Scholarly article on topic 'Design of passive fault-tolerant flight controller against actuator failures'

Design of passive fault-tolerant flight controller against actuator failures Academic research paper on "Mechanical engineering"

CC BY-NC-ND
0
0
Share paper
Academic journal
Chinese Journal of Aeronautics
OECD Field of science
Keywords
{}

Abstract of research paper on Mechanical engineering, author of scientific article — Xiang Yu, Youmin Zhang

Abstract The problem of designing passive fault-tolerant flight controller is addressed when the normal and faulty cases are prescribed. First of all, the considered fault and fault-free cases are formed by polytopes. As considering that the safety of a post-fault system is directly related to the maximum values of physical variables in the system, peak-to-peak gain is selected to represent the relationships among the amplitudes of actuator outputs, system outputs, and reference commands. Based on the parameter dependent Lyapunov and slack methods, the passive fault-tolerant flight controllers in the absence/presence of system uncertainty for actuator failure cases are designed, respectively. Case studies of an airplane under actuator failures are carried out to validate the effectiveness of the proposed approach.

Academic research paper on topic "Design of passive fault-tolerant flight controller against actuator failures"

Chinese Journal of Aeronautics, (2015),28(1): 180-190

JOURNAL OF

AERONAUTICS

Chinese Society of Aeronautics and Astronautics & Beihang University

Chinese Journal of Aeronautics

cja@buaa.edu.cn www.sciencedirect.com

Design of passive fault-tolerant flight controller against actuator failures

Yu Xiang, Zhang Youmin *

Department of Mechanical and Industrial Engineering, Concordia University, Montreal, Quebec H3G 1M8, Canada

Received 10 July 2014; revised 16 September 2014; accepted 31 October 2014 Available online 24 December 2014

KEYWORDS

Actuator failures; Lyapunov; Model uncertainty; Passive fault-tolerant control;

Peak-to-peak gain

Abstract The problem of designing passive fault-tolerant flight controller is addressed when the normal and faulty cases are prescribed. First of all, the considered fault and fault-free cases are formed by polytopes. As considering that the safety of a post-fault system is directly related to the maximum values of physical variables in the system, peak-to-peak gain is selected to represent the relationships among the amplitudes of actuator outputs, system outputs, and reference commands. Based on the parameter dependent Lyapunov and slack methods, the passive fault-tolerant flight controllers in the absence/presence of system uncertainty for actuator failure cases are designed, respectively. Case studies of an airplane under actuator failures are carried out to validate the effectiveness of the proposed approach

© 2015 Production and hosting by Elsevier Ltd. on behalf of CSAA & BUAA.

1. Introduction

Modern technological systems with increasing design complex-

ities are becoming more and more vulnerable to system/component malfunctions. Meanwhile, safety is tremendously demanded. However if no effective actions are taken, even a minor defection may develop into a catastrophic incident.

Fault-tolerant controller (FTC) is a controller to maintain system safety and an acceptable degree of performance in the presence of faults, using the configured system redundancy.1,2 Depending on the way of utilizing system redundancy, the

* Corresponding author. Tel.: +1 514 848 2424x5225. E-mail address: youmin.zhang@concordia.ca (Y. Zhang). Peer review under responsibility of Editorial Committee of CJA.

design methods of FTC can be generally classified into two sorts: passive and active approaches.3

The philosophy of passive FTC (also named as reliable controller earlier) is that a set of faulty cases as well as the normal condition are taken into account at the controller's design stage. Since neither real-time fault detection and diagnosis (FDD) nor control reconfiguration is needed, a single passive FTC is engaged in the absence or presence of system faults. Thus, the term "passive" underlies that no further action needs to be taken by the designed FTC when the prescribed faults occur during the course of operation. Due to that (1) a passive FTC has a relatively simple structure to be implemented, and (2) no time delays exist between the fault occurrence and corresponding actions, the design of passive FTC has attracted significant attention since 1990s.3

In 1992, Veillette and the co-authors propose a design method of reliable centralized and decentralized control systems.4 Facing the prescribed fault cases, the developed reliable controller is capable of ensuring the stability and

http://dx.doi.org/10.1016/j.cja.2014.12.006

1000-9361 © 2015 Production and hosting by Elsevier Ltd. on behalf of CSAA & BUAA.

performance of the closed-loop system. The concept is regarded as the baseline of the current studies of passive FTC. In 1995, the linear-quadratic (LQ) regulator technique is exploited to design a reliable controller against a class of actuator outages.5 As an essential factor of designing any FTC, redundancy is quantitatively investigated in Ref. , based on which the passive FTC design is proposed using pole region placement method. LQ/HTC performance is used as the objective of designing passive FTC,7 while an iterative linear matrix inequality (LMI) based method is developed to synthesize the FTC. Numerical simulation results illustrate that the passive FTC can not only stabilize the system under actuator failures, but also maintain a favorable level of tracking performance. In Ref. 8, a mixed H2/H1 passive FTC is designed to counteract actuator failures based on an enhanced LMI approach. From the aspect of performance, the approaches in Refs. 7'8 are less conservative when compared with the conventional LMI methods. Moreover, with respect to nonlinear systems, Hamilton-Jacobi inequality,9'10 variable structure,11 passivity theory,12 and sliding mode control13 are used to design passive FTCs, which are capable of accommodating actuator malfunctions.

Although passive FTC design has been a focus of extensive studies in the last two decades, there still exist some open issues. One of the most important factors is that the system safety requires system variables not exceed specific bounds at every time instant. More specifically in flight control systems, there are allowable ranges corresponding to the angle of attack (AOA), altitude, etc. Once these limits are broken in faulty cases, the airplane will enter irreversible state. Another aspect lies in that the performance of model-based controller design solely relies on the accuracy of modeling.14 It is particularly true when designing a passive FTC in this case. The model uncertainty has an adverse impact on the performance of the abnormal system. Due to the constraints of wind tunnel test data, flight test data, and identification methods, a specific level of inaccuracy may exist in aircraft models.

Motivated by the afore-mentioned factors, this paper proposes two passive FTC strategies under actuator fault situations corresponding to model uncertainty-free and model uncertainty cases, respectively. If the modeling accuracy is satisfied, the first passive FTC design approach can be chosen; otherwise the second design strategy is an excellent alternative. The normal and prescribed fault cases are formulated by the concept of polytope. In the design procedure of passive FTC, peak-to-peak gain is introduced to represent the relationships among the amplitudes of actuator outputs, system outputs, and reference commands. Parameter dependent Lyapunov and slack methods are also adopted so that the freedom degree of the design algorithm can be enhanced. Case studies of ADMIRE (aero-data model in research environment) benchmark aircraft are conducted to verify the effectiveness of the developed approach. For avoiding any confusion, failure in this paper stands for the total outage of an actuator, while fault specifies the loss of effectiveness of an actuator.

The rest of the paper is arranged as follows. The considered fault sets are established in Section 2. The objective and problem of designing the passive FTC are stated in Section 3, where the relationships among commands, control inputs, and system outputs are examined as well. In Section 4, the design algorithms of passive FTCs with/without consideration of model uncertainty are developed, in which the parameter dependent Lyapunov and slack methods are introduced to

reduce the conservatism. Linear and nonlinear simulations are performed in Section 5 to illustrate the effectiveness of the proposed approach, followed by some concluding remarks in Section 6.

Notation. Throughout the paper, the superscript T specifies matrix transposition, the symbol * within a matrix represents a symmetric entry, and Co{.} stands for the convex hull. Rn denotes the n-dimensional Euclidean real space, Rnxm is the set of all n x m real matrices. L1 norm of any t: [0,1) ! Rk is defined as the sup over all time of the Euclidean norm of t at every time instant. IMIrc — ess supt>0[tT(t)t(t)]1/2, in which ess means essential.

2. Representation of actuator faults

At a specified trimming point, the linear time invariant (LTI) model of ADMIRE without model uncertainty is represented by

x (t) = Ax(t) + Bu(t) x(0) = xo y(t) = Cx(t)

where x(t) 2 Rn is the state vector of the aircraft, u(t) 2 Rm indicates the control inputs of m independent actuators, and y(t) 2 Rh is the system output vector. A, B, and C are system matrices with appropriate dimensions.

Actuators play an important role in flight control systems.15 A diagram of a typical hydraulic actuator in an airplane is shown in Fig. 1. The control signal from the flight controller is transferred to the physical action exerted on an airplane by the actuation device. The control signal that is normally formed by a voltage signal is exposed on the torque motor. The amplitude of the control signal determines the angular displacement of the baffle of the torque motor, which therefore results in a differential pressure of the servo-valve. The piston of the actuator chamber is then pushed to a specific position by the hydraulic source passing through the servo-valve. Consequently, the control surface, which is connected to the rod, is deflected in order to provide the required force and moment for the airplane maneuver.

As can be seen from Fig. 1, the control surface deflection is driven by the hydraulic power, whilst the deflection degree is decided by the command from the flight controller. The actuator rod cannot move to the expected position or even worse react at all due to but not limited to hydraulic issues.16,17 As a result, the efficiency of surface deflection is shrunk or completely lost. According to the analysis of actuator faults,16

Fig. 1 Diagram of a hydraulic-driven actuator.

the control input of Eq. (1) in the event of actuator faults is simplified by

u¥(t)—Lu(t), (2)

where the diagonal matrix L — diag[/i,/2,..., /m] represents the health condition of actuators. The element /t 2 [0,1] describes the effectiveness of the ith actuator, ranging from total failure with /t — 0, i — 1,..., m, partial loss fault with 0 < /t < 1, and fault-free (normal) case with /t — 1.18 Thus, the aircraft under actuator malfunctions is expressed by

x (t) — Ax(t) + BLu(t) x(0) — xo y(t) — Cx(t)

Retracing the actuator redundancy defined in Ref. , it is known that the aircraft has m — h redundant actuators. The worst case in which the configured redundancy is capable of accommodating is that m — h actuators are complete failures. Before designing any passive FTC, the fault sets need to be determined within the capability of the configured redundancy and the admissible solutions.

Let no denote the number of the defined fault sets, the actuator faults/failures can be described by

UF(t) = L, u(t) (4)

where the scaling factor L,, i — 0,1,..., no satisfies: Li 2 Q,{Li — diag(lii, la,..., ), lj — 0 or 1, j

— 1,2,..., mg (5)

If the fault sets are chosen as (8i — 0,1,..., no), the aircraft model can be subsequently written by

x (t) — Ax(t)+ BLiu(t) x(0) — X0 y(t) — Cx(t)

Each case in the considered fault sets is known a priori, which can be regarded as the corner of the polytope. In addition, the faulty system falls into the convex hull of these corners. Therefore, the aircraft system with the considered fault sets can be modeled by the polytopic uncertainties.19 The system matrices are represented by

A(h) — ££0A,h

Bf(0) — Si=0 BiLidi

C(h) — YZtCA

with the uncertain constant parameter vector h — [0„, 01,..., 0no ]T 2 R"°+1 satisfying:

0 2 0 2 R'

: 0, P 0, ^0, — 1

One convex of the polytope represents the normal case, and each of the rest denotes the individual set of actuator outages. In summary, the aircraft model in the case of the faulty and normal conditions can be described by

x (t) — A(0)x(t) x(0) — x0 y(t) —C(0)x(t)

- Bf(0)u(t)

Additionally, considering the linearized model under uncertainty14:

x (t) — (A + AA)x(t) + (B + DB)u(t)

x(0)—x0 (10)

y(t) — Cx(t)

where [ AA, AB] — DF(t)[Ey, E2 ], D, Ex, and E2 are known constant matrices, and F(t) e Rdxw is the modeling or parameter uncertainty, which satisfies FT(t)F(t) 6 I. Thus, the system with consideration of both uncertainty and actuator failures can be written by

( X(t) — Au(0)x(t) + BuF(0)u(t), x(0) — X0 \y(t) — C(0)x(t)

where the matrices in Eq. (11) are

' Au(0) — Y,0(Ai + AAi)0l BUr(fl)^ n— d(B, + ABi)Ll0l C(0) — PZ0CiOi

with h satisfying Eq. (8) as well.

Remark 1. Since the specified fault sets fall into the actuator outages, the matrices Ai, Bi, and Ci(i — 0,1,..., no) are identical to the matrices A, B, and C of Eq. (1), in the case of one trimming condition. The uncertainty matrices AAi and ABi are namely equivalent to AA and AB in Eq. (10). The individual prescribed set is identified by the varying element Li, i = 0, 1,..., no.

3. Objective and formulation

3.1. Objective

The objective of this paper is to develop the passive FTC strategies with regards to the model uncertainty-free and uncertainty cases in the presence of actuator failures. Within the considered actuator failures, the stability and tracking performance can be ensured.

3.2. Formu/ation

An integral part is introduced in the scheme of the designed passive FTC to eliminate the steady-state tracking error.7 As shown in Fig. 2, the designed passive FTC to counteract actuator failures is based on state feedback.

Given the considered fault sets, the corresponding augmented system without uncertainty is

; Outages | Uncertainty

)-»- Integral -»- A' -»< y* Actuators -»■ ^ircraft ■*■ Sensors ■

+ K - x

y f -

Fig. 2 Scheme of the proposed passive FTC.

e(t) "0 —C(h)' /e(t)dt + 0 u(t) + I

.X (t). .0 A(h) .x(t) .BF(A). 0

where e(t)—yr(t)—y(t), and yr(t) is the reference vector. When the augmented state vector is defined as xa(t) = [(je(t)dt)T, xT(t)]T, Eq. (13) can be simplified by

-Xa(t) — Aao(0)Xa(t)+Bao (0)«(t) + Gao (0)yr(t) (14)

" 0 — C(h) " 0 A(h) 0

. Bf(0)J

g R(n+h)xh

Aao(h) = Bao(h) = Gao (h) =

£ R(n+h)x(n+h) G R(n+h)xm

On basis of Eq. (12), the augmented system with consideration of uncertainty is

■Xa(t) — AUao(0)Xa(t)+BUao(0)«(t)+GUao(0)yr(t) (15)

' Auao(h)— Aao(0)+DaFEa Buao(h)— Bao(0)+DaFE2i(0)

GUao —

Ea, = [0 E

The performance output za(t) is defined by

Za(t) = CzXa(t)+DzL(h)u(t)

where L(h) — £'—0Liei.

For the sake of aircraft safety, it is required that safety bounds are not exceeded to prevent the handicapped aircraft

actuator and system outputs are included in the chosen performance output, the physical interpretation behind Eq. (17) is to describe and link the peak values of actuator and system outputs in response to the maximum commands. Hence, the objective of designing passive FTCs against the considered fault cases turns to minimize the upper bound y and maintain the stability of the closed-loop system for all h 2 0.

4. Passive fault-tolerant flight controller design

Considering the designed passive FTC with respect to Eq. (9) in the following form which includes both proportional and integral actions:

u(t) = Kxx(t)+ Ke / e(t)dt = Kpftc Xa(t)

where Kpftc — [Ke, Kx] 2 Rmx(n+h). Thus, the closed-loop augmented system in the case of actuator outages is

X a(t) = (Aao(h)+ Bao(h)KpFTc)Xa(t) + GM(0)yr(t)

Analogously, in the condition of model uncertainty, the closed-loop augmented system can be represented by

Xa(t) = (Auao(h)+ Buao(h)KpFTC )Xa(t)+ Guao(%r(t) (20) Subsequently, the regulated output is:

Za(t) = (Cz + DzL(h)KpFTc)Xa(t) (21)

Theorem 1. (Uncertainty-free case). If there exist positive definite matrices Yi — YT > 0, i — 0,1,..., no, matrices S and N, and scalars k > 0, i > 0, y > 0 satisfying the following:

kY, -(Aao,S + Bao,N)-(Aao,S + Bao,N)T

Yi + S —(Aao,S + Bao,N)T

S + ST

entering an irreversible state (e.g. tail stall). On the other side, the amplitudes of actuator movements and system outputs highly rely on the commands. Therefore, it is of paramount importance to examine the relationships among the peak values of references, actuator outputs, and aircraft outputs. Based on this consideration, following peak-to-peak gain is proposed to be employed to represent such relationships in this paper:

llZall

sup |i—¡i

0<||yr||<i lUrll

■< c

where JZayr is the transfer function from yr to za, and y denotes the upper bound of the peak-to-peak gain. As considering that

~ kYi 0 (CzS + DZL,N)T' H — * (y — i)/ 0 > 0 (23)

* * y/

therefore, KPFTC — NS—1 guarantees that system Eq. (19) is stabilized and the peak-to-peak norm of JZayr is smaller than y.

Proof. In accordance with the sufficient condition of peak-to-peak gain in Ref. 20 and the multiple convexity concept proposed in Ref. 21, the following inequalities hold true so that the peak-to-peak norm of the transfer function Tzayr is less than y,

kP(h) + (Aao(h) + Bao (h)KpFTc)TP(h)+ P(0)(Aao(0)+ Bao(h)KpFTc)

P(h)Gao(h) —ll

za yr N oo ,00

kP(0) 0 (Cz + DzL(0)Kpftc)1

* (y- l)1 0

* * yl if y 2 Li with HyJL 6 1.

e: hh <0

Therefore, it renders that Ht < 0, i — 0,1,..., no is the sufficient condition for Eq. (30)'s holding true. This completes the proof. □

With the help of Projection Lemma in Ref. 22, Eq. (26) is Remark 2. Tteorem 1 possesses Aree major advantages: (1)

equivalent to Eq. (24),

Projection Lemma is used to decouple Lyapunov matrix

kP(0)- V(Aao(0)+ Bao (O)KpFTC )-(Aao(0)+ Bao (0)KpFTc)T VT -VGao(0) P(ff)+V -(Aao(0)+ Bao(0)KpFTc)T VT

* -ii -GTo(h) vt

where V is a general matrix.

from system matrices; (2) parameter dependent Lyapunov

Defining S — V 1 and then pre- and post-multiplying Eq. method is adopted to set up different Lyapunov matrices in

(26) by diag(ST, I, S1) and diag(S, I, S), one can derive:

response to each prescribed set; and (3) the slack matrix S

kY(0)-(Aao(0)+ Bao(0)KpFTc)S - ST(Aao(0) + Bao (0)KpFTcf -Gao(0) Y(0)+S - ST (Aao(0)+ Bao (0)KpFTC )T

-GTo(0) S ST

where Y(h),STP(h)S. If N,KpftcS is defined, Eq. (27) is that does not have to be positive definite replaces Lyapunov

recast by the following inequality:

matrix. Thus the techniques ensure that the proposed algo-

kY(0)-(Aao(0)S + Bao(0)N) - (Aao(0)S + Bao(0)N)T -Gao(0) Y(0)+S -(Aao(0)S + Bao(0)N)T

-GTo(0) S ST

If the condition Y(0) — J21—00iYi is satisfied, Eq. (28) can be represented by:

EH00'U < 0 (29)

Therefore, for every i — 0,1,..., no, U, < 0 guarantees that Eq. (29) holds true.

If Eq. (25) is pre- and post-multiplied by the following matrices diag(ST, I, ST) and diag(S, I, S) and defining N,KPFTCS and Y(0),STP(0)S, thus:

kY(0) 0 (CzS + DzL(0)N)T

* (c — l)I 0

* * yI Moreover, Eq. (30) can be written by:

rithm is less conservative compared with the classical method in Ref. 20.

Remark 3. At the design stage, the algorithm is to minimize the upper bound of peak-to-peak gain y subject to Eqs. (22) and (23), where i — 0,1,..., no. Using LMI Toolbox,23 the passive FTC gain without consideration of model uncertainty is KPFTC — NoptS^p't, where Nopt and Sopt are the optimal solutions of matrices N and S, respectively.

Theorem 2. (Uncertainty case). If there exist positive definite matrices Yi — YT > 0, i — 0,1,..., no, matrices S, N, and Q, and scalars k > 0, i > 0, y > 0, e > 0 satisfying the following inequalities:

k Yt -(AaoiS + Ba0lN)-(Aa0lS + Bao,N)T -G*,

* -ßI

Yl + S -(AaoiS + BaoiN)T (Ea1 S + E^N)

S + S1

QDa 0 0 0

"kYi- 0 (CzS + DzL,N)t "

Hi — * (y — i)/ 0 > 0, (33)

* * y/

thus, KPFTC — NS^1 guarantees that system Eq. (20) is stabilized and the peak-to-peak norm of TZayr is smaller than y.

Proof. In accordance with the sufficient condition of peak-to-peak gain in Ref. 20 and the multiple convexity concept proposed in Ref. 21, the following inequalities hold true so that the peak-to-peak norm of the uncertain system Eq. (20) is less than y,

where V is a general matrix. Similar to the derivation process of Eq. (22) and defining Q,STP(h), it is obtained that Eq. (32) is the sufficient condition for Eq. (34) holding true.In addition, the proof process of Eq. (33) is identical to that of Eq. (23) in Theorem 1. For the interest of space, it is omitted herein. This completes the proof. □

Remark 4. Theorem 2 offers an option of designing a passive FTC against actuator failures in the presence of model uncertainty. In the design process, the matrices D, E\, and E2, which are known to specify the degree of model uncertainty, are taken into account. As a result, the passive FTC generated

kP(h) + (Auao(h)+ Buao(h)KpFTc)TP(h)+ P(h)(Auao (fl)+ Buao ( h)KpFTC)

P(h)Guao(h)

kP(h) 0 (Cz + DzL(h)KpFTc)

* (c — l)I 0

* * ci

if yr 2 L1 with ||yr||OT 6 1. According to the uncertainty representation, Eq. (34) equals to:

by Theorem 2 can not only accommodate the prescribed actuator failures, but also work in the case with modeling errors.

Remark 5. By minimizing the upper bound of the peak-to-peak gain y, the maximum value of performance output

kP(h) + (Aao(h)+ Bao(h)KpFTc)TP(h)+ P(h)(Aao(h) + Bao(h) Kpftc) P(h)Gao(h)

* — li

(DaFEa! + DaFE2L(h)KpFTc)TP(h)+ P(h)(DaFEa1 + DaFE2L(h)KpFTc) 0

From Ref. 14 and FTF 6 /, the following inequality holds true (including the aircraft and actuator variables) can be estimated

for any e >0:

(DaF£al + DaF£2i(h)KpFTC)TP(h)+P(h)(Da F£al + DaF£2-L(0) Kpftc) 6 eP(h)DaFFTDTP(h) + e—'(£al + £2L(h)KpFTc)T(£a1 + £2L(h)KpFTc)

In consequence, the sufficient condition for Eq. (36) to be held

provided that the information of reference commands is known a priori. In this sense, the developed approach coincides with the requirements of safety-critical processes. In addition, this concept can also be extended to flight envelope protection in fault cases.

kP(h) + (Aao(h)+ Bao(h)KpFTc)TP(h)+ P(h)(Aao(h) + Bao(h) Kpftc) P(h)Gao(h)

* —li

8P(h)DaFFTDTP(h) (Ea1 + E2L(h)KpFTc)T * ei

By virtue of Projection Lemma in Ref. , Eq. is equivalent to Eq. (39),

kP(h)— V(Aao(h)+Bao (h)KpFTc)

— (Aao (h)+ Bao (h)KpFTc)T VT + eP(h)DaFFTD'TP(h) — VGao (h) P(h)+ V —(Aao (h)+ Bao (h)KpFTC)T V

+8—'(Ea! + E2L(h)KpFTc)T(Ea1 + E2L(h)KpFTC )

ao(f)i A*ao(

-GTo(h)vT

V + VT

5. Numerical case studies

5.1. Deve/oped simu/ation p/atform

The simulation platform that is developed by Diagnosis, Flight Control and Simulation Lab at Concordia University is illustrated in Fig. 3. The platform is basically made up by two units. The controller to be validated, actuator models, sensor models, and aircraft models are integrated in Unit 1. For the convenience of simulation, the functionalities of data storage and failure injection are designed as well. The data from Unit 1 are transmitted to Unit 2 by User Datagram Protocol (UDP) networks. Unit 2 is designed to demonstrate the flight animation of the selected aircraft using FlightGear software.

Table 1 Trimming condition of the ADMIRE model.

Symbol Physical meaning Value

MTrim Mach number at the trimming condition 0.45

HTrim Altitude at the trimming condition 3000 m

VTrim Air speed at the trimming condition 147.86 m/s

aTrim AOA at the trimming condition 3.74°

qTrim Pitch rate at the trimming condition 0

T^Tom Throttle stick setting 0.08

cTrim dRC RC at the trimming condition 0.05°

cTrim dLC LC at the trimming condition 0.05°

cTrim dROE ROE at the trimming condition -0.04°

cTrim dLOE LOE at the trimming condition -0.04°

(¡Trim dRIE RIE at the trimming condition -0.04°

Trim dLIE LIE at the trimming condition -0.04°

5.2. Se/ected aircraft mode/

In the selected ADMIRE model, the state vector is defined as x(t) — [a, b,p, q, r]T, the control input vector is u(t) — [¿rc, ¿lc, ¿ROE, ¿rie, ¿lie, ¿loe]t, and the system output vector is y(t) — [a, b]T. a, b,P, q, and r are the AOA, sideslip angle, roll rate, pitch rate, and yaw rate, respectively. The control inputs ¿RC, ¿LC, ¿ROE, ¿RIE, ¿lie, and ¿loe specify the deflections of right canard (RC), left canard (LC), right outer elevon (ROE), right inner elevon (RIE), left inner elevon (LIE), and left outer elevon (LOE), respectively. The actuator dynamics is modeled by 1/(0.05s + 1). The operating range of each actuator is [—25°, 250]. The trimming conditions are detailed in Table 1, under which the system matrices are:

-1.0649 0 0

8.1633 0

0.0034

-0.2492

-22.5462

-0.0057

1.7970

0.0656 -2.0457 0

-0.1096

0.9728

-1.0476 0

-0.9879

0.5432

0.4357

-0.0062 -0.0062 -0.0709 -0.1172 -0.1172 -0.0709

-0.0072 -0.0072 0.0039 0.0188 -0.0188 -0.0039

1.2456 -1.2456 -10.6058 -9.2345 9.2345 10.6058

2.7172 2.7172 -2.4724 -4.0101 -4.0101 -2.4724

-0.7497 0.7497 -0.4923 -1.1415 1.1415 0.4923

1 0 0 0 0 0 10 0 0

5.3. Simu/ation scenarios

Two simulation scenarios are set up, which are (1) ADMIRE model without uncertainty; and (2) ADMIRE model with model uncertainty. It should be mentioned that in scenario 2, the model uncertainty matrices are:

-0.5 0 0 0 0 0 0.5 0 0 0

E2 = -0.0005 X

111111 2 2 2 2 2 2

Fig. 3 Diagram of the developed simulation platform.

The reference signals of AOA and sideslip angle with amplitudes of 5° and 1° are initiated at 1 s. The four elevons are assumed to become complete failures at 10 s. In the numerical simulation studies, a nominal controller,20 a LQ/HTC-based passive FTC,7 and the proposed passive FTC are implemented and compared, respectively. Interested readers can visit web www.youtube.com/user/NAVConcordia or http://i.youku. com/NAVConcordia to watch the video clips of ADMIRE animation under those three control strategies. The detailed comparison and evaluation are provided as follows.

5.4. Results of Scenario 1 and evaluation

As can be seen from Fig. 4, the nominal controller, LQ/HTC-based passive FTC(PFTC), and proposed passive FTC can maintain the tracking performance when all actuators are working normally. It is indicated by Table 2 in the normal condition, the AOA (2.64 s, 0%) and sideslip angle (1.99 s, 0%) track the commands with superior performance under the

< i O 2

Failures occur

_i_i_i_i_i_i_i_i_i_

Time (s)

^ F 1 /V" Failures occur i

0 4 8 12 16 20

Time (s)

-Reference ---Normal controller — LQ/Z/^PFTC --Proposed FTC Fig. 4 Aircraft output responses in Scenario 1.

nominal controller as compared with those in the LQ/HTC-based passive FTC and proposed passive FTC. It is true since the nominal controller is only concentrated on the best performance in the normal condition. From Fig. 5, when all actuators are healthy, the LQ/H^-based passive FTC drives RC and LC to deflect more angles than those under the nominal controller and the proposed passive FTC. When the LQ/HTC-based passive FTC is commissioned, it is easy to reach the physical limits of RC and LC even though the aircraft is flying ordinarily.

When all elevons are outages at 10 s, the safety cannot be ensured by the nominal controller any more as the AOA and sideslip angle become oscillatory as the dash-dot lines shown in Fig. 4. In this situation, the aircraft becomes unstable and unrecoverable as the physical bounds are broken. By contrast, the LQ/HTC-based passive FTC and the designed passive FTC are capable of keeping the faulty aircraft stabilized and returning the aircraft outputs to the intended angles. Fig. 4 and Table 2 also indicate that the returning time and overshoot of AOA (2.35 s, 11.8%) and sideslip angle (2.7 s, 14.4%) achieved by the LQ/H^-based strategy are interior to those by the proposed FTC (AOA: 1.4 s, 10%; sideslip angle: 0.75 s, 4%). Fig. 5 exhibits that after elevon outages occur, RC and LC are saturated under supervision of the nominal controller. However, when the proposed passive FTC is

commissioned, the amplitudes of the healthy actuators are considerably less than those of the normal controller. Therefore, the results of scenario 1 illustrate that the designed passive FTC can not only maintain the safety of the airplane when the prescribed failures occur, but also obtain an acceptable level of performance.

5.5. Results of scenario 2 and assessment

The simulation results of scenario 2 are illustrated by Figs. 6 and 7 and Table 3. As shown in Fig. 6, before elevon outages occur, AOA and sideslip angle can track the reference signals under the selected three controllers. However, the settling time and overshoot of AOA and sideslip angle achieved by the nominal controller and LQ/HTC-based passive FTC are considerably degraded as comparison of those without model uncertainty. The degree of performance degradation in the developed FTC is remarkably less than those by the other two controllers. The details are: (1) the performance of AOA returning time, sideslip angle returning time, sideslip angle overshoot in the case of nominal controller is decreased by 27.27%, 53.27%, and 0 fi 2.5%, respectively; (2) when the LQ/HTC-based passive FTC is used, the degraded degree of the above performance is 28.42%, 40.53%, and 185.71%, respectively; and (3) under the proposed FTC, the performance degradation of AOA returning time, sideslip angle returning time, sideslip angle overshoot is 24.13%, 0.96%, and 53.85%, respectively.

After elevon outages, the nominal control strategy cannot guarantee the safety of the faulty aircraft. Although the LQ/ HTC-based passive FTC can counteract elevon failures as shown in Fig. 6, the system performance is greatly deteriorated according to Tables 2 and 3. On the other hand, the developed passive FTC with consideration of model uncertainty is capable of obtaining better performance rather than those under the other two controllers. Moreover, the performance achieved by the proposed FTC is slightly degraded in comparison of the model uncertainty-free case. Based on Fig. 7, the redundant actuators RC and LC deflect more than the normal case (before 10 s) so as to accommodate the elevon failures and maintain the safety of the faulty system. It is also

Table 2 Performance of the three controllers in Scenario 1

Different controller Condition Proposed passive FTC LQ/Hœ-based passive FTC Nominal controller

Range of AOA Normal [0, 5°] [0, 5°] [0, 5°]

Failure [5°, 5.5°] [4.4°, 5°] Oscillatory

Range of sideslip angle Normal [0, 1.12°] [0, 1.06°] [0, 1°]

Failure [0.96°, 1°] [0.86°, 1°] Oscillatory

Peak value of RC Normal -2.75° -8.38° -2.21°

Failure -4.39° -4.42° Saturated

Peak value of LC Normal -4.64° -12.75° -5.36°

Failure -8.56° -8.58° Saturated

Settling/returning time (AOA, D = 5%) Normal 2.86 s 2.85 s 2.64 s

Failure 1.17s 2.35 s Oscillatory

Overshoot (AOA) Normal 0 0 0

Failure 8% 11.8% Oscillatory

Settling/returning time (Sideslip angle, D = 5%) Normal 3.12s 3.38 s 1.99 s

Failure 0.75 s 2.7 s Oscillatory

Overshoot (Sideslip angle) Normal 11.7% 5.6% 0

Failure 4% 14.4% Oscillatory

5 ¡j ¡j >-----------iL

--------JTT ! j

10 15 Time (s)

§ "< pi

/ f / ROE outage

10 15 Time (s)

y n :l - \ \ \

\ RIE outage

Normal controller ----LQ/ff PETC - Proposed FTC

Fig. 5 Actuator deflections in Scenario 1.

10 15 Time (s)

\ LIE outage

10 15 Time (s)

G I 03

Failures occur

Time (s)

/ y —^ Failures occur

0 4 8 12 16 20

Time (s)

■Reference —Normalcontroller —LQ/Z/^PFTC --ProposedFTC Fig. 6 Aircraft output responses in Scenario 2.

demonstrated by Fig. 7 and Table 3 that the peak values of actuator deflections are controlled within the allowable operating ranges by the proposed passive FTC.

Thus, it is known that model uncertainty is detrimental to performance both in normal and faulty cases. The comparison also illustrates that the developed passive FTC is a viable option of compensating for the adverse effects caused by model uncertainty and actuator failures.

5.6. Results of nonlinear simulation

Scenarios 1 and 2 are further investigated in the case with nonlinear dynamics of the selected ADMIRE for the purpose of further verifying the proposed passive FTCs. It is shown in

Normal controller ----LQ/Z/^PETC - Proposed FTC

Fig. 7 Actuator deflections in Scenario 2.

Table 3 Performance of the three controllers in Scenario 2.

Different controller Condition The proposed LQ/Hœ-based Nominal

passive FTC passive FTC controller

Range of AOA Normal [0, 5°] [0, 5°] [0, 5°]

Failure [5°, 5.5°] [4.2°, 5°] Oscillatory

Range of sideslip angle Normal [0, 1.18°] [0, 1.16°] [0, 1.03°]

Failure [0.96°, 1°] [0.82°, 1°] Oscillatory

Peak value of RC Normal -3.6° -10.4° -2.6°

Failure -4.04° -4.05° Saturated

Peak value of LC Normal -4.8° -14.5° -5.7°

Failure -7.9° -7.9° Saturated

Settling/returning time (AOA, D = 5%) Normal 3.55 s 3.66 s 3.35 s

Failure 1.4 s 2.95 s Oscillatory

Overshoot (AOA) Normal 0 0 0

Failure 8.2% 16% Oscillatory

Settling/returning time (Sideslip angle, D = 5%) Normal 3.15s 4.75 s 3.05 s

Failure 1.0 s 2.8 s Oscillatory

Overshoot (Sideslip angle) Normal 18% 16% 2.5%

Failure 6% 18% Oscillatory

Fig. 8 that without model uncertainty, the AOA and sideslip angle are controlled to return the intended angles after all ele-von complete failures (at 10 s). Based on Fig. 9, the designed passive FTC can still maintain the safety of the aircraft in the presence of elevon outages and model uncertainty. Fig. 9 exemplifies that the developed controller with explicit consideration of model uncertainty can obtain gracefully degraded performance as compared to the uncertainty-free case illustrated in Fig. 8.

4 8 12 Time (s) 16 20

Time (s)

Fig. 9 Aircraft outputs in nonlinear simulation of developed controller with explicit consideration of model uncertainty.

6. Conclusion remarks

The prescribed actuator failures are developed in terms of polytopic uncertainty. Peak-to-peak norm of the closed-loop system is adopted to describe the relationships among the maximal values of actuator outputs, reference signals, and system outputs. Based on a clear understanding of the safety requirements, the concept of peak-to-peak gain is incorporated in the design procedure of passive FTC, in which the parameter dependent Lyapunov and slack variable methods are applied for reducing conservatism. From a practical perspective, the passive FTC strategies corresponding to model uncertainty-free and uncertainty cases are investigated. Both linear and nonlinear simulation studies subject to the ADMIRE aircraft model with elevon outages are conducted. It is demonstrated conclusively that the developed approach is effective in the presence of both actuator failures and model uncertainty.

Acknowledgement

The authors would like to acknowledge the financial support from the Natural Sciences and Engineering Research Council of Canada (NSERC) through Discovery Grant and Engage Grant for the work reported in this paper.

References

1. Zhang YM, Jiang J. Bibliographical review on reconfigurable fault-tolerant control systems. Ann Rev Control 2008;32(2):229-52.

2. Blanke M, Kinnaert M, Lunze J, Staroswiecki M. Diagnosis and fault-tolerant control. 2nd ed. Berlin Heidelberg: Springer-Verlag; 2006.

3. Jiang J, Yu X. Fault-tolerant control systems: a comparative study between active and passive approaches. Ann Rev Control 2012; 36(1):60-72.

4. Veillette RJ, Medanic JV, Perkins WR. Design of reliable control systems. IEEE Trans Autom Control 1992;37(3):290-304.

5. Veillette RJ. Reliable linear-quadratic state-feedback control. Automatica 1995;31(1):137-43.

6. Zhao Q, Jiang J. Reliable state feedback control systems design against actuator failures. Automatica 1998;34(10):1267-72.

7. Liao F, Wang JL, Yang GH. Reliable robust flight tracking control: an LMI approach. IEEE Trans Control Syst Technol 2002;10(1):76-89.

8. Zhang Q, Ye S, Li Y, Wang X. An enhanced LMI approach for mized H2/H1 flight tracking control. Chin J Aeronaut 2011;24(3): 324-8.

9. Liang YW, Liaw DC, Lee TC. Reliable control of nonlinear systems. IEEE Trans Autom Control 2000;45(4):706-10.

10. Yang GH, Lam J, Wang JL. Reliable H^ control for affine nonlinear systems. IEEE Trans Autom Control 1998;43(8):1112-7.

11. Liang YW, Xu SD. Reliable control of nonlinear systems via variable structure scheme. IEEE Trans Autom Control 2006;51(10): 1721-6.

12. Benosman M, Lum KY. Application of passivity and cascade structure to robust control against loss of actuator effectiveness. Int J Robust Nonlinear Control 2010;20(6):673-93.

13. Wang RR, Wang JM. Passive actautor fault-tolerant control for a class of overactuated nonlinear systems and applications to electric vehicles. IEEE Trans Veh Technol 2013;62(3):972-85.

14. Zhou K. Khargonekar PP. Robust stabilization of linear systems with norm-bounded time-varying uncertainty. Syst Control Lett 1988;10(1):17-20.

15. Kang R, Jiao Z, Wang S, Chen L. Design and simulation of electro-hydrostatic actuator with a built-in power regulator. Chin J Aeronaut 2009;22(6):700-6.

16. Yu X, Jiang J. Hybrid fault-tolerant flight control system design against partial actuator failures. IEEE Trans Control Syst Technol 2012;20(4):871-86.

17. Niksefat N, Sepehri N. A QFT fault-tolerant control for electro-hydraulic positioning systems. IEEE Trans Control Syst Technol 2002;10(4):626-32.

18. Zhang YM, Jiang J. Active fault-tolerant control system against partial actuator failures. IEE Proc Control Theory Appl 2002; 149(1):95-104.

19. Shaked U. Improved LMI representations for the analysis and the design of continuous-time systems with polytopic type uncertainty. IEEE Trans Autom Control 2001;46(4):652-6.

20. Scherer C, Weiland S. Linear matrix inequalities in control. Delft: Delft University; 2004.

21. Gahinet P, Apkarian P, Chilali M. Affine parameter-dependent Lyapunov functions and parameter uncertainty. IEEE Trans Autom Control 1996;41(3):436-42.

22. Gahinet P, Apkarian P. A linear matrix inequality approach to H^ control. Int J Robust Nonlinear Control 1994;4(4):421-48.

23. Boyd SP, Ghaoui E, Feron L, Balakrishnan V. Linear matrix inequalities in system and control theory. Philadelphia, PA: SIAM; 1994.

Yu Xiang received the B.S., M.S., and Ph.D. degrees from Northwestern Polytechnical University, in 2003, 2004, and 2008, respectively. He is currently a Research Associate in the Department of Mechanical & Industrial Engineering at Concordia University, Montreal, Canada. His research interests include fault-tolerant control systems, flight control systems, and networked-based control systems.

Zhang Youmin received the B.S., M.S., and Ph.D. degrees from Northwestern Polytechnical University, in 1983, 1986, and 1995, respectively. Dr. Zhang is currently a full Professor in the Department of Mechanical & Industrial Engineering at Concordia University, Montreal, Canada. His main research interests are in the areas of monitoring, fault diagnosis and fault-tolerant control of safety-critical systems; avionics, guidance, navigation, and cooperative control of manned and unmanned aerial/space/ground/surface vehicles. Dr. Zhang has published 4 books, 10 book chapters, and more than 330 refereed journal and conference papers. He serves as a member of the IFAC Technical Committee on SAFEPROCESS, a member of the AIAA Infotech@Aerospace Program Committee on Unmanned Systems etc. He is the Editor-in-Chief of Journal of Instrumentation, Automation and Systems, and an Editorial Board Member of several journals, and the Program Chair of ICUAS'14, General Chair of ICIUS'14 and ICUAS'15.