ONGOING WORK ON FAULT DETECTION AND ISOLATION FOR FLIGHT CONTROL APPLICATIONS

ONGOING WORK ON FAULT DETECTION AND ISOLATION FOR FLIGHT CONTROL APPLICATIONS Jason M. Upchurch Old Dominion University Systems Research Laboratory M.S. Thesis Advisor: Dr. Oscar González Abstract Modern aircraft flight control relies on a complex network of interacting systems. These systems are safety critical systems, since a failure could have catastrophic consequences. It is therefore necessary to detect and isolate faults in aircraft control system components such as actuators or sensors before the fault is allowed to cause a system failure. Such detection and isolation could potentially enable timely system reconfiguration and increase safety of flight operations. Numerous fault detection and isolation techniques have been presented in the literature. This paper demonstrates the ability of one such technique, observer-based eigenstructure assignment, to detect and isolate faults by following implementation procedures and verifying its effectiveness through simulation. The scope of this paper is limited to actuator faults and to the simple case where all eigenvectors are assignable. Future work will include a similar assessment of the technique s suitability for fault detection and isolation in sensors and in the case where not all eigenvectors are assignable. The goal of this work is to build a catalog of fault detection and isolation techniques and to devise an experiment in order to assess each technique s relative advantages for flight control applications. Introduction In the field of aircraft flight control, failures of actuators and sensors are of great concern. Failures may lead to a loss of control and, therefore, carry the potential to cause a catastrophic outcome. If a problem with an actuator or sensor could be quickly detected as a fault and subsequently isolated, then system safety could potentially be improved by allowing for the early initiation of a graceful system degradation or reconfiguration. The field of fault detection, isolation, and reconfiguration (FDIR) is concerned with solving such problems. The purpose of this paper is to present ongoing research into the fault detection and isolation (FDI) capabilities of the eigenstructure assignment (EA) technique, in particular. A key problem of interest in fault detection (FD) is the ability to identify faults in the presence of system disturbances and uncertainty. As Willsky noted, a FD system must necessarily be sensitive to abrupt changes caused by faults, but this requirement also makes the system susceptible to false alarms due to other high-frequency inputs, such as noise. The goal of the observer-based EA technique is to provide a way for fault diagnostic signals (i.e., residuals) to be generated such that they are not influenced (or at least minimally influenced) by disturbance inputs to the system. This disturbance decoupling aspect of EA is addressed in the next major section of this paper, Fault Detection Using Eigenstructure Assignment. A set of concise design steps to achieve disturbance decoupling for a simple case is presented in Design for Disturbance Decoupling. Next, Example I applies the technique to a Boeing 747 aircraft model in level flight. The observer-based EA method is well-known to many researchers and has been shown in the literature to provide a theoretical means for FD in flight control applications.,3,4 In order to fulfill a fault isolation requirement, however, the designer must decouple, for example, the ith residual signal associated with the jth fault, where i j and i and j are some integer-valued indexes associated with a fault affecting the ith or jth component, respectively. This decoupling is built into the design methodology, and it results in residual signals that explicitly indicate which component is experiencing the fault (multiple residual signals are capable of informing of faults in multiple components). This design methodology was introduced by Shen et al. 5 and is the topic of Fault Detection and Isolation Using Eigenstructure Assignment. Then, Design for Fault Isolation presents a step-by-step summary of the design steps to achieve fault isolation. Finally, Example II will show that while this particular design method of the EA technique allows for fault detection and isolation, the residual signals are not exactly decoupled from disturbances. Regarding the scope of the paper, several assumptions are made about the system used in the development of the Fault Detection Using Eigenstructure Assignment and Fault Detection and Isolation Using Eigenstructure Assignment

sections which may not be true, or may be difficult to verify in practice. While these assumptions are carried over in the development of the technique in this paper, the simulations attempt to show only the general effects of faults on the residual signals in the presence of disturbance and thereby inform broadly on the suitability for flight control applications. Subsequent research will seek to refine this work by removing many of the assumptions (e.g., by introducing actuator dynamics). The ongoing research is aimed at building a catalog of FDI techniques and devising an experiment to determine if any particular class of techniques is more suitable for flight control applications. Fault Detection Using Eigenstructure Assignment Robust fault detection refers to the decoupling of the residual diagnostic signals from other disturbance inputs. Observer-based eigenstructure assignment is aimed at achieving this robust property by generating residuals that are responsive to faults and not to disturbances. 3 To examine how the designer can use EA to achieve this disturbance decoupling, consider the following development. As Patton and Chen noted, 6 the actuator fault model of a system can be derived as follows. Let the model of the plant be ẋ = Ax + Bu + Kf + Ed () y = Cx, () where x R n is the state vector, u R m is the known input vector, d R q is the unknown disturbance vector, f R p is the fault vector, y R r is the output vector, A, B, C, K, E are known with appropriate dimensions. Now, the observer model is known to be ˆx = Aˆx + Bu + L(y ŷ) (3) ŷ = C ˆx, (4) where ˆx R n is the state estimation vector, and ŷ = C ˆx is the estimated output vector. L is the observer gain matrix with appropriate dimensions. The error in the state estimation is e = x ˆx. Then the dynamics of the error are given by ė, which is the difference between () and (3). To model uncertainty, let A in () be perturbed, that is, redefine A in () as A p = A + A. Furthermore, define the residual r to be a weighted difference between the system output and its estimated output. Then the state estimation error dynamics and the residual are described by ė = (A LC)e + Kf + Ed + Ax (5) r = W Ce, (6) where W R p m is the residual weighting matrix. Now, letting A = (i.e., no uncertainty), taking the Laplace transform of the system, and solving for the residual results in r(s) = W C(sI (A LC)) Ed(s) (7) +W C(sI (A LC)) Kf(s). It can be observed that the residual is not zero even if there is no fault. Thus, the need for disturbance decoupling is demonstrated. The transfer function from the disturbance to the residual is given by G rd (s) = W C(sI (A LC)) E. (8) For the simple case, assume all the eigenvalues are real and distinct. Then the design goal is to choose W and L such that (8) is equal to zero and the eigenvalues of A LC are in the stable region of the complex plane. To understand how to achieve this design requirement, let H = W C be the matrix of left eigenvectors of A LC, where W is chosen such that W CE =. Then we have sufficient conditions to exactly decouple the residual from the disturbance. Design for Disturbance Decoupling To simplify the design, suppose it is possible to choose H. There exist techniques for approximate decoupling for the case where it is not possible to assign an eigenstructure such that H is the matrix of left eigenvectors of the observer, and future work will investigate such approximate solutions. The design for the simple case of distinct eigenvalues and assignable eigenvectors is presented below. ) Determine p = dim(null(e T C T )) ) Let W R p r such that W T has the p independent columns in null(e T C T ) 3) Select p left eigenvectors of A LC to be the p rows of H = W C = [ l l... l 3 4) Select p real eigenvalues of A LC to be associated with the p eigenvectors 5) Find α, α,..., α p, the representations of l, l,..., l p with respect to P (λ i ) = (λ i I A T ) C T, i =,..., p so that α i = (P T (λ i )P (λ i )) P T (λ i )l T i, i =,..., p 6) Select n p additional distinct eigenvalues of A LC 7) Select almost arbitrarily the n p representations of the eigenvectors associated with the n p eigenvalues, i.e., select α i, i = p +,..., n 8) Find the n p eigenvectors using l i = (P (λ i )α i ) T, i = p +,..., n 9) Find L = ( [ α α... α n [ l l... l n ) T Example I This section presents the simulation methodology and discusses the results from applying the design for disturbance Jason M. Upchurch

decoupling steps to a linearized aircraft model. 7 The model is given by u.3.39.3 u ẇ q =.65.39 7.74 w...49 q θ θ +..8.4.6.598 [ δe +.3.39.65.39.. [ uw where u is the aircraft velocity along the body axis, w is the aircraft velocity perpendicular to the body axis, q is the pitch rate, θ is the angle between the aircraft body axis and horizontal, is the elevator angle, is the aircraft thrust, u w is the wind velocity along the body axis, and is the wind velocity perpendicular to the body axis (the latter two inputs are disturbance inputs). Furthermore, if actuator dynamics are neglected, then as Chen and Patton noted, 8 one type of fault model can be defined to be the difference between the input to the plant (actual input) and the desired control input (the output of the controller), i.e., f = u u, (9) where u is the (actual) input to the plant and u is the (desired) control input. Note that when the control input is equal to the plant input, we have no fault and f = as expected. The control inputs in simulation were defined arbitrarily as sinusoids simply to provide some sense of the general relationships. Future work is intended to close the loop so that control inputs are not defined in this arbitrary manner. Faults for the simulation were also somewhat arbitrarily defined, but built on the idea that two types of faults could reasonably be described as a stuck actuator ( lock-in-place ) and an actuator with no output (complete outage). Developing more detailed actuator fault models is also topic of future work (e.g., the introduction of actuator dynamics with the possibility of saturation). An arbitrarily scaled white Gaussian noise input was added to represent the wind disturbances. Finally, non-zero initial conditions were selected to show how any initial system mismatch may affect the residual. Substituting (9) into () and letting K = B allows the residual system to be written as ė = (A LC)e + Ed + B(u u) () r = W Ce. () The given design steps yielded two residual vectors. MAT- LAB R was then used to simulate different combinations of fault conditions on the actuators, and the resulting residuals were analyzed qualitatively. Figure shows the residual for a particular fault configuration where Actuator (the elevator actuator) becomes locked in place and Actuator (the thrust.5.5.5.5 Residual response: Actuator lock in place r r 3 4 5 6 7 8 9.5.5.5.5 Fig.. Actuator : Lock-in-place fault. 3 4 5 6 7 8 9 Fig.. Residual response: Actuator no fault Actuator : No fault. r r actuator) experiences no fault. The inputs shown in Figure are those pertaining only to Actuator. The lock-in-place fault was initiated at time t = 4s. Prior to the time of fault, both residual signals, r and r, show asymptotic stability (by design). However, at the time of the fault, the elevator actuator becomes stuck at a constant value, and r indicates that a fault has been detected. Figure was obtained from the same simulation experiment, where now the inputs are those pertaining only to Actuator. The residuals shown identically in Figure and Figure are a result of a single experiment where all of the inputs to the system are accounted for over both plots. Thus, the design steps lead to the successful detection of a fault. To understand the limitations of the given design steps for detecting faults in cases of multiple faults, a new simula- Jason M. Upchurch 3

.5.5.5.5 Residual response: Actuator lock in place r r 3 4 5 6 7 8 9.5.5.5.5 Fig. 3. Actuator : Lock-in-place fault. Residual response: Actuator outage 3 4 5 6 7 8 9 Fig. 4. Actuator : Outage fault. r r tion was run where fault conditions were induced in both actuators. Figure 3 shows the residual response to a new fault configuration with inputs relevant to Actuator (lockin-place fault), and Figure 4 shows the residual response to this new configuration with inputs relevant to Actuator (outage fault). Again, both residuals are asymptotically stable prior to the introduction of faults. However, when the faults are induced at time t = 4s, only one of the residual signals, r, responds. The need to isolate faults to particular actuators motivates the next section, where both detection and isolation are addressed. Figure 4 shows the residual response for Actuator. Fault Detection and Isolation Using Eigenstructure Assignment As shown in Example I, EA may be used to detect a fault in one or more actuators. However, in order to achieve fault isolability it is necessary to revisit (7) with this particular goal in mind. It is now convenient to obtain the transfer function from the fault vector to the residual vector, which is given by G rf (s) = W C(sI (A LC)) K. () Then the input-output relationship between the fault vector and residual vector can be compactly expressed as r(s) = G rf (s)f(s). (3) If G rf (s) in (3) is a diagonal matrix (at least in steady state), then the fault to residual mapping is one-to-one, so that there is no ambiguity isolating the fault (or combination of faults). 5,9 The referenced papers were used as the basis for the design steps outlined in the following section. These papers also present techniques useful for attenuating the effects of unstructured disturbance inputs on the residual signal; however, they are not presented in this paper. Such treatment will be the subject of future investigation. Design for Fault Isolation The design steps for fault isolation for the simple case are presented below. The simple case assumes that (A, C) are an observable pair, and that all of the eigenvalues of the observer system (A LC) are to be distinct. The design steps below are a concisely- summarized continuous-time version of the complete algorithm presented in the literature. 5,9 ) Select n distinct eigenvalues for the observer system (A LC) ) Let K be an orthonormal basis for null(k T ) 3) Let T k = [ K K 4) Let à = T [ K AT K and C = CT K à à 5) Let à = where à à à R p p, à R p (n p), à R (n p) p, and à R (n p) (n p) are the partitions of à with dimensions as specified [ 6) Let C = C C where C R r p and C R r (n p are the partitions of C with dimensions as specified [ 7) For i =,..., n let Ŝλ i = ÃT C T λ i I n p ÃT C T 8) for i = p +,..., n a) Let ˆΣ λi be a basis [ for null(ŝλ i ) b) Partition ˆΣ ˆNλi λi = where ˆN λi and ˆM λi are ˆM λi of compatible dimensions to right multiply Ŝλ i Jason M. Upchurch 4

[ c) Let Ñλ i = so that ˆN Ñλ i has a total of n rows λi Residual response: Actuator lock in place d) Let Mλi = ˆM λi 9) For i =,..., p a) ã T i is the ith row of à b) e n i is the ith column of an n n identity matrix c) p i = [ e p [ i p (n p) d) Ŝλ i i = λ i e n i ã i Ŝ λi e) ˆΣ i λ i be a basis for [ null(ŝi λ i ) ˆN f) Partition ˆΣ i i λ i = λi ˆM λ i where ˆN λ i i and ˆM λ i i are i of compatible dimensions to right multiply Ŝλ i i g) ˆN λi is [ the matrix ˆN λi with the first row removed p i h) Ñ λi = ˆN λ i ˆN i λ i i ) For i =,..., n a) M λi = ˆM λi and N λi = TKÑλ T i b) Arbitrarily chose nonzero column vectors of compatible dimensions so that l i = N λi α i and ξ i = M λi α i, P = [ l T l T... ln T T where det(p ) and null(c) null( [ lp+ T lp+ T... ln T ) T = { } and Ξ = [ ξ... ξ ) V = P ) V = [ v v... v p 3) For i =,..., p ω i = ( λ i )/ l T i, k i where ki is the ith column of K 4) Λ W = diag(ω, ω,..., ω p ) 5) L = P Ξ T 6) W = Λ W [ (CV ) T (CV ) (CV ) T Example II To validate the preceding design steps, the observer gain matrix, L, and the residual weighting matrix, W, were obtained. Then, the same aircraft model and MATLAB R routine from Example I were used in a new experiment. The simulation results for Example II are presented below in a way that parallels Example I. Figure 5 shows the residual response for Actuator. Figure 6 shows the same residual response from the simulation plotted with the inputs pertaining to Actuator. As in Example I, the two residual vectors produced are asymptotically stable. Unlike Example I, however, the residuals are no longer decoupled from the disturbance inputs, which can be verified by observing that they now take on a slightly noisy characteristic. The residual indicating a fault has occurred is still dominated by the fault input for this particular example with arbitrary control inputs of arbitrary scale. Since it is unrealistic to expect this behavior to hold for other cases, future work will explore techniques that explicitly combine minimizing the residual due to disturbances or exactly de-.5.5.5.5 r r 3 4 5 6 7 8 9.5.5.5.5 Fig. 5. Actuator : Lock-in-place fault. 3 4 5 6 7 8 9 Fig. 6. Residual response: Actuator no fault Actuator : No fault. r r coupling from them when possible while also providing for fault isolation. To determine the technique s ability to isolate faults uniquely, a two-fault configuration was introduced: a lockin-place fault in Actuator and an outage fault in Actuator. The results of this simulation are shown in Figure 7 and Figure 8. For the new fault configuration, it can be observed that the first residual, r, indicates the lock-in-place fault for the elevator actuator, and the second residual, r, indicates the outage fault for the thrust actuator. Thus, the technique provides a means to uniquely isolate faults. Jason M. Upchurch 5

.5.5.5.5 Residual response: Actuator lock in place r r 3 4 5 6 7 8 9.5 Fig. 7. Actuator : Lock-in-place fault. Residual response: Actuator outage be uniquely isolated to specific components, and for the case of the aircraft model used in the paper, the technique showed satisfactory ability to maintain detection capabilities in the presence of disturbances. Future work will explore techniques that may be capable of explicitly combining disturbance decoupling (for dealing with structured uncertainties) with disturbance attenuation (for dealing with unstructured uncertainties) into a single fault detection and isolation scheme. Future work will also reintroduce practical considerations into the aircraft model, such as actuator dynamics (including saturation), and will investigate the suitability of other FDI techniques for flight control applications. Additional techniques will be addressed in a manner similar to the presentation of EA in this paper in order to develop a catalog of several FDI techniques. Finally, a study of these techniques will be undertaken in order to determine their relative advantages for flight control applications. Acknowledgements This work was made possible by funding from the Virginia Space Grant Consortium and Old Dominion University..5.5.5 r r 3 4 5 6 7 8 9 Fig. 8. Actuator : Outage fault. Conclusion The safety of aviation systems may potentially be improved by the detection and isolation of faults in actuators and sensors. The necessary FDI systems must be robust to disturbances (i.e., disturbances are decoupled or attenuated with respect to residuals), and they must be capable of isolating one or more faulty components unambiguously. One technique that shows promise in accomplishing both goals is eigenstructure assignment. Eigenstructure assignment has been shown to be capable of decoupling the residual signal exactly from known structured uncertainties, as in the first case. However, additional design considerations are necessary in order to provide fault isolation capabilities. This second case allows for faults to References [ A. Wilsky, A survey of design methods for failure detection in dynamic systems, Automatica, vol., no. 6, pp. 6 6, 976. [ D. Wang and K. Lum, Adaptive unknown input observer approach for aircraft actuator fault detection and isolation, International Journal of Adaptive Control and Signal Processing, vol., no., pp. 3 48, 6. [3 I. Hwang, S. Kim, and C. Seah, A survey of fault detection, isolation, and reconfiguration methods, IEEE Transactions on Control Systems Technology, vol. 8, no. 3, pp. 636 653,. [4 D. Wang, G. Huang, G. Guo, and S. Yu, An FDI approach for aircraft actuator lock-in-place fault, in Proceedings of the IEEE International Conference on Control and Automation, Guangzhou, China, 7. [5 L. Shen, S. Chang, and P. Hsu, Robust fault detection and isolation with unstructured uncertainty using eigenstructure assignment, Journal of Guidance, Control, and Dynamics, vol., no., pp. 5 57, 998. [6 R. Patton and J. Chen, On eigenstructure assignment for robust fault diagnosis, International Journal of Robust and Nonlinear Control, vol., no. 4, pp. 93 8,. [7 S. Boyd. (8) Lecture 4. Stanford University. [Online. Available: http://www.stanford.edu/class/ee63s/lectures/aircraft.pdf [8 J. Chen and R. Patton, Robust model-based fault diagnosis for dynamic systems. Kluwer Academic Publishers, 999. [9 L. Shen and P. Hsu, Robust design of fault isolation observers, Automatica, vol. 34, pp. 4 49, 998. Jason M. Upchurch 6