delft University of Technology, Faculty of Aerospace Engineering, Delft, The Netherlands (January 2005) 34. Maoui, G. (ed.): Cockpits by Airbus Industrie. Cherche midi enterprise (1998)

1

Introduction

45

35. Mulder, J.A., van Staveren, W.H.J.J., van der Vaart, J.C., de Weerdt, E.: Lecture Notes AE3-302, Flight Dynamics. Delft University of Technology, Faculty of Aerospace Engineering, Delft, The Netherlands (January 2006) 36. Patton, R.J.: Fault tolerant control systems: The 1997 situation. In: Proceedings of IFAC Symposium on SAFEPROCESS, HULL, UK, August 1997, pp. 1033–1055 (1997) 37. Pratt, R.W.: Flight Control Systems, practical issues in design and implementation. In: IEE/AIAA, Stevenage, UK/Reston, USA (2000) 38. Smaili, M.H.: Flight Data Reconstruction and Simulation of EL AL Flight 1862. Final thesis, T.U. Delft (November 1997) 39. Smaili, M.H.: Flight data reconstruction and simulation of the 1992 amsterdam bijlmermeer airplane accident. AIAA-2000-4586 (August 2000) 40. Smaili, M.H., Breeman, J., Lombaerts, T.J.J., Joosten, D.A.: A simulation benchmark for integrated fault tolerant flight control evaluation. In: AIAA MST (2006) 41. Williams-Hayes, P.S.: Flight test implementation of a second generation intelligent flight control system. In: Infotech@Aerospace (2005) 42. Yeh, Y.C.: Triple-triple redundant 777 primary flight computer. In: IEEE Aerospace Application Conference, Aspen, Colorado, pp. 293–307 (1996) 43. Zhang, Y., Jiang, J.: Bibliographical review on reconfigurable fault-tolerant control systems. In: 5th IFAC Symposium on Fault Detection, Supervision and Safety for Technical Processes, Washington DC, USA, June 9-11, pp. 265–275 (2003)

Chapter 2

Fault Tolerant Flight Control - A Survey Michel Verhaegen, Stoyan Kanev, Redouane Hallouzi, Colin Jones, Jan Maciejowski, and Hafid Smail

2.1 Why Fault Tolerant Control? Nowadays, control systems are involved in nearly all aspects of our lives. They are all around us, but their presence is not always really apparent. They are in our kitchens, in our DVD-players, computers and our cars. They are found in elevators, ships, aircraft and spacecraft. Control systems are present in every industry, they are used to control chemical reactors, distillation columns, and nuclear power plants. Michel Verhaegen Delft University of Technology, Delft Center for Systems and Control, Mekelweg 2, 2628CD Delft, The Netherlands e-mail: [email protected] Stoyan Kanev ECN Wind Energy, P.O.Box 1, 1755ZG Petten, The Netherlands e-mail: [email protected] Redouane Hallouzi ReliaCon, Rotterdamseweg 145, 2628AL Delft, The Netherlands e-mail: [email protected] Colin Jones ETH Zurich, Automatic Control Laboratory ETL K14.2, Physikstrasse 38092 Zurich, Switzerland e-mail: [email protected] Jan Maciejowski University of Cambridge, Engineering Department, Trumpington Street, Cambridge CB2 1PZ, United Kingdom e-mail: [email protected] Hafid Smaili National Aerospace Laboratory NLR, Anthony Fokkerweg 2, 1059 CM Amsterdam, The Netherlands e-mail: [email protected] C. Edwards et al. (Eds.): Fault Tolerant Flight Control, LNCIS 399, pp. 47–89. c Springer-Verlag Berlin Heidelberg 2010 springerlink.com

48

M. Verhaegen et al.

They are constantly and inexhaustibly working, making our life more comfortable and more efficient . . . until the system fails. Faults in technological systems are events that happen rarely, and come mostly unexpectedly. In [43] the following definition for a fault is made: A fault is an unpermitted deviation of at least one characteristic property or parameter of the system from the acceptable/usual/standard condition. Faults are difficult to accurately predict in time, and to prevent. The impact of a fault can be a small reduction in efficiency, but could also lead to overall system failure. In safety critical systems this can lead to catastrophic events with significant costs, both economically and in terms of human life. Several such examples are • the explosion at the nuclear power plant at Chernobyl, Ukraine, on 26th April 1986 [67]. About 30 people were killed immediately, while another 15,000 were killed and 50,000 left handicapped in the emergency clean-up after the accident. It is estimated that five million people were exposed to radiation in Ukraine, Belarus and Russia. • the crash of the A MERICAN A IRLINES flight 191, a McDonnell-Douglas DC-10 aircraft, at Chicago O’Hare International Airport on 25 May 1979 (see Chapter 1). In this incident 271 persons on board and 2 on the ground were killed when the aircraft crashed into an open field [74, 75]. • the explosion of the Ariane 5 rocket on 4th June 1996, where the reason was a fault in the Internal Reference Unit that had the task to provide the control system with altitude and trajectory information. As a result, incorrect altitude information was delivered to the control unit [67]. The question that immediately arises is “Could something have been done to prevent these disasters?”. While in most situations the occurrences of faults in the systems cannot be prevented, subsequent analysis often reveals that the consequences of the faults could be avoided or, at least, that their severity (in terms of economic losses, casualties, etc.) could be minimized. If faults could be detected and diagnosed rapidly enough, then, in many cases, it is possible to subsequently reconfigure the control system so that it can safely continue its operation (though with degraded performance) until the time comes when it can be switched off to allow repair. In order to minimize the chances for such catastrophic events as those summarized above, safety-critical systems must possess the properties of increased reliability and safety. A way to offer increased reliability and safety is by means of a fault-tolerant control (FTC) system design. An FTC system could have been designed to lead to a safe shutdown of the Chernobyl reactor way before it exploded [67]. Subsequent studies following the McDonnell-Douglas DC-10 crash showed that the crash could have been avoided [75]. In the last minutes of the Ariane 5 crash the normal altitude information had been replaced by some diagnostic information that the control system was not designed to understand [67]. Fortunately, there are also examples,

2

Fault Tolerant Flight Control - A Survey

49

-

Controller

inputs

Controlled System

sensors

reference

actuators

system faults

outputs

Fig. 2.1 According to their location, faults are classified into sensor, actuator and component faults.

which show that taking appropriate measures can indeed prevent disasters (see also Chapter 1): 1. A McDonnell-Douglas DC-10 aircraft executing flight 232 of U NITED A IR LINES from Denver to Minneapolis experienced a disastrous failure in the hydraulic lines that left the plane without any control surfaces at 37,000 ft. The crew then improvised a control strategy that used only the throttles of the two wing engines and managed to successfully crash-land the plane in Sioux City, Iowa, saving the lives of 184 out of the 296 passengers on board [66]. 2. In the D ELTA A IRLINES flight 1080 an elevator became jammed at 19 degrees. The pilot was not given any indication of what had actually occurred but still was able to reconfigure the remaining lateral control elements to land the aircraft safely [75]. All these examples clearly motivate the need for increased fault-tolerance in order to improve to the maximum possible extent the safety, reliability and availability of controlled systems. This is particularly true as modern systems become increasingly complex. The examples above also explain the large amount of research in the field of fault detection, diagnosis and fault-tolerant control. An overview of this research is provided in this chapter.

2.2 Fault Classification Faults are events that can take place in different parts of the controlled system. In the FTC literature faults are classified according to their location of occurrence in the system (see Figure 2.1). Actuator faults: they represent partial or total (complete) loss of control action. An example of a completely lost actuator is a “stuck” actuator that produces no (controllable) actuation regardless of the input applied to it. Total actuator faults can occur, for instance, as a result of a breakage, cut or burned wiring, short circuits, or the presence of a foreign body in the actuator. Partially failed actuators produce only a part of the normal (i.e. under nominal operating conditions) actuation. This can result from hydraulic or pneumatic leakage, increased resistance or a fall in the supply voltage, etc. Duplicating the actuators in the system in

50

M. Verhaegen et al.

order to achieve increased fault-tolerance is often not an option due to their high prices and large size and mass. Sensor faults: these faults represent incorrect readings from the sensors that the system is equipped with. Sensor faults can also be subdivided into partial and total. Total sensor faults produce information that is not related to the value of the measured physical parameter. They can be due to broken wires, lost contact with the surface, etc. Partial sensor faults produce readings that are related to the measured signal in such a way that useful information could still be retrieved. This can, for instance, be a gain reduction so that a scaled version of the signal is measured, a biased measurement resulting in a (usually constant) offset in the reading, or increased noise. Due to their smaller sizes sensors can be duplicated in the system to increase fault tolerance. For instance, by using three sensors to measure the same variable one may consider it reliable enough to compare the readings from the sensors to detect faults in (one and only one) of them. The socalled “majority voting” method can then be used to pinpoint the faulty sensor. This approach usually implies significant increases in the related costs. Component faults: these are faults in the components of the plant itself, i.e. all faults that cannot be categorized as sensor or actuator faults will be referred to as component faults. These faults represent changes in the physical parameters of the system, e.g. mass, aerodynamic coefficients, damping constant, etc., that are often due to structural damage. They often result in a change in the dynamical behaviour of the controlled system. Due to their diversity, component faults cover a very wide class of (unanticipated) situations, and as such are the most difficult ones to deal with. Further, with respect to the way faults are modelled, they are classified as additive and multiplicative, as depicted in Figure 2.2. Additive faults are suitable for representing component faults in the system, while sensor and actuator faults are in practice most often multiplicative by nature. Faults are also classified according to their time characteristics (see Figure 2.3) as abrupt, incipient and intermittent. Abrupt faults occur instantaneously often as a result of hardware damage. They can be very severe since, if they affect the performance and/or the stability of the controlled system, prompt reaction from the FTC system is required. Incipient faults represent slow parametric changes, often as a result of aging. They are more difficult to detect due to their slow time characteristics,

fault

fault signal

+

faulty signal

additive fault

signal

x

faulty signal

multiplicative fault

Fig. 2.2 According to their representation, faults are divided into additive and multiplicative.

51

fault

fault

Fault Tolerant Flight Control - A Survey

fault

2

time

time

abrupt

incipient

time

intermittent

Fig. 2.3 With respect to their time characteristics faults can be abrupt, incipient and intermittent.

but are also less severe. Finally, intermittent faults are faults that appear and disappear repeatedly, for instance due to partially damaged wiring.

2.3 Modelling Faults As already mentioned in Section 2.2, faults are often represented as additive or multiplicative adjustments to the nominal behaviour. In this section we further concentrate on the mathematical representation of these faults and will provide a discussion on when and why one representation is more appropriate than the other. Throughout this chapter the state-space representation of dynamical systems is used, so that the relation from the system inputs u ∈ Rm to the measured outputs y ∈ R p is written in the form xk+1 = Axk + Buk Snom : (2.1) yk = Cxk + Duk , where xk ∈ Rn denotes the state of the system at time instance k, and A, B, C and D are matrices (possibly time-varying) of appropriate dimension.

2.3.1 Multiplicative Faults Multiplicative modelling is mostly used to represent sensor and actuator faults. Actuator faults represent malfunctioning of the actuators of the system, for example as a result of hydraulic leakages, broken wires, or stuck control surfaces in an aircraft. Such faults can be modelled as an abrupt change of the nominal control action from uk to ukf = uk + (I − ΣA )(u¯ − uk ), (2.2) where u¯ ∈ Rm is a (not necessarily constant) vector that cannot be manipulated, and where ΣA = diag{ σ1a , σ2a , . . . , σma }, σia ∈ R. In this way σia = 0 represents a total fault (i.e a complete failure) of the i-th actuator of the system so that the control action coming from this i-th actuator becomes equal to the i-th element of the uncontrollable offset vector u, ¯ i.e. ukf (i) = u(i). ¯ On

52

M. Verhaegen et al.

the other hand, σia = 1 implies that the i-th actuator operates normally (uk (i) = u(i)). The quantities σia , i = 1, 2, . . . , m can also take values in between 0 and 1, making it possible to represent partial actuator faults. Substituting the nominal control action uk in equation (2.1) with the faulty ukf results in the following state-space model xk+1 = Axk + BΣAuk + B(I − ΣA )u¯ (2.3) Smult,a f : yk = Cxk + DΣA uk + D(I − ΣA )u. ¯ f

Models in the form (2.3) are referred to as multiplicative fault models and have been widely used in the literature (see, for example [86, 73]). It needs to be noted that while such multiplicative actuator faults do not directly affect the dynamics of the controlled system itself, they can significantly affect the dynamics of the closed-loop system, and may even affect the controllability of the system. Figure 2.4 presents a simple example with a 50% actuator fault that results in instability of the closed-loop system. In the example of Figure 2.4 a system consisting of the transfer function S(s) = 1/(s − 1) is controlled by a PI controller with transfer function C(s) = 1.5 + 5s , so that a sinusoidal reference signal is tracked under normal operating conditions (i.e. during the first 20 seconds of the simulation). At time instance t = 20 sec, a 50% loss of control effectiveness is introduced and as a result the closed-loop system stability is lost. This example makes it clear that even “seemingly simple” faults may significantly degrade the performance and can even destabilize the system. Similarly, sensor faults occurring in the system (2.1) represent incorrect reading from the sensors, so that as a result the real output of the system yreal differs from k the variable being measured. Multiplicative sensor faults can be modelled in the following way f yk = yk + (I − ΣS )(y¯ − yk ), (2.4) where y¯ ∈ R p is an offset vector, and ΣS = diag{ σ1s , . . . , σ ps }, σis ∈ R, so that σ sj = 0 represents a total fault of the j-th sensor, and σ sj = 1 models the normal mode of operation of the j-th sensor. Partial faults are then modelled by taking σ sj ∈ (0, 1). Substitution of the nominal measurement yk in (2.1) with its faulty counterpart ykf results in the following state-space model that represents multiplicative sensor faults xk+1 = Axk + Buk Smult,s f : (2.5) yk = ΣSCxk + ΣS Duk + (I − ΣS )y. ¯ In this way, combinations of multiplicative sensor and actuator faults are represented in the following way ¯ xk+1 = Axk + BΣA uk + b(ΣA , u) Smult : (2.6) yk = ΣSCxk + ΣS DΣA uk + d(ΣA , ΣS , u, ¯ y), ¯

2

Fault Tolerant Flight Control - A Survey

reference generator

53

1,5+5/s

50% fault

PI Controller

actuator fault

Monitoring

1 s−1 System

reference trajectory system output 4

2

fault occurrence

6

0

−2

−4

−6 0

5

10

15

20 time, sec

25

30

35

40

Fig. 2.4 After a multiplicative fault the system may become unstable if no reconfiguration takes place.

with

¯ = B(I − ΣA )u, ¯ b(ΣA , u) d(ΣA , ΣS , u, ¯ y) ¯ = ΣS D(I − ΣA )u¯ + (I − ΣS )y. ¯

The multiplicative model is thus a “natural” way to model a wide variety of sensor and actuator faults, but cannot be used to represent more general component faults. This fault model representation is most often used in the design of the controller reconfiguration scheme of an active FTC system since for controller redesign one usually needs the state-space matrices of the faulty system.

2.3.2 Additive Faults The additive faults representation is more general than the multiplicative one. A state-space model with additive faults has the form xk+1 = Axk + Buk + F fk Sadd : (2.7) yk = Cxk + Duk + E fk , where fk ∈ Rn f is a signal describing the faults. This representation may, in principle, be used to model a wide class of faults, including sensor, actuator, and

54

M. Verhaegen et al.

fault

f(x)

signal

+

constant scaling

faulty signal

additive fault

signal

x

constant offset

+

faulty signal

multiplicative fault

Fig. 2.5 Using additive fault representation to model total sensor (or actuator) faults results in a fault signal that depends on yk (uk ). This is not the case with the multiplicative model where the fault magnitude and the offset are independent on the signals in the state-space model.

component faults. Using model (2.7), however, often results in the signal fk becoming related to one or more of the signals uk , yk and xk . For instance, when using this additive fault representation to model a total fault in all actuators (ΣA = 0 and u¯ = 0 in equation (2.2)) then in order to make equivalent to model (2.3) one model (2.7) F B needs to take a signal fk such that E fk = − D uk holds, making fk dependent on uk . Clearly, the fault signal being a function of the control action is not desirable for controller design. On the other hand, fk is independent of uk when multiplicative representation is utilized. Figure 2.5 illustrates this. Another disadvantage of the additive model when used to represent sensor and actuator faults is that, in terms of input-output relationships, these two faults become difficult to distinguish. Indeed, suppose that the model xk+1 = Axk + Buk + fka yk = Cxk + Duk + fks , is used to represent faults in the sensors and actuators. By writing the corresponding transfer function y(z) = (C(zI − A)−1 B + D)uk + C(zI − A)−1 fka + fks , it becomes clear that the effect of an actuator fault on the output of the system can be modelled not only by the signal fka , but also by fks . An advantage is, as already mentioned, that the additive representation can be used to model a more general class of faults than multiplicative ones. In addition, it is more suitable for the design of FDD schemes because the faults are represented by one signal rather than by changes in the state-space matrices of the system as is the case with the multiplicative representation. For that reason the majority of FDD methods are focused on additive faults [33, 3, 57].

2.3.3 Component Faults The class of component faults was defined in Section 2.2 as the most general as it includes faults that may bring changes in practically any element of the system. It was defined as the class of all faults that cannot be classified as sensor or actuator

2

Fault Tolerant Flight Control - A Survey

55

faults. A component fault may introduce changes in each matrix of the state-space representation of the system due to the fact they may all depend on the same physical parameter that undergoes a change. Component faults are often modelled in the form of a linear parameter-varying (LPV) system xk+1 = A( f )xk + B( f )uk yk = C( f )xk + D( f )uk ,

(2.8)

where f ∈ Rn f is a parameter vector representing the component faults. It should be noted that this model might also be used for modelling sensor and actuator faults. Due to the fact the matrices may depend in a general, nonlinear, way on the fault signal fk this model is less suitable for fault detection and diagnosis.

2.4 Main Components in an FTC System FTC systems are generally divided into two classes: passive and active. Passive FTC systems are based on robust controller design techniques and aim at synthesizing a single, robust controller that makes the closed-loop system insensitive to anticipated faults. This approach requires no online detection of the faults, and is therefore computationally more attractive. Its applicability, however, is very restricted due to its serious disadvantages: • In order to achieve robustness to faults, usually a very restricted subset of the possible faults can be considered; often only faults that have a “small effect” on the behaviour of the system can be treated in this way. • Achieving increased robustness to certain faults is only possible at the expense of decreased nominal performance. Since faults are effects that happen very rarely it is not reasonable to significantly degrade the fault-free performance of the system only to achieve some insensitivity to a restricted class of faults. However, using passive FTC systems can also have its advantages. One advantage is that a fixed controller has relatively modest hardware and software requirements. Another advantage is that passive FTC systems, due to their lower complexity compared to active FTC systems, can be made more reliable according to classical reliability theory [84]. Examples of passive FTC systems can be found in [61, 72, 97]. As opposed to passive methods, the active approach to the design of FTC systems is based on controller redesign, or selection/mixing of predesigned controllers. This technique usually requires a fault detection and diagnosis (FDD) scheme that has the task of detecting and localizing the faults if they occur in the system. The structure of an active FDD-based FTC system is presented in Figure 2.6. The FDD part uses input-output measurement from the system to detect and localize the faults. The estimated faults are subsequently passed to a reconfiguration mechanism (RM) that changes the parameters and/or the structure of the controller in order to achieve an acceptable post-fault system performance. Depending on the way the post-fault controller is formed, active FTC methods are further subdivided into projection-based methods and on-line redesign methods.

M. Verhaegen et al.

Reconfiguration mechanism

estimated

fault

Fault Detection & Diagnosis

FDD

56

FTC reference

Controller

input

System

output

faults

Fig. 2.6 Main components of an active FTC system.

The projection based methods rely on the controller selection from a set of off-line predesigned controllers. Usually each controller from the set is designed for a particular fault situation and is switched on by the RM whenever the corresponding fault pattern has been diagnosed by the FDD scheme. In this way only a restricted, finite class of faults can be treated. The on-line redesign methods involve on-line computation of the controller parameters, referred to as reconfigurable control, or recalculation of both the structure and the parameters of the controller, called restructurable control. Comparing the achievable post-fault system performances, the on-line redesign method is superior to the passive method and the off-line projection-based method. However, it is computationally the most expensive method as it often boils down to on-line optimization. There are a number of important issues when designing active FTC systems. Probably the most significant one is the integration between the FDD part and the FTC part. The majority of approaches in the literature are focused on one of these two parts by either considering the absence of the other or assuming that it is perfect. To be more specific, many FDD algorithms do not consider the closed-loop operation of the system and, conversely, many FTC methods assume the availability of perfect fault estimates from the FDD scheme. The interconnection of such methods is potentially infeasible and there can be no guarantees that a satisfactory post-fault performance, or even stability, can be maintained by such a scheme. It is therefore very important that the designs of the FDD and FTC, when carried out separately, are each performed bearing in mind the presence and imperfections of the other. For making the interconnection possible, one should first investigate what information from the FDD is needed by the FTC, as well as what information can actually be provided by the FDD scheme. Imprecise information from the FDD that is incorrectly interpreted by the FTC scheme might lead to a complete loss of stability of the system. The usual situation in practice is that after the occurrence of a fault in the system there is initially not enough information in terms of input/output measurements from the system to make it possible for the FDD scheme to diagnose the fault. For this reason, only after some time elapses and more information becomes available can the FDD scheme detect that a fault has occurred. Even more time is required to

2

Fault Tolerant Flight Control - A Survey

57

localize the fault and its magnitude. As a result, the information that is provided to the FTC part is initially more imprecise (i.e. with larger uncertainty), and it gets more and more accurate (with less uncertainty) as more data becomes available from the system. The FTC scheme should be able to deal with such situations. Therefore, the FTC should necessarily be capable of dealing with uncertainty in the FDD information/estimates, and should perform satisfactorily (guaranteeing at least the stability) during the transition period that the FDD scheme needs to diagnose the fault(s). Very often the dynamics of real physical systems cannot be represented accurately enough by linear dynamical models so that nonlinear models have to be used. This necessitates the development of techniques for FTC system design that can explicitly deal with nonlinearities in the mathematical representation of the system. Nonlinearities are, in fact, very often encountered in the representations of complex safety-critical controlled systems like aircraft and spacecraft. To reduce the inherent complexity of the control design, it is usual that the lateral and longitudinal dynamics of an aircraft are decoupled so that they have no effect on each other. This significantly simplifies the model of the aircraft and makes it possible to design the corresponding controllers independently. This decoupling condition can approximately be achieved for a healthy aircraft, but certain faults can easily destroy it, so that the two controllers could not be considered separately. An important issue in FTC system design is that even for a fixed operating region, where a nonlinear system allows approximation by a linear model, it is very difficult to obtain an accurate linear representation, either due to the fact that the physical parameters in the nonlinear model are not exactly known or because they vary with time. Even the nonlinear model is often derived after some simplifying assumptions, so that it only approximates the behaviour of the system. Even more, this uncertainty is further increased due to the linearization that basically consists in truncating second and higher order terms in the Taylor series expansion of the nonlinear function. As a result only a representation with uncertainty is available. It is important that the FTC system is designed to be robust to such uncertainties within the model. Another very important issue is that every real-life controlled system has control action saturation, i.e. the input and/or output signals cannot exceed certain values. In the design phase of a control system usually the effect of the saturation is accommodated by making sure that the control action will not get overly active and will remain inside the saturation limits under normal operating conditions. Faults, however, can have the effect that the control action stays at the saturation limit. For instance, when a partial 50% loss of effectiveness in an actuator has been diagnosed, a standard and easy way to accommodate the fault is to re-scale the control action by two so that the resulting actuation approximates the fault-free actuation. As a result the control action becomes twice as big and may go to the saturation limits. Clearly, in such situations one should not try to completely accommodate the fault but one should be willing to accept certain performance degradation imposed by the saturation. In other words, a trade-off between achievable performance and

58

M. Verhaegen et al.

available actuator capability might need to be made after the occurrence of a fault. This situation is often referred to as graceful performance degradation [95].

2.5 FTC Problem Formulation The dynamics of a real-life physical system can be represented in state-space in the following general form ⎧ ⎨ xk+1 = f (xk , uk , pk ), yk = h(xk , uk , pk ), S(pk ) : (2.9) ⎩ x0 = xˆ0 , where the vector xk ∈ X ⊆ Rn represents the state of the system S(pk ), uk ∈ U ⊆ Rm+nξ represents the inputs to the system, yk ∈ R p+nz denotes the outputs of the system. At each time instance t the system S(pk ) is parameterized by a (possibly unknown) parameter vector pk ∈ P ⊆ Rn p . The vector pk may represent uncertain physical parameters in the system or system faults. Nonlinear models of systems are in general inconvenient to work with due to their complexity and due to the lack of a well-developed theory for analysis and synthesis for general nonlinear models. The usual strategy to deal with them is either by approximating them with more convenient models (e.g. by means of blending of a set of local linear models as in the multi-model and in the Fuzzy control theories) or by assuming certain structure (e.g. bilinear systems, Hammerstein-Wiener systems, linearity in the input, etc.). In the multiple model approach the state space X is divided into N represen

tative and disjoint regions Xi , with Ni=1 Xi ≡ X , and in each region a point (x(i) , u(i) ) ∈ Xi × U is chosen around which the nonlinear system S(pk ) is approximated by a linear model. Under the assumption that f (·), g(·) ∈ C1 , the local linear approximation Mi (pk ) of the system S(pk ) within the open-ball neighbourhood

x − x(i) (i) (i) <ε , B(x , u ) = (x, u) ∈ X × U : u − u(i) 2 is called the pk -parameterized local linear model ⎧ (i) (i) ⎪ ⎨ xk+1 = Ai (pk )xk + Bi (pk )uk + bi(pk ), (i) (i) Mi (pk ) : yk = Ci (pk )xk + Di (pk )uk + ci (pk ), ⎪ ⎩ (i) x0 = x¯0 , with

Ai (pk ) = ∂x f (x(i) , u(i) , pk ), Bi (pk ) = ∂u f (x(i) , u(i) , pk ) Ci (pk ) = ∂x h(x(i) , u(i) , pk ), Di (pk ) = ∂u h(x(i) , u(i) , pk ) bi (pk ) = f (x(i) , u(i) , pk ) − A(pk )x(i) − B(pk )u(i) ci (pk ) = h(x(i) , u(i) , pk ) − C(pk )x(i) − D(pk )u(i) ,

2

Fault Tolerant Flight Control - A Survey

59

where ∂x f , ∂u f , ∂x h, and ∂u h represent the partial derivatives of the functions f (·) and h(·) with respect to the vectors x and u. Each local linear model Mi (pk ) describes the behaviour of the nonlinear system within one regime Xi . A global approximation can then be formed by interpolating the local models using smooth interpolation functions φi (xk , uk , pk ) > 0 that depend on the operating point (xk , uk ) as well as on the parameter vector pk , i.e. N

yˆk = ∑ μk yk , with μk = i=1

(i) (i)

(i)

φi (xk , uk , pk ) ∑Ni=1 φi (xk , uk , pk )

.

(2.10)

Such approximations are widely used in the literature (see, for instance, [47]). In fact it is shown in [46] that, under certain smoothness properties, the nonlinear system S(pk ) can be approximated to any desired accuracy on a compact subset of the state and input spaces by means of the representation (2.10) for a sufficiently large number of local models. The multiple model representation (2.10) is both intuitive and attractive, and is (i) related to the Takagi-Sugeno fuzzy model, where the weights μk in the linear combination of the local outputs are called degrees of membership. Suppose that the parameter vector pk is formed by two vectors, δk ∈ Δ ⊆ Rnδ and fk ∈ F ⊆ Rn f , so that δ (2.11) pk = k , fk where the vector δk is used to represent unknown, time-varying physical parameters of the system, and where the vector fk represents faults in the system. For consistency in terms of dimensions nδ + n f = n p . While both vectors are unknown, the fault vector fk is assumed to be estimated by an FDD scheme, and its estimate is denoted here as fˆk . Let δ0 ∈ Δ represent the nominal values of the uncertain parameters, and f0 ∈ F represent the fault-free mode of operation. Collect all local models Mi (pk ) into a model set M (pk ) = {M1 (pk ), M2 (pk ), . . . , MN (pk )} ,

(2.12)

and consider only one element of the set M (pk ) which, due to (2.11), is denoted as M(δ , f ). For simplicity of notation, the time symbol is omitted in M(δ , f ). The following objectives are considered: • passive robust FTC: design one controller K that achieves some desired performance for the model M(δ , f ) for all possible uncertainties δk ∈ Δ and faults fk ∈ F , • active robust FTC: given an estimate fˆ of the fault vector f by some FDD scheme, design a controller K( fˆ) that achieves some desired performance for the model M(δ , f ) for all possible uncertainties δk ∈ Δ and faults fk ∈ F , • active MM-based FTC: design a controller that achieves some desired performance for the nonlinear system S(pk ) for some fixed δk = δ0 ∈ Δ (i.e. in the case of no uncertainty) and for all possible faults fk ∈ F .

60

M. Verhaegen et al.

tracking error regulated outputs

u1

M11 M12

u2

M21 M22 y 2

K

y1

measured outputs

control actions

noises disturbances references

FL (M(δ , f ), K) Fig. 2.7 Partitioning of the model M(δ , f ) and forming the closed-loop with the controller K.

A natural continuation of this research activity is to combine the MM-based representation of the nonlinear system with the passive and active approaches to FTC in an attempt to deal with nonlinear systems with uncertainty as in (2.9). We will next provide some technical insight into the above objectives. Suppose that a continuous map, the performance index, is given by J : R nz ×nξ → R+ , such that J(M) = ∞ for any M ∈ RH ∞ , where R nz ×nξ denotes the set of rational transfer nz × nξ matrices, and RH ∞ denotes the set of stable real rational transfer matrices. Let M(δ , f ) ∈ R (p+nz )×(m+nξ ) be partitioned as follows

M11 (δ , f ) M12 (δ , f ) , M(δ , f ) = M21 (δ , f ) M22 (δ , f ) where, as depicted in Figure 2.7, the subsystem M22 (δ , f ) ∈ R p×m gives the relationships between the control actions and the measured output signals, and the subsystem M11 (δ , f ) ∈ R nz ×nξ describes the relationships between all exogenous inputs (such as noises, disturbances, reference signals) and the regulated (controlled) outputs that are related to the performance of the system (e.g. tracking errors). The feedback interconnection of the model M(δ , f ) with some controller K ∈ R m×p is represented by the lower linear fractional transformation FL (M(δ , f ), K) = M11 (δ , f ) + M12 (δ , f )K(I − M22 (δ , f )K)−1 M21 (δ , f ). For a fixed controller K, the performance of the resulting closed-loop is therefore represented by J(FL (M(δ , f ), K)).

2

Fault Tolerant Flight Control - A Survey

61

2.5.1 Passive Fault Tolerant Control The passive robust FTC problem is then defined as the following optimization problem Passive FTC: KP = arg min sup J(FL (M(δ , f ), K)). K

δ ∈Δ f ∈F

(2.13)

In this way a controller needs to be found that minimizes the worst-case performance over all possible values for the uncertainty vector δ and the fault vector f . This problem is considered in [51] where methods are developed for robust controller design in the presence of structured uncertainty. In practice, two main difficulties arise with the optimization problem (2.13), both being related to convexity. In the case when the state vector xk is directly measured (or, equivalently, when yk = xk ), the optimization problem (2.13) is convex in the controller parameters for many standard performance indices (e.g. J(·) = · 2 , J(·) = · ∞, etc.) provided that the set {M(δ , f ) : δ ∈ Δ , f ∈ F } is a convex polytope. In such cases (2.13) can be represented as a linear matrix inequality (LMI) optimization problem, for which there exist very efficient and computationally fast solvers. If M(δ , f ) is not a convex set, however, the original problem (2.13) is also nonconvex and the LMI solvers cannot be used. A “brute force” way to deal with this problem is to embed the set M(δ , f ) into a convex set. This, however, introduces unnecessary conservatism that for some problems might be unacceptable or undesirable. In order to deal with such problems a probabilistic design approach is proposed in [51] that is basically applicable for any bounded set M(δ , f ), as long as (2.13) can be rewritten as a robust LMI optimization problem (as for most state-feedback controller design problems). This method is basically an iterative algorithm that at each iteration generates a random uncertainty sample for which an ellipsoid is computed with the properties that (a) it contains the solution set (the set of all solutions to the robust LMI problem), (b) it has a smaller volume than the ellipsoid at the previous iteration. The approach is proved to converge to the solution set in a finite number of iterations with probability one. In the output-feedback case the probabilistic method described in [51] cannot be directly applied because the optimization problem (2.13) cannot be rewritten as a robust LMI optimization problem. The reason for that is that the output-feedback problem in the presence of uncertainty is a bilinear matrix inequality (BMI) problem, and BMI problems are not convex. Actually, such problems have been shown to be NP-hard meaning that they cannot be expected to have polynomial time complexity. A local BMI optimization approach is developed in [51] that is guaranteed to converge to a local optimum of the cost function J(FL (M(δ , f ), K)).

62

M. Verhaegen et al.

2.5.2 Active Fault Tolerant Control Whenever an estimate fˆ of the fault vector f is provided by some FDD scheme, and if the imprecision in this estimate is described by an additional uncertainty Δ f ∈ Δ f so that f = (I + Δ f ) fˆ, the active robust FTC can be defined as the problem: given f = (I + Δ f ) fˆ, evaluate K˜A ( fˆ) = arg min sup J(FL (M(δ , f ), K( fˆ))). K( fˆ)

δ ∈Δ Δf ∈ Δ f

(2.14)

The resulting controller would, in this way, be scheduled by the fault estimate fˆ and will be robust with respect to uncertainties both in the model M(δ , f ) and in the estimate of f . Clearly, the way in which the scheduling parameter fˆ enters the controller needs to be assumed before one could proceed with the optimization. In the above, Δ f represents the FDD uncertainty that, as already discussed, usually increases after the occurrence of a fault. This will then subsequently decrease as the FDD scheme refines the estimate based on the availability of more inputoutput data from the impaired system. As a result the “maximal uncertainty” is only active for some relatively short periods of time compared with the lifetime of the system. Therefore, assuming a maximal uncertainty size during the complete operation might be overly conservative since the robust controller effectively trades off performance for increased robustness to uncertainties. Hence, it is interesting to allow the controller to deal with an FDD uncertainty with time-varying size. To this end, however, the FDD scheme should be capable of providing not only an estimate of the fault but also an upper bound on the magnitude of the uncertainty on this estimate. The size of the FDD uncertainty might, for instance, be represented by a scalar γ f (k) such that fk = (I + γ f (k)Δ¯ f ) fˆk with Δ¯ f 2 ≤ 1. In this way the size of the uncertainty set is allowed to vary with time. In fact γ f (k) might be a vector to make it possible to assign different uncertainty sizes on the different entries of the fault vector fk . Therefore, provided that the FDD scheme produces ( fˆk , γ f (k)) at each time instance, the achievable performance in (2.14) may further be improved by computing the controller by solving the following optimization problem Active FTC: given f = (I + γ f Δ¯ f ) fˆ, evaluate sup KA ( fˆ, γ f ) = arg min K( fˆ,γ f )

δ ∈Δ Δ¯ f ∈ Δ¯ f γ f ≤ γ f ≤ γ¯ f

J(FL (M(δ , f ), K( fˆ, γ f ))),

(2.15)

where Δ¯ f = {Δ ∈ Δ f : Δ ≤ 1}, and where the vectors {γ f , γ¯f }, assumed known a-priori, define a lower and an upper bound on the possible uncertainty sizes. In this way methods can be developed for the design of robust active FTC for one uncertain local model M(δ , f ). The robust active FTC design problem is considered in [51].

2

Fault Tolerant Flight Control - A Survey

63

Fig. 2.8 Classification of approaches to reconfigurable flight control.

2.6 State-of-the-Art in Fault Tolerant Flight Control In this section an overview of the existing work in the area of fault tolerant control is given, an area that has been gaining increasing attention in the aerospace community in recent years. Some overview books and papers in the field of FTC are [36, 45, 5, 96]. Due to their improved performance and their ability to deal with a wider class of faults, active FTC methods have gained much more attention in the literature than the passive FTC methods. In the following, a survey is given focussed on current active FTC methods of which several have been evaluated within this GARTEUR action group. The survey starts with a classification of the described and evaluated FTC methodologies to approach the problem of reconfigurable flight control.

2.6.1 Classification of Reconfigurable Control Many methods have been proposed to solve the problem of fault tolerant control. As shown in Figure 2.8 they fall into two main categories: active and passive. Passive methods are essentially robust control techniques which are suitable for certain types of structural failures that can be modelled as uncertainty regions around a nominal model. Any failure which doesn’t push the system outside of the stability radius given by the robust controller will still have satisfactory stability and

64

M. Verhaegen et al.

performance guarantees. However, any controller with a large enough stability radius to encompass most failure situations will likely be unnecessarily conservative and there is no guarantee that unanticipated or multiple failures could be handled or even that such a controller exists. There are also many types of common failures, such as actuator or sensor faults, which cannot be adequately modelled as uncertainty. These problems motivate the need for a controller which more directly addresses the situation. The active methods differentiate themselves from passive approaches in that they take fault information explicitly into account and do not assume a static nominal model. Reconfigurable flight control is for the most part still an academic notion. Although there have been very few controllers implemented on physical systems and none on commercial aircraft, over the last 20 years several research programs have been formed to investigate their potential and as a result there are a variety of active methods. The following sections give an overview of each approach.

2.6.2 Multiple Model Control The multiple model (MM) method is an active approach to FTC that belongs to the class of projection based methods rather than to the on-line re-design methods. The MM method is frequently used for FDD/FTC purposes [92, 78, 27, 37]. The MM method is based on a finite set of linear models Mi , i = 1, 2, . . . , N that describe the system in different operating conditions, i.e. in the presence of different faults in the system. For each such local model Mi a controller Ci is designed (off-line). The key in the design is to develop an on-line procedure that determines the global control action through a (probabilistically) weighted combination of the different control actions that can be taken. The control action weighting is usually based on a bank of Kalman filters, where each Kalman filter is designed for one of the local models Mi . On the basis of the residuals of the Kalman filters, the probability 1 ≥ μi ≥ 0 of each model to be in effect, is computed. The control action is then computed as the weighted combination N

u(k) = ∑ μi (k)ui (k), i=1

N

∑ μi = 1,

(2.16)

i=1

where ui (k) is the control action produced by a controller designed for the i-th local model. The multiple model method is a very attractive tool for modelling and control of nonlinear systems. However, these approaches usually only consider a finite number of anticipated faults and proceed by building one local model for each anticipated fault. In this way, at each time instance only one model, say model Mi , is assumed to be in effect, so that its corresponding weight μi is approximately equal to unity and all the other weights μ j , j = i are close to zero. In such cases at each time instance one local controller is “active”, namely the one corresponding to the model Mi that is in effect. The disadvantage here is that if the current model is not in the predesigned

2

Fault Tolerant Flight Control - A Survey

65

Fig. 2.9 Multiple Model Switching and Tuning

model set and is instead formed by some convex combination of the local models in the model set (representing, for instance, unanticipated faults) then, in general, the control action (2.16) is not the optimal one for this model. It can easily be shown that forming the global control action as in (2.16) can even lead to instability of the closed-loop system. In order to avoid that when dealing with unanticipated faults, an approach is proposed in [51] that uses a bank of predictive controllers and forms the global control action in an optimal way, so that the optimal control action for the current model is used at each time instance instead of (2.16). Another disadvantage of the MM approaches is that model uncertainties, as well as uncertainties in the weights μi (k), cannot be considered. There are three types of reconfigurable control that fall under the heading of multiple model control: Multiple Model Switching and Tuning (MMST), Interacting Multiple Model (IMM) and Propulsion Controlled Aircraft (PCA). In the first two cases all expected failure scenarios are enumerated during a Failure Modes and Effects Analysis (FMEA) and fault models constructed which cover each situation. When a failure occurs, MMST switches to a pre-computed control law corresponding to the current failure situation. Rather than using the model which is closest to the current failure scenario, IMM computes a fault model as a convex combination of all pre-computed fault models and then uses this new model to make control decisions. PCA is a special case of MMST, where the only anticipated fault is a total hydraulics failure, and in this case only the engines are used for control. The following sections discuss these three approaches.

66

M. Verhaegen et al.

Fig. 2.10 Single Model vs. Multiple Model Adaptation

2.6.2.1

Multiple Model Switching and Tuning (MMST)

Although the idea of multiple model control has been around for many years, it has seen some interest in the reconfigurable control literature in the last few years [13, 34, 14, 10, 11, 12, 53, 25]. In MMST, the dynamics of each fault scenario is described by a different model. These models are referred to as the identification models [13] and are setup in parallel, with each one having a corresponding controller as shown in Figure 2.9. The problem then becomes one of choosing which model/controller pair to switch to at each time instant. Figure 2.10 helps to motivate the use of MMST in reconfigurable control systems. During a failure the plant is assumed to move from some nominal model P0 to a failure model Pf some distance away in parameter space. The top half of the figure shows an adaptive control scheme which is using only a single model, and the lower a MMST method. For certain plants, the MMST converges to the correct fault model faster than a single model approach. Consider a system of the form x˙ = A0 (p(t))x + B0 (p(t))u P= (2.17) y = C0 (p(t))x

2

Fault Tolerant Flight Control - A Survey

67

where x ∈ Rn , u ∈ Rm , y ∈ Rk , A0 ∈ Rn×n , B0 ∈ Rn×m , C0 ∈ Rk×n and p(t) ∈ S ⊆ Rl are the plant parameters. The quantity p(t) varies in time in an abrupt fashion and represents the various failure scenarios. Definition 6.1 (Model Set). The model set M is a set of N linear models M : {M1 , . . . , MN }

such that Mi :

x˙i = Ai xi + Bi u yi = Ci xi

where model Mi corresponds to a particular set of parameters pi ∈ S . A stabilizing controller Ki is designed for each model Mi ∈ M . The control law proceeds as follows. At each time step, the model which is closest to the current system is determined by computing a performance index Ji (t), which is a function of the errors ei (t) between the estimated outputs of model Mi and the measurements at time t. A commonly used index is [71]

Ji (t) = α e2i (t) + β 0t e−λ (t−τ ) e2i (τ )d τ α ≥ 0, β > 0, λ > 0 where α and β are chosen to give a desired combination of instantaneous and longterm accuracy measures. The forgetting factor λ ensures the boundedness of Ji (t) for bounded ei . The model/controller, Mi /Ki with the smallest index is switched to and a waiting period of Tmin > 0 is allowed to pass in order to prevent arbitrarily fast switching. Most MMST algorithms include a ‘tuning’ part which occurs during the period while a controller Ki is active, during which time the parameters of the corresponding model, and only the corresponding model Mi , are being updated using an appropriate identification technique (e.g. [2]). Recent interest in this approach arises from the following stability result: Theorem 6.2 [71]. Consider the switching and tuning system described above, where the N models are all fixed and the proposed switching scheme is used with β , λ , Tmin > 0, and α ≥ 0. Then, for each plant with parameter vector p ∈ S , there is a positive number TS and a function μS (p, Tmin ) > 0, such that if: • the waiting time Tmin ∈ (0, TS ) • there is at least one model Mi with parameter error || pˆi − p|| < μS (p, Tmin ) then all the signals in the overall system, as well as the performance indices {Ji (t)}, are uniformly bounded. Here TS depends only upon S , and μS also depends upon α , β , λ and S . In essence, Theorem 6.2 states that the MMST system is stable if the set of models Mi is dense enough in the parameter space S and the sampling rate Tmin is fast

68

M. Verhaegen et al.

enough. How dense and how fast depend on the particular system and Theorem 6.2 gives no insight into the selection of M or Tmin . Despite the limitations of Theorem 6.2, there are several papers which have applied these methods. In [13, 10, 11, 12] a MMST controller is developed for the highly over-actuated tailless advanced fighter aircraft (TAFA). Eleven fault models are required to cover the scenario of right wing damage ranging from 0% to 100% and a switching interval of 25ms is needed for stability. Clearly, this approach will not scale well to the situation where more than one failure, or multiple failures are considered. Ref. [14] describes a MMST scheme which can handle locked, floating, hard-over or loss of effectiveness actuator failures for an F-18 aircraft carrier landing manoeuvre. Only five models are needed for satisfactory performance, but again, multiple failures cannot be accommodated. Ref. [13] introduced a new method of failure parameterizations for jammed actuators, enabling multiple complete failures of control surfaces for an F-18 to be handled using a large number of simple models. For systems with relatively few and well understood failure modes, multiple model switching and tuning has advantages in being fast and provably stable. However, the main limitation is that there may be failure scenarios that were not modelled, which would likely be the case for multiple or structural failures. A severe limitation for larger systems is that the number of models required increases exponentially with the number of simultaneous failures considered. 2.6.2.2

Interacting Multiple Models (IMM)

The method of interacting multiple models (IMM) attempts to deal with the key limitation of MMST, namely that every fault scenario must be modelled, by considering fault models which are convex combinations of models in a model set. The primary assumption of IMM is that every possible failure can be modelled as a convex combination of models in a pre-determined model set M as defined above in Definition 6.1 ⎡ ⎤ M1 N N ⎢ ⎥ M f = ∑ μi Mi = μ T ⎣ ... ⎦ , Mi ∈ M , μi > 0 ∈ R, ∑ μi = 1, (2.18) i=1

MN

i=1

Then M f is the system: ⎧ ⎡ ⎡ ⎤ ⎤ A1 0 . . . 0 B1 ⎪ ⎪ ⎪ ⎢ 0 A2 . . . 0 ⎥ ⎢ B2 ⎥ ⎪ ⎪ ⎢ ⎢ ⎪ ⎥ ⎥ ⎪ ⎨ x˙ = ⎢ .. .. . . .. ⎥ x + ⎢ .. ⎥ u ⎣. . . . ⎦ ⎣ . ⎦ Mf : ⎪ BN 0 0 . . . A ⎪ n ⎪ ⎪ ⎪ ⎪ ⎪ ⎩ y = μ1C1 μ2C2 . . . μN CN x

(2.19)

2

Fault Tolerant Flight Control - A Survey

69

It is still an open question how to choose this model set or when the assumption that the failure model can be written as a convex combination of the models in the set, is valid. Fault detection and modelling is then done online by identifying the variables μi in Equation (2.18). Two proposed methods exist for computing the coefficients μ . In the first, a Kalman filter is designed for each Mi ∈ M and all filters are run in parallel. The probability that each of these models represents the true state of the system can be computed and the coefficients μ are set to these probabilities. This method is named Multiple Model Adaptive Estimation (MMAE) and is used in [68, 93]. In the second approach, the previous k f time instants are considered and the estimated output at each point is computed as a function of μ , which is then selected to minimize this difference. This approach is advocated in [52, 54]. Once a fault model has been identified, there are a variety of methods for control law calculation. Refs. [52] and [54] suggest a Model Predictive Control (MPC) scheme where the minimization of the past tracking error, and therefore of μ , is included in the cost function. Ref. [93] proposes an Eigenstructure Assignment (EA) (see Section 2.6.6) method and [68] uses a fixed controller, using the fault model M f only for state estimation. IMM is attractive in its ability to handle multiple failure scenarios by combining single failure models. However, the requirement of finding the coefficients μ after a failure makes this an adaptive algorithm and not a model-switching one. As a result it loses some of the speed of the MMST approach. The formulation of IMM as an MPC problem given in [54] also offers the potential of handling actuator constraints naturally. 2.6.2.3

Propulsion Controlled Aircraft (PCA)

After the possibility of control using only the engine throttles was demonstrated by the Sioux City accident (see Chapter 1), and following a recommendation from the National Transportation Safety Board of America, the PCA problem was taken up by the NASA Dryden Flight Research Center [16, 17] in order to provide a backup in case of total hydraulic failure. PCA is a specific instance of a multi-model approach where the fault model is identical to the nominal one, but in which all control surfaces are free floating. In 1995, a demonstration was made during which a MD-11 (Figure 2.11) and a F-15 recovered from a complete hydraulic failure and landed successfully under propulsion-only control [18]. PCA is a useful and important idea and solves a very practical problem. However, it clearly is not sufficient to solve the general reconfigurable control problem.

2.6.3 Control Allocation (CA) Control allocation is the problem of producing a desired set of forces and moments from a (usually large) set of actuators. For example, as shown in Figure 2.12, the output of the control law can be a set of desired moments and the job of the control

70

M. Verhaegen et al.

Fig. 2.11 Landing demonstration of MD-11 Propulsion Controlled Aircraft (PCA), NASA Dryden, 2001 (copyright NASA)

Fig. 2.12 Control Allocation scheme

allocation block is then to select appropriate setpoints for the actuators which will produce those moments. The control allocation algorithm takes as inputs the desired moments and an estimation of the input derivatives (adaptive B f matrix) from either a FDI or a system identification algorithm. The algorithm therefore has the ability to adapt the way actuation forces are generated from the available actuators, to the faults that have occurred. For example, if the effectiveness of a certain actuator becomes 0% due to a fault, the corresponding column in B f will also become 0. This actuator is then not considered anymore by the control allocation method. Instead, the remaining actuators can be used to generate the desired actuation forces. The goal is then to produce the desired moments ud by selecting the appropriate inputs to the system u. Whether this can be done depends on the difference between the size of ud ∈ Rm and the column rank of B f ∈ Rn×k . There are three cases to consider: • If m < k the moments can be selected exactly and the remaining degrees of freedom can be used (for example) to drive the actuators towards a desired position u p by minimizing [90, 15, 20]:

2

Fault Tolerant Flight Control - A Survey

71

1 2 ||u − u p||Wp

= 12 (u − u p)T Wp (u − u p) where Wp = WpT > 0 subject to Bu = ud where Wp is a weighting matrix prioritizing critical actuators. • If m = k then there is only one solution which places the moments exactly u = B−1 ud

• In the case when m > k there are not enough degrees of freedom to achieve ud and so a compromise must be made by (for example) minimizing the weighted norm 1 ||Bu − ud ||Wd 2 Control allocation has been heavily studied in relation to over-actuated systems (see [29] for a survey) and has received a great deal of attention in the literature for reconfigurable systems as it allows actuator failures to be handled without the need to modify the control law. However, there are two major limitations to this approach to reconfiguration. Firstly, the system will not necessarily be stable, even with a stabilizing control law, when m > k, as the input seen by the system may not be equal to that intended by the controller. Secondly, the dynamics and limitations of the actuators after a failure are not taken into account in the control law. This means that the controller will still be attempting to achieve the original system performance even though the actuators are not capable of achieving it. Control allocation has received considerable attention from the field of aerospace engineering. Extensions to the simple control allocation problem presented here have been considered in the literature. In [9] and [28] the problem of control allocation with magnitude and rate limits on the actuators is considered, [24] develops a control allocation controller for the extremely over-actuated Innovative Control Effector (ICE) aircraft and [98] looks at restoring as much of the performance of the original B matrix as possible after an actuator failure. Other examples of work in the area of control allocation for aerospace applications can be found in [7] and [38].

2.6.4 Adaptive Feedback Linearization via Artificial Neural Network This section examines a method primarily developed by Calise et al [42, 48, 41, 19, 21, 90, 20] involving a Model Reference Adaptive Control (MRAC) scheme through adaptive feedback linearization augmented by an Artificial Neural Network (ANN). This approach has been successfully demonstrated via simulation on the Tailless Advanced Fighter Aircraft (TAFA) [90, 20] and the X-36 [21]. The approach presented here splits the dynamics of the plane into three SISO subsystems, each of which has a model reference adaptive controller: roll, pitch and yaw. The output of each controller is a command specifying a desired roll, pitch or yaw moment and

72

M. Verhaegen et al.

it is then the job of the Integrated Control Effector Management (ICEM) [15, 90], a form of control allocation, to generate these moments using the available control surfaces. In the next three sections, a brief overview of the principles of feedback linearization on SISO systems will be given, review the particulars and benefits of its use in reconfiguration and finally discuss the ICEM and its role in the proposed method. 2.6.4.1

Single-Input Single-Output (SISO) Feedback Linearization

Consider the SISO nonlinear system x˙ = f (x, u) x ∈ Rn , u, y ∈ R y = h(x)

(2.20)

In feedback linearization the goal is to design a control law for the SISO nonlinear system given in Equation 2.20 such that the closed loop system is linear and controllable. Assuming the relative degree of h is r = n, the rth derivative of the output is the first derivative that is directly affected by the control. As a result, we can write the system dynamics in the normal form ([44], Section 4.2):

Φ1 (x) = h(x) = z1 Φ2 (x) = dh(x) = z˙1 dt

=y = z2

Φ3 (x) = d dth(x) = z˙2 2 .. .. . . r Φr (x) = d dth(x) = z˙r−1 r z˙r = hr (z, u)

= z3 .. . = zr

2

(2.21)

where Φ (x) = z = [z1 , . . . , zr ] . We now define the ‘pseudo control signal’ ν

ν = hˆ r (Φ (x), u) where hˆ r (Φ (x), u) is an invertible estimate of hr (z, u). Then the system dynamics can be expressed as z˙i = zi+1 , 1 ≤ i ≤ r − 1 z˙r = ν + Δ (2.22) y = z1 where

Δ = Δ (z, u) = hr (z, u) − hˆ r (y, u)

In effect, the transformation places r integrators between the pseudo control ν and the system output y, with the error Δ acting as a disturbance signal. This is now a linear and controllable system.

2

Fault Tolerant Flight Control - A Survey

73

Fig. 2.13 Nonlinear Adaptive Output Feedback Controller

2.6.4.2

Feedback Linearization for Reconfigurable Control

Feedback linearization can be used in a model-following configuration by choosing the pseudo control to have the form [19]

ν = yrc + νdc − νad , where νdc is the output of a stabilizing linear compensator for the linearized system given by Equation (2.22) with Δ = 0. The quantity νad is an adaptive signal designed to cancel Δ and yrc is the rth derivative of the signal to be tracked. The signal yrc can be obtained from an (at least) rth order reference model which defines the desired dynamics. If the model of the system is perfect, Δ = 0 and we could simply apply the input −1 r u = hˆ −1 r (x, ν ) = hr (x, yc + νdc ) and the system would track the reference trajectory. However, as there will always be modelling errors, the error Δ needs to be compensated online and for this an ANN can be used. Neural networks can be trained to approximate any function with an arbitrary precision. As a result, the ANN can estimate the modelling error and hence cancel it. The benefit of this approach is that no model structure needs to be assumed in order to estimate the error. Figure 2.13 shows the structure of the full controller, and Figure 2.14 that of the linear compensator. This control technique was proposed as a method of reconfigurable control in combination with Wise’s ICEM [15]. This scheme is suited to reconfigurable control, as the adaptation makes no assumptions about the structure of the system after

74

M. Verhaegen et al.

Fig. 2.14 Block Diagram of the Error Dynamics

the failure. Since the ANN can approximate any nonlinear function, it can track and cancel any structural failures which may occur under the assumption of sufficient control authority and excitation for adaptation. The techniques presented in this section have been developed and expanded upon in several publications: Single Input Single Output (SISO) stability proofs [19], input saturation [48], combined aero/engine control [42] and highly over-actuated systems [21].

2.6.5 Sliding Mode Control (SMC) This section reviews the work in [82]. The proposed controller is setup in a two-loop cascade configuration, with the ultimate goal of tracking a trajectory given by roll, pitch and yaw angle setpoints. The outer-loop takes roll, pitch and yaw setpoints and provides angular rate commands to the inner-loop, which is assumed to track the commands using the inputs to the actuators. The outer-loop is designed using standard robust SMC techniques. The innerloop is also a robust sliding mode controller but has an adaptive feature to handle actuator magnitude and rate limitations. In [82] it is shown that modifying the size of the boundary layer online can ensure that integrators do not wind up, as well as ensuring that actuator magnitude and rate limits are satisfied. There is a direct tradeoff between the size of the boundary layer and tracking performance. Therefore, this procedure provides an intuitive method of maximizing tracking while ensuring actuator limits. The benefits of this controller to reconfigurable control are two-fold. Firstly, being a robust control technique, it can handle all structural failures which modify the dynamics of the plant less than the assumed uncertainty. Secondly, the online adaptation of the boundary layer can handle partial loss of actuator surfaces, while avoiding limits and integrator windup by reducing the tracking performance. Although this technique provides benefits to aircraft control, there are limitations due to the use of SMC when it is presented with the full reconfigurable problem. 1. There must be one and only one control surface for every controlled variable and second, none of the control surfaces can ever be lost. This is handled in [82] by only considering failures which cause a partial loss of effectiveness of

2

Fault Tolerant Flight Control - A Survey

75

the control surfaces, which is not realistic as floating or jammed actuators are certainly possible failure scenarios. This problem could be addressed by placing a control allocation algorithm (see Section 2.6.3) between the requested outputs and the physical actuators. 2. The method proposes to use robust control to handle all structural failures. This requires a de-tuning of the controller to the point that it can handle uncertainties including all possible structural failures, which may well result in an excessively conservative controller in the non-failure situation.

2.6.6 Eigenstructure Assignment (EA) Eigenstructure Assignment (EA) was made popular in the 1980s primarily by Andry, Shapiro and Chung in their paper [1] where the method of Direct Eigenstructure Assignment (DEA) was introduced. The idea behind the method is to place the eigenvalues of a linear system using state feedback and then use any remaining degrees of freedom to align the eigenvectors as accurately as is possible. The eigenvalues determine the natural frequency and damping of each mode while the eigenvectors control how much each mode contributes to a given output. The following sections first give a brief overview of the theory behind EA and then a review of its use in reconfigurable control. 2.6.6.1

Introduction to Eigenstructure Assignment

The eigenstructure assignment (EA) method [63] to controller reconfiguration is a more intuitive approach than the Pseudo Inverse method (Section 6.6.3). It aims at matching the eigenstructures (i.e. the eigenvalues and the eigenvectors) of the Amatrices of the nominal and the faulty closed-loop systems. The main idea is to exactly assign some of the most dominant eigenvalues while at the same time minimizing the 2-norm of the difference between the corresponding eigenvectors. The procedure has been developed both under constant state-feedback [89] and outputfeedback [26]. More specifically, in the state-feedback case, if λi , i = 1, 2, . . . , n are the eigenvalues of the A-matrix of the nominal closed-loop system formed as the interconnection of (2.25) with the constant state-feedback control action uk = Fxk , and if vi are their corresponding eigenvectors, the EA method computes the statefeedback gain FR for the faulty model (2.26) as the solution to the following problem ⎧ Find FR ⎪ ⎪ ⎨ f f EA : such that (Af f + B f FR )vi = λi vf i 2, i = 1, . . . , n, (2.23) ⎪ and vi = arg min vi − vi Wi , ⎪ ⎩ f vi

f

f

f

2 = (vi − vi )T Wi (vi − vi ). In other words, the new gain FR needs to where vi − vi W i be such that the poles of the resulting closed-loop system coincide with the poles of the nominal closed-loop system and, in addition, the eigenvectors of the closed-loop A-matrices are as close as possible. As both the eigenvectors and the eigenvalues

76

M. Verhaegen et al.

determine the shape of the time response of the closed-loop system, this method can be thought of as trying to preserve the nominal closed-loop system time-response after the occurrence of faults. Thus, the objective of the EA method seems more “natural” than that of the Pseudo Inverse Method (PIM) and, moreover, the stability is guaranteed. The computational burden of the approach is not high since an analytic expression for the solution to (2.23) is available, i.e. no on-line optimization is necessary. The disadvantage is that model and FDD uncertainties cannot be easily incorporated in the optimization problem, and that only static controllers are considered. The references [22, 58] further describe the use of Eigenstructure Assignment. 2.6.6.2

Reconfigurable Eigenstructure Assignment

Although a method for choosing appropriate eigenvectors and eigenvalues is not immediately obvious for aircraft, some studies have been made on the effects of the eigenstructure (eigenvalues and eigenvectors) on flying qualities [23]. Methods which propose EA for use in reconfigurable flight control systems [58, 4, 94] first assume a linear fault model which has been given to the controller by a FDI system. x˙ = A f x + B f u y = Cf x The goal is then to design a stabilizing output feedback law K f u = Kf Cf x

(2.24)

such that the new eigenstructure closed-loop system A f + B f K f C f is as close as possible to that of the original closed-loop system A + BKC. The choice of K f can be made in a variety of ways, but the placement of the eigenspace is limited by Theorem 2.1. Generally the eigenvalues of the failed system, λif are ordered from most important to least and then the top max(m, k) are made to exactly match those of the non-failed system λ , while the remainder are kept stable. Similarly, the most important max(m, k) eigenvectors of the failed system, vif , are made close to those of the original system vi in the least squares sense. Theorem 2.1. [23] Consider a controllable and observable system with the output feedback law of (2.24) and the assumption that the matrices B and C are full rank. Then, there exists a matrix K ∈ Rm×k such that 1. max(m, k) closed-loop eigenvalues can be assigned 2. max(m, k) eigenvectors can be partially assigned with min(m, k) entries in each vector arbitrarily chosen There are several limitations to this approach when applied to reconfiguration. Firstly, only linear systems have been considered and actuator limitations have not been taken into account. Secondly, a perfect fault model is assumed and the effects of uncertainty have not been extensively studied. Finally, the effect of the eigenvectors in the failed system not being exactly equal to those in the nominal system

2

Fault Tolerant Flight Control - A Survey

77

is not well understood. The result of these significant limitations is that only a few researchers have proposed this approach. 2.6.6.3

Pseudo Inverse Method (PIM)

The pseudo-inverse method (PIM) [31] is one of the most cited active methods to FTC due to its computational simplicity and its ability to handle a very large class of system faults. The basic version of the PIM considers a nominal linear system xk+1 = Axk + Bu (2.25) yk = Cxk , with a linear state-feedback control law uk = Fxk , under the assumption that the state vector is available for measurement. The method allows for a very general post-fault system representation f xk+1 = A f xkf + B f uRk (2.26) ykf = C f xkf , where the new, reconfigured control law is taken with the same structure, i.e. uRk = FR xkf . The goal is then to find the new state-feedback gain matrix FR in such a way that the “distance” (defined below) between the A-matrices of the nominal and the post-fault closed-loop systems is minimized, i.e. FR = arg min (A + BF) − (A f + B f FR ) F FR PIM : (2.27) = B†f (A + BF − A f ), where B†f is the pseudo-inverse of the matrix B f . The advantages of this approach are that it is very suitable for on-line implementation due to its simplicity, and moreover, that it allows for changes in all state-space matrices of the system as a consequence of the faults. A very strong disadvantage is, however, that the optimal control law computed by equation (2.27) does not always stabilize the closed-loop system. Simple examples that confirm this fact can easily be generated, see for example [31]. To circumvent this problem, the modified pseudo-inverse method was developed in [31] that basically solves the same problem under the additional constraint that the resulting closed-loop system remains stable. This, however, results in a constrained optimization problem that increases the computational burden. A similar approach is also discussed in [77, 62], where the reconfigured control action uRk is directly computed from the nominal control uk as uRk = B†f Buk . Other modifications of this approach that were proposed include the consideration of additive faults on the state equation and additive terms on the control action to compensate for them in [73] and static output-feedback in [59].

78

M. Verhaegen et al.

Fig. 2.15 Model Reference Adaptive Control

2.6.7 Model Reference Adaptive Control (MRAC) Astr¨om defines an adaptive controller as “a controller with adjustable parameters and a mechanism for adjusting those parameters” ([2], Page 1). Clearly, all methods presented in this survey are adaptive to some degree (save for robust control techniques) as they require the identification of a fault model in order to compute a control law. The approach we consider here is Model Reference Adaptive Control (MRAC) which can be effective for many types of structural failures and is often used as a final stage in other algorithms. The goal of adaptive model-following is to force the plant output to track a reference model. We consider linear plants of the form x˙ = Ax + Bu + d y = Cx

(2.28)

where x ∈ Rn , u ∈ Rm , y ∈ Rk and a reference model of the form y˙d = Ad yd + Bd r

(2.29)

where yd ∈ Rk and r ∈ Rk . Ad and Bd are arbitrary square matrices with Ad stable. State feedback of the form shown in Figure 2.15 is considered. u = C0 r + G0 x + v where C0 ∈ Rk×k , G0 ∈ Rk×n and v ∈ Rk are free controller parameters. The closed loop dynamics are then y˙ = (CA + CBG0)x + CBC0 r + CBv + Cd

(2.30)

The goal is now to make the closed loop dynamics given by Equation (2.30) match the desired dynamics of Equation (2.29). If the model shown in Equation (2.28) was known exactly, the controller parameters C0 , G0 and v could be computed to achieve this. However, since post-failure the model in (2.28) is not known exactly,

2

Fault Tolerant Flight Control - A Survey

79

the controller parameters need to be adapted. There are two methods to achieve this: direct and indirect adaptation. 2.6.7.1

Indirect Adaptation

There are two stages in indirect adaptive control. Firstly the matrices A, B and d are estimated and then under the assumption that these estimates are correct the control parameters G0 ,C0 and v are computed such that the closed-loop system matches the desired dynamics. ˆ Bˆ and dˆ ([2]), A least squares algorithm can be used to compute the estimates A, which can then be used to compute the controller parameters such that the closed loop dynamics (2.30) match the desired ones (2.29). ˆ −1 Bd C0 = (CB) ˆ ˆ −1 (Ad C − CA) G0 = (CB) ˆ −1 (Cd) v = (CB) ˆ = 0. where we must assume that det(CB) The idea of identifying the model online and then computing a control law under the assumption that the estimated model is perfect is common in the reconfigurable control literature. For example, the EA algorithms of Section 2.6.6 and the IMM algorithms of Section 2.6.2.2 assume this type of structure. 2.6.7.2

Direct Adaptation

Direct adaptive control attempts to estimate the controller parameters G0 ,C0 and v directly rather than first computing the model parameters. We define G0 ,C0 and v as the ‘correct’ values of the controller parameters which will force the plant to track the reference model. A problem can then be formulated such that a least squares routine can be used to estimate the correct controller parameters [8]. The idea of direct adaptation is seen in algorithms such as the adaptive feedback linearization approach presented in Section 2.6.4. The basic model-reference adaptive control techniques described here are not by themselves suitable for reconfigurable control for two main reasons. Firstly, in order for these approaches to work a model structure must be assumed. However, the types of failures addressed in reconfigurable control may well cause the plant structure to change drastically. Secondly, adaptive control requires the system parameters to change slowly enough for the estimation algorithm to track them. Faults may well cause abrupt and drastic changes in the parameters moving the system instantaneously to a new region of the parameter space. There is no guarantee that the system will be stable during the transient period in which the adaptive algorithm is identifying the faulty plant. Despite the limitations of adaptive control for reconfiguration, some researchers have attempted to apply it in slightly modified forms [6, 35, 8]. As a result adaptive control on its own is not enough to handle the general problem, but may well be an important part of a reconfigurable algorithm.

80

M. Verhaegen et al.

2.6.8 Model Predictive Control After its introduction in the 1970s, model predictive control (MPC) has become a popular strategy in the field of industrial process control. The main reasons for this popularity are the abilities of MPC to control multivariable systems and to handle constraints. Initially, MPC was primarily applied to relatively slow processes such as the plants encountered in the process industry. The reason for this is that MPC can require considerable computational effort to generate the control signals as a result of an optimization that has to be performed at each time instance. This optimization is based on matching a prediction of the system output to some desired reference trajectory. The latter is assumed to be known in advance. For the relatively slow plants in the process industry, the considerable computational effort of MPC was not an issue because of the low sampling frequency of the controllers. However, for faster systems, higher frequencies were required that prevented on-line implementation of MPC for such systems. More recently, MPC has become a viable alternative for faster systems as a result of the increase in computational power that is available in modern control systems. For example, in [79] MPC has been used for real-time control of a miniature hovercraft. Another example is [56], in which MPC has been used for real-time control of an unmanned aerial vehicle. As discussed in [65], the MPC architecture allows fault-tolerance to be embedded in a relatively easy way by: (a) redefining the constraints to represent certain faults (usually actuator faults), (b) changing the internal model, (c) changing the control objectives to reflect limitations due to the faulty mode of operation. In such a way there is practically no additional optimization that needs to be executed on-line as a consequence of a fault being diagnosed, so that this method can be viewed as having an inherent self-reconfiguration property. However, if state-feedback MPC is used in an interconnection with an observer one should also take care to also reconfigure the observer appropriately in order to achieve fault-tolerant state estimation. Examples of the application of MPC to FTC are numerous [66, 51, 76, 50, 56]. Model predictive control has been proposed as a method for reconfigurable flight control due to its ability to handle constraints and changing model dynamics systematically. MPC relies on an internal model of the system and so, like many of the approaches presented in this survey, a fault model is required. There are two general classifications of aircraft faults: actuator and structural. As noted in [69], these failures can be handled naturally in a MPC framework via changes in the input constraints and internal model. Actuator limit and rate constraints can be written as: uli ≤ ui (t) ≤ uui duli ≤ u˙i (t) ≤ duui for actuator inputs u1 through um . If actuator i becomes jammed at position ui the MPC controller can be made to compensate by simply changing the constraints on input i to ui ≤ ui (t) ≤ ui 0 ≤ u˙i (t) ≤ 0

2

Fault Tolerant Flight Control - A Survey

81

The result will be similar to the control allocation approach where other input channels are used to create the same effect. As noted in [64], an MPC controller can be designed so that it has an intrinsic ability to handle jammed actuators without the need to explicitly model the failure. Structural failures can also be handled in a natural fashion by changing the internal model used to make prediction in either an adaptive fashion [52], a multi-model switching scheme [13] or by assuming an FDI scheme which provides a fault model [40, 39, 55, 66]. An important issue when using MPC is the robustness with respect to model uncertainties. Since MPC heavily depends on how well the controlled system is represented by the model used, measures should be taken in case of model uncertainty. One method to do so is to define an uncertainty region around the nominal model and to ensure that the MPC algorithm achieves a certain minimum performance level for the whole uncertainty region. MPC methods that take model uncertainty explicitly into account are referred to as robust MPC methods. One of the first research efforts that addresses the issue of robust MPC was performed by [60]. This issue has been addressed in the context of FTC in [51]. Like most active FTC methods, MPC-based FTC requires availability of fault information to accommodate faults. This requirement limits the ability of MPC-based FTC to deal with unanticipated fault conditions for which fault information cannot be obtained most of the time. An FTC algorithm that has this ability is therefore very desirable. Such an algorithm is subspace predictive control (SPC). This algorithm consists of a predictor that is derived using subspace identification theory [87], making it a data-driven control method. This subspace predictor is subsequently integrated into a predictive control objective function. The basic SPC algorithm was introduced by [30] and has since been used by various researchers [91, 49, 88]. If the subspace predictor is updated on-line with new input-output data when it becomes available, then SPC has the ability to adapt to changing system conditions, which can also include unanticipated faults. Besides having this ability, another important advantage of the SPC algorithm is that the issue of robustness with respect to model uncertainty is implicitly addressed because of the adaptation of the predictor. In [37] the SPC algorithm is used for FTC of the GARTEUR benchmark model.

2.6.9 Model Following The model following method is another approach to active FTC. Basically, the method considers a reference model of the form M xM k+1 = AM xk + BM rk , M M yk = x k ,

where rk is a reference trajectory signal. The goal is to compute matrices Kr and Kx such that the feedback interconnection of the open-loop system (2.25) and the state-feedback control action uk = Kr rk + Kx xk

82

M. Verhaegen et al.

matches the reference model. To this end the reference model and closed-loop system are written in the form M yM k+1 = AM xk + BM rk , yk+1 = (CA + CBKx )xk + CBKr rk ,

so that perfect model following (PMF) can be achieved by selecting Kx = (CB)−1 (AM − CA), PMF: Kr = (CB)−1 BM ,

(2.31)

provided that the system is square (i.e. dim(y) = dim(u)), and that the inverse of the matrix CB exists. When the exact system matrices (A, B) in (2.31) are unknown, ˆ B), ˆ resulting in the indirect they can be substituted by some estimated values (A, (explicit) method [8]. The indirect method provides no guarantees for closed-loop ˆ may not be invertible. In order to avoid stability, and in addition, the matrix (CB) the need for estimating the plant parameters, the direct (implicit) method of model following can be used, which directly estimates the controller gain matrices Kr and Kx by means of an adaptive scheme. Two approaches to direct model following exist, the output error method and the input error method. Examples of the application of the model following approach can be found in [8, 70, 85]. We note here, that the direct model following method is based on adaptation rules and as such is also a candidate for the group of adaptive control methods. The model following methods have the advantage that they usually do not require an FDD scheme. A strong drawback is, however, that they are not applicable to sensor faults. In addition, these methods do not deal with model uncertainty.

2.6.10 Adaptive Control Adaptive control methods form a class of methods that is very suitable for active FTC. Due to their ability to automatically adapt to changes in the system parameters, these methods could be called “self-reconfiguable”, i.e. they often don’t require the “reconfiguration mechanism” and “FDD” components, as in Figure 2.6. This, however is mostly true for component faults and actuator faults, but not for some sensor faults. If one, for instance, makes use of an adaptive control scheme based on output-feedback design to compensate for sensor faults it will make the faulty measurement (rather than the true signal) track a desired reference signal, and this in turn may even lead to instability. Indeed, in a case of a total sensor failure an adaptive controller may try to increase the control action to make the faulty measured signal equal to the desired value which will not be possible due to the complete failure of the sensor. In such cases an FDD scheme is needed to detect the sensor failure, and a reconfiguration mechanism would have to appropriately reconfigure the adaptive controller. We note here that the direct model following and MM approaches, discussed above, also belong to the class of adaptive control algorithms. LPV control methods for FTC design are also members of this class. In [51] LPV FTC methods

2

Fault Tolerant Flight Control - A Survey

83

are developed that deal with structured parametric and FDD uncertainty. Furthermore, these methods are applicable to a wide class of faults as the fault signal is allowed to enter the state-space matrices of the system in any way as long as the matrices remain bounded. Other applications of LPV control for FTC can be found, for example in [80, 32].

2.7 Comparison of Fault Tolerant Flight Control Methods The table on the next page presents a comparison of the fault tolerant control methods, applicable for reconfigurable flight control, considered in this survey. Filled circles mean that the method has the indicated property while empty circles imply that an author has suggested that the approach could be modified to incorporate the property. The columns are explained as follows: • • • •

Failures: Types of failures that the method can handle Robust: The method uses robust control techniques Adaptive: The method uses adaptive control techniques Fault Model: – FDI: An FDI algorithm is incorporated into the method – Assumed: The method assumes an algorithm which provides a fault model

• Constraints: The method can handle actuator constraints • Model Type: The type of internal model used The table also shows the fault tolerant control methodologies that have been selected for further evaluation in this action group. Their application in the different control designs using the GARTEUR FTFC benchmark and achieved real-time performances are described in the subsequent chapters of this book.

Comparison of reconfigurable control methods * Evaluated in this Action Group 1: Can handle partial loss of effectiveness of actuators, but not complete loss 2: Assumes robust control can handle all forms of structural failures

Failures Robust Adaptive Fault Model Constraints Model Type Actuator Structural FDI Assumed Linear Nonlinear Multiple Model Switching and Tuning (MMST) • • • • Interacting Multiple Model (IMM) • • • ◦ • Propulsion Controlled Aircraft (PCA) • ◦ • • • Control Allocation (CA)* • • ◦ • Feedback Linearization • • • • • Sliding Mode Control (SMC)* ◦1 • •2 • • Eigenstructure Assignment (EA) • • • Pseudo Inverse Method (PIM) • • • Model Reference Adaptive Control (MRAC)* • • • • ◦ Model Predictive Control (MPC)* • • ◦ ◦ • • • • •

Method

84 M. Verhaegen et al.

2

Fault Tolerant Flight Control - A Survey

85

References 1. Andry, A.N., Shapiro, E.Y., Chung, J.C.: Eigenstructure assignment for linear systems. IEEE Transactions on Aerospace Electronic Systems 19(5) (September 1983) 2. Astr¨om, K.J., Wittenmark, B.: Adaptive control, 2nd edn. Addison-Wesley Publishing Company, Reading (1995) 3. Basseville, M.: On-board component fault detection and isolation using the statistical local approach. Automatica 34(11), 1391–1415 (1998) 4. Belkharraz, A.I., Sobel, K.: Fault tolerant flight control for a class of control surface failures. In: Proceedings of the American Control Conference, June 2000. IEEE, Los Alamitos (2000) 5. Blanke, M., Kinnaert, M., Lunze, J., Staroswiecki, M.: Diagnosis and fault-tolerant control, 2nd edn. Springer, Heidelberg (2006) 6. Bodson, M.: Multivariable adaptive algorithms for reconfigurable flight control. In: Proceedings of the 33rd Conference on Decision and Control, December 1994. IEEE, Los Alamitos (1994) 7. Bodson, M.: Evaluation of optimization methods for control allocation. Journal of Guidance, Control, and Dynamics 25(4), 703–711 (2002) 8. Bodson, M., Groszkiewicz, J.E.: Multivariable adaptive algorithms for reconfigurable flight control. IEEE Transactions on Control Systems Technology 5(2), 217–229 (1997) 9. Bordignon, K.A., Durham, W.C.: Closed-form solutions to constrained control allocation problem. Journal of Guidance, Control and Dynamics 18(5) (September 1995) 10. Boskovic, J.D., Li, S.M., Mehra, R.K.: Reconfigurable flight control design using multiple switching controllers and on-line estimation of damage-related parameters. In: Proceedings of the 2000 IEEE International Conference on Control Applications, September 2000. IEEE, Los Alamitos (2000) 11. Boskovic, J.D., Li, S.M., Mehra, R.K.: Study of an adaptive reconfigurable control scheme for tailless advanced fighter aircraft (TAFA) in the presence of wing damage. In: Position Location and Navigation Symposium, pp. 341–348. IEEE, Los Alamitos (2000) 12. Boskovic, J.D., Li, S.M., Mehra, R.K.: Robust supervisory fault-tolerant flight control system. In: Proceedings of the American Control Conference (June 2001) 13. Boskovic, J.D., Mehra, R.K.: A multiple model-based reconfigurable flight control system design. In: Proceedings on the 37th IEEE Conference on Decision & Control, December 1998. IEEE, Los Alamitos (1998) 14. Boskovic, J.D., Mehra, R.K.: Stable multiple model adaptive flight control for accommodation of a large class of control effector failures. In: Proceedings of the American Control Conference (June 1999) 15. Brinker, J.S., Wise, K.A.: Flight testing of reconfigurable control law on the X-36 tailless aircraft. Journal of Guidance, Control and Dynamics 24(5) (September 2001) 16. Burcham, F.W., Burken, J.J., Maine, T.A., Bull, J.: Emergency flight control using only engine thrust and lateral center-of-gravity offset: a first look. Technical report, NASA (1997) 17. Burcham, F.W., Burken, J.J., Maine, T.A., Fullerton, C.G.: Development and flight test of an emergency flight control system using only engine thrust on an MD-11 transport airplane. Technical report, NASA (October 1997) 18. Burken, J.J., Burcham, F.W.: Flight-test results of propulsion-only emergency control system on MD-11 airplane. Journal of Guidance, Control and Dynamics 20(5) (October 1997)

86

M. Verhaegen et al.

19. Calise, A.J., Hovakimyan, N., Idan, M.: Adaptive output feedback control of nonlinear systems using neural networks. Automatica 37(8) (March 2001) 20. Calise, A.J., Lee, S., Sharma, M.: Direct adaptive reconfigurable control of a tailless fighter aircraft. In: AIAA Guidance, Navigation and Control Conference, Boston, MA (August 1998) 21. Calise, A.J., Lee, S., Sharma, M.: Development of a reconfigurable flight control law for the X-36 tailless fighter aircraft. In: AIAA Guidance, Navigation, and Control Conference (August 2000) 22. Davidson, J.B., Andrisani, D.: Gain weighted eigenspace assignment. Technical report, NASA (May 1994) 23. Davidson, J.B., Andrisani, D.: Lateral-directional eigenvector flying qualities guidelines for high performance aircraft. Technical report, NASA (December 1996) 24. Davidson, J.B., Lallman, F.J., Bundick, W.T.: Real-time adaptive control allocation applied to a high performance aircraft. In: 5th SIAM Conference on Control & Its Applications (2001) 25. Demetriou, M.A.: Adaptive reorganization of switched systems with faulty actuators. In: Proceedings of the 40th IEEE Conference on Decision and Control (December 2001) 26. Duan, G.R.: Parametric eigenstructure assignment via output feedback based on singular value decompositions. IEE Proceedings - Control Theory and Applications 150(1), 93– 100 (2003) 27. Ducard, G., Geering, H.P.: Efficient nonlinear actuator fault detection and isolation system for unmanned aerial vehicles. Journal of Guidance, Control, and Dynamics 31(1), 225–237 (2008) 28. Durham, W.C., Bordignon, K.A.: Multiple control effector rate limiting. Journal of Guidance, Control and Dynamics 19(1) (February 1996) 29. Enns, D.F.: Control allocation approaches. In: Proceedings of AIAA GNC Conference (August 1998) 30. Favoreel, W.: Subspace methods for identification and control of linear and bilinear systems. PhD thesis, Faculty of Engineering, K.U. Leuven, Belgium (1999) 31. Gao, Z., Antsaklis, P.: Stability of the pseudo-inverse method for reconfigurable control systems. International Journal of Control 53(3), 717–729 (1991) 32. G´asp´ar, P., Bokor, J.: A fault-tolerant rollover prevention system based on an LPV method. International Journal of Vehicle Design 42(3-4), 392–412 (2006) 33. Gertler, J.: Designing dynamic consistancy relations for fault detection and isolation. International Journal of Control 73(8), 720–732 (2000) 34. Gopinathan, M., Boskovic, J.D., Mehra, R.K., Rago, C.: A multiple model predictive scheme for fault-tolerant flight control design. In: Proceedings of the 37th IEEE Conference on Decision & Control, December 1998. IEEE, Los Alamitos (1998) 35. Groszkiewicz, J.E., Bodson, M.: Flight control reconfiguration using adaptive methods. In: Proceedings of the 34th Conference on Decision & Control, December 1995. IEEE, Los Alamitos (1995) 36. Hajiyev, C., Caliskan, F.: Fault diagnosis and reconfiguration in flight control systems. Kluwer Academic Publishers, Dordrecht (2003) 37. Hallouzi, R.: Multiple-model based diagnosis for adaptive fault-tolerant control. PhD thesis, Delft University of Technology (2008) 38. H¨arkeg˚ard, O.: Dynamic control allocation using constrained quadratic programming. Journal of Guidance, Control, and Dynamics 27(6), 1028–1034 (2004) 39. Huzmezan, M., Maciejowski, J.M.: Reconfiguration and scheduling in flight using quasiLPV high-fidelity models and MBPC control. In: Proceedings of the American Control Conference (June 1998)

2

Fault Tolerant Flight Control - A Survey

87

40. Huzmezan, M., Maciejowski, J.M.: Reconfigurable flight control of a high incidence research model using predictive control. In: UKACC International Conference on CONTROL (September 1998) 41. Idan, M., Johnson, M., Calise, A.J.: A hierarchical approach to adaptive control for improved flight safety. AIAA Journal on Guidance, Control and Dynamics (July 2001) 42. Idan, M., Johnson, M., Calise, A.J., Kaneshige, J.: Intelligent aerodynamic/propulsion flight control for flight safety: a nonlinear adaptive approach. In: American Control Conference, ACC (2001) 43. Isermann, R., Ball´e, P.: Trends in the application of model-based fault detection and diagnosis of technical processes. Control Engineering Practice 5(5), 709–719 (1997) 44. Isidori, A.: Nonlinear control systems, 2nd edn. Springer, Heidelberg (1989) 45. Jiang, J.: Fault-tolerant control systems - an introductory overview. Acta Automatica Sinica 31(1), 161–174 (2005) 46. Johansen, T.A.: Operating regime based process modeling and identification. The Norwegian Institute of Technology, University of Trondheim, ph.d. thesis, itk-report 94-109w edition (1994) 47. Johansen, T., Foss, B.: Identification of non-linear system structure and parameters using regime decomposition. Automatica 31(2), 321–326 (1995) 48. Johnson, E.N., Calise, A.J.: Neural network adaptive control of systems with input saturation. In: American Control Conference (ACC), Arlington, Virginia (June 2001) 49. Kadali, R., Huang, B., Rossiter, A.: A data driven subspace approach to predictive controller design. Control Engineering Practice 11(3), 261–278 (2003) 50. Kale, M.M., Chipperfield, A.J.: Stabilized MPC formulations for robust reconfigurable flight control. Control Engineering Practice 13(6), 771–788 (2005) 51. Kanev, S.: Robust fault-tolerant control. PhD thesis, University of Twente (2004) 52. Kanev, S., Verhaegen, M.: Controller reconfiguration for non-linear systems. Control Engineering Practice 8, 1223–1235 (2000) 53. Kanev, S., Verhaegen, M.: A bank of reconfigurable LQG controllers for linear systems subjected to failures. In: 39th IEEE Conference on Decision and Control (December 2000) 54. Kanev, S., Verhaegen, M., Nijsse, G.: A method for the design of fault-tolerant systems in case of sensor and actuator faults. In: European Control Conference, ECC (September 2001) 55. Kerrigan, E.: Fault-tolerant control of the COSY ship propulsion benchmark using model predictive control. Technical report, University of Cambridge (November 1998) 56. Keviczky, T., Balas, G.J.: Software-enabled receding horizon control for autonomous unmanned aerial vehicle guidance. Journal of Guidance, Control, and Dynamics 29(3), 680–694 (2006) 57. Kinnaert, M.: Fault diagnosis based on analytical models for linear and nonlinear systems - a tutorial. In: Proceedings of the 5th Symposium on Fault Detection, Supervision and Safety for Technical Processes (SAFEPROCESS 2003), Washington D.C., USA, pp. 37– 50 (2003) 58. Konstantopoulos, I.K., Antsaklis, P.J.: Eigenstructure assignment in reconfigurable control systems. Technical report, Interdisciplinary Studies of Intelligent Systems (January 1996) 59. Konstantopoulos, I.K., Antsaklis, P.J.: An optimization approach to control reconfiguration. Dynamics and Control 9(3), 255–270 (1999) 60. Kothare, M.V., Balakrishnan, V., Morari, M.: Robust constrained model predictive control using linear matrix inequalities. Automatica 32(10), 1361–1379 (1996)

88

M. Verhaegen et al.

61. Liao, F., Wang, J.L., Yang, G.H.: Reliable robust flight tracking control: an LMI approach. IEEE Transactions on Control Systems Technology 10(1), 76–89 (2002) 62. Liu, W.: An on-line expert system-based fault-tolerant control system. Expert Systems with Applications 11(1), 59–64 (1996) 63. Liu, G., Patton, R.: Eigenstructure assignment for control systems design. John Wiley & Sons, Chichester (1998) 64. Maciejowski, J.M.: The implicit daisy-chaining property of constrained predictive control. Applied Math and Computer Science 8(4), 695–711 (1998) 65. Maciejowski, J.M.: Predictive control with constraints. Prentice Hall, Englewood Cliffs (2002) 66. Maciejowski, J.M., Jones, C.N.: MPC fault-tolerant flight control case study: Flight 1862. In: Proceedings of the 5th Symposium on Fault Detection, Supervision and Safety for Technical Processes (SAFEPROCESS 2003), Washington D.C., USA, pp. 121–126 (2003) 67. Mahmoud, M., Jiang, J., Zhang, Y.: Active fault tolerant control systems: stochastic analysis and synthesis. Springer, Berlin (2003) 68. Maybeck, P.S.: Multiple model adaptive algorithms for detecting and compensating sensor and actuator/surface failures in aircraft flight control systems. International Journal of Robust and Nonlinear Control 9, 1051–1070 (1999) 69. Mignone, D.: Control and estimation of hybrid systems with mathematical optimization. PhD thesis, Swiss Federal Institute of Technology, ETH (January 2002) 70. Morse, W., Ossman, K.: Model-following reconfigurable flight control system for the AFTI/F-16. Journal of Guidance, Control, and Dynamics 13(6), 969–976 (1990) 71. Narendra, K.S., Balakrishnan, J.: Adaptive control using multiple models. IEEE Transactions on Automatic Control 42(2) (February 1997) 72. Niemann, H., Stoustrup, J.: Passive fault tolerant control of a double inverted pendulum - case study. Control Engineering Practice 13(8), 1047–1059 (2005) 73. Noura, H., Sauter, D., Hamelin, F., Theilliol: Fault-tolerant control in dynamic systems: application to a winding machine. IEEE Control Systems Magazine 20(1), 33–49 (2000) 74. NTSB. Aircraft accident report - american airlines, inc. DC-10-10. Technical Report NTSB-AAR-79-17, National Transpotration Safety Board, USA (1979) 75. Patton, R.: Fault tolerant control: the 1997 situation. In: Proceedings of the 3rd Symposium on Fault Detection, Supervision and Safety for Technical Processes (SAFEPROCESS 1997), pp. 1033–1054. Hull University, Hull (1997) 76. Prakash, J., Narasimhan, S., Patwardhan, S.C.: Integrating model based fault diagnosis with model predictive control. Industrial & Engineering Chemistry Research 44(12), 4344–4360 (2005) 77. Rauch, H.: Intelligent fault diagnosis and control reconfiguration. IEEE Control System Magazine 14(3), 6–12 (1994) 78. Ru, J., Li, X.R.: Variable-structure multiple-model approach to fault detection, identification, and estimation. IEEE Transactions on Control Systems Technology 16(5), 1029– 1038 (2008) 79. Seguchi, H., Ohtsuka, T.: Nonlinear receding horizon control of an underactuated hovercraft. International Journal of Robust and Nonlinear Control 13(3-4), 381–398 (2003) 80. Shin, J.-Y., Belcastro, C.M.: Performance analysis on fault tolerant control system. IEEE Transactions on Control Systems Technology 14(5), 920–925 (2006) 81. Shtessel, Y.B.: Sliding mode control: overview and applications to aerospace control. Talk notes (2001) 82. Shtessel, Y.B., Buffington, J.: Multiple time scale flight control using reconfigurable sliding modes. AIAA Journal on Guidance, Control and Dynamics 22(6), 873–883 (1999)

2

Fault Tolerant Flight Control - A Survey

89

83. Slotine, J.J.E., Li, W.: Applied Nonlinear Control. Prentice-Hall International, Inc., Englewood Cliffs (1991) 84. Stoustrup, J., Blondel, V.D.: Fault tolerant control: A simultaneous stabilization result. IEEE Transactions on Automatic Control 49(4), 305–310 (2004) 85. Tao, G., Chen, S., Joshi, S.: An adaptive actuator failure compensation controller using output feedback. IEEE Transactions on Automatic Control 47(3), 506–511 (2002) 86. Tao, G., Ma, X., Joshi, S.: Adaptive state feedback and tracking control of systems with actuator failures. IEEE Transactions on Automatic Control 46(1), 78–95 (2001) 87. Verhaegen, M., Verdult, V.: Filtering and system identification: an introduction. Cambridge University Press, Cambridge (2007) 88. Wang, X., Huang, B., Chen, T.: Data-driven predictive control for solid oxide fuel cells. Journal of Process Control 17(2), 103–114 (2007) 89. Wang, G.S., Lv, Q., Liang, B., Duan, G.R.: Design of reconfiguring control systems via state feedback eigenstructure assignment. International Journal of Information Technology 11(7), 61–70 (2005) 90. Wise, K.A., Brinker, J.S., Calise, A.J., Enns, D.F., Elgersma, M.R., Voulgaris, P.: Direct adaptive reconfigurable flight control for a tailless advanced fighter aircraft. International Journal of Robust and Nonlinear Control 9(14), 999–1022 (1999) 91. Woodley, B.R., How, J.P., Kosut, R.L.: Subspace based direct adaptive H∞ control. International Journal of Adaptive Control and Signal Processing 15, 535–561 (2001) 92. Yen, G.G., Ho, L.-W.: Online multiple-model-based fault diagnosis and accommodation. IEEE Transactions on Industrial Electronics 50(2), 296–312 (2003) 93. Zhang, Y., Jiang, J.: An interacting multiple-model based fault detection, diagnosis and fault-tolerant control approach. In: Proceedings of the 38th Conference on Decision & Control (December 1999) 94. Zhang, Y., Jiang, J.: Integrated design of reconfigurable fault-tolerant control systems. Journal of Guidance 24(1), 133–136 (2000) 95. Zhang, Y.M., Jiang, J.: Fault tolerant control system design with explicit consideration of performance degradation. IEEE Transactions on Aerospace and Electronic Systems 39(3), 838–848 (2003) 96. Zhang, Y., Jiang, J.: Issues on integration of fault diagnosis and reconfigurable control in active fault-tolerant control systems. In: Proceedings of the IFAC SAFEPROCESS, Beijing, China (August 2006) 97. Zhang, D., Wang, Z., Hu, S.: Robust satisfactory fault-tolerant control of uncertain linear discrete-time systems: an LMI approach. International Journal of Systems Science 38(2), 151–165 (2007) 98. Zhenyu, Y., Huazhang, S., Zongji, C.: The frequency-domain heterogeneous control mixer module for control reconfiguration. In: Proceedings of the 1999 IEEE International Conference on Control Applications, August 1999. IEEE, Los Alamitos (1999)

Chapter 3

Fault Detection and Diagnosis for Aeronautic and Aerospace Missions David Henry, Silvio Simani, and Ron J. Patton

3.1 Introduction The term Fault Detection and Diagnosis (FDD) is a development of the term Fault Detection and Isolation (FDI). Generally speaking, FDD goes slightly further than FDI by including the possibility of estimating the effect of the fault and/or diagnosing the effect or severity of the fault. Hence, the term FDD also covers the capability of isolating or locating a fault. Both of these topics have received considerable attention worldwide and have been theoretically and experimentally investigated with different types of approaches, as can be seen from the general survey works [1, 2, 3, 4, 5, 6, 7]. To complete the terminology, the use of the word ‘failure’ (widely used in the early literature) has been generally replaced by the word ‘fault’ [1]. This is important and it is now widely recognised that faults are unwanted malfunctions of a system, whereas a failure denotes a total cessation of a function, via a subsystem or a total system failure [8]. The developments outlined in this Chapter have been stimulated mainly by the trend in automation toward systems with increasing complexity and the growing demands for fault-tolerance, cost efficiency, reliability, and safety as these constitute fundamental design features in modern control systems. Studies of the ways in which FDI and FDD methods can be applied in aerospace systems have been David Henry IMS laboratory, Bordeaux 1 University, 351 cours de la lib´eration, 33405 Talence c´edex e-mail: [email protected] Silvio Simani University of Ferrara, Department of Engineering, 1 Via Saragat, 44100 Ferrara, Italy e-mail: [email protected] Ron J. Patton University of Hull, Department of Engineering, Cottingham Road, Hull HU6 7RX, United Kingdom e-mail: [email protected] C. Edwards et al. (Eds.): Fault Tolerant Flight Control, LNCIS 399, pp. 91–128. c Springer-Verlag Berlin Heidelberg 2010 springerlink.com

92

D. Henry, S. Simani, and R.J. Patton

given by [9, 10]. This Chapter moves the subject on about 17 years by presenting a non-exhaustive overview of recent advances in model-based FDI/FDD and their applicability for aeronautical systems and aerospace missions. This Chapter focuses on methods that have either been applied to real aerospace systems or to high fidelity simulations. For the remainder of the Chapter the terms FDI and FDD will be replaced by the term FDD because of the overlap between these two topics and as a consequence of the preference for the use of the term FDD in aerospace system studies. Measurement sensors are among the most important components for flight control and aircraft safety. For example, pitot tube air velocity sensors work in a harsh environment (e.g. the possibility of becoming iced up at high altitude). When sensors of this kind have a common mode fault (e.g. all becoming iced up) all the redundant lanes of the flight control system can potentially fail as a consequence of failing to receive suitable air data information. It is generally the case that the fault probabilities for sensors are high when compared with other components and control actuators, thus making these devices the least reliable components of the flight system. In order to improve the reliability of the system, sensor hardware and software (analytical) redundancy schemes have been investigated for aircraft over the last twenty or more years [9, 10]. For small and military aircraft, multiple hardware redundancy is harder to achieve due to a lack of operating space and weight limitations. Multiple hardware is costly and very complex to engineer and maintain. Analytical redundancy makes use of a mathematical model of the monitored process and is therefore often referred to as the model-based approach to FDD [1, 4, 11, 12]. The model-based FDD algorithms are normally programmed in computer software that may be difficult to implement on real and complex systems, where modelling uncertainty arises inevitably (due for example to process noise, parameter variations and modelling errors). The FDD procedure for incipient faults represents a challenge to the theory of model-based FDD techniques due to the inseparable mixture between fault effects and modelling uncertainty. This has been defined in the literature as the robustness problem in FDI/FDD [1, 3]. Model-based FDI/FDD commonly make use of the so-called ‘residual signal’ to facilitate the detection and isolation of faults. Methods which use the residual approach are known as the residual based methods. By far the most studied topic of the use of residual generators for FDI/FDD has been that of the deterministic state observer [13, 14, 3]. In the context of observers for stochastic systems there have also been many studies [15, 16, 3]. A number of researchers have developed residual-based methods using the parity space concept [17, 18, 2]. Others have developed the theme of robust FDI/FDD around the Unknown Input Observer (UIO) [19, 3]. Parameter identification has been a key subject for some investigators [15, 20]. Another popular approach to FDD/FDI, particularly considering robustness has been via the use of eigenstructure assignment (EA) coupled with the UIO. Patton and co-workers [21, 22] conducted a number of studies on this subject and a toolbox

3

FDD for Aeronautic and Aerospace Missions

93

for EA design was developed [23]. The UIO together with EA have been applied successfully in a robust FDI/FDD study on a jet engine [24]. Geometrical concepts for FDI/FDD (and the so-called ‘failure’ detection for the USA) were first proposed by [25]. The geometrical concepts were successfully extended in theoretical work to nonlinear systems [26, 27]. Nonlinear geometric approaches can also be found in [28, 29], in which the fault estimation method relies on the successive derivatives of input/output signals. A drawback of these strategies is a high sensitivity to measurement noise and uncertainty due to dynamical system structure. Ref. [30] describes an interesting FDD application of an UIO strategy for Lipschitz-bounded nonlinear systems. This approach is applicable to a wide class of non-linear systems without requiring a non-linear geometrical approach. A further approach to FDI/FDD has been based on state estimation using nonlinear stochastic methods such ‘Particle Filters’, a technique belonging to the class of Monte-Carlo methods, for nonlinear systems with non-Gaussian noise [31, 32]. Soft computing techniques for FDD/FDI [33] can be also exploited, making use of neural networks, fuzzy logic or neuro-fuzzy structures. Uppal and Patton [34] have shown that the neuro-fuzzy approach can be developed from the UIO concept, making structured residuals as consequents in a neuro-fuzzy system with sets of residual signals covering the non-linear operation of the system being monitored. In essence, the soft computing approaches make use of ‘implicit’ rather than ‘explicit’ models of the monitored system and hence also constitute a part of the model-based approach. The main advantages of the soft computing approaches is that an implicit mathematical model of the system being diagnosed or monitored is not required and the techniques handle non-linear dynamics in a very natural way, making them very suitable for the design of FDD schemes. Adaptive methods for fault estimation and FDI/FDD are applicable to a wide class of nonlinear systems and are becoming popular as they blend well with fault tolerant Control (FTC) or fault detection, isolation and recovery (FDIR). One adaptive method that addresses only output sensor faults, is reported in [35]. A crucial issue with any FDD scheme is its robustness to modelling uncertainty. The robustness problem in FDD is defined as the maximisation of the detectability and isolability of faults together with the minimisation of the effects of uncertainty and disturbances on the FDD procedure [1, 3, 6]. A number of FDD techniques have been mainly developed for linear systems. However, practical models of real-world systems are mostly nonlinear. Hence, viable procedures for practical application of FDD techniques must take into account model-reality mismatches and hence modelling uncertainty. For aircraft and aerospace systems the development of FDD tools that can be applied to real systems design and integration is still an open issue, particularly with interest in the reduction in the use of some multiple hardware and the integrated development of analytical redundancy methods. This is an important area for practical research. This Chapter is organised as follows. Section 3.2 summarises the basic methodologies for actuator, system component and sensor FDD. The methods are based on output estimation approaches, in conjunction with residual processing schemes,

94

D. Henry, S. Simani, and R.J. Patton

which include simple threshold detection (for the deterministic case), as well as statistical analysis when data is affected by noise. The final result consists of a strategy based on model-based FDI, namely to generate robust and redundant residual signals. The concept of residual generation is examined with reference to dynamic observers or Kalman filters. A residual signal is defined as an output estimation error, in general obtained by the difference between the measurement of one output and its corresponding estimate. Section 3.2 outlines the design of these FDD estimators for both deterministic and stochastic environments. Section 3.3 shows how the proposed FDD algorithms can be applied to the diagnosis of actuators, process components and input-output sensors for general example of a flight control problem. Other aerospace examples (e.g. spacecraft)are also considered. In particular, the FDD techniques presented in this Chapter have been tested on time series of data acquired from different high fidelity prototypes, whose linear mathematical descriptions are obtained by using both ‘first principles’ modelling and dynamic system identification procedures. Results from simulations show that diagnosed faults are perfectly compatible with the FDD requirements for these applications. Finally, Section 3.4 summarises the contributions and achievements of the Chapter.

3.2 Fault Detection and Diagnosis Approaches The model-based approach to FDD in dynamic systems has been receiving more and more attention over the last two decades, in the contexts of both research and real application. Stemming from this activity, a great variety of methods are found in the current literature, based on the use of mathematical models of the systems under investigation and exploiting modern control theory. This Section provides an overview of the various fault detection methods, with particular attention to FDD techniques related to the applications described in this Chapter. Residual generators based on different methods, such as state and output observers, parity relations and parameter estimation, are just special cases in this general framework. In the following, some commonly used residual generation and evaluation methods are discussed and their mathematical formulation presented. This Section presents and summarises special features and problems regarding the different FDD methods.

3.2.1 The Parity-Space Methods A significant number of publications address the problem of fault diagnosis using the parity space approach, see for instance [36, 37, 38, 39, 9, 18, 40, 3]. The most common application of parity space methods in the aerospace field is based on the redundancy available in Inertial Measurement Units (IMUs) [41, 39, 3, 42, 43]. The redundant measurements acquired from the IMUs are used for deriving the so-called parity-space relations. In particular, three configurations are used, i.e. the octahedron, dodecahedron and dedicated pyramidal configurations, see fig. 3.1 for an illustration.

3

FDD for Aeronautic and Aerospace Missions

95

Fig. 3.1 The octahedron (left), the dodecahedron (centre)and the dedicated pyramid (right) configurations

In the octahedron configuration, each axis (labelled numerically 1 through 6) contains a gyro and an accelerometer. Complementary axes i.e. 1 and 2, 3 and 4, and 5 and 6) make angles of 90 deg with each other and are symmetrically placed with respect to the body frame, i.e. instruments 1 and 2 are both inclined 45 deg with respect to the z body axis. Instruments 3 and 4, are inclined 45 deg with respect to the x body axis and 5 and 6, 45 deg with respect to the y body axis. This configuration facilitates the determination of 7 (static) parity relations defined according to (see [41] for more details). r1 = m1 − m2 − m3 − m4 r2 = m2 + m3 − m5 r3 = m6 + m1 − m3 r4 = m4 + m5 − m1 (3.1) r5 = m4 + m6 + m2 r6 = m1 + m2 + m6 − m5 r7 = m4 + m5 + m6 − m3 These equations are used to detect and isolate a single axis fault in either gyros or accelerometers or a simultaneous correlated double axis fault. The dedicated pyramidal configuration is based on two IMUs arranged in a geometric configuration, so that any single failure (1-axis gyro or 1-axis accelerometer) can be detected and isolated, through the 7 following (static) parity relations: r1 = (m1 + m4) − (m2 + m5 ) r2 = (m2 + m5) − (m3 + m6 ) r3 = (m3 + m6) − (m1 + m4 ) r4 = 2(m1 + m3 + m5) − 3(m1 + m4 ) r5 = 2(m2 + m4 + m6) − 3(m1 + m4 ) r6 = 2(m1 + m3 + m5) − 3(m2 + m5 ) r7 = 2(m2 + m4 + m6) − 3(m2 + m5 )

(3.2)

where measurements m1 , m3 , m5 are for IMU1 and m2 , m4 , m6 are for IMU2. For the fault detection purpose, only ri (t), i = 1, 2, 3 are used whereas the four last signals ri (t), i = 4, ..., 7 are used for fault isolation in gyros and accelerometers. The

96

D. Henry, S. Simani, and R.J. Patton

dedicated pyramidal configuration FDD technique is used in the Mars Sample Return mission, a mission undertaken jointly by NASA and the ESA. The parity-space approach can be based on the parity equations derived from the dynamic model of the system under diagnosis. The relationship between the parityspace approach and other model-based approaches has been described by a number of authors. For example, Patton and Chen describe the equivalent properties between the state observer approach and the parity space, under certain conditions [9, 18] and [44] have described the relationship between the parity space and parameter estimation approaches. In all of these methods the analytical redundancy that is developed relies on an input-output polynomial description of the system under diagnosis. The methods comprise input-output strategies for FDD, in some sense. The use of input-output forms facilitates the development of analytical descriptions for the disturbance decoupled residual generators. These dynamic filters, organised into bank structures, are able to achieve fault isolation properties. An appropriate choice of their parameters facilitates the maximistaion of the robustness with respect to both measurement noise and modelling errors, whilst optimising fault sensitivity characteristics. An approach which is strongly based on the use of input-output polynomials is referred to as the Polynomial Method (PM), presented in [45]. The PM requires the knowledge of the input-output representation of the continuous-time (or discretetime), time-invariant linear dynamic system affected by faults and disturbances. An important aspect of the PM residual generator design concerns the decoupling properties of the disturbance. This decoupling is obtained by means of a suitable coordinate exchange of the monitored input-output system. Hence, the residual generator model for the investigated system depends on suitable design polynomials and matrices, which can be arbitrarily selected among the polynomials with degree greater than or equal to the maximum row degree of the input output model. The diagnostic capabilities of the PM residual generator strongly depend on the choice of the residual transfer function. The analytical solution to this problem exists and is unique, as demonstrated in [46], due to the choice of a quadratic constraint equation. The design of the PM filter is completed by introducing a method for assigning both the zeros and the poles of the continuous time transfer function from the fault to the residual. The pole and zero locations influence the transient characteristics(maximum overshoot, delay time, rise time, settling time, etc.) of the filter as described in [45]. Finally, this PM method can be used for fault isolation. In particular, for the isolation of a fault affecting one of the output sensors, under the hypotheses that the input sensors and the remaining output sensors are fault-free, a generalized bank of residual generator filters is used. The number of these generators is equal to the number m of the system outputs, and the i-th device (i = 1, . . . , m) is driven by all but the i-th output and all the inputs of the system. In this case, a fault on the i-th output sensor affects all but the i-th residual generator. The same technique can be applied for the isolation of input sensor faults. However, it must be emphasised that the PM approach is merely a re-iteration or a new interpretation of the parity space philosophy of utilising input-output signals in polynomial form.

3

FDD for Aeronautic and Aerospace Missions

97

3.2.2 Particle Filtering Approach The particle filtering approach [47, 48, 49], also called the ‘Condensation Algorithm’ [50] or the ‘Markov Chain Monte Carlo Method’ [51, 52], is a probabilistic technique that aims to estimate jointly the state of the system x and the discrete fault modes z at time t as the a-posteriori distribution: p (s(t)|y(t), y(t − 1), ...., u(t), u(t − 1).....)

(3.3)

where s(t) = (x(t), z(t)), knowing a set of samples i.e. output/input data y(t), y(t − 1), ...., u(t), u(t − 1)..... Within the Bayesian context, the filtering problem is simplified by assuming that s(t) evolves in a Markovian way. A Markov system is one in which past and future states are conditionally independent, given the current state. The Markovian assumption facilitates a recursive formulation of the estimation problem. The problem then turns out to be the computation of xˆ and zˆ satisfying the following jump Markov linear Gaussian model: z(t) ∼ P (z(t)|z(t − 1)) x(t) = A(z(t))x(t − 1) + B(z(t))u(t) + E1(z(t))w(t) y(t) = C(z(t))x(t) + D(z(t))u(t) + E2 (z(t))v(t)

(3.4)

where y(t) ∈ ℜm denotes the observations, x(t) ∈ ℜn the unknown Gaussian states, u ∈ ℜ p a known control signal and where z(t) ∈ {1, ..., q} is the set of unknown discrete states i.e. the fault modes). The noise processes are assumed to be Gaussian so that w(t) ∼ N (0, I) and v(t) ∼ N (0, I). The parameters A, B,C, D, E1 , E2 and P (z(t)|z(t − 1)) are known matrices with D(z(t))D(z(t))T > 0 for any z(t). 3.2.2.1

Kalman Filters

If we consider only one discrete mode z(t) in (3.4), linear transition and observation functions for the continuous parameters and Gaussian noise, then the ‘belief state’ has a multivariate Gaussian probability distribution that can be computed incrementally using a Kalman filer. At each time-step t, the Kalman filtering algorithm updates sufficient statistics (μ (t − 1), σ 2 (t − 1)), prior mean and covariance of the continuous distribution, with the new observation y(t). However, in the case of non-linear transformations, the Kalman filtering algorithm does not offer an efficient solution. Good approximations can be achieved by the extended Kalman filter (EKF) or via the unscented Kalman filter (UKF). Rather than using the standard Kalman filter update to compute the a-posteriori distribution, the UKF performs as follows: Given a m-dimensional continuous space, 2m + 1 sigma points are chosen based on the a-priori covariance. The non linear equations are then applied to each of the sigma points and the a-posteriori distribution is approximated by a Gaussian distribution whose mean and covariance are computed from the sigma points. The mean is set to the weighted mean of the transitioned sigma points and the covariance is taken to be the sum of the weighted

98

D. Henry, S. Simani, and R.J. Patton

squared derivations of the transitioned sigma points from the mean. The UKF update yields an approximation to the a-posteriori probability whose error depends on how different the true probability distribution is from the ideal Gaussian case. 3.2.2.2

Particle Filters

The successes of the Kalman, EKF and UKF filtering approaches strongly depend on how the belief states behave to a multivariate Gaussian. To overcome this problem, the particle filter has been proposed in [50]. Basically, a particle filter is a Markov chain Monte Carlo algorithm that approximates the belief state using a set of ‘particles’ and keeps the distribution updated as new observations are made over time. To proceed, the algorithm operates in three steps: 1. The Monte Carlo step. This step considers the evolution of the system over time. It uses the stochastic model of the system to generate a possible future state for each sample. 2. The reviewing step. This step corresponds to conditioning on the observations. Each sample is weighted by the likelihood of seeing the observations in the updated state representing the sample. This step leads to samples that predict the observations well and with high weighting, and samples that are unlikely to generate the observations, with low weighting. 3. The resampling step. In this step, a set of uniformly weighted samples from the distribution represented by the weighted samples, is resampled. In this resampling stage, the probability that a new sample is a copy of a particular sample is proportional to its corresponding weighting. In other words, high-weighted samples may be replaced by several samples and low-weighted samples may disappear. 3.2.2.3

Rao-Blackwellized Particle Filters

Particle filters have a number of properties that make them suitable for FDD applications, e.g. they can be applied to nonlinear models with arbitrary prior belief distributions, the computation time depends only on the number of samples, not on the complexity of the model, etc. However, it should be stressed that the number of samples required to cope with high dimensional continuous state systems x is enormous, leading to curse of dimensionality and rendering the practical onboard implementation questionable. To solve this problem, the Rao-Blackwellized Particle Filter method can be used. This approach is intended for application in problems of tracking linear multimodal systems with Gaussian noise. In these systems, the belief state is a mixture of signals with different Gaussian statistics. The idea is to combine both the Particle filter that samples the discrete modes z(t) and the Kalman filter for each mode z that propagates sufficient statistics (μi (t), σi2 (t)) for the state x(t). Note that as in the particle filtering approach, a resampling step is needed to prevent particle impoverishment. The interested reader can refer to [53, 54, 55] for more theoretical details.

3

FDD for Aeronautic and Aerospace Missions

99

The particle filtering approach has been used successfully for fault diagnosis in planetary rovers, e.g. the Hyperion robot (four wheeled robot), the K-9 rover (six wheeled rover). The software code for the implementation of the PF strategy is freely available at the website http://www.cs.ubc.ca/˜nando/software.html[53, 32].

3.2.3 Nonlinear EKF Approaches In a similar way to the approaches outlined in subsection 3.2.2, an extended Kalmantype unknown input estimator is proposed in [56, 57, 58] to solve the FDD problem of fault diagnosis in aircraft and reusable launch vehicles control surfaces. The methodology is based on joint parameter and state estimation techniques and consists in providing an (optimal) estimate of the fault. Consider the following nonlinear state-space model in the discrete-time framework x(k + 1) = fi (x(k), δs (k), Ψ (x, k)) + v(k) y(k) = g(x(k)) + w(k)

(3.5)

where fi (.) = f (x(k), δs (k), Ψ (x, k))

δi (k)

(3.6)

δs refers to the healthy control surfaces and Ψ (x) is a vector composed of nonlinear functions depending on a subset of the state vector x. The index ”i” is used to outline that the estimation of the i-th fault δˆi needs to be performed. The stochastic inputs v and w denote the process and measurement noises, respectively which are assumed to be uncorrelated white noise processes with covariance matrices: Q(k) = E{v(k)v(k)T },

R(k) = E{w(k)w(k)T }

(3.7)

The initial estimates of state and covariance matrix are denoted by: x0 = E{x0 }

(3.8)

P0 = E{(x0 − x0 )(x0 − x0 )T }

(3.9)

Following the method proposed in [59], the problem of recursively estimating the augmented state vector x can be formulated as a nonlinear filtering problem that minimizes the conditional mean-square-error, i.e: k−1 } x(k) ˆ = argmin E{x(k) ˜ T x(k)|Y ˜

(3.10)

where x(k) ˜ = x(k) − x(k) ˆ is the state estimate error and Y k−1 = {y0 , y1 , · · · , yk−1 } is a matrix containing the past measurements. The state estimate x(k) ˆ is equivalent to

100

D. Henry, S. Simani, and R.J. Patton

the conditional mean of the Gaussian probability density function p(x(k)/Y (k−1) ) ∼ N (x(k), ˆ P(k)) such as: x(k) ˆ = E{x(k)|Y (k−1) }

(3.11)

T (k−1) P(k) = E{(x(k) − x(k))(x(k) ˆ − x(k)) ˆ |Y }

(3.12)

and where:

refers to the state covariance matrix in charge to quantify the uncertainty of the estimate. The estimation algorithm can then be formulated into the following nonlinear observer-based scheme: x(k ˆ + 1) = fi (x(k), ˆ δs (k), Ψ (x, k)) + K(k)e(k) (3.13) y(k) ˆ = g(x(k)) ˆ where K(k) is a non stationary gain to be computed and e(k) = y(k) − y(k/k ˆ − 1) is the innovation sequence associated to the covariance matrix Pee : T k−1 Pee = E{(y(k) − y(k))(y(k) ˆ − y(k)) ˆ |Y }

(3.14)

ˆ Based on the previous estimate of the state x(k/k) ˆ with covariance P(k/k), the filter computes at a subsequent time-step an optimal forecast of the state x(k ˆ + 1/k) and its ˆ + 1/k) whenever observations become available. This leads covariance matrix P(k to the following update equations: x(k ˆ + 1) = x(k) ˆ + K(k)e(k) P(k + 1) = P(k) − K(k)Pee (k)K T (k)

(3.15)

The expression of K(k) is given by: −1 (k) K(k) = Pxy (k)Pee

(3.16)

where Pxy denotes the predicted cross-correlation matrix defined as follows: T k−1 Pxy = E{(x(k) − x(k))(y(k) ˆ − y(k)) ˆ |Y }

(3.17)

As the above statistical expectations are generally intractable, some kind of approximation must be used, like for e.g. the Extended Kalman Filter (EKF) which is based on a first-order Taylor linearization. However, even if the EKF estimator seems to be adapted, some well-known drawbacks exist in practice, i.e. the parameters estimates can converge slower than the state estimates and in general, only local convergence can be expected. Based on the work reported in [59], this motivated [57, 58, 56] to use an approximation of the nonlinear function ‘ fi (.)’ by means of a multi-dimensional extension of Stirling’s interpolation formula. Although this method presents some optimality proofs, the key feature remains the a-priori choice of the covariance matrices Q and R. The matrix Q controls the

3

FDD for Aeronautic and Aerospace Missions

101

flexibility of the model whereas the measurement covariance matrix R controls the flexibility of the measurement equations. In the most practical cases, the optimization of Q and R is done by iteratively testing different values and evaluating the results over a test period. In practice, this tuning problem is often tackled as an ad hoc process involving a very large number of manual trials. In view of this difficulty, it has been chosen in [56] to automatically tune these matrices by means of an optimization method. The performance index to be minimized corresponds to the root-mean-square of the state estimate errors subjected to positivity constraints of Q and R matrices that is: ⎧ t 1 2 ⎨ Q > 0, R > 0 f T (3.18) R = diag(ri ) J(k) = N1 ∑( s.t. x Π x) ⎩ t0 Q = diag(qi ) For convenience, the additional constraints Q = diag(qi ) and R = diag(ri ) are imposed in the optimization algorithm. Π is a weighting matrix introduced to manage separately each component of the vector x. ˜ t0 and t f are respectively the initial and final discrete time of the tuning interval and N denotes the number of data points in the tuning interval. Because of the multi-parameter, non-linear and discrete nature of this optimization problem, a Particle Swarm Optimization (PSO) algorithm is retained in [56] to derive a numerical solution. This approach has been applied successfully in [56] to the problem of control surface failures in the HL-20 Reusable Launch Vehicles (RLV) during its landing phase. See fig. 3.8 that illustrates some results.

3.2.4 Observer-Based Approaches 3.2.4.1

Disturbance Decoupling Approaches

In the disturbance decoupling approaches, the aim is to generate the fault indicating signals i.e. the residuals denoted r)so that they behave in the orthogonal space of unknown inputs(disturbances, modelling errors), whilst maintaining sensitivity to faults. In [60], this approach is used for IMU and thruster fault diagnosis of the Mars Express spacecraft. A bank of UIOs (see Section 1 for definition) with minimum variance state estimation error is used and organised into an estimator bank for fault detection and isolation. The unknown inputs are estimated in a moving time window; the unknown input direction(s) is/are estimated via additional states in an augmented state observer structure. The unknown inputs are updated in the moving window and the minimum variance estimator is re-initialised at the end of each window period. It is assumed that faults do not occur during the unknown input estimation phase. Carefully selected performance criteria indices are used together with Monte Carlo robustness tuning and performance evaluation to provide a fault diagnosis solution.

102

D. Henry, S. Simani, and R.J. Patton

To proceed, let the system model be given in the discrete-time domain according to:

xk+1 = Ak xk + Bk uk + Ek dk + Fk1 fk + w1k yk = Ck xk + Fk2 fk + w2k

(3.19)

where xk , uk , yk denote the state, the input and the output vectors, respectively. Each entry of fk corresponds to a specific fault, dk denotes the unknown inputs to be decoupled and w1k , w2k are independent zero-mean white noise sequences with covariance matrices Qk , Rk , assumed to be known. The authors show that the following UIO can be used for FDD: zk+1 = Fk+1 zk + Tk+1 Bk uk + Kk+1 yk yˆk+1 = Ck+1 zk+1 + Ck+1 Hk+1 yk+1

(3.20)

The residual rk is also defined according to rk = yk − yˆk . Then the problem turns out to be the design of F, T, K, H to achieve disturbance decoupling with minimum variance of state estimation, K playing the role of a Kalman gain. It is shown in [16, 3] that the decoupling objectives are achieved iff the following conditions are satisfied: Ek = Hk+1Ck+1 Ek

(3.21)

Tk+1 = I − Hk+1Ck+1 1 Ck Fk+1 = Tk+1 Ak − Kk+1

(3.22) (3.23)

2 Kk+1 = Fk+1 Hk

(3.24)

1 2 Kk+1 + Kk+1

(3.25)

Kk+1 =

The necessary and sufficient condition for the existence of a solution to Eq. (3.21) is rank (Ck+1 Ek ) = rank (Ek ) and a special solution is: −1 Hk+1 = Ek (Ck+1 Ek )T (Ck+1 Ek ) (Ck+1 Ek )T

(3.26)

1 is designed to stabilise the observer and achieve minimum state The matrix Kk+1 estimation error variance. The solution to this problem is:

−1 1 Kk+1 = A1k+1 PkCkT Ck PkCkT + Rk

(3.27)

where A1k+1 = Tk+1 Ak and Pk = E{(xk − xˆk )(xk − xˆk )T } is the covariance matrix of the estimation state error at time k that can be computed according to the recursive equation: T +H T Pk+1 = A1k+1 Pk+1 (A1k+1 )T + Tk+1 Qk Tk+1 k+1 Rk+1 Hk+1 1 1 T Pk+1 = Pk − Kk+1Ck Pk (Ak+1 )

(3.28)

Remark 1. It can be seen that the observer structure described above is equivalent to a classical Kalman filter for systems without unknown inputs.

3

FDD for Aeronautic and Aerospace Missions

103

Remark 2. Note that the UIO decoupling approach was used for FDD in gyroscopes [61]. For this study the author used eigenstructure assignment to achieve the necessary de-coupling, based on the work on EA for UIO decoupling by [22]. 3.2.4.2

Iterative Learning Observer Approach

The Iterative Learning Observer (ILO) approach is proposed in [62] to diagnose time-varying faults in satellite thrusters. The goal is to derive jointly an estimate of the system state and an estimate of the fault. The ILO-based strategy uses a learning mechanism to perform estimation instead of using integrators that are used e.g. in adaptive observers. To proceed, let the system be modelled according to the following nonlinear state space model: x(t) ˙ = f (x(t)) + Bu(t) + B f u f (t) (3.29) y = Cx where x, u, y denote the state, the input and the output vectors. The vector u f denotes an additive time varying signal that models the faults to be estimated. It is assumed that u f is bounded and that ||u f (t) − K1 u f (t − τ )||∞ is finite where K1 and τ are defined below. The structure of the ILO is then defined according to: x(t) ˆ˙ = f (x(t)) ˆ + Bu(t) + Λ (y(t) − Cˆx(t)) + B f ϕ (t) ϕ (t) = K1 ϕ (t − τ ) + K2(y(t) − Cx(t)) ˆ

(3.30)

where K1 , K2 are gain matrices. The parameter τ is the updating interval. It may be taken as the sampling-time interval, or as an integer multiple of the sampling-time interval. The parameter Λ is a positive definite matrix and ϕ (t) is called the ILO input that is used to estimate the time-varying fault. As it can be seen, the signal ϕ (t) is updated by both its past information and the state estimation error.

3.2.5 Norm-Based Approaches The majority of methods discussed above involve the use of an open-loop model of the monitored system, in spite of that the FDD scheme is placed in a feedback loop. In such situations, it is well known that faults may be compensated by control actions and the early detection of them is clearly more difficult. This motivates the so-called integrated design of control and diagnosis schemes, according to the ideas proposed by [63] where robust controllers and fault detectors are designed together by optimizing a set of mixed control and fault detection objectives. For an application study on Reentry Launch Vehicles (RLV), see [64]. However, in many practical cases, this solution cannot be applied since the existing control laws are already certified for flight and consequently cannot be removed. To overcome this problem, the H∞ methods proposed in [65, 66, 67, 68, 69, 70, 71, 72] can be used. The proposed methods can be classi