Incorporating Performance Degradation in Fault Tolerant Control System Design with Multiple Actuator Failures

Transcription

1 International Incorporating Journal Perforance of Control, Degradation Autoation, in and ault Systes, Tolerant vol. Control, no. Syste, pp. 7-, Design with June Multiple Actuator ailures 7 Incorporating Perforance Degradation in ault Tolerant Control Syste Design with Multiple Actuator ailures Youin Zhang, Jin Jiang, and Didier Theilliol Abstract: A fault tolerant control syste design technique has been proposed and analyzed for anaging perforance degradation in the presence of ultiple faults in actuators. The ethod is based on a control structure with a odel reference reconfigurable control design in an inner loop and coand input adustent in an outer loop. The reduced dynaic perforance requireents in the presence of different actuator faults are accounted for through different perforance reduced (degraded reference odels. The degraded steady-state perforances are governed by the reduced levels of coand input. The reconfigurable controller is designed on-line autoatically in an explicit odel reference control fraework so that the dynaics of the closed-loop syste follow that of the perforance reduced reference odel under each fault condition. The reduced coand input level is deterined to prevent potential actuator saturation. The proposed ethod has been evaluated and analyzed using an aircraft exaple against actuator faults subect to constraints on the agnitude and slew-rate of actuators. Keywords: Coand input adustent/anageent, fault detection and diagnosis (DD, odel-following reconfigurable control (MRC, perforance degradation.. INTRODUCTION In view of potential perforance liits induced by physical liitations (such as actuator agnitude and slew-rate saturation in practical control systes, research on perforance degradation in a control syste design has recently begun to attract considerable attention [-,,]. Even though fault tolerant control of safety-critical systes is currently a very active research topic and a significant aount of research has been done in this area in the last two decades [,7,,,7], fault tolerant control syste (TCS designs with explicit consideration of possible perforance degradation have not, until recently, received the sae level of attention []. Most of the Manuscript received Septeber, 7; accepted April. Recoended by Guest Editors Marcel Staroswiecki and Bin Jiang. This work was partially supported by Natural Sciences and Engineering Research Council of Canada (NSERC. Youin Zhang is with the Departent of Mechanical and Industrial Engineering, Concordia University, Montreal, Quebec HG M, Canada (e-ail: yzhang@encs. concordia.ca. Jin Jiang is with the Departent of Electrical and Coputer Engineering, The University of Western Ontario, London, Ontario, NA B9, Canada (e-ail: iang@uwo.ca. Didier Theilliol is with the Centre de Recherche en Autoatique de Nancy, CNRS UMR 79 BP 9, Vandoeuvre Cedex, rance (e-ail: Didier.Theilliol@cran. uhp-nancy.fr. earlier work on TCS design is centered around the philosophy to recover the pre-fault syste perforance as uch as possible [,,,]. In practice, however, as a result of an actuator fault, the degree of the syste redundancy and the available actuator capabilities could be significantly reduced. If the design obective is still to aintain the original syste perforance, this ay force the reaining actuators to work beyond the noral duty to copensate for the handicaps caused by the fault. This situation is highly undesirable in practice due to physical liitations of actuators. The consequence of the so-designed TCS ay lead to actuator saturation, or worse still, to cause further daage. Therefore, trade-off between achievable perforance and available actuator capability should be carefully considered in all TCS designs. Designing a fault tolerant control syste against actuator faults to achieve specified degraded perforance without violating the actuator liits is therefore the ain focus of this paper. In [], two reference odels are used in conunction with a odel-following control schee in order to deal with noral operation and syste contingencies under actuator failures, respectively. Although a very iportant concept has been presented therein, it becoes evident that a twin odel approach is not coprehensive enough to capture all potential syste alfunctions. Different actuator faults in a syste can exhibit distinctive characteristics; they cannot and should not be

2 Youin Zhang, Jin Jiang, and Didier Theilliol odeled only by a single degraded odel. In fact, each fault should be handled differently. One of the obectives of this paper is to extend the previous work by incorporating different degraded reference odels for achieving a gracefully degraded perforance in the presence of different actuator faults. This involves the design of ultiple degraded reference odels and the selection of different levels of coand input associated with each fault condition. By representing each actuator fault via a degraded reference odel synthesized with the consideration of the syste perforance liitation under the fault condition, the overall fault handling capability of a control syste can be enhanced considerably. Since a unity steady-state gain of each reference odel is required for the purpose of coand tracking, the degradation levels in dynaic perforance in the presence of faults are ainly governed by specified degraded reference odels. Therefore, adustents to the syste coand input levels are also crucial in achieving a gracefully degraded perforance in the event of syste coponent failures. In this paper, an alternative dynaic adustent strategy based on the concept of pre-filter has been exained to provide a way for the dynaic adustent of coand input during the initial period of controller reconfiguration. The relationship between the pre-filter technique and the coand governor schee in [] is also exained. The ain contribution of this paper is to provide a way for dealing with different actuator faults with different degraded reference odels and different levels of dynaically adusted coand input to achieve a graceful perforance degradation, within the fraework of an on-line integrated DD and a reconfigurable controller design. The paper is organized as follows: The overall control structure accounting for achievable perforance degradation under ultiple actuator faults is presented in Section. A schee for selecting a set of degraded reference odels is presented in Section. A strategy for dynaic adustents of the coand input is proposed in Section. A odel-following reconfigurable control design schee associated with ultiple reference odels is developed in Section. Perforance assessent of the designed TCS for an aircraft exaple is presented in Section followed by the conclusions in Section 7.. THE INNER-OUTER STRUCTURE ACCOUNTING OR PERORMANCE DEGRADATION WITH MULTIPLE ACTUATOR AULTS The overall structure of the proposed TCS is depicted in ig., which includes odules of ultiple Coand Adustent r n Coand Generator r f Dynaic Adustent Outer Loop r' Degraded Reference Models (w.r.t. each actuator fault K x w K r' + aults u x y v + z + + Actuators Syste Sensors + - Inner Loop Stage Estiator γ^ reference odels, fault detection and diagnosis (DD, a reconfiguration echanis, and a odel-following reconfigurable controller in the inner-loop; and the coand adustent/anageent odule in the outer-loop. Note that in the presence of different faults, different degraded reference odels are used with respect to (w.r.t. different fault conditions. The inner-outer loop structure enables us to achieve a specified degraded perforance for the syste at both transient and steady-state periods, with the purpose of avoiding potential slew-rate and agnitude saturation of the actuators. The inner-loop is also responsible for the guarantee of the stability and the desired achieveent of dynaic perforance through a reconfigurable odel reference control strategy. The ain function of the outer-loop is to re-adust the coand input levels such that a potential agnitude saturation in the steady-state as well as the transient interval during the control reconfiguration can be avoided. To ipleent the above fault-tolerant control design in real-tie, the post-fault syste odel has to be deterined on-line and the state variables ust be available for feedback. In practice, only part of the state variables ay be easurable. To provide required state and fault paraeters for feedback control, siultaneous state and paraeter estiation techniques need to be used as shown in ig.. A twostage adaptive Kalan filter [,] has been used for such a purpose. urtherore, the fault detection and isolation (DI schee and the reconfiguration echanis are also needed. The details on the fault detection and diagnosis (DD and reconfiguration echanis odules in ig. have been oitted herein. Interested readers can refer to [] for details. In the following sections, odules relating to ultiple degraded reference odels, coand adustent, and a reconfigurable odel reference controller will be described in detail. u K x Desired Reference Model x^ Adaptive Two- DI Reconfiguration Mechanis DD ig.. Overall structure of the proposed TCS. z x y y

3 Incorporating Perforance Degradation in ault Tolerant Control Syste Design with Multiple Actuator ailures 9. DESIGN O MULTIPLE DEGRADED REERENCE MODELS.. The role of a reference odel in achieving degraded perforance As can be seen in ig., reference odels play an iportant role in achieving specified/degraded perforance under noral and fault conditions. In particular, the dynaic behavior of the post-fault syste is governed by the dynaics of the designed reference odel. In fact, a reference odel specifies an ideal traectory which the post-fault syste should reach a new steady-state condition defined by the syste operating set-point. The reference odels also affect the agnitude and slew-rate of generated closed-loop control signals through feedback-loop. Therefore, an appropriate selection of degraded reference odels is iportant to achieve a specified degraded perforance. If the reference odel is selected so that its outputs follow the desired outputs very quickly, a large overshoot and a short rise tie ay occur. The corresponding control signals needed to track the responses of the reference odel ay becoe large, reaching or exceeding the actuator slew-rate or agnitude saturation region. However, if the reference odel is selected so that the outputs track the coand input rather slowly, then, the tracking accuracy iproves without showing overshoots or going into an actuator saturation region. However the responses ay becoe sluggish. Therefore, for the purpose of achieving a specified perforance with a degraded level in the event of a syste coponent failure, it is preferable to design appropriate reference odels which ake a good trade-off between the achievable perforance and the physical constraints of the syste... The design of perforance reduced reference odel Assue that a reference odel of the syste under the noral condition is represented by: = A x + B r = C x, x, y ( n where x R is the state vector of the reference odel; y R p l is the output vector; and r R is the coand input vector. It is assued that p = l for the purpose of coand tracking. The above odel, known as the desired reference odel, specifies the desired dynaic characteristics of the syste under a noral condition. The corresponding transfer function atrix of this odel is then: T ( s = C ( Is A B, ( where I is an identity atrix. Let s assue that the eigenvalues of this syste are represented as: diag n Λ = [λ, λ,..., λ ]. ( In the presence of a fault, it is expected that the syste eigenvalues of the degraded reference odels will ove towards the iaginary axis to reflect the loss of the syste dynaic perforance. Suppose that the eigenvalues of the degraded reference odels under each actuator fault condition, =,..., l, are represented as: Λ = Ψ Λ, =,..., l ( where the ode degradation atrices can be selected as: diag n i Ψ = [ψ, ψ,..., ψ ], ψ, i =,..., n; =,..., l. ( The transfer function atrix of each reference odel for the degraded syste can then be obtained as: T ( s = C ( IsΨ A B ( Ψ Ψ = C Is A B = C ( Is A B, =,..., l. ( Hence, a set of degraded reference odels becoes: x y A x B r = +, = C x, =,..., l, (7 where A = Ψ A, B = Ψ B, C = C, =,, l. The atrix triplets { A, B, C, =,..., l} specify the characteristics of the degraded reference odels for various fault conditions, where the sae nuber of reference odels as the nuber of actuators has been selected. By choosing different values of Ψ, different dynaic behaviors and different levels of perforance degradation can be specified. The selection of each eleent in Ψ is application dependent and should be in conunction with a tie response analysis (represented by perforance easures such as settling tie, rise tie and percentage of overshoot etc of a designed reference odel. It should be pointed out that the synthesis of reasonable ultiple reference odels is a non-trivial task. One has to have a clear understanding of syste perforance requireents, availability of actuator

4 Youin Zhang, Jin Jiang, and Didier Theilliol redundancies, and underlying physical liitations of control actuators. These quantities set the ultiate perforance liits for systes under syste failures. It is crucial to ebed these liits into the degraded reference odels so that the physical liits of the syste are not violated in the reconfigured syste, i.e. all variables stay within an allowable space corresponding to the particular actuator fault. ortunately, the above requireents can be achieved for practical engineering applications since, unlike the on-line design of reconfigurable controller, design of reference odels are carried out in an off-line anner. This feature provides users an opportunity to deterine expected degraded reference odels with a good balance between an expected perforance degradation and a potential actuator saturation. Note that the nuber of degraded reference odels is equal to the nuber of actuators. This will also reduce the work load for designing reference odels. or the convenience to design reference odels, the above reference odels are firstly synthesized in continuous tie doain and then converted to discrete odels for the purpose of synthesis of an online reconfigurable controller.. COMMAND INPUT DYNAMIC ADJUSTMENT VIA A PRE-ILTER SCHEME To ensure that all of the syste variables are within the safe region and that all of the control actuators are free fro saturation for the reconfigured syste, one has to ake appropriate adustents to the level of a required control coand input as well. A schee proposed in [] and other techniques developed in [,9,] can be used for such a purpose. Generally speaking, an adustent of the coand input should include two parts: the selection of a set of new coand inputs to the syste at the steady-state with respect to different fault conditions; the dynaic adustent of the coand inputs during the initial period of control reconfiguration. The first part is to set acceptable new steady-state operating conditions which iniize the perforance degradation while siultaneously avoiding a potential actuator agnitude saturation at steady-state. The role of the second part is to reduce the possibility of an actuator slew-rate as well as a agnitude saturation during the transient interval of the control reconfiguration process. In this paper, a procedure proposed in [] has been extended to deterine a set of new coand inputs associated with different actuator faults. However, the ore difficult part occurs when avoiding the saturation of an actuator during the initial control syste reconfiguration due to significant faultinduced changes in syste dynaics and liited control authority of reaining actuators. With the practical constraints on actuator aplitude and slewrate, there are any ore challenges in order to balance the requireents fro both degraded perforance and saturation avoidance during this short period. As an alternative of the proposed coand governor in [], a pre-filter schee is exained in this paper. This can be described as follows. Assuing that a fault is detected at the tie instant k D, then the following odified coand input r '( k will be generated based on the new set-point r ( k, k k ; {,..., l}, as D r ( k = (ρ r'( k + ρ r ( k, ( where ρ ( ρ is a weighting paraeter governing the decay rate of switching and the initial value of r ( k = r, k < k D. Ideally, r ( k = r ( k = r if ρ =, and r ( k = r ( k when ρ =. The saller the ρ is, the slower the decay rate of the switching is. As k increases, r ( k will approach to r ( k. It should be noted that a pre-filter is located outside the feedback loop, and hence does not affect the stability or robustness properties of the loop, and has no effect on the response to disturbances. The priary effect of the pre-filter is that it defines the ideal syste response to set-point changes. In [], a dynaic reference governor has been proposed for the dynaic tapering of the coand input. It is interesting to note that the schee in [] would have been equivalent to the above pre-filter schee if fixed weighting paraeters had been used. The advantage of the above pre-filter schee is that only one paraeter needs to be deterined to achieve bupless coand switching. The ter bupless here eans that no discontinuity (or abrupt change appears during the coand input switching. Note also that a odification to the original coand input starts as soon as a fault is detected at tie k D. This allows the pre-filter to adust the coand input before and during the reconfiguration process in order to prevent the potential actuator saturation fro affecting the steady-state perforance of the reconfigured syste.. DESIGN O A MODEL REERENCE RECONIGURABLE CONTROLLER.. orulation of reconfigurable control with ultiple actuator faults To better illustrate the reconfigurable control design process, the syste odel under both noral and

5 Incorporating Perforance Degradation in ault Tolerant Control Syste Design with Multiple Actuator ailures various actuator fault conditions can be written as: x( k + = x( k + Gu( k + w( k, y y( k = H x( k, =,..., l z( k = Hx( k + v( k, n (9 where x R is the state vector; z R is the l easureent vector; u R is the control input vector, y is the controlled syste output vector, and n w R and v R are independent rando processes with eans w and v and covariances Q and R, respectively. They represent the syste and easureent noises, respectively. The initial state is assued to have ean x and covariance P, and it is independent fro w and v. During a noral operation, the syste atrices are represented by { G,, H}. Once an actuator fault occurs, the atrix G becoes G, {,..., l}, at an unknown tie k with an unknown change in G. The corresponding ultiple reference odels with the specified degraded perforance for the noral condition and each fault condition can be described by: x ( k + = x ( k + G r ( k, y ( k = H x ( k, =,..., l ( where x ( k is the state, r ( k the coand input, and y ( k the output of each reference odel. The constant atrices {, G, H, =,..., l} are of appropriate diensions, which are set the sae as the diensions of atrices { G,, H, =,..., l}. Based on the syste representation (9, and the desired reference odel ( = in (, one needs to x synthesize the following control gains { K, K, K r } for generating the desired control signals under the noral syste operation: x x r = + + u ( k K x ( k K x ( k K r ( k. ( feedback reference odel feedforward Once a fault is detected, a new set of controller x x r gains { K, K, K, =,..., l} will have to be synthesized based on the degraded reference odel corresponding to a specified fault in ( so that the closed-loop syste follows the degraded reference odel with the new control signal as: x x x r u ( k = K x ( k + K x ( k + K r ( k, ( where =,..., l, k kr, and k R represents the controller reconfiguration tie. Since different reference odels have been assigned to different actuator faults, different reconfigurable controllers need to be designed in an on-line anner. The design of these controller gains is discussed next... The design of reconfigurable controller gains One of the ain obectives of the odel-following reconfigurable control is to ake the selected syste variables track the outputs of the degraded reference odel corresponding to a particular fault condition, respectively, i.e., to synthesize a control sequence u ( k that forces the coand tracking error e ( k to be zero at the steady-state for each given condition y e ( k = y ( k y ( k = H x ( k H x ( k, =,..., l. ( When the tracking is achieved, the following will be true: y y ( k = H x ( k = H x ( k, =,..., l. ( Under the assuption that the ideal syste state x ( k and the control traectories u ( k are linear cobinations of states and inputs of each reference odel, the solution for x ( k and u ( k can be deterined by: = + x ( k S x ( k S r ( k, ( u ( k = S x ( k + S r ( k, =,..., l, ( n where S,, n=, ; =,..., l, are constant feedforward gain atrices, which can be calculated by S = Φ S ( I + Φ H, (7 S = Φ S G, ( S = Φ S ( I + Φ H, (9 S = Φ S G, =,..., l ( n and the atrices Φ, n, =, ; =,..., l, are deterined by Φ Φ Φ I G Φ = =, =,..., l. ( Φ H y

6 Youin Zhang, Jin Jiang, and Didier Theilliol It should be noted that Φ n depends on the n syste odels (9, whereas S depend on both the syste and the reference odels ( at the noral and fault conditions. To incorporate feedback into the design, let s define then, x ( k = x ( k x ( k, u ( k = u ( k u ( k, y ( k = y ( k y ( k x ( k + = x ( k + G u ( k, ( ( k H y y = x ( k, =,..., l. ( or a feedback control signal given by x u ( k = K x ( k =K x [ x( k x( k], =,..., l. ro the definition of u ( k in (, we have: x u ( k = u ( k + u ( k = u ( k K [ x ( k x ( k]. ( ( Substituting ( and ( into (, the overall control signal for each condition can be deterined by: x x r u( k = Kx( k + K x ( k + K r ( k, =,..., l. ( Note that the control law in ( consists of a feedback part, K x, a reference odel part depending on the state of the reference odel, x x K = S + K S, and a feedforward part relating r to the coand input, K = S + x K S. It should be pointed out that even though ultiple reference odels have been used for reconfigurable controller designs, only one set of controllers as specified in ( needs to be carried out for a particular actuator fault identified by the DD schee. This will keep the calculation of a reconfigurable control law sall for on-line application.. AN ILLUSTRATIVE EXAMPLE To deonstrate the effectiveness of the proposed approach and for easy coparison with the results in [], a sae - aircraft odel used in [] is adopted... Aircraft odel The linearized aircraft odel can be described as: x ( t = Ax( t + Bu(, t ( t = C y (7 y x(, t where the state and the input vectors are x = [ prβφ] T T and u = [δa δ r], respectively, with p representing the roll rate, r the yaw rate, β the sideslip angle, φ the bank angle, δ a the aileron deflection, and δ r the rudder deflection. To aintain the desired values for the sideslip and the bank angle during both the noral operation and under fault conditions, the output atrix H y is chosen as y y H = C =... Design of reference odels and coand inputs Since there are two control inputs which associate with two actuators in the syste, two degraded reference odels and two set of new coand inputs are needed to be deterined... Design of reference odels ollowing the design procedure outlined in Section. and for the selected weighting atrices diag[,,, ], Aileron fault Ψ = diag[,,, ], Rudder fault the paraeters of the syste, the desired and the degraded reference odels are given in Table. The desired reference odel is odified to achieve unity steady-state gain fro a odel in [] which satisfies all necessary perforance requireents under the noral operation. In the selection of the degraded reference odels, the following two factors Table. The syste and the reference odels. Open-Loop Syste Model Desired Reference Model Degraded Reference Model # Degraded Reference Model # A B

7 Incorporating Perforance Degradation in ault Tolerant Control Syste Design with Multiple Actuator ailures have been taken into consideration: to track the output responses specified by the degraded reference odel in the presence of any one of the two actuator faults with any level of loss of its control effectiveness, and the closed-loop control signals should not violate the slew-rate and aplitude saturation liits of the actuators under all fault conditions considered... Selection of coand input (set-points Dynaic perforance, particularly transient perforance of a reconfigured syste is governed ainly by the selection of the above reference odels. To avoid potential actuator saturation and to achieve desired degraded perforance in the presence of failure, on-line switching of coand input (setpoint ay have to be incorporated in the design of fault-tolerant control systes. The rule of selecting each coand input is that assigned set-point should not violate the saturation liit of the actuator at the corresponding fault condition, given the synthesized reconfigurable controller. or ulti-input and ultioutput (MIMO systes, there are interactive coupling effects aong different channels. Therefore, care should be given for selecting set-points so that the relationship (or ratio between different input channels should be carefully considered. This eans that reasonable and realizable set-points need to be set. Through siple sensitivity analysis, it is observed that sideslip angle is ainly controlled by aileron while bank angle is ainly controlled by rudder. There is also coupling effect fro the aileron to the bank angle. Therefore, if there is an aileron fault, deand for sideslip angle should be significantly reduced while the bank angle should be reduced when there is a rudder fault. These facts need to be considered in the deterination of the above new coand inputs associated to each actuator fault condition. Based on the above consideration, the corresponding coand inputs for the noral and the fault conditions are given in Table. To illustrate the behaviors of the synthesized reference odels with the new coand inputs, the step responses of different degraded odels are shown in ig.. The corresponding quantitative easures of the rise tie, settling tie and percent of Table. Coand inputs for the noral and fault conditions. Setpoints Noral Aileron failure Rudder failure Sideslip angle... Bank angle... Table. Characteristics of reference odels. δa T r β δr φ δa T σ % s β δr φ δa β ault-free Aileron fault Rudder fault δr φ Sideslip Angle vs. Aileron Coand Inputs Bank Angle vs. Rudder Coand Inputs 9 7 Desired reference odel Degraded ref. odel under aileron fault Degraded ref. odel under rudder fault Coand input:. deg New coand input:. deg New coand input:. deg Desired reference odel Degraded ref. odel under aileron fault Degraded ref. odel under rudder fault Coand input:. deg New coand input:. deg New coand input:. deg ig.. Step responses of reference odels with different input levels. Sideslip Angle vs. Aileron Coand Inputs Bank Angle vs. Rudder Coand Inputs Coand input:. deg Desired reference odel Degraded ref. odel under aileron fault Degraded ref. odel under rudder fault New coand input:. deg New coand input:. deg Desired reference odel Degraded ref. odel under aileron fault Degraded ref. odel under rudder fault Coand input:. deg New coand input:. deg New coand input:. deg ig.. Responses of reference odels with coand input changes. overshoot are shown in Table for easy perforance coparison aong different reference odels. To further illustrate the transient behaviors of designed reference odels, step responses with the original coand input followed by a step-type coand input switching to the new coand inputs at the tie instant of sec are shown in ig.. As

8 Youin Zhang, Jin Jiang, and Didier Theilliol expected, it is evident that degraded reference odel associated with the aileron fault has slower response in sideslip while the one associated with the rudder fault has slower response in bank angle. These facts provide us soe guidelines for selecting appropriate reference odel for each actuator fault condition... Siulation results and perforance assessent To evaluate the perforance of the proposed ethod, a loss of 7% of the control effectiveness in the aileron or rudder channel is siulated at tie t = sec. Prior to the occurrence of a fault, a constant T input vector, r = [ ], is used as the original coand input to represent the desired sideslip and the bank angle. Once an actuator fault has been detected, the new coand input specified in Table will be used to represent the degraded perforance at the steady-state for particular actuator fault. or the purpose to deonstrate the effects of saturation to the developed TCS, the aplitude and slew-rate liits for the two control actuators are set as c following: δ a = ±deg, c δ a = ±deg / sec; and c δ r = ±deg, δ = ±deg / sec. c r.. Syste perforance under the aileron fault To copare the perforance with and without consideration of perforance degradation under the aileron fault, the closed-loop syste responses of the two cases are shown in ig.. The corresponding control signals are illustrated in ig.. To illustrate the effect of pre-filter and how the coand inputs react to faults, the corresponding coand inputs are overlaid on the sae graph in ig.. It can be seen that satisfactory output responses have been obtained with the specified degraded perforance. Correspondingly, significantly reduced control deands at the steady-state in both control channels have been required for the aircraft to track degraded reference traectories. However, if perforance degradation had not been considered, eaning that the desired reference odel and original coand inputs have been used for control reconfiguration, the reconfigured output responses would track neither the original fault-free syste output responses nor the expected reference traectories with the degraded perforance. This is because considerably larger control effort in the aileron channel would have been needed if the perforance degradation had not been considered. In fact, the required control signal has exceeded the actuator saturation liit iediately after the fault occurrence... Syste perforance under the rudder fault The behavior of the syste in the presence of the rudder fault has been shown in igs. and 7. Siilar Sideslip angle (deg Bank angle (deg Response under noral condition Reference response under fault condition Reconfiguration with degraded perforance Reconfiguration without perforance degradation - t - - Response under noral condition Reference response under fault condition Reconfiguration with degraded perforance Reconfiguration without perforance degradation - t ig.. Syste outputs with and without degraded perforance. Closed-loop control signal (δ a Closed-loop control signal (δ r Saturation liit Reconfiguration with degraded perforance Reconfiguration without perforance degradation Coand input under noral and fault conditions - t Saturation liit Reconfiguration with degraded perforance Reconfiguration without perforance degradation Coand input under noral and fault conditions - t ig.. Control signals with and without degraded perforance. conclusion can be drawn as in the aileron fault case. It is clear that with the consideration of perforance degradation, the reconfigured syste responses follow the degraded reference responses satisfactorily, with even saller control effort at the steady-state copared with the one during noral operation. However, without considering perforance degrada-

9 Incorporating Perforance Degradation in ault Tolerant Control Syste Design with Multiple Actuator ailures Sideslip angle (deg Response under noral condition Reference response under fault condition Reconfiguration with degraded perforance Reconfiguration without perforance degradation Sideslip angle (deg Response under noral condition Reconfiguration with degraded reference odel Reconfiguration with desired reference odel Bank angle (deg - t - - Response under noral condition Reference response under fault condition Reconfiguration with degraded perforance Reconfiguration without perforance degradation - t ig.. Syste outputs. Closed-loop control signal (δ a Closed-loop control signal (δ r Saturation liit Reconfiguration with degraded perforance Reconfiguration without perforance degradation Coand input under noral and fault conditions - t Saturation liit Reconfiguration with degraded perforance Reconfiguration without perforance degradation Coand input under noral and fault conditions - t ig. 7. Control signals. tion, the reconfigured sideslip response can not track either the fault-free syste output response or the expected reference traectory with the degraded perforance. The required control signal in rudder channel exceeds the actuator saturation liit iediately after the fault occurrence... urther analyses To deonstrate the role of degraded reference Bank angle (deg - t - - Response under noral condition Reconfiguration with degraded reference odel Reconfiguration with desired reference odel - t ig.. Syste outputs using desired and degraded odels. Closed-loop control signal (δ a Closed-loop control signal (δ r Saturation liit Reconfiguration with degraded reference odel Reconfiguration with desired reference odel - t Saturation liit Reconfiguration with degraded reference odel Reconfiguration with desired reference odel - t ig. 9. Control signals. odel, igs. and 9 show the output responses and corresponding control signals using either degraded or desired reference odel for control reconfiguration in the event of the 7% aileron actuator fault case. It can be seen that if the sae reference odel used for noral condition had been used in the case of the fault, faster output responses had been obtained. However, such a perforance requires also fast control signals

10 Youin Zhang, Jin Jiang, and Didier Theilliol Sideslip angle (deg Bank angle (deg Response under noral condition Response under 7% loss of aileron effectiveness Response under % loss of aileron effectiveness Response under % loss of aileron effectiveness - t - - Response under noral condition Response under 7% loss of aileron effectiveness Response under % loss of aileron effectiveness Response under % loss of aileron effectiveness - t ig.. Syste outputs under different levels of fault. Closed-loop control signal (δ a Closed-loop control signal (δ r Saturation liit Under 7% loss of aileron effectiveness Under % loss of aileron effectiveness Under % loss of aileron effectiveness - t Saturation liit Under 7% loss of aileron effectiveness Under % loss of aileron effectiveness Under % loss of aileron effectiveness - t ig.. Control signals under different levels of fault. as shown in ig. 9, which ay induce actuator slewrate saturation. It can been observed fro igs. and 9, with only difference by using either desired or degraded reference odel, difference in the syste responses for the two cases lies in the transient part after the fault occurrence. The steady-state perforance is identical. This fact deonstrated clearly the role of the degraded reference odel in governing dynaic perforance of the post-fault syste. To test the perforance of the developed TCS for handling different levels of fault, different levels, ranging fro % to % control effectiveness loss, of faults for single as well as siultaneous actuator faults have been siulated. or deonstration, results for the following three fault levels, 7%, % and % loss of the aileron control effectiveness, are shown in igs. and. As can be seen, as the severity of the fault increases, the perforance of the reconfigured syste decreases. Because of significant change of the syste dynaics induced by the 7% aileron fault, the significantly large control signal is needed at the initial period of the syste reconfiguration. In fact, the required control signal in the aileron channel has exceeded the saturation liit. Once less severe fault is introduced, the control signal are well within the liits. or different levels of fault, there are also soe differences in the steady-state. As shown in ig., it should be pointed out that due to the severity of the actuator faults (7% loss of aileron/rudder control effectiveness in these cases and the requireent of sooth coand input switching, a short period of actuator aplitude saturation in the aileron/rudder control channel is observed. To deonstrate the effects and the liitations induced by actuator saturation, syste responses and associated control signals without saturation constraint are plotted further in igs. and. It is interested to see that without consideration of perforance degradation and actuator saturation constraint, ideally, one is able to recover the original Sideslip angle (deg Bank angle (deg Reconfiguration with perforance degradation Without degradation, with saturating actuator Without degradation, without saturating actuator Reference response under noral & fault conditions - t - - Reconfiguration with perforance degradation Without degradation, with saturating actuator Without degradation, without saturating actuator Reference response under noral & fault conditions - t ig.. Effect of actuator saturation on syste outputs.

11 Incorporating Perforance Degradation in ault Tolerant Control Syste Design with Multiple Actuator ailures 7 Closed-loop control signal (δ a Closed-loop control signal (δ r Saturation liit - t Saturation liit Reconfiguration with perforance degradation Without degradation, with saturating actuator Without degradation, without saturating actuator Coand input under noral and fault conditions Reconfiguration with perforance degradation Without degradation, with saturating actuator Without degradation, without saturating actuator Coand input under noral and fault conditions - t ig.. Effect of actuator saturation on control signals. perforance. However, the price to pay for the deanded perforance is that significantly large control signals need to be generated, as can be seen in ig. for the case of aileron fault condition. Because of such physical deand for a large control signal to recover perforance, violent changes in actuator characteristics induced by the fault, soothen switching in coand input in consideration of actuator slew-rate constraint, and the unavailability of an accurate post-fault odel for feedback control signal synthesis during initial period of control reconfiguration, such a teporary actuator saturation should be acceptable in the case of severe fault conditions. 7. CONCLUSIONS To achieve gracefully degraded perforance for different actuator faults, a new fault-tolerant control syste design ethod has been developed which can deal with different actuator faults through different degraded reference odels. ault-tolerant control is ipleented through a odel-following control structure by using these degraded reference odels. urtherore, the control syste coand inputs are also adusted accordingly to avoid potential saturation. Siulation results have deonstrated the effectiveness of the proposed schee using an aircraft exaple. REERENCES [] M. Blanke, M. Kinnaert, J. Lunze, and M. Staroswiecki, Diagnosis and ault-tolerant Control, nd ed., Springer, Berlin, Gerany,. [] M. Bodson and W. A. Pohlchuck, Coand liiting in reconfigurable flight control, Journal of Guidance, Control, and Dynaics, vol., no., pp. 9., 99. [] J. Chen and R. H. Middleton (Guest editors, Special issue on new developents and applications in perforance liitation of feedback control, IEEE Trans. on Autoatic Control, vol., no., pp. 97-9,. [] Y. Eun, C. Gokcek, P. T. Kababa, and S. M. Meerkov, Selecting the level of actuator saturation for sall perforance degradation of linear designs, Proc. of the th IEEE Conf. on Decision and Control, pp , Orlando, L, Dec.. [] G. C. Goodwin, S.. Graebe, and M. E. Salgado, Control Syste Design, Prentice Hall, Upper Saddle River, NJ,. [] B. Jiang, M. Staroswiecki, and V. Cocquepot, ault accoodation for nonlinear dynaic systes, IEEE Trans. on Autoatic Control, vol., no. 9, pp. 7-,. [7] M. Mahoud, J. Jiang, and Y. M. Zhang, Active ault Tolerant Control Systes: Stochastic Analysis and Synthesis, Lecture Notes in Control and Inforation Sciences, vol. 7, Springer, Berlin, Gerany,. [] H. Noura, D. Sauter,. Haelin, and D. Theilliol, ault-tolerant control in dynaic systes: Application to a winding achine, IEEE Control Systes Magazine, vol., no., pp. -9, eb.. [9] M. Pachter, P. R. Chandler, and M. Mears, Reconfigurable tracking control with saturation, Journal of Guidance, Control, and Dynaics, vol., no., pp. -, 99. [] R. J. Patton. ault-tolerant control: the 997 situation, Proc. of the rd IAC Syp. on ault Detection, Supervision and Safety for Technical Processes, pp. -, Hull, UK, Aug [] T. Perez, G. C. Goodwin, and M. M. Seron, Perforance degradation in feedback control due to constraints, IEEE Trans. on Autoatic Control, vol., no., pp. -,. [] K. M. Sobel and H. Kaufan, Direct odel reference adaptive control for a class of MIMO systes, In C. T. Leondes, editor, Control and Dynaic Systes, vol., pp. -. Acadeic Press, New York, 9. [] M. Staroswiecki and A.-L. Gehin, ro control to supervision, Annual Reviews in Control, vol., pp. -,. [] D. Theilliol, C. Join, and Y. M. Zhang, Active fault-tolerant control systes based on reconfigurable reference input, In J. Korbicz, K.

12 Youin Zhang, Jin Jiang, and Didier Theilliol Patan, and M. Kowal (Eds., ault Diagnosis and ault Tolerant Control, Acadeic Publishing House EXIT, 7. [] N. E. Wu, Y. M. Zhang, and K. Zhou, Detection, estiation, and accoodation of loss of control effectiveness, Int. J. of Adaptive Control and Signal Processing, vol., no. 7, pp ,. [] Y. M. Zhang and J. Jiang, An active faulttolerant control syste against partial actuator failures, IEE Proceedings - Control Theory and Applications, vol. 9, no., pp. 9-, Jan.. [7] Y. M. Zhang and J. Jiang, Bibliographical review on reconfigurable fault-tolerant control systes, Proc. of the th IAC Syp. on ault Detection, Supervision and Safety for Technical Processes, pp. -7, Washington, D.C., USA, June. [] Y. M. Zhang and J. Jiang, ault tolerant control syste design with explicit consideration of perforance degradation, IEEE Trans. on Aerospace and Electronic Systes, vol. 9, no., pp. -, July. Youin Zhang received his Ph.D. degree in 99 fro the Departent of Autoatic Control, Northwestern Polytechnical University, Xian, P. R. China. He held several teaching and research positions in Northwestern Polytechnical University, University of New Orleans, Louisiana State University, State University of New York at Binghaton, The University of Western Ontario, and Aalborg University Esberg, respectively. He is currently an Associate Professor in the Departent of Mechanical and Industrial Engineering at Concordia University, Canada. His ain research interests are in the areas of fault diagnosis and fault-tolerant control systes, dynaic systes odelling, identification and control, and signal processing. He published over ournal and conference papers. Jin Jiang obtained his Ph.D. degree in 99 fro the Departent of Electrical Engineering, University of New Brunswick, redericton, New Brunswick, Canada. Currently, he is a Professor in the Departent of Electrical and Coputer Engineering at The University of Western Ontario, London, Ontario, Canada. His research interests are in the areas of fault-tolerant control of safetycritical systes, power syste dynaics and controls, and advanced signal processing. Didier Theilliol received the Ph.D. degree in Control Engineering fro Nancy-University (rance in 99. Since Septeber, he is a full Professor in Research Centre for Autoatic Control of Nancy (CRAN at Nancy-University where he coordinates and leads national, European and international RD proects in steel industries, wastewater treatent plant, or aerospace doain. His current research interests include odel-based fault diagnosis ethod synthesis and active fault-tolerant control syste design for LTI, LPV, ulti-linear systes. He is a chair of Intelligent Control and Diagnosis working group where different rench and Geran research teas are involved. He published over 7 ournal and conference papers.