An Output-Based Limit Protection Strategy for Turbofan Engine Propulsion Control with Output Constraints

To accomplish the limit protection task, the Min-Max selection structure is generally adopted in current aircraft engine control strategies. However, since no relationship between controller switching and limit violation is established, this structure is inherently conservative and may produce slower transient responses than the behavior by engine nature. This paper proposes an output-based limit management strategy, which consists of the safety margin module and the parameter prediction module to monitor system responses, plus the switching logic to govern switches between the main controller and limiters, and, in this way, a faster transient performance is achieved, and the limit protections in transient states become more effective. To realize smooth switching control, the linear-quadratic bumpless transfer method is developed. The design principle of the multi-loop switching control and bumpless compensator is detailed, and the effect—on limit protection control performance—of the design parameters in the safety margin and parameter prediction modules are also analyzed. The proposed approach is tested using simulations covering the whole flight envelope on the nonlinear component-level model of a turbofan engine, and the superiority over the Min-Max architecture is also validated.


Introduction
With the development of aircraft engine technology, higher demands on performance and functionality of electronic control systems have been required. It is known that performance promotion of aircraft engines can be obtained by larger shaft accelerations, which produce fast thrust responses. However, the accompanying change in aircraft engine aerodynamic and thermodynamic processes may incur several unsatisfying circumstances such as transient reductions in stall margin, large turbine temperature transients, the danger of compressor surge, and the increase in blade wear rate. Hence, critical engine variables are supposed to be maintained within permissible limits in order to ensure the operational safety of the aero-engine. Spang and Brown summarized that much of the complexity of control comes from the need to operate the engine as close as possible to the limits where engines are most effective [1]. Hence, the tradeoff between the high engine performance and operational safety should be taken into consideration during the design process of aircraft engine control systems.
Constraints-like temperatures, stall margins, and pressure ratios-should be considered as a part of a particular design process. For instance, considering stall margins, in order to avoid unstable aero-dynamic conditions-like surge or rotating stall-a sufficient surge margin in the worst operation This paper proposes an output-based bumpless transfer limit management method for aero-engines, in order to solve the issue that the Min-Max structure cannot establish a connection between the controller switching actions and limit violation. The switching logic of multiple engine control loops-based on a safety margin module and a parameter prediction module-was established. The linear-quadratic bumpless transfer method was exploited to restrain the oscillation of key parameters in the course of the direct switching of the control loops. A high-fidelity nonlinear component level low bypass ratio engine model was used as the controlled plant to carry out the numerical simulation. Based on the simulation results, the qualitative analysis of the influence of design parameters in the safety margin module and parameter prediction module on the control performance was carried out, which provides theoretical guidance for the selection of design parameters of the two modules in future research. The results of the control effect compared with that of the Min-Max structure showed that the proposed method possesses the ability to accomplish the limit control task, and has the advantages of avoiding premature controller switching, achieving faster transient performance in the whole flight envelope.

Multi-Loop Switching Control Strategy for Aero-Engines
The multi-loop switching control strategy is shown in Figure 1. Generally, multi-loop switched systems consist of a set of continuous (or discrete) time subsystems and a switching logic that decides how to switch between subsystems. The aim of this strategy is to solve the multi-objective control problem. For such problems, the key is the design of the controller and the switching logic. The former is mainly designed for its specific control objectives. For the latter, there are two design points: one is to select the switching signal reasonably; the other is to establish the connection between the switching signal and the activation index. Finally, the single-objective control of each subsystem is transformed into the multi-objective control of the system, and the multi-control loop is scheduled. This paper proposes an output-based bumpless transfer limit management method for aero-engines, in order to solve the issue that the Min-Max structure cannot establish a connection between the controller switching actions and limit violation. The switching logic of multiple engine control loops-based on a safety margin module and a parameter prediction module-was established. The linear-quadratic bumpless transfer method was exploited to restrain the oscillation of key parameters in the course of the direct switching of the control loops. A high-fidelity nonlinear component level low bypass ratio engine model was used as the controlled plant to carry out the numerical simulation. Based on the simulation results, the qualitative analysis of the influence of design parameters in the safety margin module and parameter prediction module on the control performance was carried out, which provides theoretical guidance for the selection of design parameters of the two modules in future research. The results of the control effect compared with that of the Min-Max structure showed that the proposed method possesses the ability to accomplish the limit control task, and has the advantages of avoiding premature controller switching, achieving faster transient performance in the whole flight envelope.

Multi-Loop Switching Control Strategy for Aero-Engines
The multi-loop switching control strategy is shown in Figure 1. Generally, multi-loop switched systems consist of a set of continuous (or discrete) time subsystems and a switching logic that decides how to switch between subsystems. The aim of this strategy is to solve the multi-objective control problem. For such problems, the key is the design of the controller and the switching logic. The former is mainly designed for its specific control objectives. For the latter, there are two design points: one is to select the switching signal reasonably; the other is to establish the connection between the switching signal and the activation index. Finally, the single-objective control of each subsystem is transformed into the multi-objective control of the system, and the multi-control loop is scheduled. The multi-loop switching control strategy of aero-engines is shown in Figure 2 In fact, the aero-engine limit management method is essentially to achieve multi-objective control tasks in an engine system. The property of the multi-objective is mainly embodied in the fast response requirement for the main control plan which is implemented by the main controller, and the security requirement for the limit control plans which are implemented by the limiters. The main control plan is obtained by mapping MC f of PLA to the main output reference; the main output reference is often chosen to be the rotor speed. Limit control plans are obtained by mapping The multi-loop switching control strategy of aero-engines is shown in Figure 2. u i is the control parameter, y i is the engine output parameter, y ci is the switching logic signal and Y is the engine key parameter, where i = 1, · · · , p . f represents the mapping of the engine key parameters to the engine output parameters and switching logic signals, namely f i : Y → y i , y ci . z represents the mapping of the switching logic signals to the index of the activated control loop, namely z : y c1 , · · · , y cp → Index .
In fact, the aero-engine limit management method is essentially to achieve multi-objective control tasks in an engine system. The property of the multi-objective is mainly embodied in the fast response requirement for the main control plan which is implemented by the main controller, and the security requirement for the limit control plans which are implemented by the limiters. The main control plan is obtained by mapping f MC of PLA to the main output reference; the main output reference is often chosen to be the rotor speed. Limit control plans are obtained by mapping the f LC,i of the flight condition (H, Ma) to the output limit values; the limit outputs are often chosen to be the rotor speeds, pressures, and temperatures on the cross-section of the engine components, etc. , H Ma to the output limit values; the limit outputs are often chosen to be the rotor speeds, pressures, and temperatures on the cross-section of the engine components, etc.

Output-Based Multi-Loop Switching Control Strategy for Aero-Engines
It can be seen that the design of switching logic is the key to realize a multi-loop switching control strategy from that mentioned above, and the following two points are mainly required to be considered in the design of switching logic: one is to select the engine signal ci y needed by switching logic reasonably; the other is to design the mapping relationship from Y to ( ) This section designs the switching logic based on the two points above. Because the output-based limit management method of aero-engines proposed in this section is based on a multi-loop switching control strategy, according to the design points, the output of the engine is selected as the switching logic signal at first. However, if the current output is directly compared with the corresponding limit value, the corresponding limiter can only be activated when it exceeds or arrives at the limit boundary. Obviously, security is not well ensured by this method. Therefore, it is necessary to set a "safety margin" to determine whether the limit output is close to the restricted boundary. In addition, we still need to consider the current change rates of limit outputs and use these parameters to judge whether there is any risk of exceeding the limit in the future. Therefore, the key parameter of the engine, Y , is defined, which includes the engine output, y , and the change rate of the output, y  . Based on this parameter, the safety margin module and the parameter prediction module are designed, respectively. Figure 3 shows the output-based multi-loop switching control strategy for aero-engine.

Output-Based Multi-Loop Switching Control Strategy for Aero-Engines
It can be seen that the design of switching logic is the key to realize a multi-loop switching control strategy from that mentioned above, and the following two points are mainly required to be considered in the design of switching logic: one is to select the engine signal y ci needed by switching logic reasonably; the other is to design the mapping relationship from Y to y i , y ci . This section designs the switching logic based on the two points above.
Because the output-based limit management method of aero-engines proposed in this section is based on a multi-loop switching control strategy, according to the design points, the output of the engine is selected as the switching logic signal at first. However, if the current output is directly compared with the corresponding limit value, the corresponding limiter can only be activated when it exceeds or arrives at the limit boundary. Obviously, security is not well ensured by this method. Therefore, it is necessary to set a "safety margin" to determine whether the limit output is close to the restricted boundary. In addition, we still need to consider the current change rates of limit outputs and use these parameters to judge whether there is any risk of exceeding the limit in the future. Therefore, the key parameter of the engine, Y, is defined, which includes the engine output, y, and the change rate of the output, . y. Based on this parameter, the safety margin module and the parameter prediction module are designed, respectively. Figure 3 shows the output-based multi-loop switching control strategy for aero-engine.

Output-Based Multi-Loop Switching Control Strategy for Aero-Engines
It can be seen that the design of switching logic is the key to realize a multi-loop switching control strategy from that mentioned above, and the following two points are mainly required to be considered in the design of switching logic: one is to select the engine signal ci y needed by switching logic reasonably; the other is to design the mapping relationship from Y to ( ) This section designs the switching logic based on the two points above. Because the output-based limit management method of aero-engines proposed in this section is based on a multi-loop switching control strategy, according to the design points, the output of the engine is selected as the switching logic signal at first. However, if the current output is directly compared with the corresponding limit value, the corresponding limiter can only be activated when it exceeds or arrives at the limit boundary. Obviously, security is not well ensured by this method. Therefore, it is necessary to set a "safety margin" to determine whether the limit output is close to the restricted boundary. In addition, we still need to consider the current change rates of limit outputs and use these parameters to judge whether there is any risk of exceeding the limit in the future. Therefore, the key parameter of the engine, Y , is defined, which includes the engine output, y , and the change rate of the output, y  . Based on this parameter, the safety margin module and the parameter prediction module are designed, respectively. Figure 3 shows the output-based multi-loop switching control strategy for aero-engine.  In Figure 3, the safety margin module implements mapping f i , and the parameter prediction module implements mapping g i , where i = 1, · · · , p . The images of key parameter Y under mapping f i and mapping g i are y ci,1 and y ci,2 , respectively, and these two parameters constitute the switching logic signal y ci , namely: The safety margin module and the parameter prediction module are described separately, and the specific design methods are given in the following sub-sections. Based on the design method of the above modules, the mechanism of the proposed output-based multi-loop switching control strategy was analyzed.

Safety Margin Module
It is assumed that the key engine parameter, Y, can be obtained directly, which includes the engine output parameter, y, and the engine output parameter change rate, . y. In order to distinguish the upper-limited outputs from the lower-limited outputs, the safety margin module for output y i is described as follows: where Equations (2) and (3) consider the upper and lower limited output respectively, and α i is defined as a warning factor to describe the distance between the safety margin and the given limit for the corresponding output.

Parameter Prediction Module
In order to realize mapping g i , the parameter prediction module for output, y i , is defined as follows: where ∆T represents the system sampling time, and β i represents the prediction step size. Based on the current engine output change rates, these modules predict whether the engine will exceed the limit within a given prediction step size. Finally, for the upper-limited outputs and the lower-limited outputs, based on Equation (1), the switching logic signal, y ci , can be obtained by combining the results calculated by Equations (2) and (4), or Equations (3) and (5), respectively.

Switching Logic
After obtaining switching signal, y ci , by exploiting the safety margin module and parameter prediction module, the switching logic needs to be designed to obtain the index value of the activated control loop. The mapping z : y c → Index , realized by switching logic, is designed as follows: It can be seen that the limiter, i, is activated when the index equals i. There must be one of the following two conditions holding: one is that the corresponding switching signal is greater than 0 for the upper-limited output; the other is that the corresponding switching signal is less than 0 for the lower-limited output when the limiter, i, is activated. When none of the limiters have to be used, the index equaling to 1 means that the main controller is activated.

Mechanism Analysis of Output-Based Limit Management Method
The switching logic, Equation (6), establishes the connection between the sign symbol of the switching logic signal, y ci , and the controller activation index. For the activation condition of the limiter, the following inequalities can be obtained by rewriting Equations (2)- (5).
upper − limited output : lower − limited output : Equations (7) and (8) are the conditions to be satisfied for the upper-limited output and the lower-limited output limiter to be activated, respectively. Taking the limiter activation condition in Equation (7) as an example, if the change rate of the current limit output is considered as the change rate at future time, the two inequalities hold at the same time, which means that the limit output y i has exceeded the safety margin (1 − α i )y i described by the warning factor, and the limit output will exceed its limit value y i after β i sampling steps.
In order to describe the switching logic more vividly, Figure 4 gives a schematic diagram of the switching logic for the upper-limited outputs. In Figure 4, the abscissa axis represents time; ordinate axis represents specified output y; ordinates y = (1 − α)y and y = y represent the limit boundary-defined by safety margin-and the limit value, respectively; the black curve represents the response of system output y, and A and B are the points on the output response curve at t = t A and t = t B . The tangent lines of point A and point B are shown in the green solid line. The slopes of the two tangents are the change rate, . y i , of the output, y i , at the corresponding time. In order to obtain the system output predicted value y + . yβ∆T after the predicted step β, blue dotted lines-t = t A + β∆T and t = t B + β∆T-are made, respectively, and intersect the tangent lines of points A and B at the points A and B . It can be seen that for point A, condition y ≥ (1 − α)y holds. However, the condition y + . yβ∆T ≥ y does not hold due to y A ≤ y. Therefore, the limiter corresponding to the output y will not be activated at t = t A . For point B, both conditions y ≥ (1 − α)y and y + . yβ∆T ≥ y are satisfied; the controller will switch to the limiter corresponding to the output, y.  Now the switching logic described above is directly applied to the multi-loop control of aero-engines to realize limit management. The control effect is shown in Figure 5. The controller index equal to 1 indicates that the main controller works; 2 indicates that the limiter corresponding to the total pressure at the outlet of the high-pressure compressor is activated, and 3 indicates that the limiter corresponding to the total temperature at the inlet of the mixing chamber is activated. Now the switching logic described above is directly applied to the multi-loop control of aero-engines to realize limit management. The control effect is shown in Figure 5. The controller index equal to 1 indicates that the main controller works; 2 indicates that the limiter corresponding to the total pressure at the outlet of the high-pressure compressor is activated, and 3 indicates that the limiter corresponding to the total temperature at the inlet of the mixing chamber is activated. Now the switching logic described above is directly applied to the multi-loop control of aero-engines to realize limit management. The control effect is shown in Figure 5. The controller index equal to 1 indicates that the main controller works; 2 indicates that the limiter corresponding to the total pressure at the outlet of the high-pressure compressor is activated, and 3 indicates that the limiter corresponding to the total temperature at the inlet of the mixing chamber is activated. It can be seen that the multi-loop control method based on the non-linear output-based switching logic will lead to excessive overshoot and oscillation, which will seriously affect the control performance of the engine, although the high-pressure rotor speed finally tracks its reference. The reason for the problems above is that the difference of the engine control input signals It can be seen that the multi-loop control method based on the non-linear output-based switching logic will lead to excessive overshoot and oscillation, which will seriously affect the control performance of the engine, although the high-pressure rotor speed finally tracks its reference. The reason for the problems above is that the difference of the engine control input signals before and after switching is too large. To solve the problem, the next section will introduce a bumpless transfer compensator based on the linear-quadratic index to govern the reference of the control loop so as to avoid large oscillations between the references and the control variables before and after controller switching, and to prevent the deterioration of control performance caused by integral saturation.

Realization Principle of Bumpless Transfer Method
In order to solve the aforementioned problems, a bumpless transfer scheme is proposed. As shown in Figure 6, the control objectives are as follows: (1) the on-line and off-line controllers can generate control input signals as close as possible; (2) the virtual references of the off-line controllers-obtained by the bumpless transfer compensator and the corresponding actual references-are as close as possible. The purpose of the former is to reduce the discontinuity of the engine control input before and after controller switching so as to avoid large oscillation in system responses and also to prevent the integral saturation of the off-line controller. The purpose of the latter is to maintain the tracking ability of the off-line controller and avoid the large difference between the actual and virtual references when the off-line controller is activated, which results in a large overshoot in the system response. references-are as close as possible. The purpose of the former is to reduce the discontinuity of the engine control input before and after controller switching so as to avoid large oscillation in system responses and also to prevent the integral saturation of the off-line controller. The purpose of the latter is to maintain the tracking ability of the off-line controller and avoid the large difference between the actual and virtual references when the off-line controller is activated, which results in a large overshoot in the system response. Therefore, we need to find the gain of the bumpless transfer compensator, C, in each control loop, which possesses the capacity of driving the corresponding off-line controller to generate control input signals similar to that generated by the on-line controller. Based on optimal control theory, the control objective of off-line controller's ( i F) bumpless transfer compensator, i C , is expressed in a quadratic cost function as follows: where  Therefore, we need to find the gain of the bumpless transfer compensator, C, in each control loop, which possesses the capacity of driving the corresponding off-line controller to generate control input signals similar to that generated by the on-line controller. Based on optimal control theory, the control objective of off-line controller's (F i ) bumpless transfer compensator, C i , is expressed in a quadratic cost function as follows: where , and r i (t) are the control input signal of the aero-engine and reference signal of the on-line controller, respectively, and r i (t) is the virtual reference signal that drives the off-line controller. W ui and W ei are positive definite matrices with appropriate dimensions. At the terminal time, T, z ui (T) = u i (T) − u(T) is the difference between the control inputs generated by the off-line controller and the online controller, and W i is the positive definite matrix. In order to obtain the gain of the bumpless transfer compensator, it is necessary to solve the optimization problem of minimizing Equation (9). In order to obtain the gain, C i , the introduction of a linear state feedback controller was considered for the implementation of the control task. The structure of the off-line controller, F i , is as follows: where A ci is the ith controller state, B 1 ci , B 2 ci , C ci , D 1 ci , and D 2 ci are constant matrices with appropriate dimensions. Since Equation (10) is a constraint for solving the cost function (9) minimization problem, it is necessary to construct a generalized function by introducing dynamic Lagrange multiplier λ i .
where φ i (T) = 1 2 z ui (T)P i z ui (T), the Hamilton functions can be defined as: The necessary conditions for the minimization of Equation (9) are as follows: Based on Equation (15), r i can be yielded as: where (13) and (14), respectively, and organizing the acquired equations into a state-space form, the results are as follows:

Substituting Equation (16) into Equations
where, The non-homogeneous differential equation above is a common form of the linear-quadratic minimization problem, which can be solved by Sweep method [27]. According to [27], it can be assumed that λ i can be expressed as follows: The differential equation for Equation (20) is thus derived as: .
By substituting Equations (21) and (22) into Equation (17), respectively, two different forms of differential equations about . λ i can be derived. By using the undetermined coefficient method, if we set the coefficients of the state of the off-line controller, x ci , to be equal in two equations, we can obtain: Considering the terminal time T → ∞ , Equation (23) degenerates from the differential Riccati equation to the algebraic Riccati equation: The semi-positive definite matrix, P i , is the solution to the algebraic Riccati equation, Equation (24). At the same time, if we set the coefficients of other terms equal, we can obtain: where, Considering the terminal time T → ∞ , Equation (25) can degenerate into an algebraic equation: where The expression of r i in an infinite time domain can be obtained by substituting Equation (27) into Equation (16): where, Equation (29) can be rewritten as the following form: where C i = K x ci K y i K u i K r i . Figure 7 presents a schematic diagram of the output-based bumpless transfer limit management method for aero-engines. In this figure, each controller works with a bumpless transfer compensator. The bumpless transfer compensator obtains the virtual reference, r i , by utilizing the controller state (x ci ), engine output (y), engine control input ( u), and the corresponding reference (r i ). The selection of the engine control input and the controller references (actual references or virtual references) depends on the index value given by the switching logic. As described in Section 2, the switching logic maps from the switching logic signal, y c , to the controller activation index, the safety margin module, and the parameter prediction module jointly realize the mapping from the key engine parameter, Y, to the switching logic signal, y c . Suppose that the controller activation index is i, the controller F i is activated, the controller instruction is r i , and the engine control input u equals u i . At this time, the virtual references, r j (for all j = 1, · · · , i − 1, i + 1, · · · , p), obtained by the bumpless transfer compensator are used to ensure that the virtual reference, r j , and the actual reference, r j , as well as the value of the controller output, u j , and the engine control input, u, are similar. When the controller activation index is switched from i to j, the bumpless transfer can be realized. Because of this property of the approach to bumpless transfer, if the control loop contains integral actions, the integral saturation caused by continuous integration of the off-line controller's input can be avoided. Finally, the aero-engine output-based limit management control is realized by utilizing the structure shown in Figure 7.

Structural Transformation of the State Feedback Controllers
Consider the aero-engine state-space model: where, for all 0 t ≥ , ( ) n t ∈ x  is the state, ( ) u t ∈  is the control input, ( ) p t ∈ y  is the output, and A , B , C, and D are appropriate dimensional constant matrices.
In order to incorporate the benefits of integral control action into the control method formulation, a state augmentation based on Equation (32) is utilized by introducing the control input, u , into the system state:

Structural Transformation of the State Feedback Controllers
Consider the aero-engine state-space model: .

x(t) = Ax(t) + Bu(t) y(t) = Cx(t) + Du(t)
, where, for all t ≥ 0, x(t) ∈ R n is the state, u(t) ∈ R is the control input, y(t) ∈ R p is the output, and A, B, C, and D are appropriate dimensional constant matrices. In order to incorporate the benefits of integral control action into the control method formulation, a state augmentation based on Equation (32) is utilized by introducing the control input, u, into the system state: where, A state feedback controller, F i , to perform the tracking task of the system output, y i , to the reference, r i , is introduced as follows: where x a,ss,i = x ss,i u ss,i , and x ss,i , and u ss,i can be calculated by the following equation according to the tracking task: Ax ss,i +Bu ss,i = 0 where c i and d i are the ith row vector of the system matrixes, C and D, respectively. Solve the Equation (36), and we can obtain: Based on Equation (32), then: By substituting Equations (37) and (38) into Equation (35), a new form of the state feedback controller can be obtained: By integrating Equation (40) and assuming x(0) = 0, the control law with an integral control action can be obtained: It can be seen that the controller with integral control needs to be transformed into the form of Equation (10), then the controller can be applied to the design of the bumpless transfer compensator. By rewriting Equation (41) into the form of Equation (10), the following corresponding relations are obtained: where, B 1 ci is the system output selection matrix, the element of the ith column is −1, and the elements of other columns are all 0. S ∈ R n×p is the state variable selection matrix with appropriate dimensions. Its function is to extract the system state variables from the system outputs, which can be expressed as:

Aero-Engine Linear Parameter Varying (LPV) Model
In order to verify the proposed method in the whole flight envelope, it is necessary to build an aero-engine LPV model. The LPV model has the ability to simulate engine dynamics behavior from idle to full power in the whole flight envelope and is defined by linear systems with the steady-state equilibrium point model (SSEPM) and the state variable model (SVM) sets. These models are affine functions of system operating parameters. The system dynamics are simplified and depicted as a single model by the LPV technique [34].
In the LPV framework, the engine model in Equation (32) can be written as follows: where A(ρ), B(ρ), C(ρ), and D(ρ) are functions of the engine operating parameters, ρ, and can be obtained by the interpolation or fitting method. At each equilibrium point, the SVM can be obtained by using the hybrid fitting method [35]. Define (x, u, y) as the deviation of the engine actual value (X, U, Y) from the corresponding equilibrium point value x ss (ρ), u ss (ρ), y ss (ρ) , namely: where x ss (ρ), u ss (ρ), y ss (ρ) are the images of the mapping realized by the SSEPM. We utilize the corrected low-pressure rotor speed increment, ∆n Lc , and the corrected high-pressure rotor speed increment, ∆n Hc , as states, and the corrected fuel flow increment, ∆W f c , as control input.
We define output y = ∆n Lc ∆n Hc ∆P t3c ∆T t6c T , where ∆P t3c is the corrected total pressure increment of the high-pressure compressor outlet and ∆T t6c is the corrected total temperature increment of the mixing chamber inlet. Equation (44) can thus be rewritten as: Consider taking a steady-state equilibrium point every 2% of the corrected fuel value, W f c , in the range from 0.21 to 1.04. At each equilibrium point, the SSEPM of the engine in the ground state is established. Finally, an SSEPM with 42 equilibrium points is constructed. The polynomial fitting method [36] is used to obtain the functional relationship between the system matrix coefficients and the operating parameters. Consider that the fitting accuracy of the polynomial fitting method increases with the increase of fitting order, but too high order will increase the calculation time when calling the model. Therefore, a tradeoff between calculation time and fitting accuracy should be considered.
On the premise of keeping the order invariant, segmenting the model is a method to improve the fitting accuracy of the model. Now the corrected high-pressure rotor speed, n Hc , is used as the abscissa; the matrix element value is used as the ordinate; and n Hc equals 0.935 as the segmented point. Then an aero-engine LPV model can be built (see Appendix A) and the relationship between the engine operating parameter, n Hc , and the matrix elements of the LPV model in Equation (46) is depicted from Figures 8-11.
The SSEPM is constructed by using the interpolation method, and is depicted by the following Figure 12: The SSEPM is constructed by using the interpolation method, and is depicted by the following Figure 12: The SSEPM is constructed by using the interpolation method, and is depicted by the following Figure 12: After establishing the LPV model, a control method suitable for a wide range of engine models should be considered to be adopted. Envelope partition and similarity principle are the two methods to realize the whole envelope control of the engine. In this paper, the latter method was

Control Plan Implementation Method Based on the Similarity Principle
After establishing the LPV model, a control method suitable for a wide range of engine models should be considered to be adopted. Envelope partition and similarity principle are the two methods to realize the whole envelope control of the engine. In this paper, the latter method was chosen. When the gain scheduling method is used to realize the limit management control of the aero-engine within the full flight envelope, the engine control plan must be taken into account to obtain a more practical control scheme.
Generally, the control plan of the aero-engine includes the low-pressure rotor speed control plan, the high-pressure rotor speed control plan, the mixing chamber inlet total temperature control plan, and the high-pressure compressor outlet total pressure control plan, i.e., n Lr = f (T t1 ), n Hr = f (T t1 ), T t6r = f (T t1 ), and P t3r = f (T t1 ). It can be seen that the control plan of each controlled parameter is a function of the flight condition (H, Ma) because the inlet total temperature, T t1 , is a function of the flight condition. In order to distinguish from the main control plan n Hr = f (PLA), the four control plans above are called limit plan.
If the engine is operated under condition (H, Ma), then (P t1 , T t1 ) can be obtained by using the function (P t1 , T t1 ) = f (H, Ma) [27]. Then, the values obtained by the limit plans as the limit parameters-i.e., n Lr , n Hr , P t3r , and T t6r -are exploited to acquire similar parameters under the ground condition by the similarity principle method: n Lcr = n Lr T t1,ds T t1 , n Hcc = n Hr T t1,ds T t1 P t3cr = P t3r P t1,ds P t1 , T t6cr = T t6r where the subscript ds denotes the design points, and n Hcc is used to distinguish from n Hcr , which is the engine corrected high-pressure rotor speed reference obtained by PLA. Then based on Equation (41), the control laws can be given by: where F nLc , F nHc , F Pt3 , and F Tt6 are the controller gains for the limit plans and are obtained by the following interpolation map: The optimal augmented monotonic tracking controller (OAMTC) method [9] was considered to be used for designing the controllers in this paper. Because the controlled parameters of the limit plan, n Hr = f (T t1 ), and the main control plan, n Hr = f (PLA), are both n Hc , the two plans adopt the same controller gain, F nHc . For F nHc , let two poles be placed at λ 1 = −15 and λ 2 = −5. For F nLc , the poles are placed at λ 1 = −8.23 and λ 2 = −1.05. For F Pt3 , the pole is placed at λ = −5, and at λ = −2 for F Tt6 . It should be noted that the OAMTC method is essentially a pole placement method, and its control objective is to shape the controlled variable with monotonicity property and to ensure the stability of the closed-loop system. The value λ to be assigned is the pole of the closed-loop system, and it can be obtained by using genetic algorithm. For more details, see [9]. The map in Equation (49) can be described in Figure 13: placed at = 5 λ − , and at = 2 λ − for 6 Tt F . It should be noted that the OAMTC method is essentially a pole placement method, and its control objective is to shape the controlled variable with monotonicity property and to ensure the stability of the closed-loop system. The value λ to be assigned is the pole of the closed-loop system, and it can be obtained by using genetic algorithm. For more details, see [9]. The map in Equation (49) can be described in Figure 13: Figure 13. The maps of the controller gains: (a) nLc Tt F .

Results and Discussion
This chapter includes two parts: one is the analysis of the influence of the warning factor, α, and the predictive step size, β, on the control performance; the other is the feasibility verification of the method proposed in this paper for the limit management control within the whole flight envelope. In this paper, numerical simulation work was carried out on the aero-engine nonlinear component-level model. The computer was configured as Intel Core I3 2.53 GHz with 2 G memory. The single calculation time of the controller was less than 5 ms, far less than the sampling period of 20 ms, which met the real-time requirement.

Analysis of the Parameter Characteristics
In order to improve the limit management ability, the parameters of safety margin module and parameter prediction module must be reasonably selected. To determine an acceptable value of α for a specific limiter, it is necessary to "ignore" the parameter prediction module by setting β to infinity in Equations (4) and (5). Then, only the safety margin module can be used to obtain the index of the limiter, which consists of two functions, Equations (2) and (3).
To simplify the analysis conditions, only the main control plan and limit plans for P t3 and T t6 were considered, and the parameters α Pt3 = 0 and β Pt3 = ∞, corresponding to the limit plan for P t3 , were set to a fixed value. Let β Tt6 = ∞; then, only the influence of the different α Tt6 on the control performance was studied. Figure 14 shows the simulation results of the acceleration control of the engine operating from idle to full power under the ground condition with different α Tt6 , where the controller index being 1 indicates that the main controller is activated, 2 indicates the limiter for P t3 is activated, and 3 indicates the limiter for T t6 is activated. on the control performance was studied. Figure 14 shows the simulation results of the acceleration control of the engine operating from idle to full power under the ground condition with different 6 Tt α , where the controller index being 1 indicates that the main controller is activated, 2 indicates the limiter for 3 t P is activated, and 3 indicates the limiter for 6 t T is activated.  From Figure 14, it can be seen that, with the increase of α Tt6 , the response of the high-pressure rotor speed and the high-pressure compressor total pressure became slower; the further the peak value of the mixing chamber total temperature response is away from the limit value, the more frequent the switches of the controller. However, too frequent switching lead to the unsatisfactory oscillation problem of the system responses. It can be understood that with the increase of α Tt6 , the farther the safety margin, (1 − α Tt6 )y Tt6 , is from the limit value, y Tt6 , the easier to meet the conditions in Equation (7), and the less likely the limit violation occurs, so the number of the limiter activation increases, as shown in Figure 14d. In order to make a trade-off between the safety and the number of the controller switching, α Tt6 is decided to be set at 0.0078.
Then the influence of different parameter, β Tt6 , on the control performance was studied based on α Tt6 = 0.0078. Figure 15 shows the simulation results of the acceleration control of the engine with different β Tt6 .
From Figure 15, it can be seen that with the increase of β Tt6 , the lower the response speed of the high-pressure rotor speed and the high-pressure compressor outlet total pressure becomes, the farther the peak value of the mixing chamber inlet total temperature response deviates from the limit value, and the number of controller switching increases. It can be understood that, based on the current output change rate, if the output response moves towards its limit value, the more likely it will satisfy the activation condition with the value of β Tt6 being larger. In Figure 15b, the number of the controller switching increases with the increase of β Tt6 . It can be seen from Figure 15c that the limiter is activated when the corresponding output response is far away from its limit value, which limits the peak value of its response to be inaccessible to the limit boundary. Therefore, the response speed decreases with the increase of β Tt6 . Similarly, in order to obtain the fastest response, β Tt6 is decided to be set at 1.
between the safety and the number of the controller switching, From Figure 15, it can be seen that with the increase of 6 Tt β , the lower the response speed of the high-pressure rotor speed and the high-pressure compressor outlet total pressure becomes, the farther the peak value of the mixing chamber inlet total temperature response deviates from the limit value, and the number of controller switching increases. It can be understood that, based on the current output change rate, if the output response moves towards its limit value, the more likely it will satisfy the activation condition with the value of 6 Tt β being larger. In Figure 15b, the number of the controller switching increases with the increase of 6 Tt β . It can be seen from Figure 15c that the limiter is activated when the corresponding output response is far away from its limit value, which limits the peak value of its response to be inaccessible to the limit boundary. Therefore, the

Simulation Results and Discussion
The process of determining the parameters α and β in last sub-section is then repeated for each of the other engine limiters. In this subsection, the parameters are set as follows: The design parameters of the bumpless transfer compensator are given by: The gain of the bumpless transfer compensator in each control loop can be obtained by the following gain schedule method: By using the output-based limit management control method proposed in this paper (OBC), the simulation operating from the idle to full power under the ground condition is shown in Figure 16, which is verified by comparing the control performance with the Min-Max scheme. The controller index of 1 indicates the main controller is activated; 2 indicates the limiter for P t3 is activated; 3 indicates the limiter for T t6 is activated; 4 indicates the limiter for n H is activated; and 5 indicates the limiter for n L is activated. Two kinds of controllers are chosen for building the multi-loop limit management structure based on the Min-Max scheme-the OAMTC controller and the LMI controller (LMIC) proposed in [10].
By using the output-based limit management control method proposed in this paper (OBC), the simulation operating from the idle to full power under the ground condition is shown in Figure  16, which is verified by comparing the control performance with the Min-Max scheme. The controller index of 1 indicates the main controller is activated; 2 indicates the limiter for In Figure 16b, it can be seen that the response speed of the OBC method is basically the same as that of the LMIC method, both of which have a faster response speed than that of the OAMTC method. From Figure 16b-e, it can be seen that all of the three limit management control methods (OAMTC, LMIC, and OBC) can realize the steady protection and transition limit protection of the engine, and there is no limit violation occurring. From Figure 16f, it can be seen that, for the LMIC and OAMTC methods based on the Min-Max scheme, the output limits are not exceeded before 4s t = , but their corresponding limiters have been activated. The reason for that is the switching action of the controller is only related to the fuel change rate of each loop. However, for the OBC method, the switching action of the controller is determined by the output-based switching logic signal, and the problem above will be solved. From Figure 16f, it can be seen that 6 t T has the possibility of exceeding its limit at 4s t = . Then the main controller is switched to the 6 t T limiter by the switching logic, which realizes the transition limit protection. It can be seen that the OBC method establishes a direct relationship between the switching action of the controller and the limit violation.
Finally, the simulation validation of the limit management control in the flight envelope is carried out operating at the full power condition, which is shown in Figure 17. In Figure 16b, it can be seen that the response speed of the OBC method is basically the same as that of the LMIC method, both of which have a faster response speed than that of the OAMTC method. From Figure 16b-e, it can be seen that all of the three limit management control methods (OAMTC, LMIC, and OBC) can realize the steady protection and transition limit protection of the engine, and there is no limit violation occurring. From Figure 16f, it can be seen that, for the LMIC and OAMTC methods based on the Min-Max scheme, the output limits are not exceeded before t = 4 s, but their corresponding limiters have been activated. The reason for that is the switching action of the controller is only related to the fuel change rate of each loop. However, for the OBC method, the switching action of the controller is determined by the output-based switching logic signal, and the problem above will be solved. From Figure 16f, it can be seen that T t6 has the possibility of exceeding its limit at t = 4 s. Then the main controller is switched to the T t6 limiter by the switching logic, which realizes the transition limit protection. It can be seen that the OBC method establishes a direct relationship between the switching action of the controller and the limit violation.
Finally, the simulation validation of the limit management control in the flight envelope is carried out operating at the full power condition, which is shown in Figure 17.
and OAMTC methods based on the Min-Max scheme, the output limits are not exceeded before 4s t = , but their corresponding limiters have been activated. The reason for that is the switching action of the controller is only related to the fuel change rate of each loop. However, for the OBC method, the switching action of the controller is determined by the output-based switching logic signal, and the problem above will be solved. From Figure 16f, it can be seen that 6 t T has the possibility of exceeding its limit at 4s t = . Then the main controller is switched to the 6 t T limiter by the switching logic, which realizes the transition limit protection. It can be seen that the OBC method establishes a direct relationship between the switching action of the controller and the limit violation.
Finally, the simulation validation of the limit management control in the flight envelope is carried out operating at the full power condition, which is shown in Figure 17. The altitude and Mach number curves are shown in Figure 17a-b, respectively. In Figure 17c, the OAMTC and the LMIC response curves basically coincide. A significant difference between the control effect of these response curves and that of the OBC method is whether the steady-state tracking error exists or not. It can be seen that for OBC method, the response tracks its reference with no steady-state error and satisfactory dynamic performance. However, steady-state errors cannot be eliminated by the OAMTC and the LMIC method. The reason is that, for these two methods, the steady-state , a ss x is used as the tracking reference which is obtained by the interpolation method, and the error between the actual steady-state of the engine corresponding to the tracking reference, r , and the "interpolation" steady-state will be introduced. In Figure 17d, the OBC response keeps within the limit, whereas the responses of Min-Max based methods exceed the limit. Viewing that the Min-Max scheme is able to realize the steady limit protection, the limit violation may be caused by the "error" mentioned above. In Figure 17e-g, the limit protection for The altitude and Mach number curves are shown in Figure 17a,b, respectively. In Figure 17c, the OAMTC and the LMIC response curves basically coincide. A significant difference between the control effect of these response curves and that of the OBC method is whether the steady-state tracking error exists or not. It can be seen that for OBC method, the response tracks its reference with no steady-state error and satisfactory dynamic performance. However, steady-state errors cannot be eliminated by the OAMTC and the LMIC method. The reason is that, for these two methods, the steady-state x a,ss is used as the tracking reference which is obtained by the interpolation method, and the error between the actual steady-state of the engine corresponding to the tracking reference, r, and the "interpolation" steady-state will be introduced. In Figure 17d, the OBC response keeps within the limit, whereas the responses of Min-Max based methods exceed the limit. Viewing that the Min-Max scheme is able to realize the steady limit protection, the limit violation may be caused by the "error" mentioned above. In Figure 17e-g, the limit protection for the limit plans of n H , P t3 , and T t6 are all realized, but the control performance of the OBC method is better than that of the other methods. And as shown in Figure 17i, the fewer number of controller switching events carried out by the OBC method proved that the proposed strategy established the relationship between the switching action and the limit violation and provided faster control performance. Therefore, the method presented in this paper has the potential for application in actual engine control systems.

Conclusions
This paper has proposed a new limit management control approach to ensure the operational safety of aero-engines. The novelty of this methodology lies in the multi-loop switching control strategy with the output-based switching logic. It consists of the following design points: the design of the safety margin module, the parameter predictive module, and the switching logic, and also the method to realize bumpless transfer. Compared with the Min-Max scheme, one advantage of this methodology is that the switching logic signal obtained by the safety margin module and the parameter predictive module establishes the connection between the switching action and the limit violation, and, therefore, the limit violation can be directly avoided. Another advantage of this methodology lies in the subsequent reduction of the controller switching frequency, which improves the control performance. From the results of simulations varying from acceleration control to steady control scenarios, conclusion can be drawn that the proposed strategy has superiority over the Min-Max strategy in transient limit protection and has the potential for application in the aero-engine control practice.