An Adaptive Fault-Tolerant FCS for a Large Transport Aircraft

An Adaptive Fault-Tolerant FCS for a LargeTransport Aircraft

Adolfo Sollazzo1, Gianfranco Morani2, and Andrea Giovannini3

1 Fault-Tolerant FCS

The final design of the flight control system with fault-tolerant characteristics isshown in Fig. 1. Such an FCS is made-up of several parts, first of all the robust

Fig. 1 The scheme of the final design of the Fault-Tolerant FCS

control laws that represent the core module of the controller, then a control allo-cation module which has the capability of distributing the control effort dependingon the availability of the actuation devices, whose efficiency condition is given bythe Fault-Detection and Identification module. The FDI module also gives informa-tion about the aircraft’s general behaviour and efficiency, thus allowing a supervisor

A. SollazzoItalian Aerospace Research Center - CIRA [email protected]

G. MoraniItalian Aerospace Research Center - CIRA [email protected]

A. GiovanniniItalian Aerospace Research Center - CIRA [email protected]

155

156 A. Sollazzo, G. Morani, A. Giovannini

module to manage the FCS in terms of estimated envelope protection, in additionto the attitude and rate limitations. Finally, an autopilot module, whose mode is se-lected by the panel, gives the attitude reference to the robust control law module forthe aircraft state regulation.The current state of the research in CIRA in the field of fault-tolerant flight controlsystems is focused on how to achieve robustness against actuator faults by meansof adaptive control techniques. While this topic and the control allocation are al-ready well assessed, the FDI techniques represent the next step forward towards thefinal design. In this chapter, the core module involving the robust control laws isdescribed and reported in detail, along with some descriptions of the autopilot mod-ule. The control module is based on the adaptive model-following technique, whilethe latter is designed by means of the classical sequential loop closure approach.The FCS is the main focus of this chapter and is depicted in Fig. 2. Its theoreticalbackground is recalled in the next section.

Fig. 2 The scheme of the current design of the Fault-Tolerant FCS

1.1 Adaptive Model-Following

Amongst the many different fault-tolerant control techniques [1], an AdaptiveModel Following strategy (AMF) [2], [3] has been selected. The AMF belongs to theModel Reference Control Strategy paradigm and it earns its robustness by means ofthe adaptive control technique [4]. This is a direct adaptive technique, whose strat-egy is to apply a control law, with a fixed structure, and with a gain matrices set thatensures two objectives, specifically demand tracking and stability. This techniqueconsists of a gain variation of the control loops to minimize the difference betweenthe reference model and the real plant behaviour. Several methods are present inthe literature with regard to the adaptation algorithm [2]-[5]. The one adopted inthe AMF is based on a Lyapunov strategy [2], [3]. It is worth remarking that thedirect adaptive strategy differs slightly from the indirect one [4]. The latter methodis based on the identification of the current plant parameters and the use of a fixedstructure control law, whose gains depend on the plant parameters. All the adaptivetechniques, in principle, do not imply the use of a FDI subsystem. This is a feature

An Adaptive Fault-Tolerant FCS for a Large Transport Aircraft 157

that makes these methods very attractive, because it allows the designer to focuson achieving the desired robustness level for the closed loop system. A further fea-ture of the AMF technique is its strong robustness against parameter uncertainty inthe system model, compared to classical control techniques. Moreover, the modelfollowing strategy lets the designer fix in a clear and simple way the reference dy-namics for the system. This is attractive for the designer who can also schedule thecontrol laws across the whole flight envelope, even though the design has been car-ried out in only one flight condition.In this section, some details about the AMF control technique [2] are reported. Con-sider the linear model of the plant:

x = Ax+Bu+dy = Cx (1)

where the term d represents the trim data for the state derivatives. The referencesystem dynamics are written as:

ym = Amym +Bmr (2)

where ym is the desired output for the plant, r is the given demand, and Am andBm represent the reference linear system dynamics. The control law structure is thefollowing:

u = C0 (G0x+v+ r+K0ym) (3)

where G0, C0 and v are terms evaluated by the adaptation rules, and K0 is a feed-forward gain matrix evaluated once. It is now possible to calculate the error function(tracking error) as follows:

e = ym−y (4)

and it is particularly interesting to evaluate the error dynamics, in terms of the plantparameters and the reference system dynamics:

ym−y = (CA+CBC0G0)x+CBC0r+CBC0v+CBC0K0ym +Cd−Amym−Bmr (5)

Assuming the desired error system dynamics, expressed as:

e = Aee+Φ (6)

where Ae is a stable and properly chosen matrix and Φ represents a bounded forc-ing function, it is possible to write the following identities to ensure the trackingobjective (ym = y):

CA+CBC∗0G∗0 = AeC

CBC∗0 = BmCBC∗0v∗ = −CdCBC∗0K0 = Am−Ae

(7)


The identities (7) facilitate writing expressions for the optimal terms G∗0, C∗0 , v∗ and

K0 to obtain a perfect model inversion that guarantees the asymptotic stability of theplant and asymptotic zero error:

G∗0 = B−1

m (AeC−CA)C∗0 = (CB)−1 Bmv∗ = −B−1

m CdK0 = B−1

m (Am−Ae)

(8)

It is evident that it is necessary for both Bm and CB matrix to be invertible. Whilethe former is a design parameter and can be chosen to be invertible, the latter, calledhigh frequency gain, is a structural characteristic of the plant. In fact, the right invert-ibility of the high frequency gain is linked to the capability of the control variablesto directly affect the output variables passing through the state variables. It is worthremarking that this is different from controllability and observability of the state-space representation since the realization of the double integrator A = [ 0 1 ; 0 1 ],B = [ 0; 1 ] and C = [ 1 0 ] is both controllable and observable, but has a null highfrequency gain matrix. The foregoing discussion does not take into account systemparameter variations. The non-linearity of the real system can be taken into accountby means of proper variation of the dynamic (A), input (B), output matrices (C), andtrim data (d). Moreover, uncertainty on the system parameters can also be modelledby proper variation of the aforementioned matrices and data. So, an adaptation ruleset is necessary to react to variations in the system parameters and uncertainty. Thealgorithm which will be adopted is a Lyapunov based and its structure is describedhere. First of all, define the differences between the actual adaptive parameters andthe optimal ones as follows:

∆G = G0−G∗0

∆Ψ = C∗−10 −C−1

0∆v = v0−v∗0

(9)

It is now possible to write expressions for the error dynamics taking into accountparameter variations. After some calculations [2] it can be shown:

e = Aee+Bm∆Gx+Bm∆Ψu+Bm∆v (10)

Now, Lyapunov stability condition for the error system will be investigated. Con-sider the Lyapunov candidate function:

V = eT Pe+ tr{∆GT ∆Gγ1

}+ tr{∆Ψ T ∆Ψγ2

}+∆vT ∆v

γ3(11)

where γi with i = 1, . . . ,3 are three positive scalars and P is the symmetric andpositive definite matrix solution of the Lyapunov equation:

ATe P+PAe =−Q with Q > 0 (12)


The derivative of V in (11) has the following expression (see [2]):

V = −eT Pe+2tr{ 1γ1

∆GT (∆ G+ γ1BT

mPexT )+

1γ2

∆Ψ T (∆Ψ + γ2BT

mPeuT )}+

1γ3

∆vT (∆ v+ γ3BT

mPe)

(13)

Choosing:G0 = −γ1BT

mPexT

C0 = −γ2C0BTmPeuTC0

v = −γ3BTmPe

(14)

nullifies the last three terms in the expression for the derivative in (13). Expressions(14) represent the adaptation rules for the control law parameters, affected by thethree scalars γi with i = 1, . . . ,3 in terms of adaptability rate. Finally, by taking intoaccount (14), (13) and (9) it is possible to obtain the non-positiveness of Lyapunovcandidate function derivative:

V =−eT Pe≤ 0 (15)

That ensures asymptotic stability for the error dynamic system.The next section describes how the technique above is actually implemented toachieve the required fault-tolerance.

1.2 The SCAS Architecture

The SCAS module is made of two nested sub-modules both designed by means ofthe adaptive technique described in the previous section. The inner module takescare of the angular rates, while the outer one copes with the control of the attitudeangles. This solution exploits the separation between the faster angular rate dynam-ics and the attitude angles dynamics, which are slower. The approach achieves asensible reduction in the control law complexity, that is to say the total number ofcontroller states is decreased with respect to an all-in-one control module. A de-tailed schematic of the SCAS architecture is depicted in Fig. 3, while the detailedgraphical description of each module is reported in Fig. 4.The variables reported in Fig. 4 directly refer to the adaptive model-following the-

ory described in Section 1.1. It is, now, worth giving a detailed description abouthow it is implemented. With reference to the variables of Section 1.1, the state, theoutput, the control and the reference vectors for the outer loop, the angular ratesregulator, are set-up as follows:


Fig. 3 The SCAS architecture

Fig. 4 The internal architecture of each SCAS module

x =[

vTAS, α, φ , θ]

y =[

φ , θ]

u =[

pdem, qdem, rdem]

r =[

φdem, θdem]

For the inner loop, the variables are set-up as:

x =[

vTAS, α, p, q, r]

y =[

p, q, r]

u =[

δAil, δEle, δRud]

r =[

pdem, qdem, rdem]

where the control variable, u, is left generically as the ailerons, the elevator and therudder commands. The design parameters of both the inner and the outer loops con-sist of a few matrices. First of all, the dynamics of the reference model are expressedin terms of the two matrices Am and Bm with the limitation that the former must bechosen with negative eigenvalues and the latter invertible. The desired error dynam-ics are chosen by means of Ae. The tuning of this matrix allows the modification ofthe system performance, in conjunction with the reference model parameters, but it


also affects the capability of rejecting noise and disturbances, so it has meaning interms of the real control system bandwidth. The matrix Q, used in the calculationof the Lyapunov matrix P (see eq.12), can be interpreted as a weighting matrix. Thetuning of this matrix makes it possible to trade off the tracking requirement, in termsof adaptability, of one or more output variables with respect to the others. Finally,the three parameters γ1, γ2 and γ3 are used to change the adaptive capability, thehigher the values of these parameters, the faster the adaptability. These parametershave been designed by means of a trial and error analysis.

1.3 Limitations And Practical Solutions

Adaptive model-following is a very robust control technique, but it also requiresseveral strong hypotheses to be verified. The first hypothesis concerns the necessityto avoid unmodelled dynamics. This need arises trivially because the control laws,and particularly the adaptation rules, cannot properly process the dynamics of thesystem, if this information is incomplete. The invalidity of the aforementioned hy-pothesis may lead to instability. Some authors [4] express this need by assuming thetransmission zeros have a negative real part. Even though the two assumptions aresubstantially different, they both deal with the same problem. In the case of unmod-elled dynamics, they can be made stable in closed loop if the zeros of transmissionare located in the negative real half plane.In the benchmark, both the actuators and sensors models do not have a dynamic rep-resentation, they only concern the nonlinearities and noise (in the case of the sen-sors). This is a particularly favourable condition for the adaptive model-followingtechnique and facilitates successful results.The second fundamental hypothesis for adaptive model-following concerns the highfrequency gain, that is the CB matrix. This matrix, as already discussed in Section1.1, needs to be full rank. In the benchmark no sensor failures are considered, thisavoids problems with the equivalent C matrix, whose rank never decreases. Similarassertions may be made concerning the equivalent B matrix. In fact, even thoughactuator failures are considered in the benchmark, the high redundancy level of thecontrol devices always ensures a sufficient number of control variables, hence avoid-ing non-right invertibility issues of the high frequency gain matrix.Finally, adaptive model-following is a control technique for linear plants. Thismeans that the non linearities in the plant may give problems, particularly thosenon linearities that cause abrupt variations in the plant behaviour. Some examplesof these kinds of non linearities are the actuators limits, both in terms of rate andposition, but also those like the stall conditions. All the non linearities are not treatedin the implementation of the adaptive model-following, here discussed. To deal withthe actuator limitations, it would be necessary to adopt techniques such as controlallocation [8]-[13] or similar techniques to rearrange the control effort [3]. The re-arrangement could be based on the knowledge of the limitations concerning thecontrol variables and, in the case of failures, of the current actuator condition. In the


FCS here described, the only way to avoid this kind of problem has been to reducethe performance as far as possible without going below an acceptable level.A harder problem is the stall condition. It is always necessary to include a properenvelope protection system. For instance, as is typically done in classical control, itwould be possible to consider a module to override the control laws when the flightcondition approaches stall. In the case of an FTC technique, in the case of structuraldamage, this is a very critical topic due to the higher complexity level of such a FCSand the interactions between the control laws and the envelope protection module.Moreover, in the case of heavy structural damage (as in the case of the Bijlmermeeraccident [6]) the stall angle may change significantly (from 15 to 8.5 degrees), so,while designing the envelope protection strategy, it is necessary to avoid destructiveinteractions between the control laws and the stall prevention system. Thus, two op-posite philosophies are possible: one could try to identify the new value of the stallangle by means of a proper FDI technique and to use it as a new threshold. Thelatter would adopt a safety rule by considering blindly a reduction in the supposedstall angle of a certain percentage of the nominal one. This technique was taken intoaccount in order to retain one of the main features of the FCS, that is to say, theabsence of an FDI subsystem. On the other hand, this represents a drawback dueto the performance reduction caused in all cases that do not involve a stall anglevariation with respect to the nominal one. In practice, this assertion relates to allthe benchmark cases except for the EL AL 1862 test scenario. This results from theweakness of a strategy that tries to recover stability in the case of severe structuraldamage without having knowledge of what has actually happened. In the FCS, de-scribed here, the stall prevention module involves two actions. The first concernsthe attitude angles (φ , θ ), whose references are both limited by means of a coupleof variable thresholds that depend on the current value of the angle of attack. Thesecond action refers to the attitude rates (p, q, r), whose references are modified tocounteract the stall condition when a stall condition is approached.

2 The Classic A/P

The Autopilot mode module employs a total of six modes, three longitudinal modesand three lateral modes. Both lateral and longitudinal autopilot modes are designedby means of classical control techniques, involving sequential loop closure, and byadopting schemes that use proportional/integral regulators (see [14]). A list of themodes is given in the following table. Moreover, in addition a classical autothrottlemodule has been designed for true airspeed regulation.


Table 1 List of Autopilot available modes

Longitudinal Lateral

Altitude Hold/Select Heading Hold/SelectGlideslope Intercept Localizer InterceptApproach Lon Approach Lat

3 Numerical Validation

The Fault-Tolerant FCS has been tested by means of the benchmark software en-vironment, described in chapter II. The SCAS architecture has been customised interms of the control variables, u, to match the control effectors set. The full set ofcontrol variables is reported in Table 2. It is worth adding that the A/P module pro-

Table 2 List of control variables

variable description

InAille f t the left inboard aileron commandInAilright the right inboard aileron commandOutAille f t the left outboard aileron commandOutAilright the right outboard aileron commandSp the spoilers commandSpspbrk the speedbrakes commandInElevs the inboard elevators commandOutElevs the outboard elevators commandRudupper the upper rudder commandRudlower the lower rudder commandHStab the horizontal stabilizer commandDi f f T hr the differential throttle command

vides the demand for the attitude angles, φ and θ , and the mean value of the throttlecommand to the engines.The benchmark environment includes a detailed model of the vehicle, and is ableto reproduce the actual behaviour even in faulty conditions. Figures 5 and 6 reportthe considered surface failure scenarios and the EL AL 1862 flight failure condition[6], [7]. The FCS has been tested in the face of each failure condition, while per-forming all the available manoeuvres (see chapter II for details). These manoeuvresrepresent the four phases of an emergency landing manoeuvre after a failure occursduring the initial climb phase. These manoeuvres are: straight flight, a right turn andlocalizer beam intercept, glideslope beam intercept and the final approach. All thetests have been carried out in turbulence and windy (uwind = 11 m/s, vwind = 12 m/s,wwind = 0 m/s) conditions.The results of the numerical tests are reported in terms of time histories of the mainquantities with respect to the fixed manoeuvre along with their desired and accept-able limits (see chapter 6 for details). Even though all the combinations of faulty


Fig. 5 The surfaces failure scenario

Fig. 6 The EL AL 1862 flight failure scenario

conditions and manoeuvres have been explored, it is not practical to report all thefigures here. Only the most meaningful results are reported here and, at the end ofthe section, a table with a summary of the test results is added to give an overviewof the fault-tolerance achieved thanks to the proposed FCS.One of the worse failure cases is the rudder runaway. In this situation, the rud-

der generates a strong yawing moment that reduces the directional manoeuvrability.This problem is particularly evident in the case of the right turn manoeuvre (seeFig.7), when it is necessary to generate a yawing moment opposite to the disturbingone to perform the turn. The performance is not really good, but stability is main-tained.The loss of the vertical fin seems not to be a critical failure (see Fig.8). The adap-


λ [d

eg]

States with specs

0 50 100 150 200−5

0

5

0 0.2 0.4 0.6 0.8 10

0.5

1Right Turn and LOC intercept

v TA

S [m/s

]

0 50 100 150 200

90

100

φ [d

eg]

0 50 100 150 200−40−20

02040

p [d

eg/s

]

0 50 100 150 200−2

0

2

q [d

eg/s

]

0 50 100 150 200−2

0

2

r [d

eg/s

]

0 50 100 150 200−2

0

2

α [d

eg]

0 50 100 150 20005

1015

β [d

eg]

0 50 100 150 200−10

0

10

nz

0 50 100 150 200−2

0

2

ny

0 50 100 150 200

−202

RC

max

[m/s

]0 50 100 150 200

−4−2

024

Fig. 7 Right turn and Localizer intercept with rudder runaway

λ [d

eg]

States with specs

0 50 100 150 200−5

0

5

0 0.2 0.4 0.6 0.8 10

0.5

1Right Turn and LOC intercept

v TA

S [m/s

]

0 50 100 150 200

90

100

φ [d

eg]

0 50 100 150 200−40−20

02040

p [d

eg/s

]

0 50 100 150 200−2

0

2

q [d

eg/s

]

0 50 100 150 200−2

0

2

r [d

eg/s

]

0 50 100 150 200−2

0

2

α [d

eg]

0 50 100 150 20005

1015

β [d

eg]

0 50 100 150 200−10

0

10

nz

0 50 100 150 200−2

0

2

ny

0 50 100 150 200

−202

RC

max

[m/s

]

0 50 100 150 200−4−2

024

Fig. 8 Right turn and Localizer intercept with loss of vertical tail


tive FCS is able to handle this condition without any problem, the performancesare also acceptable. The stuck elevator failure also does not represent a critical con-

Γ [d

eg]

States with specs

0 50 100 150−1

0

1

v TA

S [m/s

]

glideslope intercept

0 50 100 150

90

100

α [d

eg]

0 50 100 1500

5

10

15

p [d

eg/s

]

0 50 100 150−2

0

2

q [d

eg/s

]

0 50 100 150−2

0

2

r [d

eg/s

]

0 50 100 150−2

0

2

n Z [g

]

0 50 100 150−2

0

2

λ [d

eg]

0 50 100 150−5

0

5

RC

max

[m/s

]

0 50 100 150−8−6−4−2

0

0 50 100 150

−4

−2

0

2

γ [d

eg]

Fig. 9 Glideslope beam intercept with elevators stuck

dition in any of the considered manoeuvres, thanks to the stabilizer being used asan alternative control surface. As an example the glideslope intercept manoeuvre isconsidered, and it is evident the control laws manage the failure with no difficulties(see Fig.9).However, the stabilizer runaway is a quite important failure. During the glideslope

intercept, it is evident (see Fig.10) that the pitch down disturbing moment, gener-ated by the failed stabilizer, makes the aircraft dive quickly. The control laws ”workhard” to react and to reach the proper altitude to follow the beam. Here, the ab-sence of an FDI subsystem is evidently a drawback. The control laws suppose allthe surfaces are available and the control effort is distributed on this basis. If FDIinformation is available, starting from the knowledge of the failure, all the controleffort would have been moved onto the elevators.In Fig.11 the whole manoeuvre is performed in the case of rudder runaway. As dis-cussed earlier the right turn is the critical phase, but in this case the failure occursduring the early straight flight, so the aircraft has time to acquire a proper attitude toapproach the turn and the successive phases of the manoeuvre.The EL AL 1862 failure scenario is surely the most difficult condition (see Fig.12).This failure is particularly critical not only due to the reduced number of control ef-fectors available, but also due to the structural damage on the right wing that makesstrong and abrupt variations in the inertial and aerodynamical parameters, such as


the stall angle. This important parameter is significantly reduced as a result of thedamage. As the right turn phase starts, the angle of attack increases quickly, ap-proaching the new stall value, thus a persistent oscillation arises, slightly damped,but it only fades out when the right turn is almost accomplished.The following table gives a summary of the test results. First of all it is necessaryto define a classification able to give an idea of the overall effectiveness of the FCSto achieve stable flight and, if possible, good quality of performance. A four levelsscale is used as follows:

• Not critical (?). The failure condition is not critical both in terms of stability andperformance achieved;

• Negligibly critical (¦). The failure does not compromise the stability, but the per-formances are slightly degraded;

• Critical (¯). The failure results in strong reduction in performance even thoughstability can be maintained;

• Dramatically critical (•). The failure causes instability;

It is evident that stuck elevators, stuck ailerons and the loss of the vertical tail areeasily manageable failure conditions. However, stabilizer runaway and even moredramatically rudder runaway are critical failure conditions. Finally, the EL AL 1862failure case is quite manageable by means of the adaptive FCS, even though it is notalways possible to achieve acceptable performances.

Γ [d

eg]

States with specs

0 50 100 150−1

0

1

v TA

S [m/s

]

glideslope intercept

0 50 100 150

90

100

α [d

eg]

0 50 100 1500

5

10

15

p [d

eg/s

]

0 50 100 150−2

0

2

q [d

eg/s

]

0 50 100 150−2

0

2

r [d

eg/s

]

0 50 100 150−2

0

2

n Z [g

]

0 50 100 150−2

0

2

λ [d

eg]

0 50 100 150−5

0

5

RC

max

[m/s

]

0 50 100 150−8−6−4−2

0

0 50 100 150

−4

−2

0

2

γ [d

eg]

Fig. 10 Glideslope beam intercept with stabilizer runaway


100 200 300 400 500

States

0 100 200 300 400 500−20

0

20

φ [d

eg]

100 200 300 400 500 0 100 200 300 400 5000

5

10

θ [d

eg]

100 200 300 400 500 0 100 200 300 400 5000

200

400

ψ [d

eg]

100 200 300 400 500 0 100 200 300 400 500400

600

800

h [m

]

100 200 300 400 500 0 100 200 300 400 500−4

−2

0x 10

4

x [m

]

100 200 300 400 500time [s]

0 100 200 300 400 500−1

0

1x 10

4

y [m

]

time [s]

Fig. 11 Entire emergency manoeuvre with rudder runaway

100 200 300 400 500

States

0 100 200 300 400 500

−20

0

20

φ [d

eg]

100 200 300 400 500 0 100 200 300 400 5000

5

10

θ [d

eg]

100 200 300 400 500 0 100 200 300 400 500

200

300

400

ψ [d

eg]

100 200 300 400 500 0 100 200 300 400 500200

400

600

h [m

]

100 200 300 400 500 0 100 200 300 400 500−4

−2

0x 10

4

x [m

]

100 200 300 400 500 0 100 200 300 400 500−5000

0

5000

10000

y [m

]

Fig. 12 Entire emergency manoeuvre in the case of flight EL AL 1862 failure scenario

4 Future Development

In this section some preliminary results of further developments are shown. A Con-trol Allocation module is used to improve robustness of the closed loop system and


Table 3 Summary of results

Straight Flt RT and LOC Glideslope Full Manoeuvre

Stuck Elevators ? ? ? ?Stuck Ailerons ? ? ? ?Stabilizer runaway ¦ ¯ ¯ ¦Rudder runaway ¦ ¦ ¯ •Loss of Vertical Tail ? ? ? ?EL AL 1862 case ? ¦ ? ¯

to achieve a better management of the control effector ranges. The module exploitsthe Active Set method whose original implementation is fully discussed in [10].With reference to the scheme of Fig.1, the aforementioned module would need aFDI module (not developed yet) and so a strong hypothesis is made here. A simpleactuator monitoring system is assumed to be present and fully efficient, thus a stuckor runaway failure is supposed to be accurately reported within a delay of 4 seconds.It is worthwhile remarking that the only data the monitor provides, is a logical onesuch as healthy/failed and therefore information about the kind of failure which hasoccurred or the position of the failed surface are not assumed to be available.

Two failure conditions make evident the improvement which can be achievedby adopting a control allocation strategy in conjunction with the adaptive modelfollowing, one is the rudder runaway while performing the right turn manoeuvre.Figure 13 shows both the achievable trajectory with (red line) and without (blue line)the Control Allocation module. Moreover, in Fig.14 the time histories of some statevariables are reported. The black dashed lines represent the results obtained with thecontrol allocation, while the blue solid lines represent the ‘adaptive only’ technique.It is evident how the control allocation module gives smoother manoeuvres. The

Fig. 13 Rudder runaway failure case, improvements achievable thanks to control allocation: tra-jectory

second condition chosen is the horizontal stabilizer failure, while flying straight and


50 100 150 200 0 50 100 150 200150

200

250

300

350

400

ψ [d

eg]

50 100 150 200 0 50 100 150 200−4

−2

0

2

4

r [d

eg/s

]

20 40 60 80 100 120 140 160 180 200 220

AMF

AMF+CA

(a)

20 40 60 80 100 120 140 160 180 200 220

20 40 60 80 100 120 140 160 180 200 220

20 40 60 80 100 120 140 160 180 200 220

20 40 60 80 100 120 140 160 180 200 220

AMFAMF+CA

(b)

Fig. 14 Rudder runaway failure case, improvements achievable thanks to control allocation: timehistories

with level wings. The results are reported in Fig.15, using the line style meaning aspreviously used. The improvements achieved are evident.

5 Conclusions

The numerical tests demonstrate that the adaptive model-following technique canbe applied successfully to recover from the surface failures in the presence of suf-ficient remaining control efficiency. In the face of structural damage, (El Al 1862case) the control laws adopted are again efficient as long as their applicability hy-potheses remain valid, that is to say controllability, observability and the absence of


10 20 30 40 50 0 10 20 30 40 502

3

4

5

6

7

α [d

eg]

10 20 30 40 50 0 10 20 30 40 50−2

−1

0

1

2

q [d

eg/s

]

5 10 15 20 25 30 35 40 45 50

AMF

AMF+CA

(a)

5 10 15 20 25 30 35 40 45 50

5 10 15 20 25 30 35 40 45 50

5 10 15 20 25 30 35 40 45 50time [s]

AMFAMF+CA

(b)

Fig. 15 Stabilizer runaway failure case, improvements achievable thanks to control allocation

unmodelled dynamics. In fact, the main weak point of the FCS, as has been shownby the numerical tests, is the poor ability to recover steady flight, while the enve-lope limits are exceeded. In this condition the aircraft behaviour abruptly changes,thus representing a critical situation for the adaptive control and a real threat to sta-bility. This condition is particularly critical in the case of structural damage, whenthe envelope limits may change significantly. A proper solution should be adoptedto achieve more efficient envelope protection, so preserving the validity of the hy-potheses necessary for the applicability of the adaptive control technique.

Concerning the performances achieved in faulty conditions, it is fair to say thatthey are slightly degraded if compared with those of the nominal conditions. In de-tail, in the case of surface damage, the performance loss is not so evident, but inthe case of structural damage, the behaviour of the aircraft is significantly differentfrom the nominal case. Furthermore, the aircraft dynamics are also made worse by


the flight conditions which are really close to the stall limit. It is worthwhile remark-ing that, in the case of stuck surfaces, the damaged ones are considered locked at anearly neutral position. In these conditions, the disturbing moment which is gener-ated is almost negligible, thus the unfailed surfaces are efficient enough to providethe manoeuvrability necessary for attitude control. This is the reason that these fail-ure conditions are quite simple to recover from.

In the case of surfaces locked out of their neutral position (e.g. see the stabilizerand rudder runaway), the adaptive model-following control laws may not be suffi-cient to recover stable flight and they need the help of a specific technique such ascontrol allocation - along with a broader set of information about the current stateof the actuators (need of a FDI subsystem).

The adaptive model-following scheme represents an attractive starting point tobuild up a fault-tolerant FCS. That is to say, it can be used successfully as the corecontrol law, but it should be integrated with several other modules such as a con-trol allocation system (to efficiently and quickly redistribute the control effort) aFDI subsystem (for providing information to the control allocation system to giveinformation about the new flight envelope limits) and to ensure a consolidated setof feedback signals. A further optional module could be a proper supervisor ableto reconfigure the trajectories starting from knowledge of the current flight enve-lope limits (e.g. right turn not safe but left turn possible) and the control devicesavailability.

References

1. Patton, R. J.: Fault-Tolerant Control Systems: The 1997 Situation. Proc. of the IFAC Sympo-sium on Fault Detection, Supervision and Safety for Technical Processes, Vol. 2, (1997)

2. Kim, K.S., Lee, K. J. and Kim, Y.: Reconfigurable Flight Control System Design Using DirectAdaptive Method. Journal of Guidance, Control, and Dynamics Vol. 26, No. 4 (2003)

3. Tandale, M. and Valasek, J.: Structured Adaptive Model Inversion Control to SimultaneouslyHandle Actuator failure and Actuator Saturation. Proc. of the AIAA Guidance, Navigationand Control Conf., (2003)

4. Bodson, M., Groszkiewicz, J. E.: Multivariable Adaptive Algorithms for ReconfigurableFlight Control. IEEE Transactions on Control Systems Technology, Vol. 5, No. 2 (1997)

5. Boskovic, J. D. and Mehra, R. K.: Multiple-Model Adaptive Flight Control Scheme for Ac-commodation of Actuator Failures. Journal of Guidance, Control, and Dynamics, Vol. 25, No.4, (2002)

6. Smaili, M. H.: Flight Data Reconstruction and Simulation of the 1992 Amsterdam Bijlmer-meer Airplane Accident. AIAA Modeling and Simulation Technologies Conf., (2000)

7. Smaili, M. H., Breeman, J., Lombaerts, T. J. and Joosten, D. A.: A Simulation Benchmark forIntegrated Fault Tolerant Flight Control Evaluation. AIAA Modeling and Simulation Tech-nologies Conf., (2006)

8. Durham, W .C.: Constrained Control Allocation. AIAA Journal Of Guidance, Control, AndDynamics Vol. 16, No. 4 (2002)

9. Bodson, M.: Evaluation of Optimization Methods for Control Allocation. AIAA Journal OfGuidance, Control, And Dynamics Vol. 25, No. 4 (2002)

10. Harkegard, O.: Efficent Active Set Algorithms for Solving Constrained Least squares Prob-lems in Aircraft Control Allocation. Proc. of the 41st IEEE Conf. on Decision and Control,(2002)


11. Virnig, J. and Bodden, D.: Multivariable Control Allocation and Control Law Conditioningwhen Control Effector Limit. Proc. of the AIAA Guidance, Navigation and Control Conf.,(2000)

12. Enns, D.: Control Allocation Approaches. Proc. of the AIAA Guidance, Navigation and Con-trol Conf., (1998)

13. Buffington, J. and Chandler, P.: Integration of on-line system identification and optimization-based control allocation. AIAA Guidance, Navigation, and Control Conf., (1998)

14. van Keulen, R.: Real-time Simulation and Analysis of the Automatic Control System of theBoeing 747/200. MA Thesis, Technical University of Delft, (1991)

An Adaptive Fault-Tolerant FCS for a Large Transport Aircraft

Documents

Transcript of An Adaptive Fault-Tolerant FCS for a Large Transport Aircraft