Robust Fault Detection for Commercial Transport Air Data Probes

Transcription

1 Robust Fault Detection or Commercial Transport Air Data Probes Paul Freeman, Peter Seiler, and Gary J. Balas Department o Aerospace Engineering and Mechanics, University o Minnesota, Minneapolis, MN, USA ( {reeman, seiler, balas}@aem.umn.edu) Abstract: Air data probes provide essential sensing capabilities to aircrat. The loss or corruption o air data measurements due to sensor aults jeopardizes an aircrat and its passengers. To address such aults, sensor hardware redundancy is typically combined with a voting system to detect and discard erroneous measurements. This approach relies on redundancy, which may lead to unacceptable increases in system weight and cost. This paper presents an alternative, model-based approach to ault detection or a non-redundant air data system. The model-based ault detection strategy uses robust linear iltering methods to reject exogenous disturbances, e.g. wind, and provide robustness to model errors. The proposed algorithm is applied to NASA s Generic Transport Model aircrat with an air data system modeled based on manuacturer data provided by Goodrich Corporation. The ault detection ilters are designed using linearized models at one light condition. The detection perormance is evaluated at a particular reerence light condition using linear analysis and nonlinear simulations. Keywords: Fault detection, air data systems, robust estimation. 1. INTRODUCTION Stringent saety requirements have driven aircrat system design or decades. The system availability and integrity requirements or commercial light control electronics are typically no more than 1 9 catastrophic ailures per light hour (Bleeg, 19; Collinson, 3). The typical industry design solution is based extensively on physical redundancy at all levels o the design. For example, the Boeing 777 has 1 spoilers, outboard ailerons, laperons, elevators, one rudder and leading/trailing edge la (Yeh, 199, 199). Each o these suraces is driven by two or more actuators, all connected to dierent hydraulic systems. Moreover, the control law sotware is implemented on three primary light computing modules. Each computing module contains three dissimilar processors with control law sotware compiled using dissimilar compilers. The inertial and air data sensors have a similar level o redundancy. The redundancy-dependant control architectures used in the aircrat industry achieve extraordinarily high levels o availability and integrity. However, the use o physical redundancy dramatically increases system size, complexity, weight, and power consumption. Moreover, such systems are extremely expensive in terms o design and development costs as well as the unit production costs. There is an increasing demand or high-integrity, yet low cost, ault tolerant aerospace systems, e.g. unmanned aerial vehicles and ly-by-wire in lower end business and general aviation aircrat. In such applications, analytical redundancy may be used to limit the number o sensors needed, but the ability to detect sensor ailures may also be diminished. This paper ocuses on the use o analytical redundancy to detect aults in an air data system. Nearly all aircrat utilize air data probes to measure total and static pressure to determine airspeed and altitude. For proper operation, the probes must be ree o blockages, e.g. due to icing or dirt. Failures o these probes have resulted in numerous atal accidents o commercial, military, and general aviation aircrat. To address these ailures, sensor hardware redundancy is typically combined with voting systems to detect and discard erroneous measurements. The ault detection problem usually comprises a method to compute residuals and a process to declare aults based on the residuals. It is desired that the generated residual be a good representation o the ault o interest while being insensitive to process and measurement noises. Generation o residuals depends on the inormation available about the system. I a suiciently accurate model o the system is available, model based methods can be used to estimate system states and outputs. See (Gertler, 199), (Isermann, ), and (Ding, b) or a detailed treatment o model based and model-ree ault detection methods. Based on these methods, this paper uses the H ramework to design an analytical ault detection ilter or an air data system. The paper has the ollowing structure. Models or the system are provided in Section. Section 3 describes the H methods used to design the robust ault detection ilter. Simulation results and analysis are given in Section. Finally, Section discusses conclusions o this work and directions or uture research.

2 . MODELING.1 Generic Transport Model Longitudinal Dynamics V m θ m q m The NASA Generic Transport Model (GTM) is a remotecontrolled. percent scale commercial aircrat (Murch and Foster, 7). NASA developed a high idelity six degree-o-reedom Simulink model o the GTM (Cox, 1) with the aerodynamic coeicients described as look-up tables. The longitudinal model o the GTM aircrat dynamics is used or this study and is described in more detail in (Freeman et al., 11). The longitudinal dynamics o the GTM are described by a standard ive-state longitudinal model where V is the air speed (knots), α is the angle o attack (deg), q is the pitch rate (deg/s) and θ is the pitch angle (deg), and h is the altitude (t). The control inputs are the elevator delection δ elev (deg) and engine throttle δ th (percent). The GTM has two engines and equal thrust settings or both engines is assumed. The thrust rom a single engine T (lbs) is a unction o the throttle setting δ th (percent). The actuator dynamics are modeled as linear systems. The elevator actuator is a Hz bandwidth, irst-order system with a 1 ms delay. The engine dynamics are modeled as a second order system.. Aircrat Trim and Model Linearization A steady, level reerence light condition is chosen within the GTM light envelope. The GTM, including actuator dynamics, is trimmed at the ollowing condition: V 7 knots α.3 deg x = q θ = deg/s.3 deg ; u = h t δth = δ elev 33.9 %.7 deg The nonlinear GTM dynamics are linearized about this trim condition. The resulting linear model is used or control law development, ilter synthesis, and simulation..3 Control Law The GTM longitudinal axis light control law is an airspeed/altitude hold autopilot designed using a combination o classical loop-at-a-time and H techniques. The design allows or ault detection simulation and analysis while holding the GTM at a cruise condition or perorming simple longitudinal maneuvers. These control laws serve merely to provide a closed-loop aircrat model that approximates the light characteristics o a true aircrat or the purposes o simulation. The ull control law interconnection is shown in Figure 1, and details regarding the controllers can be ound in (Freeman et al., 11).. Inertial and Air Data Sensors Sensors or angle o attack, pitch rate, and pitch angle are modeled as unity with additive white noise and bias on the true states. Sensor dynamics are neglected in the model. (1) V cmd + h cmd K V + Control Law K θ + h m Fig. 1. Autopilot Control Law Architecture SAS K h δ elev δ th The basic relationshi between air data measurements and aircrat states are derived in (Collinson, 3). For altitudes in the troposphere (up to 3, t), the static pressure p s is related to altitude h by: ( h = T ( ) ) LR/g 1 () L where T := 1.7 R is the temperature at sea level, L :=.3 R t t is the troposphere lae rate, g := 3.17 s is the gravity constant at sea level, p s := 11.1 lb t is the static pressure at sea level, and R := 171 t lb R slug is the ideal gas constant. For compressible air and subsonic speeds, the static and total pressures, p s and p t, are related to the calibrated (indicated) airspeed V c (knots) by: ( ) /7 pt p s V c = A + 1 ; (3) p s where A := 1. knots is the speed o sound at sea level. The calibrated airspeed is equal to the true airspeed at sea level but the two airspeeds dier at altitudes above sea level. A more accurate model at high altitudes would include a model o the total air temperature sensor used to compute true airspeed (Goodrich, ). This is neglected in this paper and hence the models are only valid at low altitudes at which the GTM lies. Pitot-Static Probe Model For typical commercial transport air data sensors, p s and p t are measured via independent pressure lines and transducers. Dynamic pressure, p dyn = p t p s, is a calculated quantity (Collinson, 3; Goodrich, ). The pressure measurement devices are modeled by inverting the unctions in Equations -3 to obtain values o static and total pressure rom the GTM altitude and airspeed states. To model sensor noise and aults in the pressure measurements, the nominal pressure signals are corrupted by white noise and aults are added to the pressure signals to yield pressure measurements. Pressure Measurement Processor Model Pressure transducer measurements are used to derive altitude and airspeed measurements or eedback to the control loo and to the pilot. Equations and 3 yield altitude and airspeed measurements rom pressure measurements. All pressure signals have units o i (lbs/in ) in the GTM simulation and analysis. The air data system architecture is depicted in Figure. p s

3 Linearizing the air data conversion equations about the trim condition in Equation 1 provides insight into appropriate magnitudes or injected aults: dhm = dv m [ ] d dp t From Equation, aults o magnitude.1 i in p s will yield an h m error o t and V m error o -.1 knots, respectively. A ault o the same size in p t will yield an V m error o.1 knots. Additionally, aults injected on p s and p t both inluence V m. For simultaneous, equal magnitude aults in p s and p t, V m will be unaected. h p Transducers p s (h) Physics-Based Pressure Model V p t (V, h) n, p s p t + n pt, pt + p sm p tm Fig.. Air Data Sensor Architecture h m (p sm ) Air Data Conversion V m (p tm p sm ) 3. ROBUST FAULT DETECTION () h m V m The H synthesis ramework used to design ilters to estimate disturbances, e.g. aults, at the plant input. H methods oer a number o advantages over traditional Kalman iltering, including superior perormance in the presence o model uncertainty and the ability to ilter process noise and exogenous disturbances without necessarily having a statistical model o those inputs (Simon, ). A H ilter is synthesized rom the linearized GTM model to estimate aults associated with the static and total pressure measurements. Unmodeled dynamics and model uncertainty are neglected or this analysis, but the ramework is easily extended to include uncertainty. 3.1 H Problem Formulation The linearized aircrat dynamics are connected with the autopilot (Figure 1), inertial sensor models, and air data sensor architecture (Figure ). The generalized plant gengt M has the ollowing inputs: the autopilot reerence signals r = [V cmd h cmd ], the inertial measurement noises, ñ = [n α n q n θ ], and the injected pitot aults = [ pt ]. The errors ẽ are the dierence between the injected aults and estimated aults ˆ =. ˆ ˆpt The generalized GTM plant has measurement outputs y = [p sm p tm α m q m θ m ]. These are the measurements that will be available to the ault detection ilter. The objective o the H ilter synthesis is to generate a stable ilter F which minimizes norm between the disturbances and the errors. Weighting unctions are used to describe the expected requency content o the inputs and the desired requency content o the errors, the normalized inputs [r n ] and outputs e. Figure 3 shows the desired interconnection o the ilter with the generalized plant gengtm with signal weights and ilter F. Input and output signals with tildes represent their respective normalized signals in physical units. r n W re W nois W ault r P gen ñ gengt M ˆ + ẽ e Werror Fig. 3. Interconnection or H Filter Synthesis F For ault detection, the disturbances are the autopilot reerence signals r and the inertial measurement noises n. The ilter seeks to track the injected aults with the ault estimates ˆ while rejecting inertial measurement noise n and reerence commands r. Similar H and H model matching approaches to FDI ilter design have been applied in (Varga, 3, 9; Marcos et al., ; Ding, a; Zolghadri et al., ; Mazarsand et al., ). 3. Signal Weighting Methodology W re is a static weight that deines relative size o the autopilot reerence commands: 1 W re = ().7 W nois relects the assumption that the inertial sensor noise magnitude is greater at low requencies and high requencies while the noise magnitude is reduced at intermediate requencies. Such behavior can be ound in mid-grade inertial sensors that may be utilized on a small UAV. This leads to an unusual choice o weighting unction; a simpler model may not account or increased noise magnitudes at low requency, and would likely have a irst-order weighting unction. The weight chosen to represent the requency content associated with these signals is: W nois =.119s + 3.7s s () + 17s The weighting on the inertial sensor noise is chosen iteratively so that the transer unction rom ñ to ˆ on the unweighted gengt M interconnection with F has gain less than 1 or all requencies. The weighting on the n q signal is an order o magnitude larger than the other weightings due to the higher noise level on the pitch rate sensor output. Near 1 rad/s, W nois rolls down db; it then rolls up approximately db near 1 rad/s. The transer unctions rom inertial sensor noise to pressure ault estimates show stronger attenuation in the ˆ channel; this act is important or analysis o the ilter perormance. W ault Faults are injected into the static and total pressure channels to corrupt the measurements. The ault weight, Equation 7, is chosen such that the DC gain represents large aults (- db). The weight is small or requencies greater than rad/s to penalize tracking o high requency aults. The aircrat dynamics roll o near y

4 this requency; hence, the eect o higher requency aults will not appear in the angle or rate measurements. This diminishes the tracking ability o F at high requencies. The high requency gain o W ault is - db. W ault =.1s + 3. s I (7) W error The error weight represents the inverse o the allowable tracking error at each requency. Normally, the error weight would be large at low requency to ensure close tracking. Tracking at high requency is less desirable and error weightings will roll o to some small high requency gain. The particular nature o this problem, however, is such that the usual error weighting methodology cannot be adopted or the generalized GTM ilter synthesis. Equation shows the DC gain o P ỹ, the partition o gengt M rom to ỹ P ỹ ω= = Note that the matrix representing the DC gain is rank deicient. Thus, aults in the direction = [1 1] are indistinguishable rom an unaulted conditon. The unobservability o this ault direction at DC has a simple physical explanation. As mentioned previously, a simultaneous and equal ault in both pitot probes has no eect on the airspeed measurement. A ault in the = [1 1] direction only causes a bias in the altitude measurement. The model or the longitudinal dynamics is unaected by a constant oset in altitude. Thus, a ault in the = [1 1] direction will cause the closed loop system to adjust to a biased value o altitude but all measurements will appear, in steady state, to converge back to their original trim conditions. This rank deiciency places limits on the ault detection perormance at low requencies. For a ilter F to ensure perect ault tracking at low requency, F must be a eudoinverse o P ỹ over that requency range. In particular, a ilter F that would make the tracking error arbitarily small at low requency cannot be synthesized by hinsyn (Balas et al., 1) because the partition is rank-deicient and its eudoinverse does not exist. To circumvent this problem, W error is chosen such that the DC gain is small (- db) and begins to roll up at 1 rad/s to -1 db at 1 rad/s. For requencies greater than 1, the traditional approach o rolling o to a small high requency gain (- db) is applied. This error weighting has a small DC gain, rolls up at very low requencies, and rolls down again at higher requencies; this allows or the best ilter perormance given the inherent system limitations. () W error =.11s +.11s +. 1 s +.3s I (9) 3.3 FDI Filters The weighted interconnection shown in Figure 3 is generalized into the weighted generalized plant P gen (Doyle et al., 19). The ilter F is synthesized with a γ-value o. using P gen and hinsyn to meet the objectives described in Sections The hinsyn algorithm synthesizes a ilter at the low γ-value or a ew reasons. First, the small weight choices scale γ to be small. Next, model uncertainty is not considered in this ormulation, allowing or stronger ilter attenuation o disturbances.. ANALYSIS OF ROBUST FAULT DETECTION The ault detection perormance o the ilter F synthesized in Section 3 is examined or three ault scenarios. First, ault detection perormance is analyzed or a step aults in the static pressure measurement o the closedloop linear generalized GTM model, gengt M. Detection perormance is analyzed in the presence o inertial sensor noise. Similarly, ault detection perormance is evaluated or a step ault in the total pressure measurement o gengt M while the static pressure measurement remains unaulted. Finally, the perormance o the synthesized ilter is examined or a simultaneous ault in p s and p t in the closed-loop nonlinear GTM. The ilter can take advantage o the expected closedloop system dynamics to generate ault estimates since it was synthesized using a closed-loop generalized plant, These estimates would be more accurate than estimates resulting rom the common open-loop synthesis approach that ails to model the dynamics associated with the expected operation o a system in the ield..1 Typical Faults and Desired Filter Perormance Numerous common ault scenarios exist or typical air data systems, including blockages, icing, and water accumulation. Particular combinations o blockages in the pitot inlet, drain hole, static port, or pressure lines can lead to signiicant errors in altitude and/or airspeed measurements. Based on manuacturer data provided by Goodrich Corporation, a simple model or certain air data blockages can be obtained by injecting step aults into the static and total pressure measurements. The perormance o the synthesized ilter under these scenarios is examined. The ilter should yield estimates that track the generalized ault inputs reasonably quickly with minimal steadystate error. False positives are very undesirable. Any ault detection system implemented with the goal o control reconiguration must be suiciently ast as to allow or reconiguration beore undesired aircrat maneuvers become unsae.. Step Fault Detection in Linear GTM The ault tracking perormance o F or a small step ault in the static pressure measurement is shown in Figure. At time t = 1 second, a step ault o magnitude.1 i is injected into the static pressure measurement signal or the linear generalized plant gengtm using the ilter F. The simulation has a duration o seconds and inertial and

5 pitot sensor noise is included. The ilter outputs ˆ should track the ault in the aulted static pressure channel and show no ault in the unaulted total pressure channel. For long simulations, as with the static ault scenario, the estimates will eventually drit..3 Simultaneous Fault Detection 1 x hat pt 1 x A ault o equal magnitude injected simultaneously into the static and total pressure channels will not have an impact on the airspeed measurement. Because such a compound ault has limited observability, it is interesting to examine the ability o F to detect such a condition. Given the desirable perormance o F on the linear GTM, the perormance o F or this more diicult ault will be investigated on the nonlinear longitudinal GTM. x 1 3 x 1 3 Fig.. Fault estimation: p s step, Linear GTM The ilter detects the static pressure ault in the linear model nearly instantaneously and tracks it eectively. The ilter does not yield errorless ault tracking, however, due to the gengt M rank deiciency described in Section 3.. The slowest pole o F has a requency on the order o 1 rad/s, so the ault estimation error will grow quite slowly. The ault estimate will eventually decay to zero in the aulted channel and drit away rom zero in the unaulted channel. Measures to combat this drit must be designed into any algorithm that can be implemented on an operational system. The ault estimate in the unaulted total pressure ault channel contains considerable noise relative to the static pressure ault estimate. Because noise on the inertial sensors is ed into the ilter, the resulting ault estimates will be noisy. As stated in Section 3., inertial sensor noise couples to ˆ pt more strongly than ˆ, accounting or the higher noise levels in the total pressure estimate. Since the inertial measurements are ed into the airspeed hold autopilot, the ilter relies on these measurements to detect the presence o a ault in the airspeed measurement much more than or the altitude measurement. Consequently, the noise levels in ˆ pt are larger. While the H ilter is designed to minimize the eect o sensor noise on the ault estimates, it cannot be eliminated entirely. 1 x hat pt 1 x Fig.. Fault estimation: p t step, Linear GTM Next, the same simulation is conducted with a total pressure ault rather than a static pressure ault. Figure shows that the ilter detects the total pressure ault in the linear model and tracks the ault with some residual noise or the reasons explained above. The ilter correctly estimates no ault on the static pressure measurement. 1 hat pt 1 Fig.. Fault estimation: Simultaneous p s and p t step, Nonlinear GTM Figure shows the ault estimates or the simultaneous ault in the nonlinear GTM. Figure 7 shows the control inputs, aircrat state responses, and static pressure ault estimate throughout the nonlinear GTM simulation. The simultaneous ault results in a bias in the altitude measurement. All o the control inputs and aircrat states except the altitude measurement converge back to the original trim condition. The only eect o the simultaneous ault is that the aircrat converges to an oset altitude. Despite the simultaneous ault that does not appear in the airspeed measurement at zero requency, the ilter is able to detect the initial step in both measurements as aults. The ilter uses the inertial state measurements to track the ault by compensating or the dynamic response o the aircrat to the step changes in the measurements. The ault estimates eventually decay to zero due to the unobservability o this ault in steady state.. CONCLUSIONS This paper developed a method to detect aults in a pitot-static probe using H synthesis o a robust ault detection ilter. Signal weights were chosen to circumvent the unobservable ault at low requency. The perormance o the ault detection ilter was analyzed on the linear and nonlinear longitudinal GTM dynamics or individual step aults as well as a simultaneous, equal magnitude ault in each pressure measurement. This approach was shown to be eective or detecting step aults and combinations o step aults. By extending modeling to uncertainty in the GTM aerodynamic model and actuator dynamics, a robust ault detection ilter can be synthesized using µ- synthesis techniques. Additionally, extending robust ault detection iltering to an aircrat s entire light envelope using linear parameter-varying techniques would provide a stronger understanding o ault tolerance implications at all parts o the light regime.

6 δ elev [deg] V s [knots] q [deg/s] h [t] δ elev Response V Response q Response 1 3 h Response 1 3 δ th [%] α [deg] θ [deg] 3 3 δ th Response α Response θ Response x Fig. 7. Control Input and State Response: Simultaneous p s and p t step, Nonlinear GTM ACKNOWLEDGEMENTS This material is based upon work supported by the National Science Foundation under Grant No entitled CPS: Embedded Fault Detection or Low-Cost, Saety-Critical Systems. Any opinions, indings, and conclusions or recommendations expressed in this material are those o the author(s) and do not necessarily relect the views o the National Science Foundation. The authors acknowledge Andrei Dorobantu or the design o the innerloop SAS controller. air data probes: Extended version with modeling. AerospaceControl/CPS.html. Gertler, J.J. (199). Fault detection and diagnosis in engineering systems. Marcel Dekker, 1st edition. Goodrich (). Air Data Handbook. Goodrich Corportation Sensors and Integrated Systems. Isermann, R. (). Fault-diagnosis systems: an introduction rom ault detection to ault tolerance. Springer, 1st edition. Marcos, A., Ganguli, S., and Balas, G. (). An application o H-ininity ault detection and isolation to a transport aircrat. Control Engineering Practice, 13(1), Mazarsand, E., Jaimoukha, I., and Li, Z. (). Computation o a reerence model or robust ault detection and isolation residual generation. Journal o Control Science and Engineering,, 1 1. Murch, A. and Foster, J. (7). Recent NASA research on aerodynamic modeling o post-stall and spin dynamics o large transport airplanes. In th AIAA Aerospace Sciences Meeting and Exhibit, Reno, Nevada, AIAA Simon, D. (). Optimal State Estimation: Kalman, H- ininity, and Nonlinear Approaches. John Wiley & Sons. Varga, A. (3). On computing least order ault detectors using rational nullspace bases. In In Proceedings o the IFAC Symp. SAFEPROCESS 3, Washington D.C. Varga, A. (9). General computational approach or optimal ault detection. In SAFEPROCESS 9, Barcelona, Spain. Yeh, Y. (199). Triple-triple redundant 777 primary light computer. In Proceedings o the 199 IEEE Aerospace Applications Conerence, Yeh, Y. (199). Design considerations in Boeing 777 lyby-wire computers. In Third IEEE International High- Assurance Systems Engineering Symposium, 7. Zolghadri, A., Castang, F., and Henry, D. (). Design o robust ault detection ilters or multivariable eedback systems. International journal o modelling and simulation, ACTA Press, (1). REFERENCES Balas, G., Chiang, R., Packard, A., and Saonov, M. (1). Robust Control Toolbox. The MathWorks. Bleeg, R. (19). Commercial jet transport ly-by-wire architecture considerations. In AIAA/IEEE Digital Avionics Systems Conerence, 399. Collinson, R. (3). Introduction to Avionics Systems. Kluwer, nd edition. Cox, D. (1). The GTM DesignSim v1. Ding, S.X. (a). Model-based Fault Diagnosis Techniques. Springer. Ding, S.X. (b). Model-based Fault Diagnosis Techniques: Design Schemes, Algorithms, and Tools. Springer, 1st edition. Doyle, J., Glover, K., Khargonekar, P., and Francis, B. (19). State-space solutions to standard h- and h-ininity control problems. IEEE Transactions on Automatic Control, 3(), Freeman, P., Seiler, P., and Balas, G. (11). Robust ault detection or commercial transport