Oscillatory Failure Detection for Flight Control System Using Voting and Comparing Monitors

XUE Ying，YAO Zhenqiang

1. Shanghai Aircraft Design and Research Institute，Shanghai 200210，P.R. China；

2. School of Mechanical Engineering，Shanghai Jiao Tong University，Shanghai 200240，P.R. China

（Received 18 June 2018；revised 20 February 2019；accepted 05 March 2019）

Abstract: Oscillatory failure cases（OFC）detection in the fly-by-wire（FBW）flight control system for civil aircraft is addressed in this paper. First，OFC is ranked four levels：Handling quality，static load，global structure fatigue and local fatigue，according to their respect impact on aircraft. Second，we present voting and comparing monitors based on un-similarity redundancy commands to detect OFC . Third，the associated performances，the thresholds and the counters of the monitors are calculated by the high fidelity nonlinear aircraft models. Finally，the monitors of OFC are verified by the Iron Bird Platform with real parameters of the flight control system. The results show that our approach can detect OFC rapidly.

Key words: oscillatory failure; fly-by-wire; flight control system; monitor; voting

0 Introduction

Abnormal oscillation of aircraft control surfaces due to component malfunction in the actuator servoloops is called oscillatory failure case（OFC）. OFC has became a hot topic since the fly-by-wire（FBW）technology and digital flight control system（FCS）was introduced into the civil aircraft by Airbus［1］.Besides the obvious advantages，FBW’s increasingly complex system has brought new faults. OFC is the critical one that could propagate via the actuation systems to the control surfaces，interfering the structural loads［2］.

The loads can function in the strong interaction with aero-elasticity if the frequency of aero-elasticity falls within the bandwidth of actuators［3］. Overloads due to aircraft’s poor damp and flexible modes can cause significant component loads and resonance phenomena . Since the probability of the oscillation can be reduced by the architecture of FCS，some actions have to be taken to prevent the occurrence of OFCs or to alleviate their effects on aircraft structure［4］. Thus，occurrence of OFC could be controlled by strictly architecture design，and the best way is to use an OFC monitoring system［5］.

Most fault detection methods are sensor-based or model-based. Sensor-based ones adopt additional sensors to detect OFC. The monitor compares the sensor signals with a tolerance and determines whether they match. If some signals fail，the monitor will switch off them and calculates a consolidated parameter by using the rest health sensors，so any fault can be eliminated before propagating to the control loop［6-7］. This method holds a simple logic，a fast and effective response，and a high reliability，but it requires more complicated hardware and extra cost and weight.

Model-based approaches are designed based on the A380 aircraft. The monitor uses a nonlinear hydraulic actuator model to generate a residual by comparing the true position with the estimated one［2，8-9］.In Ref.［10］，an observer - based monitoring approach was proposed to calculate the residual without using additional surface sensors for the Airbus A340 aircraft. It was validated by comparing the A340 allowable OFC surface angles limitation，and the results showed that there was enough margin between the OFC monitor line and the reference limitation line.

However，these module - based ways are designed based on analytical redundancy technology and cannot cover all the OFC sources due to the following limitations.

（1）They are designed based on the mathematic，the reliability and the robustness，which depends on the accurate actuator model and has not sufficiently verified in practice.

（2）They are only used for the OFC detection of the actuators，and incapable to solve those in command inputting and processing phases in flight control computer（FCC）.

Therefore，to realize the dissimilarity redundancy technique，the traditional sensor-based monitors should be improved. We propose an approach based on the present system structure and eliminate external sensors. The sensors used for flight control can also be used to detect OFC，and monitors are designed based on the presented redundancy flight control sensors. The contributions of this paper are：

（1） Compared with traditional sensor - methods，our approach is based on system redundancy sensors and saves additional OFC sensors.

（2）Compared with model-based methods，the logic of the proposed OFC detection is simpler，while reliability and robustness are increased.

1 Certification Requirements

According to the standard requirements of FAR/CS/CCAR 25，the structure loads cover the following items： 25.301， 303， 305， 307， 333，471，561，571，601，603，605，607，609，613，691，521，623，625 and 629. These certification requirements are classified into four kinds：dynamic loads，flutter loads，fatigue loads on actuator and control surface，static load［10-12］. The main source of these loads is OFC，so in order to analyze OFC，the following effects of different levels are studied：

Level 1Airplane controllability：Pilots are hard to control the airplane during continued flight and landing because of oscillation.

Level 2Excessive limit load：Oscillation results in excessive loads in the overall airplane including wings，fuselage，and empennage. The magnitude and frequency of the oscillation should be constrained in an allowable limitation，that is，if the control surfaces are saturation，the channels should be shut down within three to five OFC cycles.

Level 3Global structure fatigue：Oscillation loads are the results of acting on the airplane structure and produces unaccepted structure fatigues and damages. The magnitude and frequency of oscillations should be defined as a series of oscillation numbers during one flight.

Level 4Low cycle local fatigue （force fight）：Each actuator’s motion of one surface is out of sync because OFC and the loads appear. These loads could result in unaccepted fatigue damages on the control surface.

To meet each OFC level，the allowable limitation line of the surface structure should be calculated correspondingly and these lines are considered as the OFC monitor requirement. Table 1 shows different levels of the OFC monitor requirements for a civil aircraft.

Table 1 OFC requirements

In this paper，Level 1 and Level 2 are detected by the below monitors；while Level 3 and Level 4 are detected by another monitors，due to the requirement of higher detection speed and nonlinearity relationship between the frequency and the oscillatory angle.

2 OFC Monitoring System Design

2. 1 System description

The flight control system structure of one type of civil aircraft is illustrated in Fig.1.

Fig.1 Flight control system structure

In Fig.1，there are three FCCs and four actuator control electronics（ACEs）to provide flight control signals for calculation and redundancy management. Each surface actuator is controlled by remote electrical unit（REU）to receive digital signal from FCCs and ACEs. Pilots will use side stick or pedal to transfer operation into electrical signals and send them to ACEs. Four power conditioning modules（PCM）provide the electrical power to FCCs，ACEs and REU separately.

There are two modes of operation：Normal mode（NM）and direct mode（DM）. In NM，FCS provides full system functions，closed loop flight control，system monitoring，crew annunciation and maintenance support. This mode is available if a sufficient sensor set is available and at least one FCC is valid. If all FCCs fail，FCS will be degraded to DM. In DM，FCS provides a basic mechanic from the pilot stick to control surface with body rate damping，and it can be controlled by the airplane manual operation. In this case，only the basic system monitoring is provided：A simple and deterministic control path from stick input to control surface.

The command （COM） and monitor （MON）lane of FCC and ACE are un-similarity design with different hardware frames. Signals are collected and calculated in two individual channels to output the command，so the comparion between them is the effective way to detect OFC.

2. 2 OFC location

OFC accounts on electronic components in fault mode which can generate spurious sinusoidal signals. The signals can be propagated through the servo-loop control and results in the control surface oscillation［13］.

Normally the command signals follow these steps：

（1）Pilot’s analog is input into the four redundancy position sensors；

（2）Each signal sent to the four ACEs is collected and processed by the ACE；

（3）The four signals from the four ACEs are sent to FCCs to vote and the command is calculated by the control law（CLAW）；

（4）The voted command goes back to the four ACEs to process the output command and to control the surface.

Faults often occur in the components including the analog input position sensors，FCCs，and ACEs. They generate error oscillations of the command that is sent to the actuator servo-valve，as shown in Fig.2. OFCs are considered as the sinusoidal signals with frequency uniformly distributed over the range of 0—15 Hz. OFC signal can be filtered by the low pass filter［14］.

Fig.2 OFC source localization

OFC existing in command process could be detected by the monitors. The overall distribution of these monitors is designed，as shown in Fig.3. Voting is located at a FCC to isolate the OFC signals from the four ACEs and output the voted command to the ACE. Input and output signals of ACE are monitored by the comparing monitor in MON and COM lanes of the ACE separately.

Fig.3 OFC monitors distribution

2. 3 Voting algorithm

In NM，commands and all other signals that contribute to CLAW are validated through the voter function，which transforms the redundant input signals to one uniform signal. The voting algorithm deals with signal faults in order to select the healthy ones and report the health of the inputs and the outputs. Any oscillatory fault that exceeds the allowed threshold should be detected，set to invalid and excluded from voting（see Fig.4）.

Fig.4 Voting procedure

The voting algorithm encompasses comparing logic，threshold and voting algorithm.

Common comparing logics include weight voting［15］，cross voting and order-decreased voting［16］.Complicated voting logic can increase integrity and availability while decrease real-time performance and reliability.

Typical voting algorithms include the median -value voting，the average voting and the majority voting. The median voting is only suitable for uneven redundancy；the average voting is impacted by the signal drift；and the majority voting is applicable for discrete signal［17-18］.

Alternative thresholds include constant thresholds， variable thresholds［19］and adaptive thresholds［20］. Variable thresholds are used two or more constant thresholds during different comparing phases based on tolerance distribution；adaptive thresholds are more intelligent than others and could provide different values based on different flight cases.

Reliability is the critical factor to the monitor design. A simple logic and constant thresholds can increase real time performance and reliability，even if its failure detection rate is lower than that with a complicated logic. If the monitor is tripped，the corresponding channel is latched and voted out.

The proposed voter in this paper presents four signals：Maximum，second maximum （Smax） to second minimum （Smin），and minimum. It compares these signals according to the rules listed in Table 2：The failed signal is voted out and latched；if two or more signals are voted out，the control channel is latched，otherwise，the last three signals are used to calculate the output. The error threshold is defined based on the worst tolerance accumulation between each signal.

Table 2 Definition of parameters

According to Table 2，the voter can check out the failure after the maximum five comparing time.After voter comparing， the middle signal of the three residual signals is selected as the output command.

2. 4 Comparing monitor

Comparing monitor monitors command generation，lanes in ACEs，and the input and the output processes.

Compared with traditional sensor - based monitors，the proposed monitor needs no additional sensors and is based on the dissimilarity technique.COM and MON lanes in the ACE process the input/output commands individually by using the nonsimilarity board and core. The comparator provides the high confidence because the failure rate is very low（＜10-9）if OFC exists in both non - similarity lanes at the same time.

The comparing method works in this way. If the difference between the two lanes exceeds the prescribed thresholds， the monitor will start to count errors. And once the threshold is exceeded，the monitor will report the fault. The differences between the command and the monitor lanes in nominal operation are very small and can be compared bit by bit. They have a persistence function and reset logic in the monitor. The persistence and latch can be recorded and reset. A hold feature is also included for temporarily disabling the monitor while the system is set in maintain mode. The typical monitor is shown as Fig.5.

The error threshold is defined based on the worst tolerance accumulation and enough margins to ensure the robustness.

Fig.5 Comparing monitor structure

3 OFC Monitor Performance Simulation

First，threshold and count time were set according to the theoretical values to define the worst limitation. Second，the monitor was simulated to by Matlab simulation model. FCS integration simulation model is a highly representative simulation platform for FCS structure，as illustrated in Section 1.1. It includes the nonlinear rigid-body aircraft submodel，a full set of control surfaces and actuator sub-models，sensor sub-models，flight control laws and pilot inputs sub-models. Fig.6 depicts the general structure of this platform with interfaces of each sub-models. Given its complicated architecture，detailed information is eliminated in Fig. 6. This platform can support the high fidelity simulation because it contains the input and the output processing latency，the command processing control law，the monitor logic and other elements which can impact the hardware response time.

Fig.6 FCS integration simulation model

Fig.7 presents the calculation steps of the threshold and the count time of the simulation.

Fig.7 Monitor parameters caculation steps

3. 1 UCI and DCI definition

The up count increment（UCI）is the speed of the monitor response and the down count increment（DCI）is generated from the errors that will be reduced if there is no more error to be counted［21］. An asymmetric up/down counter is necessary to start counting while faults exceed the input monitor threshold. In order to increase the monitor robustness，the criterion for increment is selected to maximize the number of UCI while the fault is detected in time. But the number is also limited by the actual computer process frequency. In order to find out the most sensitive UCI number in the active computer hardware response performance，we deployed a condition as injecting 10 Hz OFC signal for 1 s and increasing UCI from 5 to 40，as shown in Fig.8.Fig.8 shows that the maximum number of counts 17 can be achieved if UCI is larger than 30.

Fig.8 Up count increment times

DCI should be much smaller to reduce the slower error reduction in case that some other errors emerge. It is proposed to set as one to get the minimum count time.

3. 2 Comparing monitor performance

The input threshold is estimated by using a simulation model with assuming maximum surface rate.From the simulation，the max difference between command and monitor lanes in transient process goes up to 0.86° during the full surface deflection，and the result is presented in Fig.9. This is used as a monitor threshold value.

Fig.9 Difference between ACE COM and MON

According to the definition in Table 1， the most critical requirement was to detect the fault at 10 Hz with amplitude ＞1° within 5 cycles（0.5 s）.Fig.10 illustrates the relationship of UCI and DCI in OFC monitor process.

Fig.10 Monitor trip process

The counter threshold limitation met Eqs.（1—3）

where tctis the Counter threshold limitation；tuthe accumulation of UCI；tdthe accumulation of DCI；cucithe counter number for UCI，set as 30 according to Section 3.1；cdcithe counter number for DCI，set as 1 according to Section 3.1；ntrgthe UCI trigger number per one OFC cycle；ntrgthe UCI trigger number per one OFC cycle；tframethe Monitor execution frame based on hardware frequency，set as 1/96 according to FCC process frequency.

The actual counter time should be lower than this limitation. According to Eqs.（1—3），the worst case of counter threshold was lower than 350 at 10 Hz，which was 10 times of the trigger. The simulation results showed that the trip time（blue curve）reached its maximum of 0.48 s，much less than the required limitation （red curve， from the point （2.5 s，2 Hz）to the point（0.5 s，10 Hz）），when OFC test sample of sine（sweep from 2 Hz to 10 Hz）with amplitude 1.2° was injected，as shown in Fig.11.

Fig.11 Comparing monitor trip time simulation

3. 3 Voting monitor performance

The validated rotation variable differential transformers （RVDT） signals of the pilot input were voted and compared in the FCC COM and MON lane from the four RVDTs. The max comparing threshold was defined based on the tracking errors between each RVDT. After that，the voting algorithm averaged the four RVDTs and the outputs.The counter threshold met Eq.（1），according to the process frequency of 80 Hz，and the worst case of CT was lower than 115 at 10 Hz，four times of the trigger frequency.

The worst scenario was the one where RVDT wasdropped out by the voter，but the oscillatory of another one still existed because it was lower than the monitor threshold and could not be detected by the monitor，so the output command combined this oscillation based on the left three signals，as shown in Fig.12.

Fig.12 Voting simulation

The simulation calculated the pilot input to control the surface deflection based on the maximum gain of the CLAW. Fig.13 shows that even one RVDT has OFC，the voting algorithm could average them，and the surface deflection（blue curve）is still lower than Level 1 & 2 OFC requirements（red curve）.

Fig.13 Worst surface deflection scenario based on voting

4 Verification of the OFC Monitor

4. 1 Iron bird platform

We adopted the iron bird platform to verify the performance of OFC monitor in real conditions.

The FCS hardware configurations in the Iron Bird Platform is the same as real aircraft（include FCCs，ACEs，REUs and actuators）and the platform also includes simulation and record devices.

The theoretical failure cases were performed on the platform. RVDT OFC signals were injected by signal simulation system to ACEs signal input channels. The error signals were processed by ACE and FCC to output to REU，and REU drived the actuators to move. If any OFC were not detected by the monitors，the surface would oscillate.

Finally， the proposed monitors that are achieved in the ACEs and FCCs detected OFC from the signal simulation system. If the oscillatory were detected successfully， the actuators would stop to move and go back to the initial position.

The architecture of iron bird platform is depicted in Fig.14.

Fig.14 Iron bird platform

4. 2 OFC test

In order to verify the OFC detection ability of these monitors，the following two scenarios were tested by the Iron Bird Platform. The worst cases of voter：2 v. s. 2，and the logic was complicated to compare.

Scenario 1Two RVDTs were oscillatory（out of the threshold）and two others were normal，Roll RVDT 1 and 2 injected OFC by sine wave with 2.5°+/-1.8°，0.2 Hz，2.5°+/-1.8°，0.2 Hz.

Scenario 2Two RVDTs were oscillatory（one was out of the threshold and the other was in the threshold），and two others were normal. Roll RVDT 1 and 2 injected OFC by sine wave with 4.3°+/-1.8°，10 Hz，4.3°+/-0.8°，10 Hz.

Pass criteriaWhen the monitor was tripped，RVDT ?signal changed to the default value and RVDT ?valid signal was set to invalid.

The tests was performed at FCS Normal Mode. the monitors monitored the movement of surface to check whether the surface oscillatory exceeded the limit line. If the monitors filled in work normally，the oscillatory actuator would be powered off. The test parameters and note are listed in Table 3 and the test results are presented in Figs.15，16：

In Figs. 15，16，RVDT valid status drawings indicates that the monitors could detect OFC in one RVDT channel and set the failure RVDT from valid（1） to invalid（0） less than 2 s for 0.2 Hz and 0.5 s for 10 Hz.

RVDT voted valid status drawings proved that the monitors could detect OFC in one or two RVDTs by comparing with others and set voted RVDT from valid（1）to invalid（0）less than 2 s for 0.2 Hz and 0.5 s for 10 Hz.

Fig.15 Two RVDTs oscillatory at frequency of 0.2 Hz

Fig.16 Two RVDTs oscillatory at frequency of 10 Hz

Table 3 Parameters definition

For Scenario 1，aileron left/right inboard/outboard drawings verify that OFC monitors have latched the failure command output in FCS command path and shut down the control channel from position +/-10° to 0°（default）in less than 2 s for 0.5 Hz .

For Scenario 2，since the oscillatory RVDT was voted out，the aileron left/right inboard/outboard surface oscillatory was decreased to the accepted status in less than 0.5 s.

5 Conclusions

A robust detection monitor is studied for OFCs that occur in FBW flight control system of civil aircraft. First，we introduce the principle of OFC and research the OFC regular defined in CCAR25.

Second，we propose the OFC monitors to detect OFCs at FCC and ACE. The monitors can provide highly satisfactory results in term of robustness and detection. The simulation analyzes the threshold of monitor parameters and simulates the trip time of each monitor. This study is focused on the OFC Level 1 & 2 at the signal process phase. Further investigations are necessary to set up the monitor on OFC Level 3 and 4 at the actuator close loop.

Finally，the monitors are verified on the dedicated Iron Bird Platform with the real FCS hardware. The test results show that the monitors can detect OFC failures and shut down the surface oscillations in a short time and meet the OFC detection requirements.