Reference and Limit Governors for Limit Protection of Turbofan Engines

: This paper proposes a novel architecture of limit protection including the references governors and limit governors and applies this architecture to limit protection in turbofan engines. References governors are designed as add-on schemes to a pre-stability engine control system that modiﬁes reference commands to avoid constraints violation. Limit governors are proposed as an assistant part for references governors adjusting constraints to prevent references from stopping updates. The use of output admissible sets for a class of variable constraints is exploited to form invariant sets. Simulation results based on a turbofan engine model show that references governors with limit governors can e ﬀ ectively enforce the multiple constraints and provide enhanced engine thrust when steady violation occurs.


Introduction
The implementation of advanced control systems on aircraft turbofan engines requires the effective limit protection, which keeps the engine operating within its constraints [1]. These constraints prevent the engine components from risky operating conditions such as surge, stall and flame blowout avoidance, pressures and temperatures limits, over fan and core speeds, actuator magnitude and rate limits.
Turbofan engine control systems have incorporated methods to avoid these constraint violations. The conventional and widely used method to handle these constraints is using a Min-Max architecture as shown in Figure 1 [2]. The linear single-input main regulator is designed to drive the fan speed and several auxiliary linear regulators are used to maintain the limited variables. Main and auxiliary regulators are combined with a Min-Max selector that selects an auxiliary regulator when it is necessary to avoid a specific constraint violation. All regulators use fuel flow rate as the single control channel. The fuel flow rate applied to the integrator is selected according to the formula: where L contains the indices of the regulators associated with the Min selector, H contains the indices of the regulators with the max selector, u rj are the min-selected regulator outputs and u rk are the max-selected regulator outputs. In this paper, this approach will be considered as the traditional Min-Max (TMM) approach. Since it has been demonstrated that the TMM approach is inherently conservative and produces slower transient responses, the interest in developing methods to reduce the conservatism of the limit protection approach has been growing [3]. In recent decades, techniques have been developed to improve the TMM approach. In [3], conditional active limit regulators are added on the Min-Max architecture. Numerous candidates have also been applied to design the regulators for Min-Max architecture such as sliding mode control [4,5] and monotonic control [6]. However, a large number of technologies with limited protection functions that are not based on the Min-Max structure have been developed for aircraft engines. One of the existing approaches to handle constraints is the model predictive control (MPC) [7,8]. MPC will re-design the controller to achieve not only the limit protection function but also the main control tasks. Other approaches consider augmenting a well-designed controller with a constraint handling capability [9][10][11][12][13]. This kind of approach is attractive by preserving existing controllers that have well-designed control quality. The augmentation with barrier functions is an example of this kind of approach, and the reference governors are the same.
In this paper, we focus on the application of references governors (RGs) to limit protection in turbofan engines. RGs are an add-on scheme for enforcing closed-loop system constraints by predictively modifying the reference commands to the closed-loop system when necessary. While RGs have been researched for over twenty years and studies of applications cover many areas [14][15][16], there are still several challenges in applying RGs from the practical standpoint such as the infeasibility treatment [17]. When the online optimization problem does not admit a solution, the widely used strategy is to continue applying the previous reference. Nevertheless, this could result in the stop of updating reference and the tracking rate will slow down. More seriously, if the infeasibility occurs for a long time, the main tracking aim will not be achieved. The situation described above may occur for two reasons. One is enhanced engine thrust requirements make the engine operate beyond normal operational limits, which is called steady violation. The other is the RG designed has a constrained domain of attraction that is not large enough. When steady violation occurs, prioritized reference governors can enforce over-limit constraints as soft constraints in the order of their priority so that if all constraints cannot be strictly met, slight violation of the soft constraints will be permitted [18]. The extended command governors use more degrees of freedom to find feasible solutions through optimization, which expands constrained domains of attraction by adding optimization parameters and inevitably increases the computational cost of the optimization problem [19]. In this paper, a novel architecture containing RGs and limit governors (LGs) are proposed to enhance the engine thrust and expand the constrained domain of attraction, shown in Figure 2. In addition, the architecture proposed simplifies the structure and makes an improvement of transient performance compared to the TMM architecture. The main strategy is to avoid introducing as many optimization parameters as possible while expanding constrained domain of attraction. When the RG online optimization problem has no solution, the LG will slack the constraint values within a limit band according to the off-line designed constraint slack law. Due to the inherent risky nature of slacking constraints, it is important to design limit bands In recent decades, techniques have been developed to improve the TMM approach. In [3], conditional active limit regulators are added on the Min-Max architecture. Numerous candidates have also been applied to design the regulators for Min-Max architecture such as sliding mode control [4,5] and monotonic control [6]. However, a large number of technologies with limited protection functions that are not based on the Min-Max structure have been developed for aircraft engines. One of the existing approaches to handle constraints is the model predictive control (MPC) [7,8]. MPC will re-design the controller to achieve not only the limit protection function but also the main control tasks. Other approaches consider augmenting a well-designed controller with a constraint handling capability [9][10][11][12][13]. This kind of approach is attractive by preserving existing controllers that have well-designed control quality. The augmentation with barrier functions is an example of this kind of approach, and the reference governors are the same.
In this paper, we focus on the application of references governors (RGs) to limit protection in turbofan engines. RGs are an add-on scheme for enforcing closed-loop system constraints by predictively modifying the reference commands to the closed-loop system when necessary. While RGs have been researched for over twenty years and studies of applications cover many areas [14][15][16], there are still several challenges in applying RGs from the practical standpoint such as the infeasibility treatment [17]. When the online optimization problem does not admit a solution, the widely used strategy is to continue applying the previous reference. Nevertheless, this could result in the stop of updating reference and the tracking rate will slow down. More seriously, if the infeasibility occurs for a long time, the main tracking aim will not be achieved. The situation described above may occur for two reasons. One is enhanced engine thrust requirements make the engine operate beyond normal operational limits, which is called steady violation. The other is the RG designed has a constrained domain of attraction that is not large enough. When steady violation occurs, prioritized reference governors can enforce over-limit constraints as soft constraints in the order of their priority so that if all constraints cannot be strictly met, slight violation of the soft constraints will be permitted [18]. The extended command governors use more degrees of freedom to find feasible solutions through optimization, which expands constrained domains of attraction by adding optimization parameters and inevitably increases the computational cost of the optimization problem [19]. In this paper, a novel architecture containing RGs and limit governors (LGs) are proposed to enhance the engine thrust and expand the constrained domain of attraction, shown in Figure 2. In addition, the architecture proposed simplifies the structure and makes an improvement of transient performance compared to the TMM architecture. The main strategy is to avoid introducing as many optimization parameters as possible while expanding constrained domain of attraction. When the RG online optimization problem has no solution, the LG will slack the constraint values within a limit band according to the off-line designed constraint slack law. Due to the inherent risky nature of slacking constraints, it is important to design Energies 2019, 12, 2803 3 of 18 limit bands referring to risk management [20]. Based on the selected risk level, an operating limit band can be selected. Detailed design methods will not be considered in the article. referring to risk management [20]. Based on the selected risk level, an operating limit band can be selected. Detailed design methods will not be considered in the article.

Reference
Governor Controller Turbofan Engine Closed-loop system Limit Governor This paper is organized as follows. In Section 2, the design of the turbofan engine controller and the establishment of the prediction model are discussed. The design methods and details of RGs and LGs are discussed in Section 3, followed by the simulation results and discussion in Section 4. Conclusions are given in Section 5.

Turbofan Engine Control Method and Prediction Model
A modern twin-spool turbofan engine was studied in this paper. A high degree of confidence component level model of the turbofan engine has been achieved and details and details can be seen in [21,22]. The turbofan engine mainly consists of the following components: Inlet, fan, compressor, combustor, high pressure turbine (HPT), low pressure turbine (LPT), bypass and nozzle [23]. Each component was modeled by aerothermodynamics calculations and solving a set of balance equations. The engine design operation data and characteristic maps of rotating components were used to construct the turbofan engine nonlinear model. The nonlinear model of turbofan engine is given by: where n R  x is the state vector, uR  is the input variable and is the output vector.
The engine model was coded with the C language and packaged by the Dynamic Link Library (DLL) for simulation in a Matlab environment. This engine model has been also used in other closed-loop control research [24,25]. The detailed nonlinear model can calculate steady state data and response data at arbitrary operating point. The operating point is defined by altitude (ALT), Mach number (MN) and power lever angle (PLA). For given ALT, MN and PLA, there is a corresponding operating point described by an equilibrium point ( , ) ee xy and a steady-state control e u . The linear model at the operating point can be obtained by the hybrid fitting method, which combines partial perturbing and fitting methods [26]. The linear model is presented as: where A , B , C and D are the system matrices with appropriate dimensions and  This paper is organized as follows. In Section 2, the design of the turbofan engine controller and the establishment of the prediction model are discussed. The design methods and details of RGs and LGs are discussed in Section 3, followed by the simulation results and discussion in Section 4. Conclusions are given in Section 5.

Turbofan Engine Control Method and Prediction Model
A modern twin-spool turbofan engine was studied in this paper. A high degree of confidence component level model of the turbofan engine has been achieved and details and details can be seen in [21,22]. The turbofan engine mainly consists of the following components: Inlet, fan, compressor, combustor, high pressure turbine (HPT), low pressure turbine (LPT), bypass and nozzle [23]. Each component was modeled by aerothermodynamics calculations and solving a set of balance equations. The engine design operation data and characteristic maps of rotating components were used to construct the turbofan engine nonlinear model. The nonlinear model of turbofan engine is given by: where x ∈ R n is the state vector, u ∈ R is the input variable and y ∈ R p is the output vector. The engine model was coded with the C language and packaged by the Dynamic Link Library (DLL) for simulation in a Matlab environment. This engine model has been also used in other closed-loop control research [24,25]. The detailed nonlinear model can calculate steady state data and response data at arbitrary operating point. The operating point is defined by altitude (ALT), Mach number (MN) and power lever angle (PLA). For given ALT, MN and PLA, there is a corresponding operating point described by an equilibrium point (x e , y e ) and a steady-state control u e . The linear model at the operating point can be obtained by the hybrid fitting method, which combines partial perturbing and fitting methods [26]. The linear model is presented as: where A, B, C and D are the system matrices with appropriate dimensions and ∆x = x − x e , ∆u = u − u e and ∆y = y − y e .

Augment LQ Tracking Controllers for Discrete Systems
We considered the discrete linearized models for the engine. ∆x, ∆u and ∆y are replaced by x, u and y for convenience in the subsequent article. The linear model is rewritten as: The ith output is: where i = 1, 2, . . . , p, C i is the ith row of the matrix C and D i is the ith element of the matrix D.
Considering the controller includes integral action u r (k): The state-space description is augmented: where u r (k) ∈ R is the new input variable, the augmented state vector is defined as T and the augmented matrices are defined as: For single input, y 1 is chosen as the main regulated output (typically fan speed), whose set-point is to be tracked with zero steady-state error. The other outputs y i (i = 2, 3, . . . , p), (typically high-pressure turbine outlet temperature and low-pressure compressor outlet pressure [1]) are used as limited variables, which are discussed later in the paper. In this section, the main control objective was set-point tracking for main regulated output. Let r ∈ R, u s , x s denote the tracking reference, control input and state as k → ∞ , respectively. Define an augmented steady state x a,s = x s u s and Z = A − I B C 1 D 1 , the steady state value was calculated by: Define the steady state deviation: then, where C a,1 is the first row of C a .
Given the system presented in (11), the optimal LQ controller was obtained by using the state-feedback gain K a that minimizes a performance index: where Q is a symmetric positive semi-definite matrix and R is a symmetric positive-definite matrix. The pairs (A a , B a ) and (B a , C a,1 ) were assumed to be controllable and observable respectively. The optimal controller is given in the form of state feedback The feedback matrix K a is obtained by solving the Riccati equation.
Considering the difficulty of using steady state deviation ∆x a (k) to achieve feedback control, ∆x a (k) can be replaced by x(k) and r(k) − y 1 (k). The replacement eliminates the calculation of tracking steady state x s and control input u s and introduces variables that are easier to obtain online. In addition, the system can realize tracking without steady-state error due to the tracking error is introduced into the state feedback controller.
Combined with Equations (4), (9), (10), (13), the following equations can be derived: This approximation enables the integral action u r (k) can be calculated at the current sample time and the error of approximation can be ignored because of the extremely short sampling time and sufficiently slow rates of time variation in system states.

Modeling Methods of the Closed-Loop System
The RG in this paper is based on a linear discrete-time model of the engine. Based on Equation (5), the nominal controller can be rewritten as: With the LQ controller (19), the closed loop system prediction model becomes: where T denotes the states of the closed-loop system, v(k) is the admissible reference command, which will be determined by a solution of the online optimization problem discussed in Section 3. The system matrices play the important roles in the steady and transient performance of the closed-loop system prediction model. However, the system matrices in model (20) cannot accurately describe the steady and transient performance of the turbofan engine and the controller because of the nonlinearity of the combination of turbofan engines and controllers. In order to improve modeling accuracy of the closed-loop system, a fitting method is used to re-compute partial system matrices' elements [27]. The fitting method generates the system matrices' elements with the object function of least square errors between the closed-loop system and closed-loop system prediction model responses to step reference. In this paper, the matrix A c remains constant to ensure the stability of the prediction model and the matrix D c stays at 0.
The procedure of the modeling method is summarized as follows.
(1) Establish a linearized turbofan engine model at an equilibrium point by hybrid fitting method.
(2) Design a nominal tracking controller at the same equilibrium point.
(3) The initials matrices of the closed-loop system prediction model are given by substituting the controller into the linearized model. (4) The closed-loop system prediction model matrices are tuned to the outputs differences of the closed-loop system and closed-loop system prediction model at the equilibrium point by fitting method. In the end, the closed loop system prediction model is established as: where matrices B rc and C rc are re-computed matrices. Energies 2017, 10, x FOR PEER REVIEW 6 of 18 denotes the states of the closed-loop system, ( ) v k is the admissible reference command, which will be determined by a solution of the online optimization problem discussed in Section 3.
The system matrices play the important roles in the steady and transient performance of the closed-loop system prediction model. However, the system matrices in model (20) cannot accurately describe the steady and transient performance of the turbofan engine and the controller because of the nonlinearity of the combination of turbofan engines and controllers. In order to improve modeling accuracy of the closed-loop system, a fitting method is used to re-compute partial system matrices' elements [27]. The fitting method generates the system matrices' elements with the object function of least square errors between the closed-loop system and closed-loop system prediction model responses to step reference. In this paper, the matrix c A remains constant to ensure the stability of the prediction model and the matrix c D stays at 0 .
The procedure of the modeling method is summarized as follows.
(1) Establish a linearized turbofan engine model at an equilibrium point by hybrid fitting method.
(2) Design a nominal tracking controller at the same equilibrium point.
(3) The initials matrices of the closed-loop system prediction model are given by substituting the controller into the linearized model. (4) The closed-loop system prediction model matrices are tuned to the outputs differences of the closed-loop system and closed-loop system prediction model at the equilibrium point by fitting method. In the end, the closed loop system prediction model is established as: where matrices rc B and rc C are re-computed matrices.

Reference Governors
RGs are add-on predictive control schemes that enforce state and control constraints in discrete-time closed-loop systems. Unlike conventional MPC schemes, which enforce constraints

Reference Governors
RGs are add-on predictive control schemes that enforce state and control constraints in discrete-time closed-loop systems. Unlike conventional MPC schemes, which enforce constraints and ensure system stability, RGs are used to augment systems with closed-loop controllers that may have been designed without taking constraints into account [28].
As the control input rate u r (k) is considered as a constraint, it is convenient to augment the control input rate u r (k) to outputs by Equation (18), where C arc = C rc The classical reference governor is designed for a discrete-time linear system model of the form like model (22). The objective of RGs is to manage the applied command v(k), which should be as close as possible to the desired reference r and to guarantee that the system constraints y c (k) ∈ Y, Y = y c Sy c ≤ s is enforced. Some assumptions were made here: Assumption 1. All eigenvalues of A c were in the unit disk.

Assumption 2.
The pair (C arc , A c ) was observable. Assumption 3. The set Y was compact, convex and contained 0 in its interior.
In general, to design RGs, a constraint admissible set O m * must be introduced to enforce the constraints. If all of the assumptions above are met, the set O m * that is close to the maximal output admissible set will be finitely determined and positively invariant [28]. Hence, the set O m * can be described as: whereŷ c (k + m x c (k), v(k)) denotes the predicted response m steps ahead from the time instant k with the constant reference input v(k) applied andŷ c∞ denotes steady state output. The finite index m * can be calculated by the algorithm 3.2 in [29]. Moreover, if (x c (k), v(k)) ∈ O m * and v(k) is applied to the system at time k, then (x c (k + 1), v(k)) ∈ O m * . According to model (22), the output prediction y c (k + m x c (k), v(k)) andŷ c∞ are calculated by: Consider Equations (24) and (25), it is easier to compute the finitely determined set O m * .
where matrices H m * +1 x , H m * +1 v and h m * +1 can be computed using the following recursive algorithm: and these matrices are initialized to, The RG computes at each discrete time k an admissible command v(k) by solving the following optimization problem, where λ(k) is a scalar adjustable bandwidth parameter. If no danger of constraint violation exists, λ(k) = 1, and v(k) = r in which case the RG do not interfere with the operation of the system. If a constraint violation might be caused, the value of λ(k) is decreased by the RG. Moreover, if λ(k) = 0, the RG momentarily keeps the system away from tracking the reference command to ensure it is safe.

Constraints and Limit Governors
Typical formulations of the reference governor are applied to systems with hard constraints, i.e., systems where the constraints y c (k) ∈ Y for all the time are strict. However, handling situations when satisfying all constraints at once is sometimes infeasible. In this case, the RG cannot get the solution of the optimization problem and λ(k) is set to zero usually as an infeasible treatment, which means the previous command will be followed. It is an effective strategy due to the positively invariant of the set O m * . Nevertheless, a long period of no solution will cause the stagnation of command leading to the failure of providing the required engine thrust.
To solve this problem, the limit is considered as a limit band, i.e., s min ≤ s(k) ≤ s max and LGs are introduced to adjust the limit so that the constraints y c (k) ∈ Y(k), Y(k) = y c Sy c ≤ s(k) are relaxed for better tracking performance, which means s(k) ≤ s(k + 1) and Y(k) ⊆ Y(k + 1). The LG relaxes the constraints only when the original RG does not solve a solution. The constraints vary so that the state Equation (22) becomes, Denote the finitely determined inner approximate maximal output admissible sets for system (30) with time-varying constraints within the limit band as O m k (k), where m k , calculated according to different limits, is the minimum index for each output admissible set called the minimum finitely determined index. Offline work calculating several minimum finitely determined indexes has been taken. We chose the maximal index of minimum finitely determined indexes, and defined the simplified set O m max (k), This set was proposed for a practical reason to consider storage space while the computational burden might be increased.

Proof. Suppose at a time instant k, an initial state and admissible command satisfies
By using (22), (24), Equation (34) is detailed as: where these initial matrices are replaced for: and the recursive algorithm is changed as: (ii) if the constraints are variable s(k) < s(k + 1), Equation (34) still holds according to proposition 1. However, constraints have been changed as s(k + 1) at time instant k + 1. Since s(k) < s(k + 1), Consider the above description, the Equation (40) could be obtained if the admissible command keeps constant.

Remark 2.
Note that Proposition 2 requires that (x c (k), v(k)) ∈ O m max (k) and the calculation of RGs need the previous time step v(k − 1). At an initial time, an admissible command v(0) that ensures constraints are enforced at the initial state x c (0) is needed. In general, v(0) = 0 or a small enough value is a good default option. Furthermore, proposition 2 implies that the invariance of the set O m max (k) still exists when slack variant constraints are enforced.
Proposition 2 is exploited to help with the design of LGs.
LGs are assistant parts of RGs dealing with the case that strict constraints are enforced so that the tracking aim is hardly accomplished and only intervenes in systems when the feasibility of the RG optimization problem occasionally will be lost. Specifically speaking, LGs will relax the constraints in the absence of the RG solution.
To ensure that turbofan engines are operating within safe conditions, we imposed upper and lower limits on high-pressure turbine outlet temperature (T 43 ), low-pressure compressor outlet pressure (P 6 ) and rate of fuel flow (WF r ) as examples of forms, Define relaxed limits: P 6minr = (1 + β)P 6min , P 6maxr = (1 + β)P 6max , WF rminr = (1 + γ)WF rmin , WF rmaxr = (1 + γ)WF rmax , where α, β and γ are off-line design parameters, which can be designed by the risk management. These constraints can be expressed in the following form: where y c (k) = Particularly, LGs constraint slack law could be designed like RGs form: where ρ is a scalar adjustable bandwidth parameter, an over-high parameter may cause unnecessary slack of constraints, on the other hand, too small may not achieve the enhanced engine thrust goal.
With the use of LGs, (29) is modified to: Computationally, the use of LGs does not increase too much a burden, the implementation of RGs still requires solving a similar LP problem.

Simulation Results and Discussion
The example considered here is of an aircraft gas turbine engine actuated with one reference input, i.e., the fan speed. The linearized engine model is for a turbofan engine at near idle ground. The linearized model has fan speed and core speed as states, fuel flow as the control input and high-pressure turbine outlet temperature, low-pressure compressor outlet pressure and rate of fuel flow as constraints outputs. All variables are normalized relative to the maximum power condition. The linearized engine model matrices corresponding to Equation (4) are as follows: The closed-loop system prediction model matrices corresponding to Equation (22) are as follows:   The tracking aim of all the simulations was to increase the fan speed by 2%. The simulations were set up in Matlab (R2012b) on a Windows 7 32 bit PC (CPU Core(TM) i3-4170 3.7 GHz, Memory 4 GB). Parameters of the feedback control for set-point tracking were given as K 1 = −3.4314 −11.2365 −0.3290 , K 2 = −0.3290. We first illustrated the operation of the original RG and its advantages over the traditional Min-Max structure on a high fidelity turbofan engine model. The same main controller was implemented on the turbofan engine model and the original RG and Min-Max structure was designed for the same constraints limits, i.e., T 43max = 0.7332, P 6max = 0.5210. Figure 4 compares the performances of the original RG and the traditional Min-Max method. The response became less conservative and quicker when the original RG was used and all constraints were strictly enforced. More specifically, the limit would be as close as possible to the limit value using RG, while the traditional Min-Max method might cause the limit to be restricted prematurely before reaching the limit value.
The tracking aim of all the simulations was to increase the fan speed by 2%. The simulations were set up in Matlab (R2012b) on a Windows 7 32 bit PC (CPU Core(TM) i3-4170 3.7 GHz, Memory 4 GB). Parameters of the feedback control for set-point tracking were given as 3.4314 11.2365 0.3290 . We first illustrated the operation of the original RG and its advantages over the traditional Min-Max structure on a high fidelity turbofan engine model. The same main controller was implemented on the turbofan engine model and the original RG and Min-Max structure was designed for the same constraints limits, i.e., 43 max 0.7332 T = , 6 max 0.5210 P = . Figure 4 compares the performances of the original RG and the traditional Min-Max method. The response became less conservative and quicker when the original RG was used and all constraints were strictly enforced. More specifically, the limit would be as close as possible to the limit value using RG, while the traditional Min-Max method might cause the limit to be restricted prematurely before reaching the limit value.   Secondly, we illustrated the influence of parameter design of LGs in handling varying constraints. Figure 5 compares the performances of RGs with LGs for different parameters ρ. To verify the validity LGs, the temperature constraint, pressure constraint and rate of fuel flow constraint were designed as follows in the simulation: T 43max = 0.7332, P 6max = 0.5210, WF rmax = 0.0060, α = 0.0020, β = 0.0048, γ = 0.2667.
From the simulation results we could observe that the fan speed could quickly track the reference speed within the parameter variation. The response became faster when the parameter ρ was increasing and it showed that all constraints were almost enforced.
Secondly, we illustrated the influence of parameter design of LGs in handling varying constraints. Figure 5 compares the performances of RGs with LGs for different parameters ρ . To verify the validity of LGs, the temperature constraint, pressure constraint and rate of fuel flow constraint were designed as follows in the simulation: From the simulation results we could observe that the fan speed could quickly track the reference speed within the parameter variation. The response became faster when the parameter ρ was increasing and it showed that all constraints were almost enforced.  Finally, we illustrated the ancillary effects of LGs for RGs in enhancing the engine thrust. In this simulation, the temperature constraint, pressure constraint and rate of fuel flow constraint were designed as the same as the second simulation and steady violation condition would occur by the manual design of limits. Figure 6 compares the performances of RGs with and without LGs. As shown in Figure 6, 43 T , 6 P and r WF rode the constraint boundary without LGs. However, due to steady violation, the fan speed failed to track the reference speed resulting in failing to obtain the required thrust. With LGs, the fan speed could quickly track the reference speed so that the engine thrust could be enhanced and all constraints were strictly enforced. Finally, we illustrated the ancillary effects of LGs for RGs in enhancing the engine thrust. In this simulation, the temperature constraint, pressure constraint and rate of fuel flow constraint were designed as the same as the second simulation and steady violation condition would occur by the manual design of limits. Figure 6 compares the performances of RGs with and without LGs. As shown in Figure 6, T 43 , P 6 and WF r rode the constraint boundary without LGs. However, due to steady violation, the fan speed failed to track the reference speed resulting in failing to obtain the required thrust. With LGs, the fan speed could quickly track the reference speed so that the engine thrust could be enhanced and all constraints were strictly enforced.

Conclusions
The paper illustrated the application and improvement of the recently developed reference governors for constraint handling in turbofan engines. To ensure the effective work of RGs, limit governors were proposed as add-on schemes that slack constraints when RGs were infeasible. The limit governor design method to guarantee the invariance of the output admissible set was studied in this paper. The reference governor with the limit governor rigorously enforced the constraints based on an accurate prediction model and the design method of output admissible sets. Simulation results, based on high fidelity engine models, confirmed the following points of this research: (1) The reference governor approach provided a faster and less conservatism response than the traditional min-max approach; (2) the proposed limit protection scheme could effectively track the reference, enhance the engine thrust when steady violation occurred and handled the constraints during transients and steady states.

Conclusions
The paper illustrated the application and improvement of the recently developed reference governors for constraint handling in turbofan engines. To ensure the effective work of RGs, limit governors were proposed as add-on schemes that slack constraints when RGs were infeasible. The limit governor design method to guarantee the invariance of the output admissible set was studied in this paper. The reference governor with the limit governor rigorously enforced the constraints based on an accurate prediction model and the design method of output admissible sets. Simulation results, based on high fidelity engine models, confirmed the following points of this research: (1) The reference governor approach provided a faster and less conservatism response than the traditional min-max approach; (2) the proposed limit protection scheme could effectively track the reference, enhance the engine thrust when steady violation occurred and handled the constraints during transients and steady states.