Actuators Fault Diagnosis and Tolerant Control for ... - Semantic Scholar
Actuators Fault Diagnosis and Tolerant Control for an Unmanned Aerial Vehicle Fran¸cois Bateman, Hassan Noura and Mustapha Ouladsine Abstract— In this paper a fault detection and isolation (FDI) method coupled with a fault tolerant control system are developed in order to deal with control surface failures for an Unmanned Aerial Vehicle (UAV). The failures considered are stuck control surfaces which occur during the aircraft manoeuvres: turn, velocity and slope variations. These faults are difficult to detect and to isolate. On the one hand they are soft variations and the aircraft is equipped with a controller which mask them, on the other hand redundancies offered by the control surfaces cause problems of isolability. The Fault Detection and Isolation system proposed here is based on a signal processing approach and drives a Fault Tolerant Control System (FTCS) built with a bank of Linear Quadratic controllers.
I. INTRODUCTION Airworthiness of UAVs in the civil and military airspaces requires increasing their reliability. As regards Flight Control Systems (FCS), they are among the most critical equipments of these aircrafts. Therefore, fault diagnosis and accommodation strategies have to be considered at early stage. Because of weight and cost constraints, multiple hardware redundancies are difficult to implement and the Self-Repairing Control System (SRCS) has to use the standard configuration of the UAV to fit it to the considered fault. Regarding the control surface failures, some difficulties tackled in this paper have to be underlined: • in case of asymmetric actuator failure, the noncoupled longitudinal and lateral-directional axis hypothesis are not valid and a complete non-linear model of the UAV which takes into account these couplings has to be considered, • the UAV is equipped with an autopilot which masks the failure effects, • the control surfaces offer redundancies which makes difficult the fault isolation, • because of these redundancies, when a fault occurs, a strategy of re-allocation of the healthy actuators has to be implemented. Numerous research efforts have been made in the fields of fault diagnosis and fault tolerant control applied to F. Bateman is with LSIS and Ecole de l’air, 13300 Salon de Provence, France, [email protected] H. Noura is with Laboratoire des Sciences de l’Information et des Syst` emes (LSIS), Universit´ e Paul C´ ezanne , Aix Marseille III, Domaine Universitaire de St J´ erˆ ome, 13397, France, has-
aircraft. For fault diagnosis, model-based approaches use a mathematical model of the monitored system to generate residuals. These methods implement Kalman filters [1], [2], [3], Unknown Input Observers, multi-model of failure approach [4], [5] or polynomial methods to design disturbance de-coupling residual generator linear filters [6]. Other FDI Methods based on signal processing have been proposed in [7] where diagnosis is realized using wavelet analysis. A Discrete Fourier transform analysis associated with a least square algorithm was proposed in [8]. The joint problem of control surface failure diagnosis and accommodation applied to aircraft has been treated with banks of controllers in [9] and [10]. A complete failure estimation and restructuration strategy using KF is proposed in [11]. In [12], a complete FDI and FTC using neural networks was implemented. In this paper, the proposed fault detection method consists in superimposing an excitation signal on the control vector as proposed in [2], this signal disrupts the state vector only if a failure occurs. Once the fault is detected, an isolation process is started, each one of the control surfaces is excited with a specific signal which constitutes its signature. The isolation consists in identifying the presence or the absence of this signature in the measurements. When the actuator failure occurs, the equilibrium of forces and moments is broken and significant couplings appear between the longitudinal and the lateral axis. In order to find a new equilibrium, the fault-free mode control surface deflection constraints1 are relaxed, the (FTCS) takes advantage of the redundancies offered by the control surfaces and controls each one separately. The method proposed is a low computational load one and could be implemented for low-cost UAVs. This paper is organized as follows. Section II describes the UAV used for this study and the class of failures considered. In section III the FDI method based on a signal processing approach is described. Section IV presents the accommodation strategy and simulation results are shown in section V. II. UAV AND FAILURE DESCRIPTION A. UAV Description The aircraft studied is a real single-engined with high wing. As Fig. 1 displays, the UAV is provided with seven
[email protected] M. Ouladsine is with Laboratoire des sciences de l’Information et des Syst` emes [email protected]
1 differential deflection of ailerons, symmetric deflections of elevators and flaps.
control surfaces and a throttle. In the presence of a control surface failure, these controls provide redundancies used to keep the aircraft in flight. r ig h t e le v a to r
d e r
r ig h t a ile r o n
d a r
d r > 0 r u d d e r le ft e le v a to r
d e l > 0
r ig h t fla p
d fr
le ft fla p
p r o p u ls io n
d fl > 0
le ft a ile r o n
d a l > 0
B. Model of the failures
d x
Fig. 1.
ment technique. As far as the longitudinal axis is concerned, the UAV disposes of two control inputs: elevators and throttle, thus an external closed-loop control with proportional-integral controller is designed for the true airspeed and the aerodynamic slope γ = θ−α. As regards the lateral-directional axis, the only output controlled is the bank angle ϕ. Next, controlling the turn of rate ψ˙ is equivalent !to control the bank angle ϕ , indeed à V ψ˙ . ϕ = atan g
The UAV Mistral and its 8 actuators
A nonlinear model of the UAV assumed to be rigid body and constant weight was built around a six degrees of freedom platform. The state vector X = [ϕ, θ, V, α, β, p, q, r]T where ϕ is the bank angle, θ the pitch angle, V the true airspeed, α the angle of attack, β the sideslip, p the roll, q the pitch, r the yaw. The control vector U = [δx , δar , δal , δf r , δf l , δer , δel , δr ]T where δx is the throttle, δar , δal the right and left ailerons, δf r and δf l the right and left flaps, δer and δel the right and left elevators and δr the rudder. Control surface deflections are bounded amplitudes and velocities. Atmospheric disturbances W such as wind gusts are modeled using a Dryden spectra. For this aircraft, all the state vector is measured. The UAV equations issued from aircraft flight mechanics are not detailed in this paper, nevertheless the model can be represented by the equations:
The failures considered in this paper are actuators which are stuck in their current positions. In fault-free mode, the control input vector is fixed to a trim position Ue and u corresponds to the variations of the control around the trim: U = Ue + u
(4)
The jamming of the control surfaces is described with an additive model: U f = Ub + ΓU
(5)
where Γ = diag(α1 , ..., αi , ..., α8 ), i min ≤ Ubi ≤ δimax when • αi = 0 et Ub = δi (tf ) avec δi th the i control surface is stuck, tf is the time of the failure occurence, j th • αj = 1, Ub = 0 when the j control surface is healthy. III. FAULT DIAGNOSIS A. Failure detection
The actuator failure detection can be achieved by detecting variations in the aircraft angular rates. The fault detection method uses the redundancies offered by the The state equations (1) are linearized around an operat- control surfaces. It consists in exciting all the actuators ing point and a linear model (2) useful to design the FDI with square signals with a period T and amplitudes chosen in the kernel of the control matrix B. The period is provided. T must be compatible with the aircraft dynamic and x˙ = Ax + Bu (2) the amplitudes must not disrupt the state vector. In the fault-free mode, the excitation vector uex is really applied where the control matrix B is: to the aircraft, as this vector is in the kernel of the control 0 0 0 0 0 0 0 0 matrix B, it does not disrupt the state vector. When 0 0 0 0 0 0 Bθδr Bθδx Bvδx Bvδar Bvδal Bvδf r Bvδf l Bvδer Bvδel 0 a failure occurs, the state vector is disrupted and the B state variables contain a signal with period T . Detecting B B B B B B B αδx αδar αδal αδf r αδf l αδer αδel αδr Bβδ 0 0 0 0 0 0 Bβδr x a fault consists in detecting this signal component in Bpδar Bpδal Bpδf r Bpδf l Bpδer Bpδel Bpδr the measured state variables and especially in the roll 0 0 Bqδar Bqδal Bqδf r Bqδf l Bqδer Bqδel Bqδr 2 p . So the measured roll is continuously correlated 0 Brδar Brδal Brδf r Brδf l Brδer Brδel Brδr with a sinusoidal signal of period T . Then, this cross(3) correlation function is integrated and the result Σ Rpm (t) Because of the redundancies, the column rank of matrix is continuously monitored: Z t B is 6 and the size of its kernel is 2. This property of B ΣRpm (t) = Rpm (τ )dτ (6) is useful to design the excitation signal. t0 For the fault-free mode, two controllers are set up for the longitudinal and lateral−directional state vari2 For an aircraft, the roll mode is the state variable which has the ables. They are carried out using eigenstructure assign- fastest dynamic. X˙ Y
= f (X) + g(X)U + h(X, W ) = X
(1)
When ΣRpm (t) exceeds a threshold, a failure is detected. This threshold depends on the manoeuvre made, particularly when the UAV turns, the angular velocities are strongly modified and in fault-free mode, the signal ˙ The conseΣRpm (t) increases with the turn of rate ψ. quences of this are possible false alarms. To avoid this, the threshold σ is calibrated according to the turn of rate ˙ variations ∆ψ.
˙ + σ0 σ = |∆ψ|
pm (t) sin ωδar t
×
sin ωδf l t
×
sin ωδer t
×
(7) ×
sin ωδel t
with σ0 the threshold used during flight level (ψ˙ = 0).
B. Failure isolation
Because of the redundancies, the failures which may affect the ailerons δar , δal and the flaps δf r , δf l are difficult to isolate. The isolation method proposed here allows to overcome this problem. Once the fault has been detected, each control surfaces is excited with a which constitutes its signature. For specific signal uex i the control surface δi ∈ U , this signature is a sinusoidal signal with amplitude δˆi and pulsation ωi which is called characteristic pulsation of δi . The amplitudes of these excitations must be sufficient to disrupt the state variables without increasing the effects of the failure. They are set in order to produce the same amplitude variations about the measured roll (this constraint is not feasible for the elevators which are not designed to produce roll, nevertheless elevator excitations have sufficient amplitudes to produce significative signatures on the roll). The characteristic pulsations must be compatible with the actuators and with the UAV dynamics. When the control surface δi is stuck, its signature uex i is not detectable in the measurements which contain all the characteristic pulsations except ωi . Isolating the faulty control surface δi , it is showing the absence of the characteristic pulsation ωi in the measurements.
rδar
R t+T ′
sδar
t
rδf l R t+T ′
sδf l
t
rδer R sδer t+T ′ t
rδel R t+T ′ sδel t
Fig. 2.
Isolation process
The signal processing method for fault isolation is applied to the roll p which has the fastest dynamic. Suppose that the faulty control surface is δi and the healthy actuators are indexed j. The measured roll pm writes: X pˆj sin(ωj t + φj ) (8) pm (t) = p(t) + j6=i
p(t) contains the following components : the current manoeuvre effects and the failure effects. During the isolation phase, this signal moves slowly in front of the characteristicµpulsations. ¶ As for the phase φj , its p(jωj ) . expression is arg δj (jωj ) The isolation is achieved by multiplying the signal pm with sinusoidal signals named carriers with pulsations equal to the characteristic pulsations ωk = {ωj , ωi }: rk (t) = pm (t)sin(ωk t + φk )
(9)
rk (t) = p(t)sin(ωk t + φk ) X pˆj ³ £ ¤ cos (ωj − ωk )t + φj − φk + 2 j6=i £ ¤´ (10) − cos (ωj + ωk )t + φj + φk
Conditions about characteristic pulsations: ωj are chosen such as |ωj − ωk |min is a greatest common factor of ωk , |ωj − ωk | and ωj + ωk . Next rk (t) is integrated for a duration multiple of T ′ = 2π : |ωj − ωk |min Z t+T ′ sk (T ′ ) = rk (τ )dτ (11) t
•
when the carrier has a pulsation ωk = ωi (the signature of the faulty actuator δi ), as p(t) does not contain component of pulsation ωi , the signal si (T ′ ) can be written as (remember that p has slow variations in comparison with the carriers): Z t+T ′ si (T ′ ) = p(τ )sin(ωi τ + φi )dτ ≃ 0 (12) t
•
when the pulsations of the carriers ωk 6= ωi , it results from the choice of the integration duration T ′ that for all j 6= k, the integrals of sinusoidal terms of pulsations (ωj + ωk ) and |ωj − ωk | are zeros, they differ from zero if ωj = ωk and sk (T ′ ) becomes:
more solicited than others (for example, when the right aileron fails, the demand made by the left aileron is the most important). In order to balance the demands on the healthy actuators, weights in the Ri matrix are adapted to each failure.
Vc γc ϕc
Lnom
+ − 6
R
L−δel
When a failure is detected and isolated the control surface deflection constraints are relaxed and each one of the healthy actuators is controlled separately. Some studies have shown that for this aircraft, thanks to the redundancies, this strategy of control allowed to reach an operating point close from the fault-free mode operating point and maintained the UAV controllable. Consequence of this, the faulty model of the UAV remains close to the nominal model, so for the faulty-case a set of controllers may be pre-computed. As the 7 control surfaces may be faulty, 7 controllers are designed and implemented as Fig.3 shows. K −δi , L−δi are Linear Quadratic controllers designed to compensate for the faulty control surface δi . ¡ −δ ¢ K i L−δi = Ri GTi Pi (15) with Pi the algebric Riccati solution of:
F T Pi + Pi F T + Qi − Pi Gi Ri−1 GTi Pi = 0 where matrices F , Gi and C are: ¶ µ −δ ¶ µ A 08×3 B i Gi = F = C 03×3 03×7 0 0 1 0 01×4 C = 0 1 0 −1 01×4 1 0 0 0 01×4
-C
ϕ
θ Knom¾ V
α K β p K −δr ¾ q r 6 −δel¾
L−δr
sk (T ′ ) =
IV. FAILURE COMPENSATION
+ - UAV ? model + ? 6 6
pˆj sk (T ′ ) = cos(φj − φk ) (13) 2 Theµknowledge ¶ of the transfer functions gives: φj = p(jωj ) arg and the phase of the carrier φk is δj (jωj ) chosen equal to φj , then: pˆj (14) 2 To sum up, when δi is faulty, the signal si (T ′ ) is zero or close to zero and the signals sk ∀k 6= i are other than zero.
?
V Supervisor¾ FDI ¾ γ ϕ
Fig. 3.
Bank of controllers
V. SIMULATIONS AND RESULTS For the detection, square signals of period T = 3s and amplitudes chosen in the kernel of the control matrix B are added to the control input. ¡ uex = 0.7
−2.6◦
−1.6◦
3.6◦
4◦
3.9◦
−3.7◦
¢T 0◦ (19)
Note that δr is equal to 0◦ , it means that the method proposed above does not allow to detect failures on δr . This could be explained physically by the lack of redundancy for this control surface. The following manoeuvres are realized: at t = 10s, a true airspeed variation, at t = 30s a slope variation and a flat turn on the time interval [40, 60s]. As is shown by Fig. 4, the effects of the excitation on control inputs are significant, nevertheless on Fig. 5 the state vector is not disrupted. At t = 61s the right aileron fails, the fault is detected, next the excitation is not applied. throttle δx (%) 25 20
(16)
15 10 5 0 0
10
20
30
40
50
60
70
80
50
60
70
80
50
60
70
80
right aileron δar (°)
(17)
5
0
-5 0
10
20
30
(18)
B −δi is the matrix B deprived of the column associated with the faulty control surface δi . The weighting matrices Qi and Ri are chosen with the Bryson criterion. However in order to compensate the failure, some actuators are
40
right elevator δer (°) 5
0
-5 0
10
20
Fig. 4.
30
40
Signal processing for fault detection
TABLE I Signatures for the isolation
true airspeed V m.s-1 23 22 21 20 19 0
10
20
30
40
50
60
70
80
aerodynamic slope γ (°)
δj ωδj (rad/s)
1.28
δˆj φk (◦ )
2 0
δar 24 (10− 20 )−1 119
δal 20
δf r 16
δf l 12
δer 8
δel 4
1 −56
1.88 130
1.62 −41
8
4
-2 -4 -6 0
10
20
30
40
50
60
70
Bode Diagram
80
From: dar
From: dal
From: dfr
From: dfl
20
bank angle φ(°) 15
10 10
0 -5 0
10
20
30
40
Fig. 5.
50
60
70
80
detection
Fig. 6 details the detection process through another simulation. A t = 20s the UAV engages a flat turn, the roll p and the fault-detection signal ΣRpm increase. To take into account these effects resulting from the manoeuvre, the threshold σ is matched to the turn of rate variation. At t = 21s the right aileron is stuck in its current position. The failure is detected at t = 22.35s and the isolation process is triggered. right aileron δar fails at t=21s 5 0 -5 -10 0
5
10
15
20
25
30
35
40
25
30
35
40
30
35
40
roll p (°/s) 0.5 0 -0.5 -1 0
5
10
15
20
threshold σ and fault detection signal ΣRpm 0.4 0.2 0 0
5
10
15
20
25
signals sk for the fault-isolation 0.05 0
s
δ
-0.05 0
ar
5
Fig. 6.
10
15
20
25
30
35
40
Signal processing for fault detection and isolation
For the isolation, the characteristic pulsations are chosen as the Table I indicates. They respect the conditions about the characteristic pulsations mentioned above. The excitations have to produce the same amplitude variations on the roll p, thus their amplitudes δˆj may be chosen by mean of the magnitude Bode diagrams represented on Fig.7 (due to lack of place, those of δer and δel are not shown here). The third row of Table I shows the normalized amplitude excitations for each one of the control surface, the detail of the calculation is provided for δar . The Bode phase diagram gives the phases of the carriers φk useful to maximize sk (T ′ ) in (13).
Magnitude (dB) ; Phase (deg) To: p To: p
5
0 System: untitled1 -10 I/O: dar to p Frequency (rad/sec): 24 M agnitude (dB): -1.28 -20
System: untitled1 I/O: dal to p Frequency (rad/sec): 20 Magnitude (dB): -0.0911
System: untitled1 I/O: dfr to p Frequency (rad/sec): 16 Magnitude (dB): -5.48
System: untitled1 I/O: dfl to p Frequency (rad/sec): 12 Magnitude (dB): -4.16
-30 -40 360 270 180 90 System: untitled1 I/O: dar to p Frequency (rad/sec): 24 0 Phase (deg): 119 -90 0 10
System: untitled1 I/O: dfr to p Frequency (rad/sec): 16 Phase (deg): 130 System: untitled1 0 10to p I/O: dal Frequency (rad/sec): 19.9 Frequency (rad/sec) Phase (deg): -56.1
Fig. 7.
0
10
System: untitled1 I/O: dfl10 to0p Frequency (rad/sec): 12 Phase (deg): -41.6
Bode diagrams
From t = 22.35s to t = 25.5s, the isolation process is started as shown on Fig.6. During this interval, the roll p is made up of the sum of the signatures except for the right aileron signature. This signal is multiplied by carriers which pulsations are equal to those in the second row of Table I. Next the results are integrated on a duration T ′ to generate the signals sk . At t = 25.5s, the result of the integration is examined and the zero signal sδar indicates the faulty control surface δar . Note that the duration has been chosen equal to ¶ µ integration 2π ′ . T = 4 The accommodation strategy is illustrated on Fig. 8 (beginning of the flat turn and right aileron failure) and Fig. 9 (end of the flat turn) whereas the UAV banks with a high turn of rate (360◦ /20s). A fault on δar occurs at t = 21s, when it has been detected and isolated, a precomputed linear quadratic controller designed for this failure is selected. In the first case (red dash-dot), the cœfficients in the weighting matrix Rδar are set with the same values and the commutation is sharp. In the second case (black dash), to take into account the fact that the demand made on δal is more important, the cœfficient is twice as in the first case and the commutation is softer. The nominal, faulty and accommodated trajectories of the aircraft are presented on Fig. 10 whereas an aileron failure occurred at t = 21s. This failure is not critical because an aircraft could be designed and fly with only one aileron. However, in case of failure and without accommodation the aircraft slips and this fact may be critical during the landing stage.
bank angle φ(°) 50 40 30 20 10
t
failure
0 45
46
47
48
49
50
51
52
53
54
55
left aileron δal (°)
250
5 0
200
-5
150 -10 45
46
47
48
49
50
51
52
53
54
nominal flight path
55
500
100
rudder δr (°)
400
flight path with faulty aileron 300
15
50
200
flight path with accomdation
10
100
5
0
0
700
-5 45
46
47
48
49
Fig. 9.
50
51
52
53
54
55
600
500
400
300
200
Fault accommodation Fig. 10.
100
0
-100
0 -100 -200 -300 -400 -500
Flight path
References VI. CONCLUSIONS
[1]
An actuator fault diagnosis coupled with a fault tolerant control have been proposed. The diagnosis method is based on a processing signal approach and allows to deal with redundancies. An accommodation strategy using Linear Quadratic controller has been implemented, nevertheless, the commutations between the normal mode controller and the faulty mode controller remain abrupt. At present, a soft commutation method is studying, it consists in computing on-line a new operating point such as the faulty equilibrium state and control vectors remain as close as possible to the nominal equilibrium state and control vectors. This strategy requires an estimation of the faulty control surface position. As the failure has yet been detected and isolated, a unique Kalman filter which state vector has been augmented by the failed input state variable equation may be used. This solution should be of a lesser computational load and faster than the one which uses a bank of Kalman filters.
bank angle φ(°) 50 40 30 20 10 0 20
25
30
35
30
35
30
35
left aileron δal (°) 0 -20 -40 -60
failure
detection isolation
accommodation
-80 20
25
rudder δr (°) 20 10 0 -10 -20 20
25
Fig. 8.
Fault accommodation
C. Hajiyev, F. Caliskan, Sensor and control surface/actuator failure detection applied to F16 flight dynamic, Aircraft Engineering and aerospace technology (2), 2005, pp.152-160. [2] G. Ducard, A Reconfigurable Flight Control System based on the EMMAE Method, American Control Conference, Mineapolis, USA, 2006, pp.5499-5504. [3] T. Kobayashi and D.L. Simon, Application of a bank of Kalman filters for aircraft engine fault diagnostics, NASA Report 212526, 2003. [4] R. Hallouzi, M. Verhaegen, S. Kanev, Model weight estimation for FDI using convex faults models, 6th IFAC symposium on fault detection, supervision and safety on technical processes, Beijing, China, 2006, pp.847-852. [5] S. Samar, D. Gorinevsky, S.P. Boyd, Embedded estimation of fault parameters in an unmanned aerial vehicle, Conference on Control Applications, Munich, Germany, 2006, pp.3265-3271 [6] A. Marcos, S. Ganguli, G.J. Balas, An application of H∞ fault detection and isolation to a transport aircraft, Control Engineering Practice (13), 2005, pp.105-119. [7] J.L. Aravena, F.N. Chowdhury, Fault detection of flight critical systems in Proc. 20th , Digital Avionics Systems Conference, October 2001. [8] M. Napolitano, Y. Song, B. Seanor, On-line parameter estimation for restructurable flight control system, Aircraft Design (4), 2001, pp.19-50. [9] S. Kanev, M. Verhaegen, Reconfigurable robust fault-tolerant control and state estimation, 15th world congress IFAC, Barcelona, Spain, 2002. [10] J. Aravena, K. Zhou, X.R. Li, F.Chowdhury, Fault tolerant safe controller bank, , 6th IFAC symposium on fault detection, supervision and safety on technical processes, Beijing, China, 2006, pp.859-864. [11] Y. Zhang, J. Jiang, Design of restructurable active fault tolerant control system, IFAC, Barcelone 2002. [12] M. Napolitano, Y. An, B. Seanor, A fault tolerant flight control system for sensor and actuatot failures using neural network, Aircraft Design (3), 2000, pp.103-128.
I. INTRODUCTION Airworthiness of UAVs in the civil and military airspaces requires increasing their reliability. As regards Flight Control Systems (FCS), they are among the most critical equipments of these aircrafts. Therefore, fault diagnosis and accommodation strategies have to be considered at early stage. Because of weight and cost constraints, multiple hardware redundancies are difficult to implement and the Self-Repairing Control System (SRCS) has to use the standard configuration of the UAV to fit it to the considered fault. Regarding the control surface failures, some difficulties tackled in this paper have to be underlined: • in case of asymmetric actuator failure, the noncoupled longitudinal and lateral-directional axis hypothesis are not valid and a complete non-linear model of the UAV which takes into account these couplings has to be considered, • the UAV is equipped with an autopilot which masks the failure effects, • the control surfaces offer redundancies which makes difficult the fault isolation, • because of these redundancies, when a fault occurs, a strategy of re-allocation of the healthy actuators has to be implemented. Numerous research efforts have been made in the fields of fault diagnosis and fault tolerant control applied to F. Bateman is with LSIS and Ecole de l’air, 13300 Salon de Provence, France, [email protected] H. Noura is with Laboratoire des Sciences de l’Information et des Syst` emes (LSIS), Universit´ e Paul C´ ezanne , Aix Marseille III, Domaine Universitaire de St J´ erˆ ome, 13397, France, has-
aircraft. For fault diagnosis, model-based approaches use a mathematical model of the monitored system to generate residuals. These methods implement Kalman filters [1], [2], [3], Unknown Input Observers, multi-model of failure approach [4], [5] or polynomial methods to design disturbance de-coupling residual generator linear filters [6]. Other FDI Methods based on signal processing have been proposed in [7] where diagnosis is realized using wavelet analysis. A Discrete Fourier transform analysis associated with a least square algorithm was proposed in [8]. The joint problem of control surface failure diagnosis and accommodation applied to aircraft has been treated with banks of controllers in [9] and [10]. A complete failure estimation and restructuration strategy using KF is proposed in [11]. In [12], a complete FDI and FTC using neural networks was implemented. In this paper, the proposed fault detection method consists in superimposing an excitation signal on the control vector as proposed in [2], this signal disrupts the state vector only if a failure occurs. Once the fault is detected, an isolation process is started, each one of the control surfaces is excited with a specific signal which constitutes its signature. The isolation consists in identifying the presence or the absence of this signature in the measurements. When the actuator failure occurs, the equilibrium of forces and moments is broken and significant couplings appear between the longitudinal and the lateral axis. In order to find a new equilibrium, the fault-free mode control surface deflection constraints1 are relaxed, the (FTCS) takes advantage of the redundancies offered by the control surfaces and controls each one separately. The method proposed is a low computational load one and could be implemented for low-cost UAVs. This paper is organized as follows. Section II describes the UAV used for this study and the class of failures considered. In section III the FDI method based on a signal processing approach is described. Section IV presents the accommodation strategy and simulation results are shown in section V. II. UAV AND FAILURE DESCRIPTION A. UAV Description The aircraft studied is a real single-engined with high wing. As Fig. 1 displays, the UAV is provided with seven
[email protected] M. Ouladsine is with Laboratoire des sciences de l’Information et des Syst` emes [email protected]
1 differential deflection of ailerons, symmetric deflections of elevators and flaps.
control surfaces and a throttle. In the presence of a control surface failure, these controls provide redundancies used to keep the aircraft in flight. r ig h t e le v a to r
d e r
r ig h t a ile r o n
d a r
d r > 0 r u d d e r le ft e le v a to r
d e l > 0
r ig h t fla p
d fr
le ft fla p
p r o p u ls io n
d fl > 0
le ft a ile r o n
d a l > 0
B. Model of the failures
d x
Fig. 1.
ment technique. As far as the longitudinal axis is concerned, the UAV disposes of two control inputs: elevators and throttle, thus an external closed-loop control with proportional-integral controller is designed for the true airspeed and the aerodynamic slope γ = θ−α. As regards the lateral-directional axis, the only output controlled is the bank angle ϕ. Next, controlling the turn of rate ψ˙ is equivalent !to control the bank angle ϕ , indeed à V ψ˙ . ϕ = atan g
The UAV Mistral and its 8 actuators
A nonlinear model of the UAV assumed to be rigid body and constant weight was built around a six degrees of freedom platform. The state vector X = [ϕ, θ, V, α, β, p, q, r]T where ϕ is the bank angle, θ the pitch angle, V the true airspeed, α the angle of attack, β the sideslip, p the roll, q the pitch, r the yaw. The control vector U = [δx , δar , δal , δf r , δf l , δer , δel , δr ]T where δx is the throttle, δar , δal the right and left ailerons, δf r and δf l the right and left flaps, δer and δel the right and left elevators and δr the rudder. Control surface deflections are bounded amplitudes and velocities. Atmospheric disturbances W such as wind gusts are modeled using a Dryden spectra. For this aircraft, all the state vector is measured. The UAV equations issued from aircraft flight mechanics are not detailed in this paper, nevertheless the model can be represented by the equations:
The failures considered in this paper are actuators which are stuck in their current positions. In fault-free mode, the control input vector is fixed to a trim position Ue and u corresponds to the variations of the control around the trim: U = Ue + u
(4)
The jamming of the control surfaces is described with an additive model: U f = Ub + ΓU
(5)
where Γ = diag(α1 , ..., αi , ..., α8 ), i min ≤ Ubi ≤ δimax when • αi = 0 et Ub = δi (tf ) avec δi th the i control surface is stuck, tf is the time of the failure occurence, j th • αj = 1, Ub = 0 when the j control surface is healthy. III. FAULT DIAGNOSIS A. Failure detection
The actuator failure detection can be achieved by detecting variations in the aircraft angular rates. The fault detection method uses the redundancies offered by the The state equations (1) are linearized around an operat- control surfaces. It consists in exciting all the actuators ing point and a linear model (2) useful to design the FDI with square signals with a period T and amplitudes chosen in the kernel of the control matrix B. The period is provided. T must be compatible with the aircraft dynamic and x˙ = Ax + Bu (2) the amplitudes must not disrupt the state vector. In the fault-free mode, the excitation vector uex is really applied where the control matrix B is: to the aircraft, as this vector is in the kernel of the control 0 0 0 0 0 0 0 0 matrix B, it does not disrupt the state vector. When 0 0 0 0 0 0 Bθδr Bθδx Bvδx Bvδar Bvδal Bvδf r Bvδf l Bvδer Bvδel 0 a failure occurs, the state vector is disrupted and the B state variables contain a signal with period T . Detecting B B B B B B B αδx αδar αδal αδf r αδf l αδer αδel αδr Bβδ 0 0 0 0 0 0 Bβδr x a fault consists in detecting this signal component in Bpδar Bpδal Bpδf r Bpδf l Bpδer Bpδel Bpδr the measured state variables and especially in the roll 0 0 Bqδar Bqδal Bqδf r Bqδf l Bqδer Bqδel Bqδr 2 p . So the measured roll is continuously correlated 0 Brδar Brδal Brδf r Brδf l Brδer Brδel Brδr with a sinusoidal signal of period T . Then, this cross(3) correlation function is integrated and the result Σ Rpm (t) Because of the redundancies, the column rank of matrix is continuously monitored: Z t B is 6 and the size of its kernel is 2. This property of B ΣRpm (t) = Rpm (τ )dτ (6) is useful to design the excitation signal. t0 For the fault-free mode, two controllers are set up for the longitudinal and lateral−directional state vari2 For an aircraft, the roll mode is the state variable which has the ables. They are carried out using eigenstructure assign- fastest dynamic. X˙ Y
= f (X) + g(X)U + h(X, W ) = X
(1)
When ΣRpm (t) exceeds a threshold, a failure is detected. This threshold depends on the manoeuvre made, particularly when the UAV turns, the angular velocities are strongly modified and in fault-free mode, the signal ˙ The conseΣRpm (t) increases with the turn of rate ψ. quences of this are possible false alarms. To avoid this, the threshold σ is calibrated according to the turn of rate ˙ variations ∆ψ.
˙ + σ0 σ = |∆ψ|
pm (t) sin ωδar t
×
sin ωδf l t
×
sin ωδer t
×
(7) ×
sin ωδel t
with σ0 the threshold used during flight level (ψ˙ = 0).
B. Failure isolation
Because of the redundancies, the failures which may affect the ailerons δar , δal and the flaps δf r , δf l are difficult to isolate. The isolation method proposed here allows to overcome this problem. Once the fault has been detected, each control surfaces is excited with a which constitutes its signature. For specific signal uex i the control surface δi ∈ U , this signature is a sinusoidal signal with amplitude δˆi and pulsation ωi which is called characteristic pulsation of δi . The amplitudes of these excitations must be sufficient to disrupt the state variables without increasing the effects of the failure. They are set in order to produce the same amplitude variations about the measured roll (this constraint is not feasible for the elevators which are not designed to produce roll, nevertheless elevator excitations have sufficient amplitudes to produce significative signatures on the roll). The characteristic pulsations must be compatible with the actuators and with the UAV dynamics. When the control surface δi is stuck, its signature uex i is not detectable in the measurements which contain all the characteristic pulsations except ωi . Isolating the faulty control surface δi , it is showing the absence of the characteristic pulsation ωi in the measurements.
rδar
R t+T ′
sδar
t
rδf l R t+T ′
sδf l
t
rδer R sδer t+T ′ t
rδel R t+T ′ sδel t
Fig. 2.
Isolation process
The signal processing method for fault isolation is applied to the roll p which has the fastest dynamic. Suppose that the faulty control surface is δi and the healthy actuators are indexed j. The measured roll pm writes: X pˆj sin(ωj t + φj ) (8) pm (t) = p(t) + j6=i
p(t) contains the following components : the current manoeuvre effects and the failure effects. During the isolation phase, this signal moves slowly in front of the characteristicµpulsations. ¶ As for the phase φj , its p(jωj ) . expression is arg δj (jωj ) The isolation is achieved by multiplying the signal pm with sinusoidal signals named carriers with pulsations equal to the characteristic pulsations ωk = {ωj , ωi }: rk (t) = pm (t)sin(ωk t + φk )
(9)
rk (t) = p(t)sin(ωk t + φk ) X pˆj ³ £ ¤ cos (ωj − ωk )t + φj − φk + 2 j6=i £ ¤´ (10) − cos (ωj + ωk )t + φj + φk
Conditions about characteristic pulsations: ωj are chosen such as |ωj − ωk |min is a greatest common factor of ωk , |ωj − ωk | and ωj + ωk . Next rk (t) is integrated for a duration multiple of T ′ = 2π : |ωj − ωk |min Z t+T ′ sk (T ′ ) = rk (τ )dτ (11) t
•
when the carrier has a pulsation ωk = ωi (the signature of the faulty actuator δi ), as p(t) does not contain component of pulsation ωi , the signal si (T ′ ) can be written as (remember that p has slow variations in comparison with the carriers): Z t+T ′ si (T ′ ) = p(τ )sin(ωi τ + φi )dτ ≃ 0 (12) t
•
when the pulsations of the carriers ωk 6= ωi , it results from the choice of the integration duration T ′ that for all j 6= k, the integrals of sinusoidal terms of pulsations (ωj + ωk ) and |ωj − ωk | are zeros, they differ from zero if ωj = ωk and sk (T ′ ) becomes:
more solicited than others (for example, when the right aileron fails, the demand made by the left aileron is the most important). In order to balance the demands on the healthy actuators, weights in the Ri matrix are adapted to each failure.
Vc γc ϕc
Lnom
+ − 6
R
L−δel
When a failure is detected and isolated the control surface deflection constraints are relaxed and each one of the healthy actuators is controlled separately. Some studies have shown that for this aircraft, thanks to the redundancies, this strategy of control allowed to reach an operating point close from the fault-free mode operating point and maintained the UAV controllable. Consequence of this, the faulty model of the UAV remains close to the nominal model, so for the faulty-case a set of controllers may be pre-computed. As the 7 control surfaces may be faulty, 7 controllers are designed and implemented as Fig.3 shows. K −δi , L−δi are Linear Quadratic controllers designed to compensate for the faulty control surface δi . ¡ −δ ¢ K i L−δi = Ri GTi Pi (15) with Pi the algebric Riccati solution of:
F T Pi + Pi F T + Qi − Pi Gi Ri−1 GTi Pi = 0 where matrices F , Gi and C are: ¶ µ −δ ¶ µ A 08×3 B i Gi = F = C 03×3 03×7 0 0 1 0 01×4 C = 0 1 0 −1 01×4 1 0 0 0 01×4
-C
ϕ
θ Knom¾ V
α K β p K −δr ¾ q r 6 −δel¾
L−δr
sk (T ′ ) =
IV. FAILURE COMPENSATION
+ - UAV ? model + ? 6 6
pˆj sk (T ′ ) = cos(φj − φk ) (13) 2 Theµknowledge ¶ of the transfer functions gives: φj = p(jωj ) arg and the phase of the carrier φk is δj (jωj ) chosen equal to φj , then: pˆj (14) 2 To sum up, when δi is faulty, the signal si (T ′ ) is zero or close to zero and the signals sk ∀k 6= i are other than zero.
?
V Supervisor¾ FDI ¾ γ ϕ
Fig. 3.
Bank of controllers
V. SIMULATIONS AND RESULTS For the detection, square signals of period T = 3s and amplitudes chosen in the kernel of the control matrix B are added to the control input. ¡ uex = 0.7
−2.6◦
−1.6◦
3.6◦
4◦
3.9◦
−3.7◦
¢T 0◦ (19)
Note that δr is equal to 0◦ , it means that the method proposed above does not allow to detect failures on δr . This could be explained physically by the lack of redundancy for this control surface. The following manoeuvres are realized: at t = 10s, a true airspeed variation, at t = 30s a slope variation and a flat turn on the time interval [40, 60s]. As is shown by Fig. 4, the effects of the excitation on control inputs are significant, nevertheless on Fig. 5 the state vector is not disrupted. At t = 61s the right aileron fails, the fault is detected, next the excitation is not applied. throttle δx (%) 25 20
(16)
15 10 5 0 0
10
20
30
40
50
60
70
80
50
60
70
80
50
60
70
80
right aileron δar (°)
(17)
5
0
-5 0
10
20
30
(18)
B −δi is the matrix B deprived of the column associated with the faulty control surface δi . The weighting matrices Qi and Ri are chosen with the Bryson criterion. However in order to compensate the failure, some actuators are
40
right elevator δer (°) 5
0
-5 0
10
20
Fig. 4.
30
40
Signal processing for fault detection
TABLE I Signatures for the isolation
true airspeed V m.s-1 23 22 21 20 19 0
10
20
30
40
50
60
70
80
aerodynamic slope γ (°)
δj ωδj (rad/s)
1.28
δˆj φk (◦ )
2 0
δar 24 (10− 20 )−1 119
δal 20
δf r 16
δf l 12
δer 8
δel 4
1 −56
1.88 130
1.62 −41
8
4
-2 -4 -6 0
10
20
30
40
50
60
70
Bode Diagram
80
From: dar
From: dal
From: dfr
From: dfl
20
bank angle φ(°) 15
10 10
0 -5 0
10
20
30
40
Fig. 5.
50
60
70
80
detection
Fig. 6 details the detection process through another simulation. A t = 20s the UAV engages a flat turn, the roll p and the fault-detection signal ΣRpm increase. To take into account these effects resulting from the manoeuvre, the threshold σ is matched to the turn of rate variation. At t = 21s the right aileron is stuck in its current position. The failure is detected at t = 22.35s and the isolation process is triggered. right aileron δar fails at t=21s 5 0 -5 -10 0
5
10
15
20
25
30
35
40
25
30
35
40
30
35
40
roll p (°/s) 0.5 0 -0.5 -1 0
5
10
15
20
threshold σ and fault detection signal ΣRpm 0.4 0.2 0 0
5
10
15
20
25
signals sk for the fault-isolation 0.05 0
s
δ
-0.05 0
ar
5
Fig. 6.
10
15
20
25
30
35
40
Signal processing for fault detection and isolation
For the isolation, the characteristic pulsations are chosen as the Table I indicates. They respect the conditions about the characteristic pulsations mentioned above. The excitations have to produce the same amplitude variations on the roll p, thus their amplitudes δˆj may be chosen by mean of the magnitude Bode diagrams represented on Fig.7 (due to lack of place, those of δer and δel are not shown here). The third row of Table I shows the normalized amplitude excitations for each one of the control surface, the detail of the calculation is provided for δar . The Bode phase diagram gives the phases of the carriers φk useful to maximize sk (T ′ ) in (13).
Magnitude (dB) ; Phase (deg) To: p To: p
5
0 System: untitled1 -10 I/O: dar to p Frequency (rad/sec): 24 M agnitude (dB): -1.28 -20
System: untitled1 I/O: dal to p Frequency (rad/sec): 20 Magnitude (dB): -0.0911
System: untitled1 I/O: dfr to p Frequency (rad/sec): 16 Magnitude (dB): -5.48
System: untitled1 I/O: dfl to p Frequency (rad/sec): 12 Magnitude (dB): -4.16
-30 -40 360 270 180 90 System: untitled1 I/O: dar to p Frequency (rad/sec): 24 0 Phase (deg): 119 -90 0 10
System: untitled1 I/O: dfr to p Frequency (rad/sec): 16 Phase (deg): 130 System: untitled1 0 10to p I/O: dal Frequency (rad/sec): 19.9 Frequency (rad/sec) Phase (deg): -56.1
Fig. 7.
0
10
System: untitled1 I/O: dfl10 to0p Frequency (rad/sec): 12 Phase (deg): -41.6
Bode diagrams
From t = 22.35s to t = 25.5s, the isolation process is started as shown on Fig.6. During this interval, the roll p is made up of the sum of the signatures except for the right aileron signature. This signal is multiplied by carriers which pulsations are equal to those in the second row of Table I. Next the results are integrated on a duration T ′ to generate the signals sk . At t = 25.5s, the result of the integration is examined and the zero signal sδar indicates the faulty control surface δar . Note that the duration has been chosen equal to ¶ µ integration 2π ′ . T = 4 The accommodation strategy is illustrated on Fig. 8 (beginning of the flat turn and right aileron failure) and Fig. 9 (end of the flat turn) whereas the UAV banks with a high turn of rate (360◦ /20s). A fault on δar occurs at t = 21s, when it has been detected and isolated, a precomputed linear quadratic controller designed for this failure is selected. In the first case (red dash-dot), the cœfficients in the weighting matrix Rδar are set with the same values and the commutation is sharp. In the second case (black dash), to take into account the fact that the demand made on δal is more important, the cœfficient is twice as in the first case and the commutation is softer. The nominal, faulty and accommodated trajectories of the aircraft are presented on Fig. 10 whereas an aileron failure occurred at t = 21s. This failure is not critical because an aircraft could be designed and fly with only one aileron. However, in case of failure and without accommodation the aircraft slips and this fact may be critical during the landing stage.
bank angle φ(°) 50 40 30 20 10
t
failure
0 45
46
47
48
49
50
51
52
53
54
55
left aileron δal (°)
250
5 0
200
-5
150 -10 45
46
47
48
49
50
51
52
53
54
nominal flight path
55
500
100
rudder δr (°)
400
flight path with faulty aileron 300
15
50
200
flight path with accomdation
10
100
5
0
0
700
-5 45
46
47
48
49
Fig. 9.
50
51
52
53
54
55
600
500
400
300
200
Fault accommodation Fig. 10.
100
0
-100
0 -100 -200 -300 -400 -500
Flight path
References VI. CONCLUSIONS
[1]
An actuator fault diagnosis coupled with a fault tolerant control have been proposed. The diagnosis method is based on a processing signal approach and allows to deal with redundancies. An accommodation strategy using Linear Quadratic controller has been implemented, nevertheless, the commutations between the normal mode controller and the faulty mode controller remain abrupt. At present, a soft commutation method is studying, it consists in computing on-line a new operating point such as the faulty equilibrium state and control vectors remain as close as possible to the nominal equilibrium state and control vectors. This strategy requires an estimation of the faulty control surface position. As the failure has yet been detected and isolated, a unique Kalman filter which state vector has been augmented by the failed input state variable equation may be used. This solution should be of a lesser computational load and faster than the one which uses a bank of Kalman filters.
bank angle φ(°) 50 40 30 20 10 0 20
25
30
35
30
35
30
35
left aileron δal (°) 0 -20 -40 -60
failure
detection isolation
accommodation
-80 20
25
rudder δr (°) 20 10 0 -10 -20 20
25
Fig. 8.
Fault accommodation
C. Hajiyev, F. Caliskan, Sensor and control surface/actuator failure detection applied to F16 flight dynamic, Aircraft Engineering and aerospace technology (2), 2005, pp.152-160. [2] G. Ducard, A Reconfigurable Flight Control System based on the EMMAE Method, American Control Conference, Mineapolis, USA, 2006, pp.5499-5504. [3] T. Kobayashi and D.L. Simon, Application of a bank of Kalman filters for aircraft engine fault diagnostics, NASA Report 212526, 2003. [4] R. Hallouzi, M. Verhaegen, S. Kanev, Model weight estimation for FDI using convex faults models, 6th IFAC symposium on fault detection, supervision and safety on technical processes, Beijing, China, 2006, pp.847-852. [5] S. Samar, D. Gorinevsky, S.P. Boyd, Embedded estimation of fault parameters in an unmanned aerial vehicle, Conference on Control Applications, Munich, Germany, 2006, pp.3265-3271 [6] A. Marcos, S. Ganguli, G.J. Balas, An application of H∞ fault detection and isolation to a transport aircraft, Control Engineering Practice (13), 2005, pp.105-119. [7] J.L. Aravena, F.N. Chowdhury, Fault detection of flight critical systems in Proc. 20th , Digital Avionics Systems Conference, October 2001. [8] M. Napolitano, Y. Song, B. Seanor, On-line parameter estimation for restructurable flight control system, Aircraft Design (4), 2001, pp.19-50. [9] S. Kanev, M. Verhaegen, Reconfigurable robust fault-tolerant control and state estimation, 15th world congress IFAC, Barcelona, Spain, 2002. [10] J. Aravena, K. Zhou, X.R. Li, F.Chowdhury, Fault tolerant safe controller bank, , 6th IFAC symposium on fault detection, supervision and safety on technical processes, Beijing, China, 2006, pp.859-864. [11] Y. Zhang, J. Jiang, Design of restructurable active fault tolerant control system, IFAC, Barcelone 2002. [12] M. Napolitano, Y. An, B. Seanor, A fault tolerant flight control system for sensor and actuatot failures using neural network, Aircraft Design (3), 2000, pp.103-128.
