Collaborative Robotics: Enhance Maintenance Procedures on Primary Flight Control Servo-Actuators

Featured Application: The proposed research aims to improve primary flight control servo-actuators maintenance procedures using collaborative robotics. The ongoing research campaign highlights how the implementation of a robot arm can lead to a better diagnostic of the faulty unit and to the extraction of health features useful for prognostics purposes. Abstract: Electro-Hydraulic Servo-Actuators (EHSAs) are mainly used to command primary ﬂight control surfaces in military and commercial aircraft. Since these devices are crucial for vehicle stability and maneuverability, a correct assessment of their health status is mandatory. Within this framework, a joint research project (HyDiag), held by Politecnico di Torino and Lufthansa Technik AG (LHT), aims to provide a more efﬁcient and reliable procedure to determine the operating conditions of the EHSA. A smart and automatic sequence, able to extract several health features of the Unit Under Test (UUT), has been developed and integrated. The present paper discusses the implementation of a collaborative robot, equipped with a vision system and customized tools, for both health features extraction, and maintenance tasks on unserviceable servo-actuators. The main challenges related to the automation of such complex tasks in a real working environment are highlighted, togetherwith the advantages brought by the proposed approach. The paper also presents the ﬁrst results of an ongoing experimental campaign. Speciﬁcally, it reports the enhancements of the maintenance procedures using collaborative robotics and possible future developments.


Introduction
Industrial manipulators were created to support human labour in repetitive and simple tasks. This technological development enables operators to focus on those roles that require human skills. The growing implementation of robotics in the industry now requires workers to oversee the production line, more than operating manual tasks [1]. However, with the implementation of new sensors and algorithms, robots have been successfully used in several additional industrial fields, such as manufacturing and logistics [2]. The growing interest in process automation has also been driven by the development of collaborative robots. These "cobots" can share their working environment with a human operator without jeopardizing the workers' safety. According to [3], such Human-Robot Collaboration (HRC) had a positive impact, in particular, over Small-Medium Enterprises (SMEs), allowing them to be more competitive in the global market. Nevertheless, as reported in [4], current trends see collaborative robots more involved in assembly processes than in maintenance applications. The reason behind this could be related to the complexity • Ordinary maintenance: it involves routine operations, mainly related to Planned Preventive Maintenance (PPM) procedures, to replace specific components on a machine to prevent a failure; • Extra-ordinary maintenance: performed after a failure has occurred, when the component is not in a nominal operating condition anymore.
Since complex components, such as a flight control servo-actuator, can be affected by several failure modes, it is required to set up an adaptive maintenance procedure. This level of flexibility increases the overall complexity of the application, making it difficult to be entirely handled by a robot. According to [5], when the environmental variability increases, there is a trend to move from autonomous to teleoperated manipulators. This shift in the paradigm of robotics is justified by the requirement of taking advantage of the flexibility, and intelligence of the human operator. This trend is confirmed by several studies [6][7][8][9][10] in which different types of robots have been successfully used, mainly, for inspection purposes rather than for repairing the damage.
This work describes the implementation of a UR10 collaborative robot from Universal Robots. The aim is to optimize extra-ordinary repair procedures on electro-hydraulic servo-actuators. According to [11,12], an efficient health-assessment methodology would bring benefits to aircraft reliability and availability, and reduce maintenance costs. The aim is achieved by a combination of advanced diagnostics and prognostics algorithms [13,14]. In addition to the health-assessment software, an industrial manipulator has been adopted to support maintenance procedures [15,16]. The importance of this research has been analyzed and proved to be profitable by [17], where the amount, and the costs, of Shop Load Events (SLEs) of several servo-actuators, in a period of 15 years, have been examined.
The actual maintenance procedures, adopted by LHT and reported in Figure 1a, could be upgraded to a new process schematized in Figure 1b. involved in assembly processes than in maintenance applications. The reason behind this could be related to the complexity of maintenance tasks, which require a level of flexibility that makes the coding of the operation itself hard.
By focusing the attention on maintenance applications, it is possible to identify two main branches: • Ordinary maintenance: it involves routine operations, mainly related to Planned Preventive Maintenance (PPM) procedures, to replace specific components on a machine to prevent a failure; • Extra-ordinary maintenance: performed after a failure has occurred, when the component is not in a nominal operating condition anymore.
Since complex components, such as a flight control servo-actuator, can be affected by several failure modes, it is required to set up an adaptive maintenance procedure. This level of flexibility increases the overall complexity of the application, making it difficult to be entirely handled by a robot. According to [5], when the environmental variability increases, there is a trend to move from autonomous to teleoperated manipulators. This shift in the paradigm of robotics is justified by the requirement of taking advantage of the flexibility, and intelligence of the human operator. This trend is confirmed by several studies [6][7][8][9][10] in which different types of robots have been successfully used, mainly, for inspection purposes rather than for repairing the damage.
This work describes the implementation of a UR10 collaborative robot from Universal Robots. The aim is to optimize extra-ordinary repair procedures on electrohydraulic servo-actuators. According to [11,12], an efficient health-assessment methodology would bring benefits to aircraft reliability and availability, and reduce maintenance costs. The aim is achieved by a combination of advanced diagnostics and prognostics algorithms [13,14]. In addition to the health-assessment software, an industrial manipulator has been adopted to support maintenance procedures [15,16]. The importance of this research has been analyzed and proved to be profitable by [17], where the amount, and the costs, of Shop Load Events (SLEs) of several servo-actuators, in a period of 15 years, have been examined.
The actual maintenance procedures, adopted by LHT and reported in Figure 1a, could be upgraded to a new process schematized in Figure 1b. Electro-hydraulic servo-actuators are not subjected to scheduled maintenance. In case of failure, the unserviceable unit is dismounted from the aircraft and shipped to the test field. If one or more tests, reported on the Maintenance Manual (MM) of the unit, fail, the EHSA is sent to the workshop where experienced technicians replace the non- Electro-hydraulic servo-actuators are not subjected to scheduled maintenance. In case of failure, the unserviceable unit is dismounted from the aircraft and shipped to the test field. If one or more tests, reported on the Maintenance Manual (MM) of the unit, fail, the EHSA is sent to the workshop where experienced technicians replace the non-functional components. The unit is then tested to be compliant with the requirements defined by the Original Equipment Manufacturer (OEM). More in detail, the test procedure requires many manual adjustments to regulate specific outputs of the unit under test. Only when all the functional tests are passed, the servo-actuator is considered serviceable; if not, the entire testing process is repeated. Since this approach does not include an accurate analysis of the unit health status, it may require several adjustments and repair loops, resulting in a considerable loss of time and increment of the maintenance costs.
To reduce the number of testing loops and, at the same time, have a better knowledge of the root cause of the failure, a new semi-automatic maintenance procedure, reported in Figure 1b, has been developed. The first step consists of an automatic entry test [13] where an excitation signal is commanded to the UUT to extract Health Features (HFs). These data will be later used to better identify the health status of the entire servo-actuator. Additional health features are obtained using a collaborative robot that regulates different elements (i.e., screws) on the faulty unit. This is done to evaluate the EHSA response to the aforementioned signal under different operating conditions. This approach not only guarantees the operators' safety, but it assures high repeatability of the process. The results of these tests are collected into an automatically generated trouble-shooting document. Since this information derives from a more accurate and reliable investigation on the overhaul status of the EHSA, it is more likely that the root cause of the failure is detected. The replacement of faulty sub-components is then performed by technicians, according to the instructions reported on the trouble-shooting document. The industrial manipulator is also used to achieve more accurate regulations of the EHSA during the adjustment procedure, leading to better respect the acceptability thresholds defined by the maintenance manual. Following the adjustments, an automatic exit test, which combines the HyDiag entry test and the robot features extraction, is performed. The last step is the OEM certification test that remains mandatory before being able to mount the unit back on the aircraft. On the contrary, if the HyDiag exit test is failed, a new trouble-shooting document is automatically generated, and the faulty servo-actuator is brought back to the workshop to be repaired. Nevertheless, due to more in-depth, and precise knowledge of the actual health status of the EHSA, given by the evaluation of the extracted health features, the project aims to avoid any iteration between testing and repairing operations, leading to a reduction in both maintenance costs and time.

Experimental Setup
The experimental campaign has been held in the hydraulic laboratory of the Lufthansa Technik Components Innovation department. The HyDiag entry and exit tests, the robot feature extraction sequence, and the adjustments have been performed using the setup reported in Figure 2a, whose main subsystems are schematized in Figure 2b. To reduce the number of testing loops and, at the same time, have a better knowledge of the root cause of the failure, a new semi-automatic maintenance procedure, reported in Figure 1b, has been developed. The first step consists of an automatic entry test [13] where an excitation signal is commanded to the UUT to extract Health Features (HFs). These data will be later used to better identify the health status of the entire servo-actuator. Additional health features are obtained using a collaborative robot that regulates different elements (i.e., screws) on the faulty unit. This is done to evaluate the EHSA response to the aforementioned signal under different operating conditions. This approach not only guarantees the operators' safety, but it assures high repeatability of the process. The results of these tests are collected into an automatically generated trouble-shooting document. Since this information derives from a more accurate and reliable investigation on the overhaul status of the EHSA, it is more likely that the root cause of the failure is detected. The replacement of faulty sub-components is then performed by technicians, according to the instructions reported on the trouble-shooting document. The industrial manipulator is also used to achieve more accurate regulations of the EHSA during the adjustment procedure, leading to better respect the acceptability thresholds defined by the maintenance manual. Following the adjustments, an automatic exit test, which combines the HyDiag entry test and the robot features extraction, is performed. The last step is the OEM certification test that remains mandatory before being able to mount the unit back on the aircraft. On the contrary, if the HyDiag exit test is failed, a new troubleshooting document is automatically generated, and the faulty servo-actuator is brought back to the workshop to be repaired. Nevertheless, due to more in-depth, and precise knowledge of the actual health status of the EHSA, given by the evaluation of the extracted health features, the project aims to avoid any iteration between testing and repairing operations, leading to a reduction in both maintenance costs and time.

Experimental Setup
The experimental campaign has been held in the hydraulic laboratory of the Lufthansa Technik Components Innovation department. The HyDiag entry and exit tests, the robot feature extraction sequence, and the adjustments have been performed using the setup reported in Figure 2a, whose main subsystems are schematized in Figure 2b. The unit under test has been mounted on a fixture inside the hydraulic bench, while the UR10 collaborative robot is on a movable work cart outside of it. Besides allowing a fast and straightforward setup, it simulates the working environment of the current production line. Moreover, by using a reconfigurable work cart, it has been possible to efficiently evaluate several robot positions with respect to the test bench.
Due to the toxicity and corrosive properties of the oil used by servo-actuators and the high pressures involved in the maintenance process, the entire task requires mitigating the hazards for the operator. A protective plexiglass bulkhead, positioned around the work cart, allows for meeting all the safety requirements and a proper movement of the robot. This configuration, according to [18], would be labelled as "coexistence" of the industrial manipulator and the human operator rather than a real collaboration. However, the use of a cobot is mainly justified to assure the technician's safety, during his interaction with it, in the test campaign. Since safety is of primary importance in human-robot applications [19], in addition to the safety measures provided by Universal Robots, two protection devices have been implemented:

•
Safeguard stop: additional button located on the work cart and wired to the UR10 control unit. It is used to pause the robot program without activating the joints brakes as for the emergency stop button. Once released, the robot returns to perform the task from where it was stopped; • Signal light: a signal tower with LEDs lights of different colours is used to inform the operator about the current status of the robot program: normal operating condition, paused, or anomaly detected.
In addition to the safety features, the choice of a collaborative robot has been mainly driven by its high flexibility. These machines can share their workspace with the human operator without protective cages or fences. This, together with a compact and lightweight design, allowed for positioning the robot on a movable work cart, which can be easily reconfigured according to specific needs, resulting in low setup costs. The possibility to quickly change its mounting configuration, together with joints ranges of ±360 • , and an intuitive programming language, also allowed adapting the UR10 to repair and test different types of servo-actuators, making it the right manipulator for rapid feasibility studies. Figure 3a reports, as an example, the different components of a servo-actuator object of regulation and adjustments. To do so, the UR10 has been equipped with wrenches and screwdrivers, stored in a warehouse on the work cart. Their modular design allows the robot to autonomously handle the tool change, leading to a fully automized test procedure. The unit under test has been mounted on a fixture inside the hydraulic bench, while the UR10 collaborative robot is on a movable work cart outside of it. Besides allowing a fast and straightforward setup, it simulates the working environment of the current production line. Moreover, by using a reconfigurable work cart, it has been possible to efficiently evaluate several robot positions with respect to the test bench.
Due to the toxicity and corrosive properties of the oil used by servo-actuators and the high pressures involved in the maintenance process, the entire task requires mitigating the hazards for the operator. A protective plexiglass bulkhead, positioned around the work cart, allows for meeting all the safety requirements and a proper movement of the robot. This configuration, according to [18], would be labelled as "coexistence" of the industrial manipulator and the human operator rather than a real collaboration. However, the use of a cobot is mainly justified to assure the technician's safety, during his interaction with it, in the test campaign. Since safety is of primary importance in human-robot applications [19], in addition to the safety measures provided by Universal Robots, two protection devices have been implemented: • Safeguard stop: additional button located on the work cart and wired to the UR10 control unit. It is used to pause the robot program without activating the joints brakes as for the emergency stop button. Once released, the robot returns to perform the task from where it was stopped; • Signal light: a signal tower with LEDs lights of different colours is used to inform the operator about the current status of the robot program: normal operating condition, paused, or anomaly detected.
In addition to the safety features, the choice of a collaborative robot has been mainly driven by its high flexibility. These machines can share their workspace with the human operator without protective cages or fences. This, together with a compact and lightweight design, allowed for positioning the robot on a movable work cart, which can be easily reconfigured according to specific needs, resulting in low setup costs. The possibility to quickly change its mounting configuration, together with joints ranges of ±360°, and an intuitive programming language, also allowed adapting the UR10 to repair and test different types of servo-actuators, making it the right manipulator for rapid feasibility studies. Figure 3a reports, as an example, the different components of a servo-actuator object of regulation and adjustments. To do so, the UR10 has been equipped with wrenches and screwdrivers, stored in a warehouse on the work cart. Their modular design allows the robot to autonomously handle the tool change, leading to a fully automized test procedure.
(a) (b) Nevertheless, since each unit requires different adjustments, additive manufacturing has been adopted to build customized tools. Fused Deposition Modeling (FDM) has been used to produce the camera, tool holders, and the tool head reported in Figure 3b, while the adapters, which directly interact with the EHSA, have been purchased in metal. In addition, due to the complexity and variety of the tasks required, it has been necessary to equip the robot with a Force-Torque (FT) sensor and the In-Sight 7802 industrial 2D camera from Cognex, both depicted in Figure 3b.
The faulty unit is mounted inside a test bench that provides the hydraulic pressure, while an Industrial Measurement System (IMS) collects the measurements from the EHSA through specific aeronautic cables. These data are transmitted to the Central Computer (CC) inside which an algorithm controls the sequence of actions the robot must perform on the servo-actuator. On the other hand, the industrial manipulator constantly exchanges data with the FT sensor, the camera, and the signal light tower via TCP/IP communication protocol [20]. The schematic of the main subsystems is reported in Figure 4.
. (a) Focus on the main components of a servo-actuator to be adjusted by the UR10 collaborative robot; (b) Tool d on UR10 tool flange consisting of a 2D camera, a force-torque sensor, and a customized wrench built via additive cturing.
Nevertheless, since each unit requires different adjustments, additive manufacturing has been adopted to build customized tools. Fused Deposition Modeling (FDM) has been used to produce the camera, tool holders, and the tool head reported in Figure 3b, while the adapters, which directly interact with the EHSA, have been purchased in metal. In addition, due to the complexity and variety of the tasks required, it has been necessary to equip the robot with a Force-Torque (FT) sensor and the In-Sight 7802 industrial 2D camera from Cognex, both depicted in Figure 3b.
The faulty unit is mounted inside a test bench that provides the hydraulic pressure, while an Industrial Measurement System (IMS) collects the measurements from the EHSA through specific aeronautic cables. These data are transmitted to the Central Computer (CC) inside which an algorithm controls the sequence of actions the robot must perform on the servo-actuator. On the other hand, the industrial manipulator constantly exchanges data with the FT sensor, the camera, and the signal light tower via TCP/IP communication protocol [20]. The schematic of the main subsystems is reported in Figure 4. To improve software usability, a Graphical User Interface (GUI) has been developed. To use the manipulator, the technician must only specify three parameters to launch the robot feature extraction or the adjustments sequence: • EHSA type: type of servo-actuator under test. Each model requires different test procedures, so the Central Computer must know which sub-program to run; • Robot: necessary to define the proper static IP address of the manipulator with which tests will be performed; • Task: since the proposed algorithm is used both for maintenance and health features extraction for Prognostics and Health Management (PHM) purposes, different sequences can be launched by the operator.
Knowing this information, the central computer extracts, from configuration files, the instructions to send to both the robot and the test bench. All the commands have been defined in three main configuration files: 1. Macro sequencer: high-level sequencer which controls all the tests, adjustments, and single actions to be commanded. This configuration controls both the test bench and the UR10, taking into account the EHSA type and the task selected by the operator; 2. Robot sequencer: low-level sequencer in which are defined all the single robot movements; 3. EHSA sequencer: low-level sequencer that sets the test bench and the unit under test to desired levels of pressure, currents, ram positions, or voltages inputs. To improve software usability, a Graphical User Interface (GUI) has been developed. To use the manipulator, the technician must only specify three parameters to launch the robot feature extraction or the adjustments sequence: • EHSA type: type of servo-actuator under test. Each model requires different test procedures, so the Central Computer must know which sub-program to run; • Robot: necessary to define the proper static IP address of the manipulator with which tests will be performed; • Task: since the proposed algorithm is used both for maintenance and health features extraction for Prognostics and Health Management (PHM) purposes, different sequences can be launched by the operator.
Knowing this information, the central computer extracts, from configuration files, the instructions to send to both the robot and the test bench. All the commands have been defined in three main configuration files:

1.
Macro sequencer: high-level sequencer which controls all the tests, adjustments, and single actions to be commanded. This configuration controls both the test bench and the UR10, taking into account the EHSA type and the task selected by the operator; 2. Robot sequencer: low-level sequencer in which are defined all the single robot movements; 3. EHSA sequencer: low-level sequencer that sets the test bench and the unit under test to desired levels of pressure, currents, ram positions, or voltages inputs.

Critical Aspects Related to the Automatic Adjustments Procedures
To develop an algorithm able to perform automatic adjustments on electro-hydraulic servo-actuators, the official offline simulator (URSim), provided by Universal Robots, has been used. Since it is an exact copy of the Polyscope software installed on the real robot, all the functions to command the UR10 have been developed in a simulated environment. However, since it is not possible to add any sensors, cameras, or CAD models, an extensive experimental campaign has been performed in LHT facilities to develop the automatic maintenance sequence fully. During the tests in the laboratory, which replicates the test field working conditions, several challenges, which could not have been highlighted by the simulator, emerged. The control algorithm, the camera software, and the robot program have been designed to overcome these issues and provide a setup able to perform maintenance on EHSAs in a real environment and not just in a controlled one, such as a research laboratory.
Moreover, to avoid an unjustified complexity of the robot program, each servo-actuator must be appropriately prepared by the technicians. Some tasks, such as the removal of the wires used to avoid any loosening of the safety screws, in fact, have been classified as a unit preparation procedure.

Mechanical-Related Challenges
By moving from the simulated environment to the research laboratory, several improvements in the code were necessary to adapt the software to the production field. The main challenges were related to: backlash, mounting errors, waypoint settings, and other mechanical aspects described in this section.

EHSA-Tool Backlash
One of the main issues to consider when programming a robot to perform automatic adjustments on a servo-actuator is the play between the tool and the element that must be regulated. In Figure 5a, a schematic representation of the backlash is reported, estimated to be around 11 • , between the flat screwdriver and the slotted screw, whose orientation affects the adjustment of the Electro-Hydraulic Servo-Valve (EHSV) current, which is depicted in Figure 5b.

Critical Aspects Related to the Automatic Adjustments Procedures
To develop an algorithm able to perform automatic adjustments on electro-hydraulic servo-actuators, the official offline simulator (URSim), provided by Universal Robots, has been used. Since it is an exact copy of the Polyscope software installed on the real robot, all the functions to command the UR10 have been developed in a simulated environment. However, since it is not possible to add any sensors, cameras, or CAD models, an extensive experimental campaign has been performed in LHT facilities to develop the automatic maintenance sequence fully. During the tests in the laboratory, which replicates the test field working conditions, several challenges, which could not have been highlighted by the simulator, emerged. The control algorithm, the camera software, and the robot program have been designed to overcome these issues and provide a setup able to perform maintenance on EHSAs in a real environment and not just in a controlled one, such as a research laboratory.
Moreover, to avoid an unjustified complexity of the robot program, each servoactuator must be appropriately prepared by the technicians. Some tasks, such as the removal of the wires used to avoid any loosening of the safety screws, in fact, have been classified as a unit preparation procedure.

Mechanical-Related Challenges
By moving from the simulated environment to the research laboratory, several improvements in the code were necessary to adapt the software to the production field. The main challenges were related to: backlash, mounting errors, waypoint settings, and other mechanical aspects described in this section.

EHSA-Tool Backlash
One of the main issues to consider when programming a robot to perform automatic adjustments on a servo-actuator is the play between the tool and the element that must be regulated. In Figure 5a, a schematic representation of the backlash is reported, estimated to be around 11°, between the flat screwdriver and the slotted screw, whose orientation affects the adjustment of the Electro-Hydraulic Servo-Valve (EHSV) current, which is depicted in Figure 5b. Since it is impossible to know a priori the correct direction to rotate the slotted screw, the robot first performs a 5° clockwise trial rotation (t ≈ 2 s). In the proposed example, this moves the servo-valve current further away from its optimal range (t ≈ 3 s), so a Since it is impossible to know a priori the correct direction to rotate the slotted screw, the robot first performs a 5 • clockwise trial rotation (t ≈ 2 s). In the proposed example, this moves the servo-valve current further away from its optimal range (t ≈ 3 s), so a counterclockwise rotation is automatically commanded to the robot. Nevertheless, this produces a delay on the adjustment because, even if the tool rotates, the regulation element on the servo-actuator does not since it is first necessary to compensate for the backlash. This effect is visible in Figure 5b where the servo-valve current does not vary between t ≈ 4 s and t ≈ 12 s, due to the 11 • play between the screwdriver tip and the slotted screw. This issue, however, could not be overcome by simply implementing a larger screwdriver because, over different series of the same type of EHSA, the geometry of a screw could slightly change. By considering this, there would be the risk to have a tool that would not fit inside the slotted screw, jeopardizing the entire maintenance process.

Adjustments Acceptability Threshold
According to the unit maintenance manual, each adjustment must bring a specific output (i.e., a current, voltage, or ram position) within predefined boundaries. As an example, Figure 6a reports the end of the adjustment of the ram position, obtained by regulating the orientation of the hexagonal screw pictured in Figure 6b. counterclockwise rotation is automatically commanded to the robot. Nevertheless, this produces a delay on the adjustment because, even if the tool rotates, the regulation element on the servo-actuator does not since it is first necessary to compensate for the backlash. This effect is visible in Figure 5b where the servo-valve current does not vary between t ≈ 4 s and t ≈ 12 s, due to the 11° play between the screwdriver tip and the slotted screw. This issue, however, could not be overcome by simply implementing a larger screwdriver because, over different series of the same type of EHSA, the geometry of a screw could slightly change. By considering this, there would be the risk to have a tool that would not fit inside the slotted screw, jeopardizing the entire maintenance process.

Adjustments Acceptability Threshold
According to the unit maintenance manual, each adjustment must bring a specific output (i.e., a current, voltage, or ram position) within predefined boundaries. As an example, Figure 6a reports the end of the adjustment of the ram position, obtained by regulating the orientation of the hexagonal screw pictured in Figure 6b. As it is possible to see from the graph, at t ≈ 50 s, the adjustment is completed, so, after changing the tool, the two safety screws can be fastened. However, since these two elements are mechanically connected with the hexagonal screw, this operation affects the value of the ram position read by the measurement system. The same effect, even though smaller in magnitude, is also reported in Figure 5b, where the fastening of the three safety screws tend to lower the EHSV current. In addition, at t ≈ 27 s, it can also be noticed how the removal of the screwdriver at the end of the adjustment affects the servo-valve current, probably related to a settlement of the slotted screw to a condition of equilibrium.
To guarantee that, at the end of the entire procedure (adjustment plus tightening of the safety screws), the monitored output is within the desired ranges, two solutions have been adopted: 1. The safety screws must be unfastened by a precise quantity, or until reaching a specific torque, obtained by empirical experience, so that the plate, which connects the item to be adjusted and the safety screws, is not too much loosened. If not, while screwing back the safety screws, it could move and compromise the entire procedure; 2. The acceptability thresholds defined to the robot for completing the adjustment must be more stringent than those reported on the maintenance manual. In so doing, even after fastening back the safety screws, the output would be within the boundaries. As it is possible to see from the graph, at t ≈ 50 s, the adjustment is completed, so, after changing the tool, the two safety screws can be fastened. However, since these two elements are mechanically connected with the hexagonal screw, this operation affects the value of the ram position read by the measurement system. The same effect, even though smaller in magnitude, is also reported in Figure 5b, where the fastening of the three safety screws tend to lower the EHSV current. In addition, at t ≈ 27 s, it can also be noticed how the removal of the screwdriver at the end of the adjustment affects the servo-valve current, probably related to a settlement of the slotted screw to a condition of equilibrium.

EHSA Reference Frame Definition
To guarantee that, at the end of the entire procedure (adjustment plus tightening of the safety screws), the monitored output is within the desired ranges, two solutions have been adopted:

1.
The safety screws must be unfastened by a precise quantity, or until reaching a specific torque, obtained by empirical experience, so that the plate, which connects the item to be adjusted and the safety screws, is not too much loosened. If not, while screwing back the safety screws, it could move and compromise the entire procedure; 2.
The acceptability thresholds defined to the robot for completing the adjustment must be more stringent than those reported on the maintenance manual. In so doing, even after fastening back the safety screws, the output would be within the boundaries.

EHSA Reference Frame Definition
As in [15], to assure a fast and straightforward setup, in case of changes in the mounting configuration between the robot and the servo-actuator, a relative reference Appl. Sci. 2021, 11, 4929 8 of 16 frame has been defined. All the waypoints on the servo-actuator have been saved, not according to the robot base reference frame, but to the one defined on the fixture itself. To reduce human error and to avoid the need for technicians with robot programming skills, an automatic definition of the EHSA reference frame, with respect to the robot base ( B A EHSA ), has been adopted using the camera as in Figure 7a.
Appl. Sci. 2021, 11, x FOR PEER REVIEW 8 of 16 As in [15], to assure a fast and straightforward setup, in case of changes in the mounting configuration between the robot and the servo-actuator, a relative reference frame has been defined. All the waypoints on the servo-actuator have been saved, not according to the robot base reference frame, but to the one defined on the fixture itself. To reduce human error and to avoid the need for technicians with robot programming skills, an automatic definition of the EHSA reference frame, with respect to the robot base ( B AEHSA), has been adopted using the camera as in Figure 7a. This information is the result of the multiplication of three 4 × 4 roto-translation matrices: B AEHSA = B ATCP * TCP ACAM * CAM AEHSA, which define, respectively, the relative position between the actual Tool Center Point (TCP) and the robot base ( B ATCP), between the camera and the TCP ( TCP ACAM) and the EHSA with respect to the camera ( CAM AEHSA). Since Universal Robots uses the axis-angle convention [21] to describe the TCP pose with respect to the robot base frame, B ATCP is built as: where ; ℎ ; ℎ ; ℎ ; cos and sin .
On the other hand, for both TCP ACAM and CAM AEHSA the Roll-Pitch-Yaw (RPY) convention has been adopted, leading to: where , , , , , and are, respectively, the translation and rotation coordinates of the camera reference frame according to the one of the TCP of the tool currently mounted on the robot arm, as reported in Figure 8. Ideally, according to the mounting configuration adopted, the rotations of the camera, with respect to the Tool This information is the result of the multiplication of three 4 × 4 roto-translation matrices: B A EHSA = B A TCP * TCP A CAM * CAM A EHSA , which define, respectively, the relative position between the actual Tool Center Point (TCP) and the robot base ( B A TCP ), between the camera and the TCP ( TCP A CAM ) and the EHSA with respect to the camera ( CAM A EHSA ). Since Universal Robots uses the axis-angle convention [21] to describe the TCP pose x y z r x r y r z with respect to the robot base frame, B A TCP is built as: where α = r 2 x + r 2 y + r 2 z ; h x = r x α ; h y = r y α ; h z = r z α ; c α = cos α and s α = sin α. On the other hand, for both TCP A CAM and CAM A EHSA the Roll-Pitch-Yaw (RPY) convention has been adopted, leading to: where x TCP CAM , y TCP CAM , z TCP CAM , ψ, ϕ, and θ are, respectively, the translation and rotation coordinates of the camera reference frame according to the one of the TCP of the tool currently mounted on the robot arm, as reported in Figure 8. Ideally, according to the mounting configuration adopted, the rotations of the camera, with respect to the Tool Center Point, should be null. However, possible mounting errors could occur, leading to non-zero values of the roll (ψ), pitch (ϕ), and yaw (θ) angles. As an example, in Figure 8 is schematized the procedure used to estimate the roll and pitch angles, exaggerated for better clarity, by measuring the distances y and x between a point on the checkerboard, detected by the camera at the working distances d, and the projection of the camera reference frame on it. Several measurements, taken with a different configuration of the camera, showed a linear correlation between d-y and d-x, leading to the definition of ψ = arctan y d and ϕ = arctan x d . Center Point, should be null. However, possible mounting errors could occur, leading to non-zero values of the roll ( ), pitch ( ), and yaw ( ) angles. As an example, in Figure 8 is schematized the procedure used to estimate the roll and pitch angles, exaggerated for better clarity, by measuring the distances and between a point on the checkerboard, detected by the camera at the working distances , and the projection of the camera reference frame on it. Several measurements, taken with a different configuration of the camera, showed a linear correlation between -and -, leading to the definition of arctan and arctan . Once known the position of the camera with respect to the TCP currently mounted on the robot, it has been used to obtain the data necessary to build the 4x4 roto-translation matrix TCP AEHSA. To do so, a checkerboard, similar to the one reported in Figure 7b, has been positioned on the fixture on which the faulty unit is mounted, so that the robot could take a picture of it as shown in Figure 7a. Since the EHSA fixture can be positioned, in different ways, inside the test bench, but with a fixed high with respect to the robot, one picture is enough to obtain the rotation around the Z axis and the two X and Y translations ( , , and ) of the EHSA reference frame with the respect to the one defined on the camera. The roto-translation matrix can be then simplified, leading to: In so doing, even if the fixture or the work cart change their positions due to, for example, different models of test benches or workspace limitations, it would not be necessary to set all the coordinates of the servo-actuator waypoints again.

Waypoints Coordinates Update
Since each adjustment affects the position of a mechanical component of the UUT, it is possible that the coordinates of some waypoints slightly change after such a procedure. This happens, for example, to the two safety screws reported in Figure 6b, whose orientation is a function of the servo-actuator ram position. Therefore, for the robot to properly fasten them back, it is necessary to update their coordinates by taking a picture to extract their actual location. As explained in more detail in Section 3.2.2, the correct pixels-to-meters conversion is obtained by a previous calibration of the camera with the Once known the position of the camera with respect to the TCP currently mounted on the robot, it has been used to obtain the data necessary to build the 4x4 roto-translation matrix TCP A EHSA . To do so, a checkerboard, similar to the one reported in Figure 7b, has been positioned on the fixture on which the faulty unit is mounted, so that the robot could take a picture of it as shown in Figure 7a. Since the EHSA fixture can be positioned, in different ways, inside the test bench, but with a fixed high with respect to the robot, one picture is enough to obtain the rotation around the Z axis and the two X and Y translations (ε z , δ x , and δ y ) of the EHSA reference frame with the respect to the one defined on the camera. The roto-translation matrix can be then simplified, leading to: In so doing, even if the fixture or the work cart change their positions due to, for example, different models of test benches or workspace limitations, it would not be necessary to set all the coordinates of the servo-actuator waypoints again.

Waypoints Coordinates Update
Since each adjustment affects the position of a mechanical component of the UUT, it is possible that the coordinates of some waypoints slightly change after such a procedure. This happens, for example, to the two safety screws reported in Figure 6b, whose orientation is a function of the servo-actuator ram position. Therefore, for the robot to properly fasten them back, it is necessary to update their coordinates by taking a picture to extract their actual location. As explained in more detail in Section 3.2.2, the correct pixels-to-meters conversion is obtained by a previous calibration of the camera with the checkerboard of Figure 7b. This calibration is performed at the same distance from which the picture of the objects detected on the servo-actuator has been taken. The correct coordinates of the waypoints are then automatically stored inside the camera software. When the Central Computer commands the robot to reach a component on the EHSA, the UR10 queries the camera database for the updated coordinates of the waypoint and the movement is correctly executed.

Workspace Restrictions
Due to the EHSA fixture, the mounting configuration of the camera, and the presence of cables used for both the vision system and the force-torque sensor, the maximum rotation allowed to the last joint of the manipulator is limited while loosening or fastening a screw. In so doing, if the commanded rotation would be higher than the one allowed in a specific configuration of the robot arm, it will be automatically split into multiple steps. In this scenario, the force-torque sensor is fundamental to let the robot know when the screwdriver is correctly inserted inside the screw head, assuring a proper rotation.
All the ranges, the thresholds, and the other information necessary to avoid any collision, and to properly repair a servo-actuator, are defined while programming the robot movement. On the contrary, the technician, who uses the robot in the test field, only interacts with the GUI to select the EHSA type, the robot model, and the task to be performed on the faulty unit. This has been done to avoid needing highly trained and qualified personnel, with previous knowledge about robotics or programming, to execute automatic adjustments on different servo-actuators.

Tool Jamming
Since the servo-actuators to be repaired are not in nominal operating conditions, it is possible that some components, such as the safety screws, are slightly damaged. This could lead to tool jamming, which could jeopardize the entire maintenance procedure. To minimize this risk, when fastening a screw with specific torque, measured using the forcetorque sensor, and before the backward translation used to remove the screwdriver from the safety screw, a counterclockwise rotation of 0.1 • is commanded. In so doing, the torque range with which the screw must be fastened is respected, while a slight gap between the two elements is created, allowing a safe extraction of the screwdriver. Since the automatic tool change has been designed with a magnetic coupling, in case of a damaged screw, the friction between it and the screwdriver could be sufficient to overcome the magnetic attracting force of the tool holder and the tool head, living the second one attached to the EHSA.

Customized Tools Tolerances
Since EHSAs were not designed for automatic maintenance, there was not any previous knowledge about how to develop proper tools for this kind of activity. The high complexity of the tasks to perform on the servo-actuator makes it challenging to define a unique design of a tool and it requires a trial and error approach. Moreover, the FDM technique used to manufacture them does not allow high resolution and precision, leading to an intrinsic backlash.
Besides, because of production and mounting errors, it is possible that the tool is not aligned with the rotation axis of the robot's last joint along which the TCP has been defined. This characteristic is not critical for short tools, but it can be a problem for longer ones, since an unrestrained eccentricity could lead the robot to miss the desired waypoint.

Sensors-Related Challenges
As already mentioned, to enhance the robot capabilities, and to allow proper automatic maintenance of a servo-actuator, it has been necessary to equip the robot with a force-torque sensor and a camera. Even if the implementation of these two sensors was inevitable, it came with a few drawbacks.

Force-Torque Sensor Accuracy
To guarantee correct maintenance of the unit under test, the maintenance manual also reports torques ranges to fasten the protective screws after an adjustment. To do this, it is necessary to take into account the force-torque sensor tolerances and working conditions. According to the manufacturer, changes in environmental conditions, such as pressure, temperature or humidity, could negatively affect the sensor performance [22]. So, before every measurement, a command to reset the zero level is sent to the sensor to remove possible offsets. Detailed analysis on the effects of the factors which can affect the force-torque measurements is provided by [23].

Camera Calibration
The vision system adopted is a 2D monochrome camera that can perform fast and accurate inspections on a wide range of mechanical components. Once a picture has been acquired, it is possible to extract coordinates and angles of several elements in its Field Of View (FOV). Through the camera software, these values are then used to compute the actual coordinates of the waypoints on the servo-actuator, which are then stored inside a database. However, the raw data provided by the vision system are in pixels, while the robot operates according to the metric system. The conversion is achieved by using the checkerboard sheet, reported in Figure 7b, through which the camera is calibrated. This calibration step is required for all the distances between the sensor and the object of interest on the servo-actuator. The results of all the calibration procedures are recorded inside the camera software for later use. When the Central Computer commands the camera to take a picture to locate the exact location of specific points on the faulty unit, it provides the information about which pixels-to-meters mapping to use, leading to a proper conversion.
Moreover, to minimize the fisheye effect, it is crucial to place the L-shaped pattern in the checkerboard, called fiducial, and the objects on the EHSA to be captured in the center of the camera's field of view. Otherwise, the image distortion could negatively affect the pixels-to-meters conversion, leading to erroneous waypoints coordinates.

Illumination
For the proper functioning of the computer vision, illumination must be taken into account. Since the environmental conditions of the robot workspace can change in time or with the application, the camera has been equipped with a blue internal illumination system and a bandpass filter. This also reduces the image saturation and the high reflection rate of the different metal items to be detected on the servo-actuator, such as screws or grooves. In so doing, the camera better detects the parts illuminated by its own light only, and the coordinates of the waypoints are properly updated. Moreover, since each screw could have a different level of enlightenment, the exposure time and focus setting of each picture have been experimentally determined to obtain a good quality of the image. The exposure time has been varied, according to the environmental enlightenment and the reflection properties of the target object, within the range of 0.6 and 1.5 ms.

Communication-Related Challenges
Due to the complexity of the tasks, and to assure that all the commanded actions are correctly executed by the robot, asynchronous communication between the Central Computer, the UR10, and the measurement system has been established. The control algorithm has been designed to avoid queues by waiting for the current command to be completed before sending a new one. This approach allows the Central Computer to effectively control two systems (the collaborative robot and the hydraulic test bench) which have entirely different dynamics. This control strategy assures that the correct sequence of actions is respected, and it avoids the robot continuing to work if a specific task has failed, minimizing time loss and the risk of damaging itself or the servo-actuator.

Automatic Adjustments on an EHSA
The most complex task to command to the robot during the maintenance of an EHSA is an adjustment. Since each unit has a different load history and health status, each repair operation is different from another. In so doing, hard-coding an adjustment is impossible since it is not known, a priori, if this procedure is necessary or not and, if yes, in which direction, and how much, to regulate a specific component of the faulty unit. To do so, it has been decided to structure the robot program with a series of functions, recalled by the macro-sequencer, whose inputs depend on the signals coming from the IMS. The control algorithm has been designed to adapt itself according to the values acquired through the measurement system, and its working principle is schematized in Figure 9. effectively control two systems (the collaborative robot and the hydraulic test bench) which have entirely different dynamics. This control strategy assures that the correct sequence of actions is respected, and it avoids the robot continuing to work if a specific task has failed, minimizing time loss and the risk of damaging itself or the servo-actuator.

Automatic Adjustments on an EHSA
The most complex task to command to the robot during the maintenance of an EHSA is an adjustment. Since each unit has a different load history and health status, each repair operation is different from another. In so doing, hard-coding an adjustment is impossible since it is not known, a priori, if this procedure is necessary or not and, if yes, in which direction, and how much, to regulate a specific component of the faulty unit. To do so, it has been decided to structure the robot program with a series of functions, recalled by the macro-sequencer, whose inputs depend on the signals coming from the IMS. The control algorithm has been designed to adapt itself according to the values acquired through the measurement system, and its working principle is schematized in Figure 9. To perform an adjustment, a specific movement, such as the rotation of the screwdriver (Rott), is commanded to the robot. However, the magnitude and the direction of such rotation is not preprogrammed, but calculated using a proportional control logic. So, the Central Computer would command a higher rotation if the actual measurement (Xt) is further away from its target (XTARGET), while more refined regulations are performed when the actual value is closer to the desired one. The gain adopted for each task has been defined through an experimental campaign to obtain a fast adjustment but, at the same time, avoid any overshoot. On the other hand, the rotation direction is defined by comparing the previous (Xt−1) and the actual (Xt) measures with the target value. If, as reported in Figure 5b for the trail rotation, the controlled variable moves further away from its target (|Xt−XTARGET|>|Xt−1−XTARGET|), the direction is reversed. This is done by getting the sign of the previous rotation commanded to the robot (sign(Rott−1)), and by changing it only in the case the previous command led the actual value of X to be further away from the desired one.
As an example, the adjustment procedure related to the Rotary Variable Differential Transformer (RVDT), used to measure the servo-actuator ram position, is analyzed. In Figure 10a, it is reported a view of the sensor and the three safety screws that have to be loosened to regulate the RVDT orientation according to the value of the difference between the voltages of its secondary coils (ΔU). As already mentioned, since the tools mounted on the robot are prototypes, there could be a certain amount of backlash between them and the EHSA components. For example, the one between the RVDT plate and the wrench, estimated to be around 5°, is schematized in Figure 10b. This must be considered To perform an adjustment, a specific movement, such as the rotation of the screwdriver (Rot t ), is commanded to the robot. However, the magnitude and the direction of such rotation is not preprogrammed, but calculated using a proportional control logic. So, the Central Computer would command a higher rotation if the actual measurement (X t ) is further away from its target (X TARGET ), while more refined regulations are performed when the actual value is closer to the desired one. The gain adopted for each task has been defined through an experimental campaign to obtain a fast adjustment but, at the same time, avoid any overshoot. On the other hand, the rotation direction is defined by comparing the previous (X t−1 ) and the actual (X t ) measures with the target value. If, as reported in Figure 5b for the trail rotation, the controlled variable moves further away from its target (|X t− X TARGET | > |X t−1− X TARGET |), the direction is reversed. This is done by getting the sign of the previous rotation commanded to the robot (sign(Rot t−1 )), and by changing it only in the case the previous command led the actual value of X to be further away from the desired one.
As an example, the adjustment procedure related to the Rotary Variable Differential Transformer (RVDT), used to measure the servo-actuator ram position, is analyzed. In Figure 10a, it is reported a view of the sensor and the three safety screws that have to be loosened to regulate the RVDT orientation according to the value of the difference between the voltages of its secondary coils (∆U). As already mentioned, since the tools mounted on the robot are prototypes, there could be a certain amount of backlash between them and the EHSA components. For example, the one between the RVDT plate and the wrench, estimated to be around 5 • , is schematized in Figure 10b. This must be considered when the RVDT rotation direction has to be reversed since there would be a delay between the movement of the robot arm and the rotation of the sensor, similar to the one reported in Figure 5b. Since the adjustment curve does not add any significant information, the time series is not reported. when the RVDT rotation direction has to be reversed since there would be a delay between the movement of the robot arm and the rotation of the sensor, similar to the one reported in Figure 5b. Since the adjustment curve does not add any significant information, the time series is not reported. A critical aspect of this adjustment is related to the relative position between the robot and the servo-actuator. The RVDT is located further away than the other areas of the unit, with respect to the work cart on which the UR10 is mounted. This requires the industrial manipulator to be almost fully extended, leading to a reduced accuracy of the positioning of the TCP, which could negatively affect the correct insertion of the screwdriver inside the screws.
In order to validate the automatic adjustment procedure, an experimental campaign is ongoing and the first results, related to the regulation of the RVDT of three servoactuators, are reported in Figure 11. The repeatability of the proposed approach has been verified by testing each unit three times. It can be noticed that, in all the tests carried out in the experimental campaign, A critical aspect of this adjustment is related to the relative position between the robot and the servo-actuator. The RVDT is located further away than the other areas of the unit, with respect to the work cart on which the UR10 is mounted. This requires the industrial manipulator to be almost fully extended, leading to a reduced accuracy of the positioning of the TCP, which could negatively affect the correct insertion of the screwdriver inside the screws.
In order to validate the automatic adjustment procedure, an experimental campaign is ongoing and the first results, related to the regulation of the RVDT of three servo-actuators, are reported in Figure 11. when the RVDT rotation direction has to be reversed since there would be a delay between the movement of the robot arm and the rotation of the sensor, similar to the one reported in Figure 5b. Since the adjustment curve does not add any significant information, the time series is not reported. A critical aspect of this adjustment is related to the relative position between the robot and the servo-actuator. The RVDT is located further away than the other areas of the unit, with respect to the work cart on which the UR10 is mounted. This requires the industrial manipulator to be almost fully extended, leading to a reduced accuracy of the positioning of the TCP, which could negatively affect the correct insertion of the screwdriver inside the screws.
In order to validate the automatic adjustment procedure, an experimental campaign is ongoing and the first results, related to the regulation of the RVDT of three servoactuators, are reported in Figure 11. The repeatability of the proposed approach has been verified by testing each unit three times. It can be noticed that, in all the tests carried out in the experimental campaign, Figure 11. Results of the RVDT adjustments of three servo-actuators each tested three times.
The repeatability of the proposed approach has been verified by testing each unit three times. It can be noticed that, in all the tests carried out in the experimental campaign, the adjustment was always successful. In particular, for units A and B, the final values obtained are sufficiently far from the acceptability limits. On the contrary, the final voltages obtained on unit C are closer to the boundaries foreseen by the maintenance manual, probably because of the lower stability of the RVDT.

Advantages and Disadvantages of the Proposed Application
Since each servo-actuator must be repaired according to precise instructions reported on its maintenance manual, the tasks commanded to the robot are very similar to the ones currently performed by the technicians in the test field. The goal of a partial automation of the repair process is to increase the operators' safety and to acquire more data to be used, together with the ones obtained with the HyDiag entry and exit tests, for health features extraction. With respect to standard manual procedures, the economic advantage of this approach does not rely on repairing the single faulty unit with a robot, but on the better estimate of its operating conditions. This leads to a better fault detection, a more reliable maintenance of EHSAs, and a decrease in the number of times a servo-actuator must be dismounted from the aircraft and repaired. By detecting the root cause of a failure, the repair operations would be more efficient since the technician would know exactly which component must be replaced. In addition, the implementation of prognostics algorithms would help to identify elements of the unit that, even if still in nominal conditions, are likely to fail soon. Replacing these components when the EHSA is already dismounted from the aircraft would increase the Mean Time Between Failures (MTBF), eventually preventing the occurrence of unanticipated failures.
The research campaign proved the feasibility of performing complex tasks, such as repairing servo-actuators used to regulate the position of primary flight control surfaces, with collaborative manipulators. The preliminary results suggest that, by using an industrial manipulator, it is possible to have a more accurate adjustment of the servo-actuator. The control algorithm is designed to bring a desired quantity within a specific threshold and to reach the optimal target value. This is often a critical aspect in manual operations, due to the high correlation between the control quantity and the adjustment in the rotation of the regulation mechanism. As an example, in the case study of the RVDT sensor, the difference between the voltages of its secondary coils must be within the range of ±15 mV. However, since the dependency of the ∆U voltage with the orientation of the RVDT has been estimated to be about 120 mV/ • , to bring ∆U as close as possible to the center of the acceptability interval would require exact actions. Using the proportional control algorithm described in Figure 9, this is possible with a robot, while it requires high efforts to a technician.
On the other hand, these components are not subjected to scheduled maintenance, but they are only repaired when a failure occurs, and the root cause is often unknown. Moreover, especially for old units, it can happen that a safety screw is stuck and so it cannot be loosened by the robot, compromising its adjustment. Moreover, the EHSA has to be manually prepared by the operator before launching the automatic adjustment. This process comprehends tasks such as cutting the safety-wires, which assures the screws not to be loosened, and mounting the unit on the fixture.

Conclusions
The present paper proves that a robot can be effectively used to execute complex tasks and not to be limited to repetitive and straightforward applications. The proposed work is part of a larger project of Politecnico di Torino and Lufthansa Technik AG, focused on the development of an automatic, flexible, and reliable test and maintenance procedure for electro-hydraulic servo-actuators for diagnostics and prognostics purposes. A collaborative robot, equipped with a force-torque sensor, a 2D camera, and customized tools has been used to extract data from the EHSA, that would otherwise be impossible to obtain through manual maintenance procedures currently adopted in LHT facilities. These values are properly combined to define health features able to better describe the overhaul status of the EHSA, leading to optimized maintenance of the unit. Preliminary results showed the effectiveness, and robustness of the proposed approach on devices not designed for automatic maintenance and with hard-to-access sub-components.
The next steps of the research will be focused on running an extensive experimental campaign on different servo-actuators in order to validate and improve the automatic adjustment procedures. Through this study, the time required to repair a faulty servoactuator will be reduced by optimizing the robot movements, the control algorithm logic, and by designing more precise and effective tools to be mounted on the robot arm.