Fault Diagnosis and Reconfigurable Control for Commercial Aircraft with Multiple Faults and Actuator Saturation

Abstract

Active fault-tolerant control systems perform fault diagnosis and reconfigurable control. There is a bidirectional uncertainty between them, and an integrated scheme is proposed here to account for that. The system considers both actuator and sensor faults, as well as the external disturbance. The diagnostic module is designed using an unknown input observer, and the controller is constructed on the basis of an adaptive method. The integrated strategy is presented, and the stability of the overall system is analyzed. Moreover, different kinds of anti-windup techniques are utilized to modify the original controllers, because of the different controller structures. A simulation of the integrated anti-windup fault-tolerant control method is demonstrated using a numerical model of Boeing 747. The results show that it can guarantee the stability of the post-fault aircraft and increase the control performance for the overall faulty system.

1. Introduction

The electrical flight control system (EFCS) is the industrial standard for commercial aircraft and has been widely used in the aviation sector, because it can improve the safety and performance of aircraft [1]. Following the development of commercial aircraft, EFCSs are becoming more complex than before and the performance requirements (such as safety, reliability, maintainability, etc.) have increased [2]. In response to this, fault-tolerant control (FTC) has gained importance because it can deal with system faults automatically, make the system stable, and regain the performance of faulty aircraft. Furthermore, fault signal monitoring has improved so that the integration of estimation and reconfiguration has attracted particular interest during the last decade [3].

FTC consists of passive fault-tolerant control (PFTC) and active fault-tolerant control (AFTC) [4]. In PFTC, a class of presumed faults are tackled by the designed controller, so that it is a special kind of robust control. The structure of the controller is simple because there is no need to add a diagnostic module, but the fault-tolerant capability is limited [5,6]. Thus, recently the focus has been on AFTC because of its outstanding fault handling capability [7,8,9,10,11,12,13]. The main feature of AFTC is that it contains both estimation and reconfiguration. In most of the literature works, these two modules are designed independently in the FTC system, and the estimation is only used for monitoring or diagnosis. Moreover, the capability of it is often overrated, and very few articles concentrate on the integrated scheme of fault-tolerant controller design.

To design an active fault-tolerant controller capable of addressing the mentioned difficulties, it is necessary to develop an integrated design method, with no need for a prior knowledge of faults. There are few papers about the integration of estimator and controller. In [14], a robust observer was presented to obtain system states and actuator faults. The linear matrix inequality (LMI) technique was utilized to reconfigure the controller. A disturbance observer was proposed to obtain fault signals in [15]. Based on the designed estimator, a controller is reconfigured using a modified fuzzy dynamic output feedback method to address faults (actuator or sensor) and mismatched input disturbances. The authors of [16] presented an integrated strategy of AFTC where the PD extended state observer was designed to estimate system states and actuator/sensor faults, and the control law was designed using a modified LMI-based $L_2$ robustness procedure. A reduced-order observer was to deal with the problem of fault estimation and a reconfigurable controller was built for nonlinear discrete-time systems in [17]. In the existing integrated strategy, adaptive control and robust control were used, and the theorems are mathematically correct. However, there are several weaknesses when applying this in EFCSs, because of the many assumptions about the rank of the system matrices.

Furthermore, the phenomenon of actuator saturation is important in the integrated reconfigurable strategy, because aircraft actuators are physically limited and faults will decrease their capability. Many works have focused on the combination of anti-windup and FTC [18,19,20,21,22,23,24]. The common design process is designing an original reconfigurable controller and modifying it using different anti-windup methods. In the cited literature, the magnitude saturation has been well addressed, however the rate limiting (another important constraint) has been ignored. Moreover, the integrated design strategies which can tackle the pairing between the estimation and reconfiguration have not been used, so that the real-time reconfigurable performance can not be guaranteed.

With respect to the mentioned problems, the contributions of this paper mainly include the following two points. First, different from the works in [7,8,9,10,11,12,13], an integrated reconfigurable control strategy is presented to cancel the pairing between estimator and controller, and to improve the performance of the controller. Moreover, compared with the works in [14,15,16,17], both actuator and sensor faults are considered in the design of integrated fault-tolerant control. Second, two common actuator constraints (magnitude and rate) are considered to design the anti-windup FTC scheme using different techniques. In contrast with the proposed anti-windup reconfigurable controller, most of the existing anti-windup schemes can just address the magnitude saturation [18,19,20,21,22,23,24].

The rest of this paper is organized as follows. Section 2 gives the normal/post-fault aircraft modeling. In Section 3, the integrated strategy and their anti-windup modifications are given. In Section 4, the simulation results and analyses are presented, and Section 5 reports conclusions of this paper.

The following notations will be used throughout the paper: I signifies an identity matrix, $\mathrm{diag}\left\{·\right\}$ signifies the diagonal matrix, and ${\left(·\right)}^{†}$ signifies the pseudo-inverse.

2. System Modeling

It is necessary to construct an appropriate aircraft model for the integrated design. The model of an aircraft during normal operation (without faults and actuator constraints) is described as

$$\left\{\begin{array}{c}\dot{x}=Ax+Bu\hfill \\ y=Cx\hfill \end{array}\right.$$

(1)

where $x={\left[\begin{array}{cccc}{u}_a& w_a& q& \theta \end{array}\right]}^T$ denotes the system state, in which $u_a$ is the forward velocity, $w_a$ is the vertical velocity, q is the pitch angle rate, $\theta$ is the pitch angle, and $y=\theta$ denotes the system output, and $u={\left[\begin{array}{cccc}{\delta }_{e1}& {\delta }_{e2}& {\delta }_{e3}& {\delta }_{e4}\end{array}\right]}^T$ denotes the system input, in which ${\delta }_{ei}$ is the perturbation from trim in the ith elevator. A, B, and C are the system matrix, the input matrix, and the output matrix, respectively. The detailed expressions are shown in Appendix A.

If the aircraft operates in the presence of actuator and sensor faults, system (1) can be rewritten under the fictitious multiplicative fault formulation as

$$\left\{\begin{array}{c}\dot{x}=Ax+B{u}_c+B{f}_m+B{f}_a+d\hfill \\ y_o=Cx+f_s\hfill \end{array}\right.$$

(2)

where $u_c$ denotes the controller outputs, $f_m=\overline{L}{u}_c=(L-I)u_c$ denotes the fictitious multiplicative actuator fault value, $L=\mathrm{diag}\left\{l_1,l_2,l_3,l_4\right\}$ is an indication matrix, $l_i\in [0,1]$ is the effectiveness factor, $f_a$ denotes the additive actuator fault value, d denotes the external disturbance, $y_o$ denotes the measured output, and $f_s$ denotes the sensor fault value. The detailed modeling and analysis for faults can be found in reference [25].

Assumption 1

([5]). All of the faults and disturbance in (2) are norm-bounded, and the first time derivatives of faults are norm-bounded, too.

Considering Assumption 1, we can augment the faulty system (2) into

$$\left\{\begin{array}{c}{\dot{x}}_a=A_a{x}_a+B_a{u}_c+d_a\hfill \\ y_o=C_a{x}_a\hfill \end{array}\right.$$

(3)

where $x_a=\left[\begin{array}{c}x\\ f_m\\ f_a\\ f_s\end{array}\right]$, $d_a=\left[\begin{array}{c}d\\ {\dot{f}}_m\\ {\dot{f}}_a\\ {\dot{f}}_s\end{array}\right]$, $A_a=\left[\begin{array}{cccc}A& B& B& 0\\ 0& 0& 0& 0\\ 0& 0& 0& 0\\ 0& 0& 0& 0\end{array}\right]$, $B_a=\left[\begin{array}{c}B\\ 0\\ 0\\ 0\end{array}\right]$, $C_a=\left[\begin{array}{cccc}C& 0& 0& I\end{array}\right]$.

3. Integrated Strategy and Anti-Windup Modification

In the AFTC strategy, there is a pairing between the estimation and reconfiguration, that is, the controller needs fault information provided by the estimator, and the estimator needs to know which strategy is available for reconfiguration [5]. Moreover, the actuator saturation is the most common nonlinearity in a control system and affects its stability [26]. Thus, the integrated fault-tolerant control scheme and its anti-windup modification are important for EFCS because they guarantee the aircraft to track the command signal in the presence of actuator faults and saturations. Inspired by this problem, a novel integrated anti-windup method for linear systems is presented.

3.1. Integrated Reconfigurable Controller Design

An integrated scheme is utilized to design the reconfigurable controller in this subsection. In the augmented faulty model (3), the unknown fault values $f_m$, $f_a$, and $f_s$ are contained in $x_a$ and are obtained by using the diagnostic module. The design procedure of the integrated strategy contains three steps: (1) Design a reconfigurable controller to control the aircraft to track the desired command, (2) design a fault estimator to estimate the states of the augment faulty system, and (3) calculate the undecided parameters of the controller and estimator by analyzing the stability of the overall system.

Augment the healthy system (1) into

$$\left\{\begin{array}{c}{\dot{x}}_n=A_n{x}_n+B_{n}u\hfill \\ y=C_n{x}_n\hfill \end{array}\right.$$

(4)

where $x_n=\left[\begin{array}{c}x\\ 0\\ 0\\ 0\end{array}\right]$, $A_n=\left[\begin{array}{cccc}A& 0& 0& 0\\ 0& 0& 0& 0\\ 0& 0& 0& 0\\ 0& 0& 0& 0\end{array}\right]$, $B_n=\left[\begin{array}{c}B\\ 0\\ 0\\ 0\end{array}\right]$, $C_n=\left[\begin{array}{cccc}C& 0& 0& 0\end{array}\right]$.

The reference control law is chosen as

$$u=G_x{x}_n+G_g{x}_g$$

(5)

where ${\dot{x}}_g=r-y$ is the controller state vector, r is the command signal, and $G_x$ and $G_g$ are control gains.

Thus, the reference model (as a command generator) represented by the augmented system (4) and the reference controller (5) is obtained as

$$\left\{\begin{array}{c}{\dot{x}}_m=A_m{x}_m+B_{m}r\hfill \\ y_m=C_m{x}_m\hfill \end{array}\right.$$

(6)

where $x_m=\left[\begin{array}{c}{x}_n\\ x_g\end{array}\right]$, $y_m=y$, $A_m=\left[\begin{array}{cc}{A}_n+B_n{G}_x& B_n{G}_g\\ -C_n& 0\end{array}\right]$, $B_m=\left[\begin{array}{c}0\\ I\end{array}\right]$, $C_m=\left[\begin{array}{cc}{C}_n& 0\end{array}\right]$.

The system dynamics is completely controllable by calculating the controllability matrix, and the detailed data are given in the Appendix A. An optimal control technique (such as LQR) is used here to adjust the reference controller gains. The detailed design procedure can be found in [7], and thus it is omitted here.

Moreover, the system dynamics can be derived from (3) by introducing a new control variable ${\dot{\overline{x}}}_g=r-y_o$ as

$$\left\{\begin{array}{c}{\dot{x}}_p=A_p{x}_p+B_p{u}_p+d_a+B_{m}r\hfill \\ y_p=C_p{x}_p\hfill \end{array}\right.$$

(7)

where $x_p=\left[\begin{array}{c}{x}_a\\ {\overline{x}}_g\end{array}\right]$, $u_p=u_c$, $y_p=y_o$, $A_p=\left[\begin{array}{cc}{A}_a& 0\\ -C_a& 0\end{array}\right]$, $B_p=\left[\begin{array}{c}{B}_a\\ 0\end{array}\right]$, $C_p=\left[\begin{array}{cc}{C}_a& 0\end{array}\right]$.

Defining the error between the reference model state and the system state as $e_{mp}=x_m-x_p$, a reconfigurable control law is chosen as

$$u_p=G_e{e}_{mp}+G_m{x}_m$$

(8)

Substituting the reference model (6), the system (7), and the control law (8) into the error expression yields

$$\begin{array}{cc}\hfill {\dot{e}}_{mp}& =(A_p-B_p{G}_e)e_{mp}+(A_m-A_p-B_p{G}_m)x_m+{\xi }_{mp}\hfill \end{array}$$

(9)

where ${\xi }_{mp}=-d_a$.

$G_e$ and $G_m$ are control gains, and are designed by analyzing the stability of the post-fault aircraft model, that is, ensuring ${\dot{e}}_{mp}=(A_p-B_p{G}_e)e_{mp}+{\xi }_{mp}$ where $(A_p-B_p{G}_e)$ is a Hurwitz matrix. The term ${\xi }_{mp}$ represents the errors between the faulty aircraft and the reference model, and it affects the control performance. Furthermore, the control gains are calculated by an adaptive integrated strategy to address the unknown external disturbance and system parameter errors.

In the design procedure of the fault estimator, an observer is described as

$$\left\{\begin{array}{c}{\dot{x}}_o=M{x}_o+G{u}_c+N{y}_o\hfill \\ {\widehat{x}}_a=x_o+H{y}_o\hfill \end{array}\right.$$

(10)

where $x_o$ is the observer state vector and ${\widehat{x}}_a$ is the estimate of $x_a$. The remaining undefined matrices are designed observer gain matrices.

The design objective is to make sure that the error $e_{ao}=x_a-{\widehat{x}}_a$ between the faulty system state $x_a$ and its estimate ${\widehat{x}}_a$ converges to zero. Substituting (3) and (10) into ${\dot{e}}_{ao}={\dot{x}}_a-{\dot{\widehat{x}}}_a$ yields

$$\begin{array}{cc}\hfill {\dot{e}}_{ao}& =(A_a-H{C}_a{A}_a-N_1{C}_a)e_{ao}+[(A_a-H{C}_a{A}_a-N_1{C}_a)-M]x_o\hfill \\ \hfill & \phantom{=}+[(A_a-H{C}_a{A}_a-N_1{C}_a)H-N_2]y_o+(B_a-H{C}_a{B}_a-G)u_c+{\xi }_{ao}\hfill \end{array}$$

(11)

where $N=N_1+N_2$, ${\xi }_{ao}=(I-H{C}_a)d_a$.

Remark 1.

Based on the works in [27,28], the rank condition for the designed observer (10) is $rank\left(C_a{D}_a\right)=rank\left(C_a\right)$, where $D_a$ is the coefficient matrix of $d_a$ in (3). As $D_a$ is chosen as an identity matrix I in this paper, the rank condition is satisfied.

The observer matrices are designed by analyzing the stability of the system, that is, ensuring ${\dot{e}}_{ao}=M{e}_{ao}+{\xi }_{ao}$, where M is Hurwitz. The term ${\xi }_{ao}$ represents a coupling between estimator and controller, and it affects the estimation performance. The integrated scheme is shown in Figure 1. The following theorem is proposed to guarantee the stability of the overall system and to calculate the corresponding adaptive adjustment laws.

Theorem 1.

The integrated system consisting of (3), (8) and (10) is asymptotically stable if the gains of controller and estimator hold so that

$$\left\{\begin{array}{cc}\hfill & G_e\left(t\right)=\int {\left(e_{mp}\left(\tau \right)e_{mp}^T\left(\tau \right)P_{mp}{B}_p{\Xi }_1\right)}^{T}dt+G_e\left(0\right)\hfill \\ \hfill & G_m\left(t\right)=\int {\left(x_m\left(\tau \right)e_{mp}^T\left(\tau \right)P_{mp}{B}_p{\Xi }_2\right)}^{T}dt+G_m\left(0\right)\hfill \\ \hfill & H\left(t\right)=-P_{ao}^{-1}{\left(e_{ao}^T\left(t\right)\right)}^{-1}{e}_{mp}^T\left(t\right)P_{mp}{C}_a^{-1}+H\left(0\right)\hfill \end{array}\right.$$

(12)

where $P_{mp}$, $P_{ao}$, ${\Xi }_1$, and ${\Xi }_2$ are symmetric positive-definite matrices.

Proof. 

Rewrite the controller error dynamic system as

$$\begin{array}{cc}\hfill {\dot{e}}_{mp}& ={\overline{A}}_p{e}_{mp}-B_p{\Gamma }_e\left(t\right)e_{mp}-B_p{\Gamma }_m\left(t\right)x_m+{\xi }_{mp}\hfill \end{array}$$

(13)

where ${\overline{A}}_p$ is a Hurwitz matrix, ${\Gamma }_e=G_e\left(t\right)-G_e\left(0\right)$, and ${\Gamma }_m=G_m\left(t\right)-G_m\left(0\right)$.

A Lyapunov candidate function is chosen as

$$\begin{array}{cc}\hfill V_I& =\frac{1}{2}{e}_I^T{P}_I{e}_I+\frac{1}{2}tr\left({\Gamma }_e^T{\Xi }_1^{-1}{\Gamma }_e+{\Gamma }_m^T{\Xi }_2^{-1}{\Gamma }_m\right)\hfill \end{array}$$

(14)

where $e_I={\left[\begin{array}{cc}{e}_{mp}& e_{ao}\end{array}\right]}^T$, $P_I=\mathrm{diag}\left\{P_{mp},P_{ao}\right\}$.

$$\begin{array}{cc}\hfill {\dot{V}}_I& =e_I^T{P}_I{\dot{e}}_I+tr\left({\dot{G}}_e^T\left(t\right){\Xi }_1^{-1}{\Gamma }_e+{\dot{G}}_m^T\left(t\right){\Xi }_2^{-1}{\Gamma }_m\right)\hfill \\ \hfill & =e_{mp}^T{P}_{mp}{\overline{A}}_p{e}_{mp}-e_{mp}^T{P}_{mp}{B}_p{\Gamma }_e\left(t\right)e_{mp}-e_{mp}^T{P}_{mp}{B}_p{\Gamma }_m\left(t\right)x_m-e_{mp}^T{P}_{mp}{d}_a\hfill \\ \hfill & \phantom{=}+e_{ao}^T{P}_{ao}M{e}_{po}-e_{ao}^T{P}_{ao}{\Gamma }_o\left(t\right)C_a{d}_a+tr\left({\dot{G}}_e^T\left(t\right){\Xi }_1^{-1}{\Gamma }_e+{\dot{G}}_m^T\left(t\right){\Xi }_2^{-1}{\Gamma }_m\right)\hfill \end{array}$$

(15)

Setting $-e_{mp}^T{P}_{mp}{B}_p{\Gamma }_e\left(t\right)e_{mp}+tr\left({\dot{G}}_e^T\left(t\right){\Xi }_1^{-1}{\Gamma }_e\right)=0$ and $-e_{mp}^T{P}_{mp}{B}_p{\Gamma }_m\left(t\right)x_m+$$tr\left({\dot{G}}_m^T\left(t\right){\Xi }_2^{-1}{\Gamma }_m\right)=0$ so that $tr\left(-e_{mp}{e}_{mp}^T{P}_{mp}{B}_p{\Gamma }_e\left(t\right)\right)=tr\left({\dot{G}}_e^T\left(t\right){\Xi }_1^{-1}{\Gamma }_e\right)$ and $tr\left(x_m{e}_{mp}^T{P}_{mp}{B}_p{\Gamma }_m\left(t\right)\right)=tr\left({\dot{G}}_m^T\left(t\right){\Xi }_2^{-1}{\Gamma }_m\right)$, the first and second items of (12) are obtained. Moreover, setting $-e_{mp}^T{P}_{mp}{d}_a-e_{ao}^T{P}_{ao}{\Gamma }_o\left(t\right)C_a{d}_a=0$ yields $H\left(t\right)=-P_{ao}^{-1}{\left(e_{ao}^T\left(t\right)\right)}^{-1}{e}_{mp}^T\left(t\right)$$P_{mp}{C}_a^{-1}+H\left(0\right)$. Thus, the rest of (15) is transformed into

$$\begin{array}{cc}\hfill {\dot{V}}_I& =e_{mp}^T{P}_{mp}{\overline{A}}_p{e}_{mp}+e_{ao}^T{P}_{ao}M{e}_{ao}\hfill \\ \hfill & =\frac{1}{2}{e}_I^T\left(A_I^T{P}_I+P_I{A}_I\right)e_I\hfill \end{array}$$

(16)

where $A_I=\mathrm{diag}\left\{{\overline{A}}_p,M\right\}$.

As $A_I$ is Hurwitz, it can be concluded that $P_I$ is the unique solution of the following Lyapunov matrix equation:

$$A_I^T{P}_I+P_I{A}_I=-Q_I$$

(17)

where $Q_I$ is any symmetric positive-definite matrix.

Considering (14) and (16), $V_I>0$ and ${\dot{V}}_I<0$ hold. This completes the proof of Theorem 1. □

Remark 2.

The errors ${\xi }_{mp}$ and ${\xi }_{ao}$ are always nonzero in the application so that it is necessary to integrate the estimator and the controller. The adaptive laws cancel the adverse effect of the coupling and improve the capability of the reconfigurable control.

3.2. Anti-Windup Mechanisms

Actuator constraints consist of rate and magnitude saturation. In this paper, a modified software rate limiter ($S_{RL}$) is utilized to address the rate constraint problem. As shown in Figure 2, the plants “$P_n$” and “$P_a$” consist of actual aircraft models, “$G_{ult}$” represents the ultimate reference controller (the original controller with/without a compensator), “$G_{ult}^{*}$” represents the ultimate reconfigurable controller, “M” is the reference model, and the actuator “A” is position-controlled and is subject to saturation of physical systems (i.e., they only provide a certain amount of force or moment). In this scheme, the reference controller is modified by $S_{RL}$, and a signal $d_b\left(t\right)$ has taken the place of the limiter in its quasilinear part. The reconfigurable controller can also be modified by $S_{RL}$, and another signal $d_f\left(t\right)$ has taken the place of the limiter in the post-fault model. If the physical limitations of the actuators are not considered in the design procedure, the control performance will not be satisfactory and could possibly even lead to disastrous consequences. It is difficult to design integrated anti-windup controllers because of the different controller structures. The type of $D_b\left(s\right)$ (the Laplace transform of $d_b\left(t\right)$) and $D_f\left(s\right)$ (the Laplace transform of $d_f\left(t\right)$) are denoted as $T^{D_b}$ and $T^{D_f}$, respectively [29].

Assumption 2

([30]). Whether actuators work in saturation or not, the normal and post-fault aircraft with $S_{RL}$ are stable, and two feasible conditions are $T^{D_b}\le 0$ and $T^{D_f}\le 0$.

Theorem 2.

The stable system with rate limiters will exhibit asymptotic stability in response to the injected signals $d_b\left(t\right)$ and $d_f\left(t\right)$, if the types of ultimate controllers are more than zero.

Proof. 

The block diagram algebra for the normal system can be got from Figure 2 as

$$\begin{array}{cc}\hfill E_b& =R-Y=R-\frac{1}{s}{P}_n{G}_{ult}{E}_b-\frac{1}{s}{P}_n{D}_b\hfill \\ \hfill & =\frac{R}{I+P_n{G}_{ult}}-\frac{1}{s}\frac{P_n{D}_b}{I+P_n{G}_{ult}}\hfill \end{array}$$

(18)

where $E_b$ is the error, R is the command signal, and Y is the system output. The majuscules denote the Laplace transform of their corresponding time functions. The actuator “A” is ignored in this algorithm, because the linear part of “A” is insignificant and the rate constraint in it can be canceled by $S_{RL}$. The detailed actuator model is shown in Appendix A.

Applying the final value theorem, it can be obtained that

$$e_b(\infty )=\underset{s\to 0}{lim}s{E}_b=\underset{s\to 0}{lim}\left(\frac{sR}{I+P_n{G}_{ult}}-\frac{P_n{D}_b}{I+P_n{G}_{ult}}\right)$$

(19)

As $s{E}_b=\frac{sR}{I+P_n{G}_{ult}}-\frac{P_n{D}_b}{I+P_n{G}_{ult}}$, the type of the first item is $T^{1b}=T^R-1-T^{P_n}-T^{G_{ult}}$ and the type of the second item is $T^{2b}=T^{D_b}-T^{G_{ult}}$. The stable normal system with rate limiters is going to achieve asymptotic stability if $T^{1b}<0$ and $T^{2b}<0$, i.e., $e_b(\infty )=0$. Considering Assumption 2, $T^{G_{ult}}>0$ should hold.

Furthermore, the block diagram algebra for the faulty model is shown as follows:

$$\begin{array}{cc}\hfill E_{mp}& =X_m-X_p\hfill \\ \hfill & =\frac{MR-P_1{G}_{m}MR-{\displaystyle \frac{1}{s}}{P}_1{D}_f-P_{2}D-P_{3}R}{I+P_1{G}_{ult}^{*}}\hfill \end{array}$$

(20)

where $P_1$, $P_2$, and $P_3$ denote the plant elements, respectively, and $G_{ult}^{*}$ is the ultimate expression of $G_e$. Other majuscules are the Laplace transforms of their corresponding signals.

Applying the final value theorem, it can be obtained from (20) that

$$s{E}_{mp}=\frac{sMR-s{P}_1{G}_{m}MR-P_1{D}_f-s{P}_{2}D-s{P}_{3}R}{I+P_1{G}_{ult}^{*}}$$

(21)

In a similar way, all the types of terms on the right-hand side of (21) should be less than zero. Thus, $T^{G_{ult}^{*}}>0$ should hold. This completes the proof of Theorem 2. □

Remark 3.

In this paper, $T^{G_{ult}}=1$ satisfies $T^{G_{ult}}>0$, so that it is not necessary to add a compensator to the original controller; however, $T^{G_e}=0$ does not satisfy $T^{G_{ult}^{*}}>0$, so that in this case the ultimate controller can be defined with a compensator as $G_{ult}^{*}=G_e\frac{s+G_r}{s}$.

Remark 4.

Based on the work in [30], the software rate limiters can provide enough stability margins for the linear design. Assumption of closed-loop stability is just the first step to analyze Theorem 2, so that the final value theorem can be utilized. We can use the asymptotic stability to derive a condition about the type of the injected signals and the type of controllers. The designed rate limiters and compensators may decrease the performance of the unconstrained system, but the performance of the constrained system is improved.

For the magnitude saturation problem, as the reference controller and reconfigurable controller have different block diagram architectures, different schemes should be used to modify these two controllers. An observer-based scheme is utilized to modify the reference controller to mitigate windup, as shown in Figure 3. The control signal will not reflect the plant if there is a mismatch between $\overline{u}$ and $u_r$, which is the reason causing windup. The modified reference controller is given as

$$\left\{\begin{array}{c}{u}_r=G_x{x}_n+G_g{x}_g+\int d_{b}dt\hfill \\ {\dot{x}}_g=r-C_n{x}_n+\left(G_b\overline{u}-G_b{G}_x{x}_n-G_b{G}_g{x}_g-G_b\int d_{b}dt\right)\hfill \\ \overline{u}=sat\left(u_r\right)\hfill \end{array}\right.$$

(22)

where $G_b$ is the designed gain matrix. The design task is choosing $G_b$ such that $-G_b{G}_g$ is Hurwitz. An effective design procedure is to analyze the difference between a system with actuator constraint and a system without it. The unconstrained normal system with state vector $z^u={\left[\begin{array}{cc}{x}_n^u& x_g^u\end{array}\right]}^T$ is shown as

$${\dot{z}}^u=\left[\begin{array}{cc}{A}_n+B_n{G}_x& B_n{G}_g\\ -C_n& 0\end{array}\right]z^u+\left[\begin{array}{c}{B}_n\int d_{b}dt\\ r\end{array}\right]$$

(23)

and the constrained normal system with state vector $z={\left[\begin{array}{cc}{x}_n& x_g\end{array}\right]}^T$ is shown as

$$\dot{z}=\left[\begin{array}{cc}{A}_n+B_n{G}_x& B_n{G}_g\\ -C_n& 0\end{array}\right]z+\left[\begin{array}{c}{B}_n\int d_{b}dt\\ r\end{array}\right]+\left[\begin{array}{c}{B}_n\\ G_b\end{array}\right](\overline{u}-u_r)$$

(24)

Finally, the mismatch between the two systems is shown as $\tilde{z}=z-z^u$. Subtracting (23) from (24), the mismatch system is shown as

$$\begin{array}{c}\hfill \dot{\tilde{z}}=\left[\begin{array}{cc}{A}_n+B_n{G}_x& B_n{G}_g\\ -C_n& 0\end{array}\right]\tilde{z}+\left[\begin{array}{c}{B}_n\\ G_b\end{array}\right](\overline{u}-u_r)=A_{mis}\tilde{z}+B_{mis}(\overline{u}-u_r)\end{array}$$

(25)

Assuming $A_{mis}$ can be decomposed as $S_{mis}{\Xi }_{mis}{S}_{mis}^{-1}$ and choosing $W_{mis}=\left[\begin{array}{cc}0& I\end{array}\right]S_{mis}^{-1}$, the gain $G_b$ is designed as

$$G_b=-W_{mis2}^{-1}{W}_{mis1}{B}_n$$

(26)

where $W_{mis2}$ is the last $x_g$ columns of $W_{mis}$, and $W_{mis1}$ is the remaining column of $W_{mis}$. The closed-loop system exhibits asymptotic stability.

Remark 5.

The observer-based approach is intuitively appealing as the concept of the observer is widely used [26]. Amplitude constraint is addressed by feeding back the error between $\overline{u}$ and $u_r$ to the reference controller, and it will not be modified when $\overline{u}=u_r$.

As shown in Figure 4, the anti-windup problem in the reconfigurable controller is tackled by using a modified conditioning technique. “O” represents the estimator, and “$G_p$” represents the reconfigurable controller consisting of a compensator and a software rate limiter. $x_m$ is chosen as the reference signal and the controller is described as

$$u_{cr}=G_e(x_m-x_p)+G_m{x}_m+\int d_{f}dt$$

(27)

In the conditioning technique, an auxiliary input $x_m^r$, which is called realizable reference, is chosen as a new reference signal to make sure that there is no difference between ${\overline{u}}_c$ and $u_{cr}$. The new controller is

$${\overline{u}}_c=G_e(x_m^r-x_p)+G_m{x}_m^r+\int d_{f}dt$$

(28)

Note that the actual reference signal $x_m$ does not appear in (28), so that an assumption on the present realizability (${\overline{u}}_c=u_{cr}$) of the control is held as

$$u_{cr}=G_e(x_m^r-x_p)+G_m{x}_m+\int d_{f}dt$$

(29)

The $x_m^r$ is calculated by subtracting (29) from (28) as

$$x_m^r=x_m+G_{ur}({\overline{u}}_c-u_{cr})$$

(30)

where $G_{ur}=G_m^{†}$ is the designed gain.

Remark 6.

In the modified conditioning technique case, the realizable reference $x_m^r$ removes the effect of the nonlinearity on the system input, so that the reconfigurable controller is “conditioned” back to the unconstrained mode as soon as it can.

4. Application Example

The integrated anti-windup scheme is simulated on a numerical model of Boeing 747, which is trimmed at straight and level flight. The external disturbance is defined as a uniform “1-cosine” vertical gust [31]. Two flight conditions are shown in

Table 1. Flight condition 1.

Parameter	Value
Aircraft Velocity	$V_T=0.5$ Ma
Flight Altitude	h = 20,000 ft
Gust Wavelength	$L_g=23.4$ m
Gust Velocity	$w_g=11.4$ m/s

and

Table 2. Flight condition 2.

Parameter	Value
Aircraft Velocity	$V_T=0.8$ Ma
Flight Altitude	h = 40,000 ft
Gust Wavelength	$L_g=47.9$ m
Gust Velocity	$w_g=12.8$ m/s

, respectively. The detailed data for this aircraft are obtained solely from a Boeing 747 simulator description (Boeing D6-30643) and are provided in the NASA report [32].

4.1. Anti-Windup FTC in Condition 1 at 0.5 Ma and 20,000 ft

In this condition, the reference command $r=5^{\circ }$ is a step signal given at 2 s, the elevator ${\delta }_{e2}$ is locked in $-5^{\circ }$, the surface deflection ${\delta }_{e3}$ loses $30\%$ effectiveness, the bias of the sensor is ${0.1}^{\circ }$, and all faults are given at the same time (0 s), that is, $l_2=0$, $f_{a2}=-5$, $l_3=0.7$, and $f_s=0.1$. The limits of magnitude and rate are $\pm {20}^{\circ }$ and $\pm {40}^{\circ }$/s, respectively.

Figure 5a shows the necessity of the FTC strategy because there is a significant decrease for control performance in the post-fault aircraft with LQR (red) than in the healthy aircraft with LQR (blue). In Figure 5b, however, the control performance of FTC in the post-fault aircraft (red) is nearly the same as the one of the LQR in the normal aircraft (blue). When there are magnitude and rate saturation modules in the actuators, as shown in Figure 6, the FTC method without anti-windup (red) will reduce the control performance or even make the system unstable. The anti-windup reconfigurable method is designed using a compensator (blue) to deal with the windup phenomenon and regains the performance of the post-fault aircraft. Figure 7 shows the estimates of actuator and sensor fault values. They are estimated accurately using the proposed estimator at about 5 s after occurrence. The faulty aircraft model with actuator saturation modules (magnitude and rate) is used in Figure 8. It compares the actuator deflections ($u_1$, $u_2$, $u_3$, $u_4$) and rates ($r_1$, $r_2$, $r_3$, $r_4$) between the original FTC method and the FTC with capability of anti-windup. The actuators with FTC meet their constraints so that the aircraft is unstable; on the contrary, the proposed anti-windup modifications mitigate the effects of saturation and guarantee the stability of the aircraft.

4.2. Anti-Windup FTC in Condition 2 at 0.8 Ma and 40,000 ft

A higher altitude and faster condition than before is considered to verify the effectiveness of the presented method, where $r=5^{\circ }$ is a step signal given at 2 s, ${\delta }_{e1}$ is locked in $5^{\circ }$, ${\delta }_{e4}$ loses $50\%$ effectiveness, and the bias of the sensor is $-{0.2}^{\circ }$. That is, $l_1=0$, $f_{a1}=5$, $l_4=0.5$, and $f_s=-0.2$. The limits of magnitude and rate are $\pm {20}^{\circ }$ and $\pm {40}^{\circ }$/s, respectively.

Figure 9 shows the pitch angles of the normal and faulty aircraft. From Figure 9a, it can be seen that the reduction of the control performance for the faulty aircraft with LQR (red) is more serious than the one in Figure 5a. However, FTC in the faulty system in Figure 9b (red) can also recover the control performance of the healthy system with LQR (blue). In Figure 10, we can get the same results as in Figure 6. Figure 11 shows the estimates of fault values. Figure 12 shows the actuator outputs of FTC and anti-windup FTC in the faulty aircraft with two kinds of saturation modules. As actuator 1 is locked in $5^{\circ }$, actuators 2 and 3 meet their constraints so that FTC cannot guarantee the post-fault aircraft stability. On the contrary, the anti-windup FTC can cancel out the nonlinear windup phenomenon in the actuators and make the faulty aircraft stable.

5. Conclusions

In this paper, we proposed a novel anti-windup integrated reconfigurable control approach for a rigid aircraft experiencing faults and actuator saturation. A reference controller using an optimal control scheme and a reconfigurable controller using an adaptive scheme are designed without actuator constraints. To obtain accurate fault signals, an estimation module using an observer-based method is presented. For the overall faulty system, an integrated strategy is utilized to calculate the adaptive adjustment control and estimate gains by analyzing the system stability. Three anti-windup schemes are utilized to modify the original designed controllers. Actuator and sensor faults are discussed and analyzed to verify the effectiveness of the proposed reconfigurable control method. The simulation results of the case study show that the presented method can decrease the effects of faults and actuator constraints in different flight conditions.