Fault Tolerant Flight Control

Within the aviation community, especially for commercial transport aircraft design, all developments focus on ensuring and improving the required safety levels and reducing the risks that critical failures occur. Recent airliner accident and incident statistics (published in 2008), [8], show that about 16% of the accidents between 1993 and 2007 can be attributed to Loss of Control In-flight (LOC-I), caused by a piloting mistake (e.g. due to spatial disorientation), technical malfunctions or unusual upsets due to external disturbances. Loss of flight control is a subcategory of Loss of Control In-flight (LOC-I), where a technical malfunction is the initial event which causes control loss. LOC-I remains the second largest accident category after Controlled Flight Into Terrain (CFIT) which accounts for 23% of air accidents. However, a short term study for the year 2008 shows that loss of control comes at the top in the list of catastrophic accidents, according to the UK Civil Aviation Authority (UK-CAA). Data examined by the international aviation community shows that, in contrast to CFIT, the share of LOC-I occurrences is not significantly decreasing. Resilient flight control, or fault tolerant flight control (FTFC), allows improved survivability and recovery from adverse flight conditions induced by faults, damage and associated upsets. This can be achieved by ‘intelligent’ utilisation of the control authority of the remaining control effectors in all axes consisting of the control surfaces and engines or a combination of both. In this technique, control strategies are applied to restore stability and manoeuvrability of the vehicle for continued safe operation and a survivable recovery. The aim of the GARTEUR Flight Mechanics Action Group FM-AG(16) on Fault Tolerant Flight Control, of which this book is the culmination, was to facilitate the proliferation of new developments in fault tolerant control design within the European aerospace research community in practical and real-time operational applications. This addresses the need to improve the resilience and safety of future aircraft and aiding the pilot to recover from adverse conditions induced by (multiple) system failures and damage that would otherwise be potentially catastrophic. Up until now, faults or damage on board aircraft have been accommodated by hardware design using duplex, triplex or even quadruplex redundancy of critical components. However, the approach of the research presented in this book is to focus on new control law design methods to accommodate (unanticipated) faults and/or damage that dramatically change the configuration of the aircraft. These methods take into account a unique combination of robustness, reconfiguration and (real-time) adaptation of the control laws.

Nowadays, control systems are involved in nearly all aspects of our lives. They are all around us, but their presence is not always really apparent. They are in our kitchens, in our DVD-players, computers and our cars. They are found in elevators, ships, aircraft and spacecraft. Control systems are present in every industry, they are used to control chemical reactors, distillation columns, and nuclear power plants. They are constantly and inexhaustibly working, making our life more comfortable and more efficient...until the system fails.

The term Fault Detection and Diagnosis (FDD) is a development of the term Fault Detection and Isolation (FDI). Generally speaking, FDD goes slightly further than FDI by including the possibility of estimating the effect of the fault and/or diagnosing the effect or severity of the fault. Hence, the term FDD also covers the capability of isolating or locating a fault. Both of these topics have received considerable attention worldwide and have been theoretically and experimentally investigated with different types of approaches, as can be seen from the general survey works [1, 2, 3, 4, 5, 6, 7].

The primary goal of aircraft fault tolerant flight control is to recover or maintain safe flight when failures have occurred. Aircraft failures can be categorized into subsystem failures and airframe/structural failures. Modern aircraft subsystems are equipped with redundancies and failure detection systems for maintaining and monitoring the health status of subsystems. However, when failures such as engine separations, vertical tail loss, or wing separation (see Chapter 1) have occurred to aircraft, the airframe/structure of the aircraft will experience significant changes. These failures are not detected by current on-board monitoring systems. As a consequence of these failures, the aerodynamicmodel and even themass/inertia properties of the aircraft will be obviously different from their nominal forms. The basic flight control system designed for the nominal aircraft will suffer from the new configuration of the vehicle. In most cases, the human pilot will take over from the automatic flight control system (autopilot) when unexpected behaviour has been recognised, and will try to handle the aircraft manually. Experienced pilots have been trained for handling aircraft with a limited number of failures. However, unsuccessful recovery of the flight may still happen due to human errors or limitations imposed by the flight control architecture. Many cases referring to human errors causing incidents/accidents have been reported. In those cases, situational awareness and psychological stress have been the major factors of introducing wrong decisions/commands from human pilots (see Chapter 1).

Electrical Flight Control System (EFCS), first developed by Aerospatiale and installed on Concorde (as an analog system) and then designed with digital technology on Airbus aircraft from the 1980’s (A310), provides more sophisticated control of the aircraft and flight envelope protection functions[3],[4],[5]. The main characteristics are that high-level control laws in normal operation allow all control surfaces to be controlled electrically and that the system is designed to be available under all circumstances. The EFCS is a safety-critical system designed to meet very stringent requirements in terms of safety and availability. Most, but not all, of these requirements come directly from the Aviation Authorities (for example FAA, EASA, for details see [2],[1]).

Fault tolerant flight control (FTFC), or intelligent self-adaptive control, enables improved survivability and recovery from adverse flight conditions induced by faults, damage and associated upsets. This can be achieved by ’intelligent’ utilisation of the control authority of the remaining control effectors in all axes consisting of the control surfaces and engines or a combination of both. In this technique, control strategies are applied to restore vehicle stability, manoeuvrability and conventional piloting techniques for continued safe operation and a survivable landing of the aircraft.

To obtain a quantitative measure of predicted FTFC system performance in degraded modes, specifications need to be defined to assess proper functioning under realistic operational flight conditions. The goal of the benchmark specifications modelling, as described in this chapter, is to create a set of assessment criteria in order to evaluate the quality of the performance of fault detection and identification (FDI) and reconfigurable control algorithms. The lay-out of this chapter is as follows. First, the specifications modelling process is introduced by discussing the benchmark scenario. Subsequently, the general evaluation criteria will be considered by defining two classes of test manoeuvres. Thereafter, focus is placed on the test manoeuvres for FTFC qualification, which is the major topic of this chapter. After the discussion on how the assessment quantities of interest can be divided into two categories, four qualification test manoeuvres are discussed in depth. These include straight flight, right turn and localizer intercept, glideslope intercept and final approach with sidestep. Finally, a summary of the specified assessment quantities is given for the different FTFC qualification test manoeuvres. These criteria have also been published in Ref. [3].

Sliding mode control was conceived in the USSR during the 1950’s and spread to the ‘west’ after the end of the ‘cold war’. Sliding mode control (SMC) is a nonlinear type of control methodology and a special case of variable structure control. An interesting account of early developments in this area appears in [26]. SMC is a robust control methodology and it is quite unique compared to other controller design paradigms, since the performance of the controller depends on the design of the ‘sliding surface’ and not the state tracking directly. The idea of sliding mode control is to force the trajectory of the states onto a predefined surface in the state space. Once reached (usually in finite time), the states are forced to remain on that surface for all subsequent time. Sliding mode control has an inherent robustness property to a certain type of uncertainty which makes SMC a strong candidate for passive fault tolerant control (FTC). Recent accounts of the theory associated with sliding modes appear in [14, 27]. Sliding mode control systems are, in theory, completely insensitive to a class of uncertainty called matched uncertainty [14]. This represents uncertainty which occurs in the channels associated with the control inputs. Intuitively this suggests SMC schemes should inherently have passive FTC capability with respect to actuator faults. The work by Hess & Wells [19] argues that sliding mode control has the potential to become an alternative to reconfigurable control and has the ability to maintain the required performance without requiring fault detection and isolation (FDI).

The final design of the flight control system with fault-tolerant characteristics is shown in Fig. 9.1. Such an FCS is made-up of several parts, first of all the robust control laws that represent the core module of the controller, then a control allocation module which has the capability of distributing the control effort depending on the availability of the actuation devices, whose efficiency condition is given by the Fault-Detection and Identification module. The FDI module also gives information about the aircraft’s general behaviour and efficiency, thus allowing a supervisor module to manage the FCS in terms of estimated envelope protection, in addition to the attitude and rate limitations. Finally, an autopilot module, whose mode is selected by the panel, gives the attitude reference to the robust control law module for the aircraft state regulation.

The current state of the research in CIRA in the field of fault-tolerant flight control systems is focused on how to achieve robustness against actuator faults by means of adaptive control techniques. While this topic and the control allocation are already well assessed, the FDI techniques represent the next step forward towards the final design. In this chapter, the core module involving the robust control laws is described and reported in detail, along with some descriptions of the autopilot module. The control module is based on the adaptive model-following technique, while the latter is designed by means of the classical sequential loop closure approach. The FCS is the main focus of this chapter and is depicted in Fig. 9.2. Its theoretical background is recalled in the next section.

Subspace identification is a technique that can be used for identification of state-space models from input-output data. This technique has drawn considerable interest in the last two decades [1, 2], especially for linear time-invariant systems. A reason for this is the efficient way in which models are identified for systems of high order and with multiple inputs and outputs. Subspace identification can be used to form a subspace predictor for prediction of future outputs from past input-output data and a future input-sequence. This subspace predictor can be computed without realization of the actual state-space models, which significantly reduces computational requirements. In [3] the subspace predictor has been combined with model predictive control [4], resulting in a control algorithm that has been given the name subspace predictive control (SPC). In SPC, the output predicted by the subspace predictor is part of the cost function of the predictive controller. As a result of the subspace predictor being generated completely from input-output data, the SPC algorithm is a data-driven one.

By itself reconfigurable and fault-tolerant control is a challenging task. In general fault-tolerant control requires mechanisms to detect and identify a failure, furthermore, it must be flexible as to accommodate such a failure. In the more specific case of fault-tolerant flight control, several specific challenges exist according to [1]:

In order to tackle these challenges, we will introduce a control method that is globally valid, easily reconfigurable and above all, constrained. The solution that is presented here is a synthesis between model-predictive control (MPC) and a nonlinear dynamic inversion method (NDI). Section 11.2 provides the motivation for this setup, and furthermore, the section provides a clear introduction as to how both methods interact. Section 11.2.2 and 11.2.3 provide a discussion of the theory of MPC and dynamic inversion, whereas Section 11.2.4 on control allocation, and the mapping of constraints, provides the theory that is required to make the proposed combination of MPC and dynamic inversion interact correctly. Subsequently Section 11.3 introduces the relevant equations of motion of the benchmark aircraft and applies NDI theory to these. The chapter continues with the introduction of simulation results in Section 11.4 and wraps up with a discussion and conclusions in Section 11.5.

The need for increased flight safety and aircraft reliability leads to the design of reconfigurable fault tolerant control systems. Such systems are meant to manage faulty situations and help the crew to recover control capabilities quickly. Fault Tolerant Control (FTC) is one solution to tackle this problem and has received considerable attention from the control research community and aeronautical engineering researchers in the past couple of decades (for a survey, see for instance [1, 2, 3]). The main objective of fault tolerant control is to maintain a specified performance level in the presence of faults. Two approaches can be distinguished in this area: passive and active. In the passive approach, the control algorithm is designed so that the system is able to achieve its given objectives, in healthy as well as faulty situations. Unfortunately, achieving robustness to certain faults is only possible at the expense of decreased nominal performance. Active approaches react to fault events by using a reconfiguration mechanism and, in certain cases, this ensures nominal performance in fault free situations. This is a great benefit of active FTC approaches.

There are many control approaches possible in order to achieve fault tolerant flight control. An important aspect of these algorithms is that they should not only be robust, but even adaptive in some way, in order to adapt to the faulty situation, see Ref. [1] and [5] in the literature. In the category of adaptive control algorithms, a distinction is made between indirect adaptive control and direct adaptive control. Indirect adaptive control involves two stages. First, an estimate of the plant model is generated online. Once the model is available, it is used to generate controller parameters. Instead of estimating a plant model, a direct adaptive control algorithm estimates the controller parameters directly in the controller. This can be done via two main approaches: output error and input error. Of both main categories mentioned here, indirect adaptive control is preferable due to its flexibility and its property of being model based. In both categories, there are also two subversions, namely model reference adaptive control (MRAC) and self-tuning control (STC). In the former, one relies on a reference model and works on minimizing the tracking error between plant output and reference output (such as the concept of sliding mode control). With model reference indirect adaptive control it is feasible to achieve three important goals, namely trim value adjustment for the inputs, decoupling of inputs and outputs and closed loop tracking of pilot commands, see Ref. [1]. Self-tuning control focuses on adapting the (PID) control gains of the controller by making use of the estimated parameter values and is known to be more flexible, see Ref. [21]. Currently, much research is performed in the field of indirect adaptive control, where the adaptation is more extensive than only tuning the PID control gains. One of these new indirect control possibilities is adaptive model predictive control (AMPC), which is an interesting algorithm thanks to its nature to deal with (input) inequality constraints. These constraints are a good representation for actuator faults. It should be noted that there have been already some successful applications of MPC in the field of fault tolerant flight control, see Ref. [10] and [14]. An alternative indirect adaptive nonlinear control approach is discussed in this chapter, which allows to develop a reconfigurable control routine placing emphasis on the use of physical models, and thus producing internal parameters which are physically interpretable at any time.

The approach to the fault tolerant control problem presented here is based on many years of research into the topic. The primary focus of this research has always been military combat aircraft, though the application to a civil transport platform has proved useful to further enhance the algorithms for both civil and military application.

Desktop-based simulations are extremely useful tools for the development of new controller applications and techniques as is evident from the theoretical sections of this book. But, in addition to testing the new controllers in an off-line, desktop-based benchmark simulation, an online piloted moving-base simulator evaluation can give new insights into real-time performance issues, applicability in an operational environment and if applicable, handling qualities of different aircraft configurations. It can serve as a proof-of-concept and allows the assessment of the benefits of the controllers in terms of compensation for impaired aircraft control, performance improvements in failed configurations and lowering of pilot workload. For this purpose, the aircraft model and the fault-tolerant controllers can be implemented in a pilot-in-the-loop flight simulator. Pilots with operational experience on the aircraft in question can be used to assess the efficiency of the controllers and their influence on the handling of the aircraft. Ideally the pilot should not be aware of any differences in handling with the controller engaged for the normal fault free and damaged aircraft, and be able to perform normal flying tasks with satisfactory performance in both cases. To ensure an acceptable level of validity of this assessment, the fidelity of the simulator must be sufficiently high. In addition to the dynamic behaviour of the simulated aircraft model, aspects that influence the fidelity are the appearance and functionality of the flight displays, the feel in the flight controls, the presence and field of view of an outside visual system, and the characteristics of any motion system. To increase reproducibility of the evaluation, these parameters should be documented together with the assessment results. Integration of the controllers in a real-time aircraft simulation environment, which is necessary to perform the piloted evaluation, can help identify implementation issues which would forbid practical introduction in an actual aircraft flight control system. Reliance on physical parameters which are not measured in the aircraft (e.g. sideslip angle), sensitivity to noise and delays in measurements and excessive computational loads are examples of such problems. These issues can usually be evaluated without a pilot actively in control and lead to relatively deterministic results. A more operationally oriented evaluation with a human pilot in the loop introduces variability in the results. To reduce this variation, the experiment design benefits from a well defined test scenario, appropriate performance measures and other human factors related measurement variables. To select the appropriate scenario and measurements, the intended goal of the evaluation has to be taken into account. For a general impression of the flying qualities, a procedure such as an approach and landing can be suitable. If a more detailed insight is required in lateral and/or longitudinal performance or handling qualities, more stylized manoeuvres can be performed. Examples of these include altitude captures, speed and trim changes, bank and heading captures, as well as localizer and glideslope capture and tracking. Apart from the achieved performance, which can be objectively determined, pilot feedback in the form of comments or rating scales for handling qualities (e.g. Cooper-Harper [21]) and Pilot-in-the-Loop Oscillations (PIO) can be valuable subjective results.

As the survey of major aircraft accidents and incidents in Chapter 1 has shown, it is sometimes still physically possible to control a damaged aircraft while components such as control surfaces, engines or parts of the structure have failed. In some cases, (differential) engine control was used by the pilot to replace conventional control via the ailerons and elevators due to loss of the hydraulic system. In other cases, some control surfaces may still be operating to replace the failed ones. This redundancy can be exploited by an automated reconfigurable system which identifies the remaining control options and drives the available surfaces. Ideally, the system would also be able to cope with unforeseen failures and adapt itself accordingly. If the system takes the form of a manual fly-by-wire flight control algorithm, as opposed to a fully automatic system, the requirements on the (degraded) handling qualities also need to be taken into account. The system must provide the pilot with good handling qualities in normal flight conditions and acceptable handling qualities in failed conditions.

This chapter presents flight simulator results obtained by experienced pilots based on the EL AL flight 1862 (Bijlmermeer incident) scenario. The results in this chapter are the outcome of a controller evaluation ‘flight testing’ campaign and the GARTEUR AG16 final workshop at Delft University in November 2007. The results represent the successful real time implementation of a SMC controller in real time on the SIMONA 6-DOF flight simulator.

The transition of the potentially viable fault tolerant flight control methodologies, as developed and evaluated within this GARTEUR Action Group, towards practical applications, requires a critical look at the design and safety issues concerning the developed adaptive control methodologies as an integrated part of the flight control system. Therefore, the aim of this chapter is to provide an evaluation by representatives from industry to look at the potential of the results of this action group for industrial application. This also facilitates the necessary knowledge transfer between academia, research and industry which is one of the main principles of the GARTEUR framework and of this project. Clearly, the application of fault mitigating control technologies, or ‘intelligent’ adaptive control, has benefits in a wide area of industrial domains, but in this research, the evaluation has been focused on the potential within the aerospace community. It is not the intention to assess which of the developed fault tolerant control methodologies is the ‘best’, or has the best performance achieved in the benchmark as compared to other methods. Instead, the main objective is to assess the achieved maturity level, potential and open issues of the fault tolerant control designs, as developed in this action group, in terms of applicability, complexity, compatibility with (future) on-board processor requirements and overall flight safety. This also includes the innovative aspects of the presented control solutions to accommodate potentially catastrophic on-board system failures for recovery of the aircraft and ensure safe continuation of the flight or to improve the performance and operation of the aircraft in terms of economics and efficiency. It should be remembered that in this GARTEUR Action Group, adaptive control design concepts have been assessed on their viability, both from an aircraft performance and human factors aspect, while issues from an industrial design process perspective, including the required engineering tools, design process efficiency, synthesis and flight clearance have not been taken into account. This could, however, be the subject of a subsequent research programme in which the fault tolerant flight control algorithms that have been designed and demonstrated can be used as a starting point. The evaluation of the results of this GARTEUR Action Group, as described in this chapter, has been performed by several organisations. These include Airbus, representing the European aircraft manufacturing industry and Deimos-Space, an aerospace company specializing in industrialization of innovative guidance, navigation and control solutions.

The GARTEUR Action Group FM-AG(16) on Fault Tolerant Control, of which this book is the culminating result, has made a significant step forward in terms of bringing novel ‘intelligent’ self-adaptive flight control techniques, originally conceived within the academic and research community, to a higher technology readiness level. Although work still remains to be done before stringent safety and certification requirements are met, as stipulated by the industrial reviewers in the previous chapter, this book should provide a practical reference for the aerospace community on novel fault tolerant flight control techniques and their integration within the aircraft and cockpit environment. This includes studies on the application and integration issues of modern fault tolerant control techniques and a description of several innovative fault tolerant flight control methods. It is hoped that the promising results obtained in this project, and described in this book, will motivate the further maturing, testing and safe integration of the methods. Furthermore, it is hoped the book and the accompanying software will provide a reference, and benchmark for a critical review of new advanced flight control designs.