Avionic Air Data Sensors Fault Detection and Isolation by means of Singular Perturbation and Geometric Approach

Abstract

Singular Perturbations represent an advantageous theory to deal with systems characterized by a two-time scale separation, such as the longitudinal dynamics of aircraft which are called phugoid and short period. In this work, the combination of the NonLinear Geometric Approach and the Singular Perturbations leads to an innovative Fault Detection and Isolation system dedicated to the isolation of faults affecting the air data system of a general aviation aircraft. The isolation capabilities, obtained by means of the approach proposed in this work, allow for the solution of a fault isolation problem otherwise not solvable by means of standard geometric techniques. Extensive Monte-Carlo simulations, exploiting a high fidelity aircraft simulator, show the effectiveness of the proposed Fault Detection and Isolation system.

1. Introduction

Current manned and unmanned aircraft implement autopilots ranging from simple stability augmentation systems to complex navigation systems. Due to the high level of criticality of aircraft, autopilots need to implement robust design strategies to guarantee, for example, appropriate levels of fault tolerance. In particular, a review of aeronautical worldwide sources on safety event reports reveals repeated instances of anomalous Air Data Sensor (ADS) events. The nature of ADS measurements, indeed, makes air-data probes subject to the spectrum of environmental conditions and, even with a design meant to withstand harsh conditions, instances of ADS probe faults have been recorded for diverse platform types and situations [1,2,3] and citations therein.

The Fault Detection and Isolation (FDI) represents a relevant and critical theme in many sectors such as surgery [4], automotive [5], electrical engineering [6], wind turbines [7] and aerospace engineering [8,9,10,11,12,13,14,15,16,17,18]. Although aircraft subsystems are designed with sufficient levels of redundancy to tolerate both hardware and software faults, FDI algorithms are suitable to monitor the aircraft safety and assess the eventual presence of anomalies, [19,20,21,22,23]. The main goal of the FDI is represented by the decision about the status of health of the system (fault detection) and, in case of faults, the second objective is the localization as well as the determination of the fault nature [24]. Furthermore, the importance and relevance of Air Data Sensor FDI has been highlighted by the European project (ADDSAFE, Advanced Fault Diagnosis for Sustainable Flight Guidance and Control) which was focused on the study of this problem [25].

Common FDI systems are based on either hardware or analytical redundancies but, in recent years, the aerospace industry is demanding for solutions guaranteeing the same or an improved fail safety level with a reduced level of hardware redundancy [26]. From one hand both general aviation aircraft and UAVs have not the payload capacity to be equipped with standard hardware redundancy and, on the other hand, engineers designing large aircraft try to save weight to reduce the consumed fuel, costs, noise and pollution. Conversely, analytical redundancy does not require additional hardware because exploits the mathematical model of the system as redundant information but is more challenging due to the need of guaranteeing its robustness in the presence of unknown disturbances, noise and model uncertainties.

Different model based FDI methods have been developed during recent years [27,28,29,30] but all of them share the same common structure highlighted in Figure 1. The state of art sees model based FDI methodologies be roughly classified in two main groups: those based on a bank of detection residuals each one trivially dependent on different fault components and those which implement a fault re-constructor. With reference to the FDI methods belonging to the first group, this work introduces an innovative approach applicable to those systems which can be described by a singular perturbation model.

This paper presents a model based FDI approach which solves the problem with a two-step procedure. In the first phase a set of variables known as residuals is provided by one or more parallel residual generators: each residual is designed to be zero (or zero mean) in absence of faults belonging to a certain different subset of the whole faults set. The second step is represented by the decision, made on the base of the analysis of the residuals, about the presence of faults (fault detection) and which is the fault that is affecting the system (fault isolation). The FDI module proposed in this paper is designed by means of the NonLinear version of the Geometric Approach (NLGA) [31,32]. Thanks to the NLGA it is possible to design detection residuals which are insensitive to a selected subset of all the faults potentially affecting the system. The fault isolation is obtained by collecting the detection residuals, which are insensitive to different fault subsets, in a bank of residuals whose configuration identifies which fault is present.

This paper proposes, for the design of the residual generators, an innovative and combined use of the NonLinear version of the Geometric Approach (NLGA) [31,32] and of the Singular Perturbations (SP) theory [33]. This work shows that this kind of strategy allows for the solution of the fault isolation problem, for general aviation aircraft affected by faults on air data sensors, not otherwise solvable with the standard NLGA approach, see [31,34].

Thanks to the NLGA it is possible to analyse the system to identify the isolable faults. The results of this analysis are valid for any possible methodological tool successively exploited for the design of the detection residuals. When two or more faults are unisolable the only methodological approach which can provide information about the presence of these faults consists in an estimation of the whole unisolable fault vector thus requiring the implementation of high order input re-constructor systems. With the goals of reducing the complexity of the FDI system, to increase its modularity and to make it distributable, the designers try to minimize the estimator dimensions. The literature presents some remarkable works dealing with the detection and the isolation of faults affecting aircraft air data such as [1,2,3,10,13,17,20,21,35] in which the detection filters are base on full order unknown input re-constructors. At the opposite, this paper focuses on the reduction of dimensions of the unisolable fault set and, thanks to the innovative combined use of the SP and the NLGA, allows for the isolation of the angle of attack faults, otherwise not possible, by means of reduced order detection filters.

The paper is organized as follows: Section 2 describes the nonlinear aircraft model used for the FDI module design. Section 3 details the Air Data System and its associated fault scenario whereas Section 4 proposes the design of the novel FDI module, based on the NLGA combined with SP theory. Finally, in Section 5 simulations results, based on a general aviation aircraft flight simulator and Monte-Carlo simulations, are given, showing the effectiveness of the approach and the good performance of the FDI system.

2. Nonlinear Longitudinal Aircraft Model

In this paper the aircraft is modelled as a rigid body subject to the following external forces and momentums: gravity, aerodynamics and engine thrust. The longitudinal dynamics of aircraft can be represented by the following equations, [36]:

$$\begin{array}{ccc}\hfill \dot{h}& =& v_c\hfill \\ \hfill \dot{V}& =& {\displaystyle \frac{T}{m}}cos\alpha -{\displaystyle \frac{q_{d}S{C}_{D_{TOT}}}{m}}-g{\displaystyle \frac{v_c}{V}}\hfill \\ \hfill {\dot{v}}_c& =& {\displaystyle \frac{T}{m}}\left(cos\alpha {\displaystyle \frac{v_c}{V}}+sin\alpha \sqrt{1-{\left({\displaystyle \frac{v_c}{V}}\right)}^2}\right)-g+{\displaystyle \frac{q_{d}S{C}_{L_{TOT}}}{m}}\sqrt{1-{\left({\displaystyle \frac{v_c}{V}}\right)}^2}-{\displaystyle \frac{q_{d}S{C}_{D_{TOT}}}{m}}{\displaystyle \frac{v_c}{V}}\hfill \\ \hfill \dot{\alpha }& =& q-{\displaystyle \frac{1}{mV}}\left(Tsin\alpha +q_{d}S{C}_{L_{TOT}}-mg\sqrt{1-{\left({\displaystyle \frac{v_c}{V}}\right)}^2}\right)\hfill \\ \hfill \dot{q}& =& {\displaystyle \frac{1}{I_y}}\left(d_{T}T+q_{d}S\overline{c}{C}_{m_{TOT}}\right)\hfill \end{array}$$

(1)

where h is the altitude, V is the airspeed, $v_c$ the rate of climb, $\alpha$ the angle of attack and q is the pitch rate. The term m indicates the mass, $I_y$ the longitudinal inertia, $q_d$ is the dynamic pressure, S is the wing reference area and $\overline{c}$ indicates the mean aerodynamics chord, g represents the gravity acceleration and $d_T$ the thrust arm. The aerodynamic forces and momentums coefficients are $C_{L_{TOT}}$, $C_{D_{TOT}}$ and $C_{m_{TOT}}$. Finally, T, indicating the thrust, is the first control input. For a conventional aircraft, the typical component build–up technique, see [36], leads to the following standard aerodynamics description:

$$\begin{array}{ccc}{C}_{D_{TOT}}\hfill & =& C_{D_0}+C_{D_{\alpha }}\alpha \hfill \\ C_{L_{TOT}}\hfill & =& C_{L_0}+C_{L_{\alpha }}\alpha +C_{L_q}\frac{q\overline{c}}{2V}+C_{L_{{\delta }_e}}{\delta }_e\hfill \\ C_{m_{TOT}}\hfill & =& C_{m_0}+C_{m_{\alpha }}\alpha +C_{m_q}\frac{q\overline{c}}{2V}+C_{m_{{\delta }_e}}{\delta }_e\hfill \end{array}$$

(2)

where the aerodynamics coefficients $C_{s_k}$ with $s\in \{D,L,m\}$ and $k\in \{0,\alpha ,q,{\delta }_e\}$ are considered known parameters thanks to wind tunnel and flight tests. The term ${\delta }_e$, representing the elevator deflection, is the second control input. The overall model can be rewritten in the following compact form:

$${\displaystyle \left[\begin{array}{c}{\dot{\mathbf{x}}}_1\\ \epsilon {\dot{\mathbf{x}}}_2\end{array}\right]=\left[\begin{array}{c}{\mathbf{g}}_{1,0}({\mathbf{x}}_1,{\mathbf{x}}_2)\\ {\mathbf{g}}_{2,0}({\mathbf{x}}_1,{\mathbf{x}}_2)\end{array}\right]+\sum _{i=1}^p\left[\begin{array}{c}{\mathbf{g}}_{1,i}({\mathbf{x}}_1,{\mathbf{x}}_2)\\ {\mathbf{g}}_{2,i}({\mathbf{x}}_1,{\mathbf{x}}_2)\end{array}\right]u_i}$$

(3)

where ${\mathbf{x}}_1={[h,V,v_c]}^T\in {\mathbb{R}}^{n_1}$ and ${\mathbf{x}}_2={[\alpha ,q]}^T\in {\mathbb{R}}^{n_2}$ represent the state vector, suitably partitioned, and where the term, $\epsilon$, is the small positive perturbation parameter, called singular. Moreover, the actuator inputs are two, i.e., $p=2$, with $u_1=T$ and $u_2={\delta }_e$. The model is completed by the outputs ${\mathbf{y}}_1={\mathbf{x}}_1$ and ${\mathbf{y}}_2={\mathbf{x}}_2$ whereas the non linear term ${\mathbf{g}}_{i,j}({\mathbf{x}}_1,{\mathbf{x}}_2)$ with $i\in \{1,2\}$ and $j\in \{0,\cdots ,p\}$ are:

$${\mathbf{g}}_{1,0}({\mathbf{x}}_1,{\mathbf{x}}_2)=\left[\begin{array}{c}{v}_c\\ -{\displaystyle \frac{q_{d}S{C}_{D_{TOT}}}{m}}-g{\displaystyle \frac{v_c}{V}}\\ {\displaystyle \frac{q_{d}S\left(C_{L_0}+C_{L_{\alpha }}\alpha +C_{L_q}\frac{q\overline{c}}{2V}\right)}{m}}\sqrt{1-{\left({\displaystyle \frac{v_c}{V}}\right)}^2}-{\displaystyle \frac{q_{d}S{C}_{D_{TOT}}}{m}}{\displaystyle \frac{v_c}{V}}-g\end{array}\right]$$

(4)

$$\begin{array}{c}{\mathbf{g}}_{2,0}({\mathbf{x}}_1,{\mathbf{x}}_2)=\left[\begin{array}{c}q-{\displaystyle \frac{1}{mV}}\left(q_{d}S\left(C_{L_0}+C_{L_{\alpha }}\alpha +C_{L_q}\frac{q\overline{c}}{2V}\right)-mg\sqrt{1-{\left({\displaystyle \frac{v_c}{V}}\right)}^2}\right)\\ {\displaystyle \frac{1}{I_y}}{q}_{d}S\overline{c}\left(C_{m_0}+C_{m_{\alpha }}\alpha +C_{m_q}\frac{q\overline{c}}{2V}\right)\end{array}\right]\hfill \end{array}$$

(5)

$${\mathbf{g}}_{1,1}({\mathbf{x}}_1,{\mathbf{x}}_2)=\left[\begin{array}{c}0\\ {\displaystyle \frac{cos\alpha }{m}}\\ {\displaystyle \frac{1}{m}}\left(cos\alpha {\displaystyle \frac{v_c}{V}}+sin\alpha \sqrt{1-{\left({\displaystyle \frac{v_c}{V}}\right)}^2}\right)\end{array}\right]{\mathbf{g}}_{2,1}({\mathbf{x}}_1,{\mathbf{x}}_2)=\left[\begin{array}{c}-{\displaystyle \frac{sin\alpha }{mV}}\\ {\displaystyle \frac{d_T}{I_y}}\end{array}\right]$$

(6)

$${\mathbf{g}}_{1,2}({\mathbf{x}}_1,{\mathbf{x}}_2)=\left[\begin{array}{c}0\\ 0\\ {\displaystyle \frac{1}{m}}{q}_{d}S\sqrt{1-{\left({\displaystyle \frac{v_c}{V}}\right)}^2}{C}_{L_{{\delta }_e}}\end{array}\right]{\mathbf{g}}_{2,2}({\mathbf{x}}_1,{\mathbf{x}}_2)=\left[\begin{array}{c}-{\displaystyle \frac{1}{mV}}{q}_{d}S{C}_{L_{{\delta }_e}}\\ {\displaystyle \frac{1}{I_y}}{q}_{d}S\overline{c}{C}_{m_{{\delta }_e}}\end{array}\right]$$

(7)

Hypothesis 1.

AutoPilot Control model: in general, the design of the FDI module should be independent from the structure of the controller except for some high level properties introduced by means of the control unit, such as the stability of the closed loop system. In detail, this work proposes an FDI scheme which can be successfully applied to flight controllers which have sufficiently slow outputs to allow for the definition of the manifold ${\mathbf{x}}_{2_{\mathcal{M}}}$ which will be defined later. In particular:

• given the state $\mathbf{x}={[{\mathbf{x}}_1^T,{\mathbf{x}}_2^T]}^T\in X\subset {\mathbb{R}}^n$, the control laws $u_i$ are sufficiently smooth functions of the states $\mathbf{x}$, i.e., $u_i=u_i(\mathbf{x})$, and there exist a Lipschitz constant L such that $||u_i({\mathbf{x}}^{\star })-u_i(\mathbf{x})||<L||{\mathbf{x}}^{\star }-\mathbf{x}||$ $\forall \mathbf{x},{\mathbf{x}}^{\star }\in X$;
• the control laws $u_i(\mathbf{x})$ are built up by two components $u_i(\mathbf{x})=u_i^f(\mathbf{x})+u_i^s(\mathbf{x})$ where $u_i^f(\mathbf{x})$ represents the fast component and $u_i^s(\mathbf{x})$ is the slow contribution;
• the fast term $u_i^f(\mathbf{x})$ is not active when $\epsilon {\dot{\mathbf{x}}}_2=\mathbf{0}$, i.e., it is such that

  $${\displaystyle \mathbf{0}={\mathbf{g}}_{2,0}({\overline{\mathbf{x}}}_1,{\mathbf{x}}_2)+\sum _{i=1}^p{\mathbf{g}}_{2,i}({\overline{\mathbf{x}}}_1,{\mathbf{x}}_2)u_i^s(\mathbf{x});}$$
• the slow control law, $u_i^s(\mathbf{x})$, is such that

  $${\displaystyle \underset{\epsilon \to 0}{lim}\epsilon {\displaystyle \frac{d}{dt}}{u}_i^s(\mathbf{x})=0.}$$

The assumption of having $\epsilon =0$ shrinks the state-space dimension from $n_1+n_2$ to $n_1$ because of the degeneration to an algebraic equation of the second relation in (3). In this $slow$ time scale the fast state, ${\mathbf{x}}_2$, evolve on a manifold defined by the approximated slow state ${\mathbf{x}}_1$ and the slow part of the control law, $u_i^s$, respectively identified by ${\overline{\mathbf{x}}}_1$ and ${\overline{u}}_i^s$:

$${\displaystyle \left[\begin{array}{c}{\dot{\overline{\mathbf{x}}}}_1\\ \mathbf{0}\end{array}\right]=\left[\begin{array}{c}{\mathbf{g}}_{1,0}({\overline{\mathbf{x}}}_1,{\mathbf{x}}_2)\\ {\mathbf{g}}_{2,0}({\overline{\mathbf{x}}}_1,{\mathbf{x}}_2)\end{array}\right]+\sum _{i=1}^p\left[\begin{array}{c}{\mathbf{g}}_{1,i}({\overline{\mathbf{x}}}_1,{\mathbf{x}}_2)\\ {\mathbf{g}}_{2,i}({\overline{\mathbf{x}}}_1,{\mathbf{x}}_2)\end{array}\right]{\overline{u}}_i^s}$$

(8)

Equations (8) represent the reduced model.

For standard aircraft, the algebraic system in (8)

$${\displaystyle \mathbf{0}={\mathbf{g}}_{2,0}({\overline{\mathbf{x}}}_1,{\mathbf{x}}_2)+\sum _{i=1}^p{\mathbf{g}}_{2,i}({\overline{\mathbf{x}}}_1,{\mathbf{x}}_2){\overline{u}}_i^s}$$

(9)

admits one isolated root, ${\mathbf{x}}_{2_{\mathcal{M}}}=\mathbf{M}({\overline{\mathbf{x}}}_1,{\overline{u}}_1^s,\cdots ,{\overline{u}}_p^s)$.

On the other hand, during the transient phases of the fast variables, the SP theory treats the slow variables as parameters. Defined the time scale change, $\tau =\left(t-t_0\right)/\epsilon$ with $t_0>0$, the apex derivatives are defined as ${\mathbf{x}}^{\prime }=d\mathbf{x}/d\tau$ and the dynamic order of the system is reduced from $n_1+n_2$ to $n_2$ by assuming $\epsilon =0$:

$${\displaystyle \left[\begin{array}{c}{\mathbf{x}}_1^{\prime }\\ {\mathbf{x}}_2^{\prime }\end{array}\right]=\left[\begin{array}{c}\mathbf{0}\\ {\mathbf{g}}_{2,0}({\mathbf{x}}_1,{\mathbf{x}}_2)\end{array}\right]+\sum _{i=1}^p\left[\begin{array}{c}\mathbf{0}\\ {\mathbf{g}}_{2,i}({\mathbf{x}}_1,{\mathbf{x}}_2)\end{array}\right]u_i}$$

(10)

Equations (10) represent the boundary–layer model. Defined the error ${\mathbf{z}}_2={\mathbf{x}}_2-{\mathbf{x}}_{2_{\mathcal{M}}}$, the approximated model is well posed if the following hypothesis is verified [33]:

Hypothesis 2.

The fast control law, $u_i^f$, is such that the origin of the system

$$\begin{array}{ccc}\hfill {\displaystyle \frac{d}{d\tau }}{\mathbf{z}}_2& =& {\displaystyle {\mathbf{g}}_{2,0}({\overline{\mathbf{x}}}_1,{\mathbf{x}}_{2_{\mathcal{M}}}+{\mathbf{z}}_2)+\sum _{i=1}^p{\mathbf{g}}_{2,i}({\overline{\mathbf{x}}}_1,{\mathbf{x}}_{2_{\mathcal{M}}}+{\mathbf{z}}_2)({\overline{u}}_i^s+u_i^f)}\hfill \end{array}$$

(11)

is a locally exponential stable equilibrium point, uniformly in $({\overline{\mathbf{x}}}_1,{\overline{u}}_i^s)$.

Lemma 1.

Given two matrices ${\mathbf{K}}_1$ and ${\mathbf{K}}_2$ with proper dimensions, any linear static state feedback control law $u_i(\mathbf{x})={\mathbf{K}}_1{\mathbf{x}}_1+{\mathbf{K}}_2\left({\mathbf{x}}_2-{\mathbf{x}}_{2_{\mathcal{M}}}\right)$ verifies the Hypotheses 1 and 2.

Proof. 

Let us define the fast control law with $u^f={\mathbf{K}}_2\left({\mathbf{x}}_2-{\mathbf{x}}_{2_{\mathcal{M}}}\right)$ and the slow control law with $u_i^s={\mathbf{K}}_1{\mathbf{x}}_1$. The slow control law is such that ${\displaystyle \underset{\epsilon \to 0}{lim}\epsilon {\displaystyle \frac{d}{dt}}{u}_i^s={\mathbf{K}}_1\underset{\epsilon \to 0}{lim}\epsilon {\displaystyle \frac{d}{dt}}{\mathbf{x}}_1={\mathbf{K}}_1{\mathbf{x}}_1^{\prime }=0}$. On the other hand, the fast control law is null when ${\mathbf{x}}_2={\mathbf{x}}_{2_{\mathcal{M}}}$ i.e., when ${\displaystyle \mathbf{0}={\mathbf{g}}_{2,0}({\overline{\mathbf{x}}}_1,{\mathbf{x}}_2)+\sum _{i=1}^p{\mathbf{g}}_{2,i}({\overline{\mathbf{x}}}_1,{\mathbf{x}}_2){\overline{u}}_i^s}$. Finally, the linearisation of the system (11) at the the origin is represented by ${\displaystyle {\dot{\mathbf{z}}}_2=\mathbf{A}{\mathbf{z}}_2+\sum _{i=1}^p{\mathbf{b}}_i{u}_i}$ where the couple $(A,[{\mathbf{b}}_1,\cdots ,{\mathbf{b}}_p])$, for standard aircraft configurations, is stabilizable thus implying the existence of a state feedback matrix ${\mathbf{K}}_2$ such that the origin of the system is locally exponentially stable. ☐

Remark 1.

Thanks to the state augmentation technique, the results of Lemma 1 can be extended to linear dynamic controllers to demonstrate that standards autopilots installed on general aviation aircraft, usually implementing proportional–integral–derivative structures, fulfil the Hypotheses 1 and 2.

Finally, the actual system dynamics (3) can be approximated by:

$$\begin{array}{ccc}\hfill \left[\begin{array}{c}{\dot{\overline{\mathbf{x}}}}_1\\ {\mathbf{x}}_2^{\prime }\end{array}\right]& =& {\displaystyle \left[\begin{array}{c}{\mathbf{g}}_{1,0}({\overline{\mathbf{x}}}_1,\mathbf{M}({\overline{\mathbf{x}}}_1,{\overline{u}}_1^s,\cdots ,{\overline{u}}_p^s))\\ {\mathbf{g}}_{2,0}({\overline{\mathbf{x}}}_1,{\mathbf{x}}_2)\end{array}\right]+\sum _{i=1}^p\left[\begin{array}{c}{\mathbf{g}}_{1,i}({\overline{\mathbf{x}}}_1,\mathbf{M}({\overline{\mathbf{x}}}_1,{\overline{u}}_1^s,\cdots ,{\overline{u}}_p^s))\\ {\mathbf{g}}_{2,i}({\overline{\mathbf{x}}}_1,{\mathbf{x}}_2)\end{array}\right]u_i}\hfill \end{array}$$

(12)

3. Air Data System

The Air Data System (ADS) is one of the fundamental subsystems of aircraft because, thanks to it, autopilots can regulate the airspeed, V, and barometric altitude, h, which are necessary for guaranteeing the stability and for the guidance of the air-plane. Standard ADSs also include the measurement of the angle of attack, $\alpha$, extremely useful for avoiding instantaneous dangerous stall situations (for example due to aggressive manoeuvres or unexpected wind). ADSs are composed by two main parts: the probes and the computational unit, see Figure 2a. The probes are constituted by a “total air pressure” port, a “static air pressure” port, a “total air temperature” port and a “vane sensor” which provide the measurements $y_{P_T}$, $y_{P_S}$, $y_{{\theta }_T}$ and $y_{\alpha }$ respectively.

The “total air pressure”, $P_T$, and the “static air pressure”, $P_S$, are linked to the airspeed V thanks to the Bernoulli’s law:

$$P_T=P_S+{\displaystyle \frac{1}{2}}\rho V^2$$

(13)

where $\rho$ indicates the air density, in turn linked to the static air temperature, ${\theta }_S$, and pressure, $P_S$, by means of the ideal gas law:

$$P_S=\rho R{\theta }_S$$

(14)

where R is the ideal gas constant for air $R=287.04$ m²/(°C s²). Finally the International Standard Atmosphere (ISA) model [37] introduced a mathematical description of the static air pressure, $P_S$ as function of the geometric height above the mean sea level, H:

$$\begin{array}{ccc}\hfill P_{S_{ISA}}(H)& =& P_0{\left(1-KH\right)}^{\frac{g}{RK}}\hfill \end{array}$$

(15)

where $P_0=101,325$ Pa represents the standard static pressure at the seal level and $K=4.193\times {10}^{-4}$ m⁻¹ is the temperature rate in the troposphere.

To correctly compute the barometric altitude, the airspeed V and the rate of climb $v_c$, the total air temperature ${\theta }_T$ is exploited to determine, combined with the static air pressure the air density. These computations are usually implemented into an Air Data Computer (ADC) which receive $y_{P_T}$, $y_{P_S}$, $y_{{\theta }_T}$ and $y_{\alpha }$ and give as output the estimated barometric altitude $y_h$, the estimated airspeed $y_V$ and the estimated rate of climb $y_{v_c}$:

$$\begin{array}{ccc}\hfill y_h& =& P_{S_{ISA}}^{-1}(y_{P_S})\hfill \\ \hfill \widehat{M}& =& \sqrt{{\displaystyle \frac{2}{\gamma -1}}\left[{\left({\displaystyle \frac{y_{P_T}}{y_{P_S}}}\right)}^{\frac{\gamma -1}{\gamma }}-1\right]}\hfill \\ \hfill {\widehat{\theta }}_S& =& {\displaystyle \frac{y_{{\theta }_T}}{1+\frac{\gamma -1}{2}{\widehat{M}}^2}}\hfill \end{array}\begin{array}{ccc}\hfill y_V& =& \sqrt{\gamma R{\widehat{\theta }}_S}\widehat{M}\hfill \\ \hfill y_{v_c}& =& {\displaystyle \frac{\partial P_{S_{ISA}}^{-1}(y_{p_s})}{\partial P_S}}d{y}_{P_S}\hfill \\ \hfill {\dot{dy}}_{P_S}& =& {\lambda }_{P_S}\left({\dot{y}}_{P_S}-d{y}_{P_S}\right)\hfill \end{array}$$

(16)

where $\widehat{M}$ indicates the Mach number estimation, ${\widehat{\theta }}_S$ the static air temperature estimation and $\gamma$ is the ratio of specific heats. The term $d{y}_{P_S}$ represents a low-pass filtered version of ${\dot{y}}_{P_S}$ where ${\lambda }_{P_S}$ is the pole of the filter. Finally, the FDI module needs of an estimation of the air density, $\widehat{\rho }$, which is provided by the ADS by means of the following equation:

$$\widehat{\rho }={\displaystyle \frac{y_{P_S}}{R{\widehat{\theta }}_S}}$$

(17)

The angle of attack, $\alpha$, represents a crucial quantity which describes the aerodynamic behaviour of the aircraft in each flight condition. The aerodynamic lift, L, is directly (quasi-linearly) proportional to the angle of attack until $\alpha$ remains in certain limits, $\alpha \in [{\alpha }_{min}^{lin},{\alpha }_{max}^{lin}]$, determined by the aircraft shape. Close these limits the lift the aircraft can produce increases but non linearly and reach a (minimum)maximum at $({\alpha }_{min}^L){\alpha }_{max}^L$. Further increases of $\alpha$ correspond to a decrease of L up to the so called “stall angle” ${\alpha }^{stall}$ at which the lift suddenly decreases to zero. The autopilot has to guarantee that $\alpha$ always remains in certain predetermined safety regions of the open set $({\alpha }_{min}^{stall},{\alpha }_{max}^{stall})$. Usually the angle of attack is measured by means of vane sensors constituted by a mechanical flag which align itself with the air-stream and a electronic transducer which provides the measurement of the rotation angle $y_{\alpha }$, see Figure 2b.

Air Data System Faults

This work demonstrates that, thanks to the joint use of the NLGA and the SP, faults affecting ADS can be correctly detected and isolated. To this end, the model of the system, even in presence of such faults, have to hold the singular perturbation properties. It is worth observing that failures on sensors which induce the instability of aircraft are not taken into account because no hardware redundancy is considered in this work. Different strategies, which are out of the scope of this paper, can be exploited to deal with this kind of fault scenario. Furthermore, only multiple (more than one) but non concurrent (only one per time) faults are considered in this work. The i-th fault is indicated by $F_i$ where $F_i(\mathbf{x},\mathbf{u},t,t_0)\to \mathbb{R}$ is a scalar real values function dependent on time, input and state. The faults affect the system at time $t_0\in \mathbb{R}$, with $t_0>0$, so that $F_i(\mathbf{x},\mathbf{u},t,t_0)=0$ $\forall t<t_0$ and progressively reach their asymptotic value $F_i^{\infty }$ (see Figure 3)

$$F_i(\mathbf{x},\mathbf{u},t,t_0)=F_i^{\infty }{\displaystyle \frac{1-e^{-(t-t_0)/{\Delta }_t}}{1+e^{-(t-t_0)/{\Delta }_t}}}\forall t\ge t_0$$

(18)

where ${\Delta }_t\in {\mathbb{R}}_{>0}$ is a time constant. The subscript $i\in \{1,\cdots ,n_F\}$ indicates the physical faults on altitude, air speed, rate of climb and angle of attack sensor. Finally, to improve the readability of this manuscript, the dependencies of faults are omitted but where necessary.

The faults are modelled in terms of variation, from the nominal behaviour, due to biases and sensitivity modifications as

$$y_s=s+F_{s}s=\{P_S,P_T,{\theta }_T,\alpha \}$$

(19)

where $F_s=b_s+(k_s-1)s$, $(b_s,k_s)\in \mathbb{R}\times {\mathbb{R}}_{+}$. In particular, the faulty static and total pressure outputs are described by:

$$\begin{array}{ccc}\hfill y_{P_T}& =& P_S+{\displaystyle \frac{1}{2}}\rho V^2+F_{P_T}\hfill \\ \hfill y_{P_S}& =& P_S+F_{P_S}\hfill \\ \hfill y_{{\theta }_T}& =& {\theta }_S\left(1+\frac{\gamma -1}{2}\gamma R{\theta }_S{V}^2\right)+F_{{\theta }_T}\hfill \end{array}$$

(20)

where $F_{P_T}$, $F_{P_S}$ and $F_{{\theta }_T}$ respectively indicate the faults affecting the total pressure, the static pressure and the total temperature port. The faults influencing both pressure and temperature ports result in faults on altitude, $F_h$, airspeed, $F_V$, and rate of climb, $F_{v_c}$, as:

$$\begin{array}{ccc}\hfill F_h(F_{P_S},h)& =& h-y_h\hfill \\ \hfill F_V(F_{P_T},F_{P_S},F_{{\theta }_T},V)& =& V-y_V\hfill \\ \hfill F_{v_c}(F_{P_S},v_c)& =& v_c-y_{v_c}\hfill \end{array}$$

(21)

Let us now identify the following sets of faults:

$$\begin{array}{ccc}{\mathbf{F}}_{{\mathbf{x}}_1}\hfill & =& \{F_{P_T},F_{P_S},F_{{\theta }_T}\}\hfill \\ {\mathbf{F}}_{{\mathbf{x}}_2}\hfill & =& \{F_{\alpha }\}\hfill \\ \mathbf{F}\hfill & =& \{{\mathbf{F}}_{{\mathbf{x}}_1},{\mathbf{F}}_{{\mathbf{x}}_2}\}\hfill \end{array}$$

(22)

Thanks to the assumption of non-concurrent faults, it is possible to define the “active fault” as the element $F_i\in \mathbf{F}$ which is non-zero and the "active fault subset" as the fault subset, among ${\mathbf{F}}_{x_1}$ and ${\mathbf{F}}_{x_2}$, which the active fault belongs to. Finally, let use define the k-th fault parameter set as:

$${\mathcal{S}}_k:=\{b_k,{\eta }_k:b_k\in \mathbb{R},{\eta }_k\in \mathbb{R}\}$$

(23)

4. NLGA FDI for Singularly Perturbed Aircraft Model

This section shows novel methodological aspects arising when combining SP and NLGA for the solution of the FDI problem which can be generally stated as:

Problem 1.

FDI: given the aircraft longitudinal models (3) and (12) with the fault scenario $\mathbf{F}$ described in (22), design an FDI module with inputs ${\mathbf{y}}_1(t)$, ${\mathbf{y}}_2(t)$ and $u_1,\cdots ,u_p$, and output the set $\mathcal{R}=\{r_1^d,\dots ,r_{n_R}^d\}$ of $n_R$ binary residuals such that each fault $F_k$, with $k\in \left\{1,\dots ,n_F\right\}$, affect a different, non-empty subset, ${\Omega }_k$, of residuals within $\mathcal{R}$.

The solution of an FDI problem can be stated in terms of a residual matrix, $RM$ which is an $n_R\times n_F$ rectangular matrix with boolean elements where the rows list the detection residuals whereas the columns represent the fault/fault subsets. The matrix’s element $RM(i,j)$ is equal to a logic 0 if the i-th detection residual is not sensitive to the j-th fault whereas is a boolean $X\in \{0,1\}$ otherwise. The presence of the boolean X is motivated by the residual sensitivity to the fault with respect to the noise which will be investigated in Section 5. Finally, the subsets ${\Omega }_k$ is identified by the k-th column of $RM$.

To this end, the dynamic model of aircraft subject to faults on ADS is represented by:

$$\begin{array}{c}{\displaystyle \left[\begin{array}{c}{\dot{\mathbf{x}}}_1\\ \epsilon {\dot{\mathbf{x}}}_2\end{array}\right]=\left[\begin{array}{c}{\mathbf{g}}_{1,0}({\mathbf{x}}_1,{\mathbf{x}}_2)\\ {\mathbf{g}}_{2,0}({\mathbf{x}}_1,{\mathbf{x}}_2)\end{array}\right]+\sum _{i=1}^p\left[\begin{array}{c}{\mathbf{g}}_{1,i}({\mathbf{x}}_1,{\mathbf{x}}_2)\\ {\mathbf{g}}_{2,i}({\mathbf{x}}_1,{\mathbf{x}}_2)\end{array}\right]u_i}\end{array}$$

(24)

where the output is given by

$$\left[\begin{array}{c}{\mathbf{y}}_1\\ {\mathbf{y}}_2\end{array}\right]=\left[\begin{array}{c}{\mathbf{x}}_1\\ {\mathbf{x}}_2\end{array}\right]+\left[\begin{array}{c}{\varphi }_1({\mathbf{F}}_{{\mathbf{x}}_1})\\ {\varphi }_2({\mathbf{F}}_{{\mathbf{x}}_2})\end{array}\right]$$

(25)

with

$${\varphi }_1({\mathbf{F}}_{{\mathbf{x}}_1})=\left[\begin{array}{c}{F}_h(F_{P_S},h)\\ F_V(F_{P_T},F_{P_S},F_{{\theta }_T},V)\\ F_{v_c}(F_{P_S},v_c)\end{array}\right]{\varphi }_2({\mathbf{F}}_{{\mathbf{x}}_2})=\left[\begin{array}{c}{F}_{\alpha }\\ 0\end{array}\right]$$

(26)

Fault os output can be seen as input faults by means of the method proposed in [34] and here briefly reported: ${\nu }_k\ge 1$ equivalent and simultaneous input faults, $f_{k,i}(i=1,\dots ,{\nu }_k)$, are introduced in place of the non concurrent output faults $F_k$ $\forall k\in \{1,\dots ,n_F\}$. Given the k-th scalar output $y_k$ of (24), substitute $y_k$ to its relative state $x_k$ in the dynamic system (24) and identify the ${\nu }_k\ge 1$ different functions, ${\varphi }_{k,i}(y_k)$ with $i\in \{1,\cdots ,{\nu }_k\}$, containing the term $y_k$. Define the equivalent input fault as $f_{k,i}:={\varphi }_{k,i}(x_k)$-${\varphi }_{k,i}(y_k)$ and its input vector as ${\mathbf{l}}_{k,i}$. Whenever the k-th sensor fault occurs, i.e., $F_k\ne 0$, all associated input faults $f_{k,i}(i=1,\dots ,{\nu }_k)$ will become non-zero:

$$\begin{array}{c}{\displaystyle \left[\begin{array}{c}{\dot{\mathbf{y}}}_1\\ {\dot{\mathbf{y}}}_2\end{array}\right]=\left[\begin{array}{c}{\mathbf{g}}_{1,0}({\mathbf{y}}_1,{\mathbf{y}}_2)\\ {\mathbf{g}}_{2,0}({\mathbf{y}}_1,{\mathbf{y}}_2)\end{array}\right]+\sum _{i=1}^p\left[\begin{array}{c}{\mathbf{g}}_{1,i}({\mathbf{y}}_1,{\mathbf{y}}_2)\\ {\mathbf{g}}_{2,i}({\mathbf{y}}_1,{\mathbf{y}}_2)\end{array}\right]u_i+\sum _{k=1}^{n_F}\sum _{i=1}^{{\nu }_k}\left[\begin{array}{c}{\mathbf{l}}_{1_{k,i}}({\mathbf{y}}_1,{\mathbf{y}}_2)\\ {\mathbf{l}}_{2_{k,i}}({\mathbf{y}}_1,{\mathbf{y}}_2)\end{array}\right]f_{k,i}}\end{array}$$

(27)

where the terms ${\mathbf{l}}_{1_{k,i}}$ and ${\mathbf{l}}_{2_{k,i}}$ represent the input distributions of mathematical sensor faults. Let us define with the term ${\mathbf{f}}_k$ the set of input faults associated to the sensor fault $F_k$:

$${\mathbf{f}}_k:={\{f_{k,1},\cdots ,f_{k,{\nu }_k}\}}^T$$

(28)

The set of equivalent mathematical faults associated to $\mathbf{F}$ is given by the set of vectors ${\mathbf{f}}_k$, for $k=1,\cdots ,n_F$, and is denoted by $\mathbf{f}$:

$$\mathbf{f}:=\{{\mathbf{f}}_k,k=1,\cdots ,n_F\}$$

(29)

Finally, define with ${\mathbf{l}}_{k,i}$ the mathematical fault vector field for the overall system, i.e., ${\mathbf{l}}_{k,i}={\left[{\mathbf{l}}_{1k,i}^T,{\mathbf{l}}_{2k,i}^T\right]}^T$ and with ${\mathbf{l}}_k$ the vector field collecting all the input vector fields relative to the set ${\mathbf{f}}_k$:

$${\mathbf{l}}_k:=\left\{{\mathbf{l}}_{k,1},\cdots ,{\mathbf{l}}_{k,{\nu }_k}\right\}$$

(30)

Before introducing the solution to the FDI problem rewrite the system (27) as:

$$\begin{array}{c}{\displaystyle \dot{\mathit{\xi }}={\mathbf{g}}_0(\mathit{\xi })+\sum _{i=1}^p{\mathbf{g}}_i(\mathit{\xi })u_i+\sum _{k=1}^{n_F}{\mathbf{l}}_k(\mathit{\xi }){\mathbf{f}}_k}\hfill \\ \mathit{\chi }=\mathbf{h}(\mathit{\xi })\hfill \end{array}$$

(31)

where

$$\begin{array}{c}\mathit{\xi }=\left[\begin{array}{c}{\mathbf{y}}_1\\ {\mathbf{y}}_2\end{array}\right],\mathbf{h}(\mathit{\xi })=\mathit{\xi },{\mathbf{g}}_0(\mathit{\xi })=\left[\begin{array}{c}{\mathbf{g}}_{1,0}(\mathit{\xi })\\ {\mathbf{g}}_{2,0}(\mathit{\xi })\end{array}\right],{\mathbf{g}}_i(\mathit{\xi })=\left[\begin{array}{c}{\mathbf{g}}_{1,i}(\mathit{\xi })\\ {\mathbf{g}}_{2,i}(\mathit{\xi })\end{array}\right]\end{array}$$

(32)

Im case of of fully measured state, i.e., $h(\xi )=\xi$, the NLGA necessary conditions for solving the FDI problem are expressed by the following algorithm [31]:

• given a set $s\subseteq \{1,\cdots ,n_F\}$
• given the fault set $\mathbf{F}$, define the subset ${\mathbf{F}}_s\subseteq \mathbf{F}$ with ${\mathbf{F}}_s:=\{{\mathbf{F}}_k,k\in s\}$ and the generalized disturbance ${\mathbf{D}}_s=\mathbf{F}\backslash {\mathbf{F}}_s$;
• given the equivalent fault set $\mathbf{f}$ associated to $\mathbf{F}$, define the subset ${\mathbf{f}}_s\subseteq \mathbf{f}$ associated to ${\mathbf{F}}_s$, i.e., ${\mathbf{f}}_s:=\{{\mathbf{f}}_k,k\in s\}$, and the generalized disturbance ${\mathbf{d}}_s=\mathbf{f}\backslash {\mathbf{f}}_s$ associated to ${\mathbf{D}}_s$;
• associate to the sets ${\mathbf{f}}_s$ and ${\mathbf{d}}_s$ their relative input vector fields ${\mathbf{l}}_s$ and ${\mathbf{p}}_s$ respectively:

  $$\begin{array}{ccc}\hfill {\mathbf{l}}_s& :=& \{{\mathbf{l}}_k,k\in s\}\hfill \\ \hfill {\mathbf{p}}_s& :=& \{{\mathbf{l}}_k,k\in (\{1,\cdots ,n_F\}\backslash s)\}\hfill \end{array}$$
• if ${\mathbf{l}}_s\notin {\overline{\mathbf{p}}}_s$ the generalized faults set ${\mathbf{f}}_s$ is detectable and a suitable change of coordinate can be determined.

Property 1.

Given the system (27) with the fault scenario (22), an NLGA study reveals that, defined ${\mathbf{F}}_s=\mathbf{F}\backslash \{F_{{\mathbf{x}}_2}\}$ then ${\mathbf{l}}_s={\overline{\mathbf{p}}}_s$ thus implying that the necessary conditions for the solution of the FDI problem are not fulfilled for the isolation of fault affecting the air (pressure and temperature) ports and the angle of attack vane sensor.

On the other hand, the sufficient conditions are expressed by the existence of two coordinate changes, in state and output spaces, $\Phi (\mathit{\xi })$ and $\Psi (\mathit{\chi })$ respectively, which consist in a surjection ${\Psi }_1$ and a function ${\Phi }_1$ such that ${\overline{\mathbf{p}}}_s^{\perp }\cap span\left\{d\mathbf{h}\right\}=span\left\{d\left({\Psi }_1○\mathbf{h}\right)\right\}$ and ${\overline{\mathbf{p}}}_s^{\perp }=span\left\{d{\Phi }_1\right\}$, where:

$$\left\{\begin{array}{ccc}\Phi (\mathit{\xi })\hfill & =& \left(\begin{array}{c}{\overline{\mathit{\xi }}}_1\\ {\overline{\mathit{\xi }}}_2\end{array}\right)=\left(\begin{array}{c}{\Phi }_1(\mathit{\xi })\\ {\mathbf{C}}_2\mathbf{h}(\mathit{\xi })\end{array}\right)\hfill \\ \Psi (\mathit{\chi })\hfill & =& \left(\begin{array}{c}{\overline{\mathit{\chi }}}_1\\ {\overline{\mathit{\chi }}}_2\end{array}\right)=\left(\begin{array}{c}{\Psi }_1(\mathit{\chi })\\ {\mathbf{C}}_2\mathit{\chi }\end{array}\right)\hfill \end{array}\right.$$

(33)

are (local) diffeomorphisms, whilst ${\mathbf{C}}_2$ is a selection matrix, i.e. its rows are a subset of the rows of the identity matrix. If the sufficient conditions are verified then, by using the new (local) state and output coordinates $(\overline{\mathit{\xi }},\overline{\mathit{\chi }})$, the system (31) is transformed as follows:

$$\begin{array}{c}{\displaystyle {\dot{\overline{\mathit{\xi }}}}_1={\overline{\mathbf{n}}}_1({\overline{\mathit{\xi }}}_1,{\overline{\mathit{\xi }}}_2)+\sum _{i=1}^p{\overline{\mathbf{g}}}_{1,i}({\overline{\mathit{\xi }}}_1,{\overline{\mathit{\xi }}}_2)u_i+{\overline{\mathbf{l}}}_1({\overline{\mathit{\xi }}}_1,{\overline{\mathit{\xi }}}_2){\mathbf{f}}_s}\hfill \\ {\displaystyle {\dot{\overline{\mathit{\xi }}}}_2={\overline{\mathbf{n}}}_2({\overline{\mathit{\xi }}}_1,{\overline{\mathit{\xi }}}_2)+\sum _{i=1}^p{\overline{\mathbf{g}}}_{2,i}({\overline{\mathit{\xi }}}_1,{\overline{\mathit{\xi }}}_2)u_i+{\overline{\mathbf{l}}}_2({\overline{\mathit{\xi }}}_1,{\overline{\mathit{\xi }}}_2){\mathbf{f}}_s+{\overline{\mathbf{p}}}_2({\overline{\mathit{\xi }}}_1,{\overline{\mathit{\xi }}}_2){\mathbf{d}}_s}\hfill \\ {\overline{\mathit{\chi }}}_1={\overline{\mathbf{h}}}_1({\overline{\mathit{\xi }}}_1)\hfill \\ {\overline{\mathit{\chi }}}_2={\overline{\mathit{\xi }}}_2\hfill \end{array}$$

(34)

with ${\mathbf{l}}_{s_1}(\overline{\mathit{\xi }})$ not identically zero. As described in [31], the subsystem ${\overline{\mathit{\xi }}}_1$ in Equation (34) is locally weakly observable so the detection residual associated to ${\mathbf{f}}_s$ and thus to ${\mathbf{F}}_s$ is given by:

$$\begin{array}{c}{\displaystyle {\dot{\widehat{\overline{\mathit{\xi }}}}}_1={\overline{\mathbf{n}}}_1({\widehat{\overline{\mathit{\xi }}}}_1,{\overline{\mathit{\chi }}}_2)+\sum _{i=1}^p{\overline{\mathbf{g}}}_{1,i}({\widehat{\overline{\mathit{\xi }}}}_1,{\overline{\mathit{\chi }}}_2)u_i+\mathbf{K}\mathbf{r}}\hfill \\ \mathbf{r}={\overline{\mathit{\chi }}}_1-{\mathbf{h}}_1({\widehat{\overline{\mathit{\xi }}}}_1)\hfill \end{array}$$

(35)

Finally, for each vectorial residual $\mathbf{r}$, define a positive scalar function $r=\sqrt{{\mathbf{r}}^T\mathbf{W}\mathbf{r}}$ where $\mathbf{W}$ is a positive weights matrix, a positive real constant $r^{th}$ and a boolean variable $r^d$ defined as:

$$r^d=\left\{\begin{array}{cc}0& r\le r^{th}\\ 1& r>r^{th}\end{array}\right.$$

(36)

NLGA Combined with Singular Perturbations

This Section contains the main results of this work and shows how the FDI problem can be solved by means of the coordinated use of the SP jointly with the standard NLGA.

Theorem 1.

Given the system (24) and for each k-th fault, there exist a subset of ${\mathcal{S}}_k$ such that it is possible to approximate the actual dynamics of the aircraft (24) by its associated reduced and boundary layer models.

Proof. 

Let us assume that the aircraft (24) is equipped with a controller fulfilling Hypotheses 1 and 2 and define the eigenvalues of the system, affected by the k-th fault $F_k$, as ${\lambda }_i({\mathit{\nu }}_k)$ with $i=1,\cdots ,n$ and ${\mathit{\nu }}_k=(b_k,{\eta }_k)\in {\mathcal{S}}_k$. Then, as stated in [38,39] and thanks to the smoothness of the system (24) and its control system and based on their Lipschitz features, for any ${ϵ}_k>0$ it is possible to find a sufficiently small subset ${\mathcal{S}}_k^{\star }\subseteq {\mathcal{S}}_k$, possibly dependent on ${ϵ}_k$, such that the eigenvalue of the closed loop system (24) are such that

$$||{\lambda }_i({\overline{\mathit{\nu }}}_k)-{\lambda }_i({\mathit{\nu }}_k)||<{ϵ}_k\forall {\mathit{\nu }}_k\in {\mathcal{S}}_k^{\star },i=1,\cdots ,n$$

where ${\overline{\mathit{\nu }}}_k=(0,1)$ indicates the vector of the nominal parameters (fault free condition). For each fault parameter in the set ${\mathcal{S}}_k^{\star }$, the model approximation is valid because the eigenvalues remain close the nominal ones so that the stability as well as the time separation properties can be kept valid.

On the base of the Theorem 1 the actual aircraft dynamics (24) is approximated by its reduced and boundary layer models:

$$\begin{array}{c}{\displaystyle \left[\begin{array}{c}{\dot{\overline{\mathbf{x}}}}_1\\ {\mathbf{x}}_2^{\prime }\end{array}\right]=\left[\begin{array}{c}{\mathbf{g}}_{1,0}({\overline{\mathbf{x}}}_1,{\mathbf{x}}_{2_{\mathcal{M}}})\\ {\mathbf{g}}_{2,0}({\overline{\mathbf{x}}}_1,{\mathbf{x}}_2)\end{array}\right]+\sum _{i=1}^p\left[\begin{array}{c}{\mathbf{g}}_{2,i}({\overline{\mathbf{x}}}_1,{\mathbf{x}}_{2_{\mathcal{M}}})\\ {\mathbf{g}}_{2,i}({\overline{\mathbf{x}}}_1,{\mathbf{x}}_2)\end{array}\right]u_i}\hfill \\ \left[\begin{array}{c}{\mathbf{y}}_1\\ {\mathbf{y}}_2\end{array}\right]=\left[\begin{array}{c}{\overline{\mathbf{x}}}_1\\ {\mathbf{x}}_2\end{array}\right]+\left[\begin{array}{c}{\varphi }_1({\mathbf{F}}_{{\mathbf{x}}_1})\\ {\varphi }_2({\mathbf{F}}_{{\mathbf{x}}_2})\end{array}\right]\hfill \end{array}$$

(37)

where ${\mathbf{x}}_{2_{\mathcal{M}}}=\mathbf{M}\left({\overline{\mathbf{x}}}_1,u_1,\cdots ,u_p\right)$ is an isolated root of

$${\displaystyle \mathbf{0}={\mathbf{g}}_{2,0}({\overline{\mathbf{x}}}_1,{\mathbf{x}}_2)+\sum _{i=1}^p{\mathbf{g}}_{2,i}({\overline{\mathbf{x}}}_1,{\mathbf{x}}_2)u_i}$$

(38)

The fault mapping procedure [34] applied to (37) leads to:

$$\begin{array}{c}{\displaystyle \left[\begin{array}{c}{\dot{\overline{\mathbf{y}}}}_1\\ {\mathbf{y}}_2^{\prime }\end{array}\right]=\left[\begin{array}{c}{\mathbf{g}}_{1,0}({\overline{\mathbf{y}}}_1,{\mathbf{y}}_{2_{\mathcal{M}}})\\ {\mathbf{g}}_{2,0}({\overline{\mathbf{y}}}_1,{\mathbf{y}}_2)\end{array}\right]+\sum _{i=1}^p\left[\begin{array}{c}{\mathbf{g}}_{2,i}({\overline{\mathbf{y}}}_1,{\mathbf{y}}_{2_{\mathcal{M}}})\\ {\mathbf{g}}_{2,i}({\overline{\mathbf{y}}}_1,{\mathbf{y}}_2)\end{array}\right]u_i+\sum _{k=1}^{n_1}\sum _{i=1}^{{\nu }_k}\left[\begin{array}{c}{\mathbf{l}}_{1_{k,i}}({\overline{\mathbf{y}}}_1,{\mathbf{y}}_{2_{\mathcal{M}}})\\ {\mathbf{l}}_{2_{k,i}}({\overline{\mathbf{y}}}_1,{\mathbf{y}}_2)\end{array}\right]f_{k,i}+}\\ {\displaystyle +\sum _{k=n_1+1}^{n_F}\sum _{i=1}^{{\nu }_k}\left[\begin{array}{c}\mathbf{0}\\ {\mathbf{l}}_{2_{k,i}}({\overline{\mathbf{y}}}_1,{\mathbf{y}}_2)\end{array}\right]f_{k,i}}\end{array}$$

(39)

where ${\mathbf{y}}_{2_{\mathcal{M}}}=\mathbf{M}\left({\overline{\mathbf{y}}}_1,u_1,\cdots ,u_p\right)$. The following properties have been obtained by comparing the systems (27) and (39):

• the fault set ${\mathbf{F}}_{x_2}$ does not affects the equations relative to ${\overline{\mathbf{y}}}_1$, see Equation (39);
• the whole fault vector $\mathbf{F}$ affects the equations relative to ${\mathbf{y}}_2$ and ${\overline{\mathbf{y}}}_2$, see Equations (27) and (39);
• the vector ${\overline{\mathbf{y}}}_1$ represents a constant for equations relative to ${\overline{\mathbf{y}}}_2$, see Equation (39);
• the fault set ${\mathbf{F}}_{x_2}$ does not affects the algebraic equations relative to ${\mathbf{x}}_{2_{\mathcal{M}}}$.

These properties are exploited in the following lemmas:

Lemma 2.

Given the system (39) with the fault scenario (22), taken ${\mathbf{F}}_s={\mathbf{F}}_{{\mathbf{x}}_1}$ the surjection ${\Psi }_1(\mathit{\xi })={\overline{\mathbf{y}}}_1$ and the function ${\Phi }_1(\mathit{\xi })={\overline{\mathbf{y}}}_1$ are such that:

$$span\{d{\Psi }_1(\mathit{\xi })\}=span\{d{\Phi }_1(\mathit{\xi })\}\subseteq {\overline{\mathbf{p}}}_s^{\perp }$$

Proof. 

Given the system (39) with the fault scenario (22), taken ${\mathbf{F}}_s={\mathbf{F}}_{{\mathbf{x}}_1}$ and determined ${\mathbf{D}}_s={\mathbf{F}}_{{\mathbf{x}}_2}$, the ${\mathbf{d}}_s$ is defined as ${\mathbf{d}}_s:=\{{\mathbf{f}}_k,k\in \{n_1+1,\cdots ,n_F\}\}$ with its associated input vector field defined $\forall i\in \{1,\cdots ,{\nu }_k\}$ and $\forall k\in \{n_1+1,\cdots ,n_F\}$ as:

$${\mathbf{p}}_s:=\left\{\left[\begin{array}{c}\mathbf{0}\\ {\mathbf{l}}_{2_{k,i}}({\overline{\mathbf{y}}}_1,{\mathbf{y}}_2)\end{array}\right]\right\}$$

In conclusion, the involutive closure of ${\mathbf{p}}_s$ is such that $span\{d{\overline{\mathbf{y}}}_1\}\subseteq {\overline{\mathbf{p}}}_s^{\perp }$ because, thanks to the Singular Perturbation approximation, the first $n_1$ components of each vector field in ${\mathbf{p}}_s$ are null. ☐

Lemma 3.

Given the system (39) with the fault scenario (22), given $\mathbf{F}$ and ${\mathbf{F}}_{{\mathbf{x}}_1}$ as in Property 1 and defined the input vector fields relative to their generalized disturbance, $\mathbf{p}$ and ${\mathbf{p}}_{{\mathbf{x}}_1}$ respectively, then ${\overline{\mathbf{p}}}^{\perp }\supset {\overline{\mathbf{p}}}_{{\mathbf{x}}_1}^{\perp }$.

Proof. 

The combined used of Lemma 2 and SP shows that the projection of ${\overline{\mathbf{p}}}^{\perp }$ on ${\overline{\mathbf{y}}}_1$ has components that the projection of ${\overline{\mathbf{p}}}_{{\mathbf{x}}_1}^{\perp }$ has not. As consequence, a coordinate change can be found to design a residuals that is independent from $F_{\alpha }$. ☐

Lemma 4.

Given the system (27) and its singularly perturbed approximation (39), then the active fault subset is isolable.

Proof. 

Two different residuals are designed on the base of Property 1 and Lemma 2, $r_1^d$ and $r_2^d$. The first one, $r_1^d$, is originated by ${\Phi }_1(\mathit{\xi })={\Psi }_1(\mathit{\xi })={\mathbf{y}}_1$ and the second one, $r_2^d$, exploits the singular perturbed coordinate change ${\Phi }_1(\mathit{\xi })={\Psi }_1(\mathit{\xi })={\overline{\mathbf{y}}}_1$. The residual $r_1^d$ and $r_2^d$ are organized in a residual matrix, depicted in

Table 1. Residual matrix for the isolation of the active fault subset.

Residual	${\mathbf{F}}_{{\mathbf{x}}_1}$	${\mathbf{F}}_{{\mathbf{x}}_2}$
$r_1^d$	X	X
$r_2^d$	X	0

, where the second row results to be fundamental to isolate the active fault subset. ☐

Remark 2.

A study of Table 1 reveals that the elimination of the residual $r_2^d$, introduced thanks to the adoption of the SP approximation, make the the isolation the faults in $F_{{\mathbf{x}}_1}$ and the fault on the vane sensor, $F_{\alpha }$, structurally impossible. Furthermore, can be demonstrated that Lemma 4 is valid also when considering the whole aircraft dynamics (comprehensive of lateral and directional motions) also in presence of faults affecting the side-slip angle vane sensor (considered as a further element of the fault set $F_{{\mathbf{x}}_2}$).

5. Simulation Results

The results presented in this paper have been obtained in simulation. The simulation benchmark is represented by a general aviation aircraft for which technical reports are available in literature. In particular NASA Technical Notes [40,41,42] describe the aerodynamics of the aircraft and the propeller. Figure 4 graphically depicts the blocks diagram details composing the simulator:

• Aircraft Dynamics: The dynamics of the aircraft, seen as a rigid body with six degree of freedom, is altered by torques and forces inducing accelerations which, integrated two times, generate speeds and positions. Euler angles describes the attitude of the aircraft;
• Aerodynamics: The NASA reference [40] graphically reports the aerodynamic coefficients of lift L, drag D and pitch momentum M which are functions of the angle of attack $\alpha$ and the thrust coefficient $T/(q_{d}S)$. The simulator implements these coefficients by means of look-up tables;

During the simulations the updating of both the air density, $\rho$, and the gravity acceleration modulus, g, are performed by implementing the reference [37,43] respectively.

The simulation of the sensor suite follows what stated in [44,45]:

• the pitch rate is provided by means of one gyroscope of an IMU (Inertial Measurement Unit). The measurement errors are comprehensive of non unitary scale factor, alignment error (random), g-sensitivity, additive white noise and gyro drift;
• Air Data System (ADS):

  -

  The true air-speed is affected by calibration error of the differential pressure sensor plus additive white noise;

  -

  The altitude measurement is corrupted by calibration error of the static pressure port plus additive white noise;

  -

  The attack angle vane sensor is influenced by calibration errors plus additive white noise.

A detailed description of the measurements used by the considered system can be found in [14].

5.1. Sensitivity Analysis

Uncertainties in model parameters influence the NLGA results in terms of decoupling from the disturbances ${\mathbf{d}}_s$, which is not more perfect, and reduce the sensitivity of ${\overline{\mathit{\xi }}}_1$ with respect to ${\mathbf{f}}_s$ thus making the fault detection and isolation harder. It is rather intuitive that, due to the residual sensitivities and model uncertainties, for each fault $F_k$, different fault severities could identify actual residual subsets ${\Omega }_k$ that are contained in those listed in Table 1.

In particular, for each $k=1,\cdots ,n_F$, there exist:

• an undetectable fault parameter set defined as ${\mathcal{S}}_{k_{\mathrm{und}}}\subseteq {\mathcal{S}}_k^{\star }$ such that $\forall {\mathit{\nu }}_k\in {\mathcal{S}}_{k_{\mathrm{und}}}$ each binary residual $r_i^d=0$, with $i=1,\cdots ,n_R$, so leading to ${\Omega }_k=\{\varnothing \}$ for each $k=1,\cdots ,n_F$;
• a detectable fault parameter set, ${\mathcal{S}}_{k_{\det }}\subseteq {\mathcal{S}}_k^{\star }$, defined as the fault set for which the detection is guaranteed (but not the isolability). In particular, there exist a couple of fault parameters ${\mathit{\nu }}_i$ and ${\mathit{\nu }}_j$ with $i,j\in \{1,\cdots ,n_F\}$ with $i\ne j$, respectively belonging to ${\mathcal{S}}_{i_{\det }}$ and ${\mathcal{S}}_{j_{\det }}$ for which the residuals configurations ${\Omega }_i$ and ${\Omega }_j$ are non-empty but equal thus not providing the isolability;
• an isolable fault parameter set, ${\mathcal{S}}_{k_{\mathrm{isol}}}\subseteq {\mathcal{S}}_k^{\star }$, identified as the fault parameter set such that $\forall {\mathit{\nu }}_k\in {\mathcal{S}}_{k_{\mathrm{isol}}}$ the residuals configuration ${\Omega }_k$ is unique. In particular, for each couple of fault parameters ${\mathit{\nu }}_i$ and ${\mathit{\nu }}_j$ with $i,j\in \{1,\cdots ,n_F\}$ with $i\ne j$, respectively belonging to ${\mathcal{S}}_{i_{\mathrm{isol}}}$ and ${\mathcal{S}}_{j_{\mathrm{isol}}}$ the residuals configurations ${\Omega }_i$ and ${\Omega }_j$ are non-empty and different.

Given the analogical vector residual ${\mathbf{r}}_i$ and an associated comparison threshold $r_i^{th}$, the binary residual $r_i^d>0$ is obtained by means of the following law

$$r_i^d:=\left\{\begin{array}{cc}1& \sqrt{||{\mathbf{r}}_i^T{\mathbf{W}}_i{\mathbf{r}}_i||}>r_i^{th}\\ 0& \sqrt{||{\mathbf{r}}_i^T{\mathbf{W}}_i{\mathbf{r}}_i||}\le r_i^{th}\end{array}\right.$$

(40)

where the elements of the matrices ${\mathbf{W}}_i=\frac{1}{\sqrt{\dim ({\mathbf{r}}_i)}}\mathrm{diag}([w_{i,1},\cdots ,w_{i,\dim ({\mathbf{r}}_i)}])$ have been defined in the following way:

$${\displaystyle \underset{{\mathbf{F}}_s=\{\varnothing \}}{sup}{w}_{i,j}^2{r}_{i,j}^2={\left(r^{th}\right)}^2}$$

(41)

for each $j\in \{1,\cdots ,\dim ({\mathbf{r}}_i)\}$ where $\dim ({\mathbf{r}}_i)$ indicates the dimension of the vector ${\mathbf{r}}_i$.

Table 2. Weight matrices.

Residual	Weights Matrix
${\mathbf{r}}_1$	${\mathbf{W}}_1=\mathrm{diag}([0,1.5625,25,1600,156.25])$
${\mathbf{r}}_2$	${\mathbf{W}}_2=\mathrm{diag}([1.5625,100])$

reports the values given to the weight matrices. As result, the two residuals live under the threshold $r^{th}$ (set equal to 1 in this paper) when in absence of faults, see Figure 5.

For each $k\in \{1,\cdots ,n_F\}$ the sets ${\mathcal{S}}_{k_{\mathrm{und}}}$, ${\mathcal{S}}_{k_{\det }}$ and ${\mathcal{S}}_{k_{\mathrm{isol}}}$ have been numerically determined in presence of the most common uncertain quantity in standard general aviation aircraft (mass, inertia and drag coefficients) and simulated as a random variable with uniform distribution in the set of ±5% of the corresponding nominal parameter.

Table 3. Uncertain Parameters: mass and inertia.

Par.	Units	Minimum Value	Nominal Value	Maximum Value
m	kg	$1548.5$	1630	$1711.5$
$I_y$	kg·m2	2446.1	2574.8	2703.5

and

Table 4. Uncertain Parameters: drag coefficient, $C_D(\alpha )$.

$\mathit{\alpha }$ [deg]	−3.5	−1.5	0.5	2.5	4.5	6.5	8.5	10.5	12.5	14.5	16.5	18.5
min. ${\mathbf{C}}_{\mathbf{D}}$	0.03325	0.0285	0.0285	0.03325	0.04275	0.057	0.08075	0.114	0.152	0.209	0.2755	0.361
nom. ${\mathbf{C}}_{\mathbf{D}}$	0.035	0.03	0.03	0.035	0.045	0.06	0.085	0.12	0.16	0.22	0.29	0.38
max. ${\mathbf{C}}_{\mathbf{D}}$	0.03675	0.0315	0.0315	0.03675	0.04725	0.063	0.08925	0.126	0.168	0.231	0.3045	0.399

and respectively list the nominal parameters, exploited by the FDI module, and their minimum and maximum values assumed into the plant.

Table 5. Sensor Fault Sets.

Variable	Units	m	a	b	c	d
$P_S$	Pa	89,875	−150.0	−20.0	25.0	155.0
$P_T$	Pa	91,876	−51.5	−13.0	14.5	55.5
${\theta }_T$	°C	10	−7.3	−2.0	2.0	7.2
$\alpha$	deg	2.1	−0.22	−0.05	0.07	0.17

lists the resulting fault sets whose bounds, shown in Figure 6, are obtained by assuming a slope modification $k_s\in [-0.1,0.1]$. All the results presented in this work have been obtained by means of an extended Monte-Carlo campaign covering all the cruise flight envelope (unitary positive load factor and air-speed up to the manoeuvre speed).

Remark 3.

The faults considered in this paper are corrupting the sensors and do not directly affect the plant, i.e., they are not system faults which modify the plant structure or the plant parameters. Anyway the fault have a secondary effect on the robustness of the proposed method because the aerodynamic coefficients, exploited by the FDI module, are obtained from look-up tables which entries contain also the angle of attack. This implies that erroneous values of α lead to erroneous values of the lumped parameters exploited to isolate the faults. All the simulation results are comprehensive of this phenomenon.

Remark 4.

The concept of the fault sets have been introduced to describe the behaviour of the detection and isolation logic in presence of faults modelled as sum of biases and slope modifications, i.e., $F_s=b_s+(k_s-1)s$. The sets are given to show how the combination of $b_s$ and $k_s$ influences the detection and isolation results: given $k_s$ the faults can be undetectable, detectable or isolable are functions of the value of $b_s$. The identified fault sets are realistic due to the high fidelity of the simulator. As example the maximum tolerable fault on the static port is fixed by the vertical separation of the air traffic. In particular, the vertical separation is 75 m and a fault of ±690 Pa would lead to an error of about ±60 m [35]. The minimum isolable fault size identified in this paper is about ±155 Pa which is in line with the mentioned limits. Moreover, the aeronautical standard allows for a maximum tolerable error of ±4 knots on the airspeed. The fault size of ±55 Pa on the total air pressure port leads to an airspeed variation of less than ±2 knots while the fault on the static pressure port of ±155 Pa leads to an error of about ±4.5 knots. Finally a fault of about ±7 deg on the total air temperature port leads to an erroneous airspeed of about ±1.5 knots.

5.2. Fault Isolation Performance

To complete the dissertation about the fault detection and isolation, this work ends with the presentation of some single simulation runs in which the aircraft has been set to a cruise at speed 116 knots and altitude of 3280 fts, for a nominal static air pressure and temperature of $89,875$ Pa and 8 °C respectively. The trim conditions are

$$\begin{array}{c}\alpha =2.1[\mathrm{deg}];q=0[\mathrm{deg}/\mathrm{s}];T=1469.6[\mathrm{N}];{\delta }_e=0.22[\mathrm{deg}].\end{array}$$

whereas the faults dynamics has been characterized by a time constant ${\Delta }_t$ of 1 s. Figure 7 report the behaviours of the two detection residuals in presence of faults on the static air pressure port (Figure 7a) and on the total air pressure port (Figure 7b). Both the residuals, in accordance with their design criterion, overcome their threshold thus identifying the configuration of the residual matrix. The graphs in Figure 7a clearly show a quasi impulsive behaviour due to the variation of the rate of climb induced by a fault on the static pressure port: the rate of climb is a low pass filtered version of the static pressure first time derivative indeed. Once this effect disappears the asymptotic value of the residuals is due to the erroneous values of the airspeed. This impulsive behaviour is not present in Figure 7b where the aircraft is affected by faults on the total air pressure port because this measurement does not influence the rate of climb.

The composition of the residual matrix is replicated in the behaviour of the analogical residuals depicted in Figure 7a and Figure 8b.

In conclusion,

Table 6. Monte-Carlo Simulation: sensor faults.

Var.	${\mathit{b}}_{{\mathit{s}}_{\mathit{min}}}$	${\mathit{b}}_{{\mathit{s}}_{\mathit{max}}}$	MFR	FAR	DR	IR	WIR
$P_S$	−1921	707	1.71	2.98	98.29	88.58 1	9.70 1
$P_T$	−284	1667	1.41	3.01	98.59	95.85 1	2.74 1
${\theta }_T$	−71	72.5	2.79	3.12	97.21	89.90 1	7.32 1
$\alpha$	−4.8	8	0.94	2.75	99.06	96.95	2.11

¹ Despite the NLGA analysis clearly states that it is impossible to isolate faults belonging to $F_{{\mathbf{x}}_1}$, the occurrence of a fault in the group $\{F_{P_S},F_{P_T},F_{{\theta }_T}\}$ can be isolated from $F_{\alpha }$ with the percentage indicated by the IR. Accordingly, the WIR indicates the percentage of test which resulted in the isolation of a fault out of the set $F_{{\mathbf{x}}_1}$

reports the result of a 10,000-runs Monte-Carlo simulation in which, with respect to the sets described in Table 6, the faults have been randomly generated with a uniform distribution. The following dimensionless indexes constitute the meter for evaluating the performance of the FDI module:

• Missed Fault Rate (MFR): division of the number of not detected faults over the total number of simulated faults;
• False Alarm Rate (FAR): ratio of the number of faults which have been detected over the number of simulations performed in absence of faults;
• Detection Rate (DR): number of faults that have been detected over the total number of simulations in presence of faults;
• Isolation Rate (IR): division of the number of faults which have been correctly isolated over the total number of simulations in presence of faults;
• Wrong Isolation Rate (WIR): ratio of the number of faults which have been wrongly isolated over total number of simulations in presence of faults.

The values reported in Table 5 indicate a promising effectiveness of the proposed solution. With respect to the isolability of the faults affecting the total air pressure port, there is an inherent difficulty in the isolation of the faults affecting the static pressure port. In particular, a fault increasing $P_S$ produces two counteracting effects: on one hand it increases the estimated airspeed $\widehat{V}$ but on the other it reduces the estimated air density $\widehat{\rho }$ such that the final variation of the pressure dynamic $q_d=\frac{1}{2}\widehat{\rho }{\widehat{V}}^2$ is, in modulus, smaller than the variation due to a fault, with the same magnitude, but affecting the total air pressure port. Since the pressure port faults reveal themselves by means of the dynamic pressure, this phenomenon makes easier the isolation of the faults on the total air pressure. The same conclusions can be obtained about the isolability of the faults affecting the total air temperature port. Furthermore, thanks to the structure of the detection residuals the isolation of faults affecting the vane sensor $\alpha$ is almost perfect (WIR 2%): the second detection residual, $r_2$, is theoretically independent from fault on $\alpha$ thus reducing the possibility of confusing the residual configuration. Values of WIR different from zero, for $F_{\alpha }$, are due to the presence of model uncertainties which makes the decoupling not perfect. Finally the WIR values relative to fault in $F_{{\mathbf{x}}_1}$ are also due to the residual structure: for some flight conditions, these faults may force only the first residual $r_1$ out of its threshold thus inducing a wrong isolation.

6. Conclusions

Given a general aviation aircraft affected by faults on the air data system, this paper proposed a novel approach for solving the Fault Detection and Isolation problem. The cornerstone of the proposed approach stays in the coordinated use of the NonLinear Geometric Approach and the Singular Perturbation theory and represents a suitable solution for designing Fault Detection and Isolation schemes for all that plants whose dynamics can be described by two-time scales. This work demonstrated that, by means of the proposed approach, fault affecting the angle of attack and those affecting the air (both pressure and temperature) probes can be correctly detected and isolated. An aircraft flight simulator, based on high fidelity experimental data of one real general aviation aircraft, has been used as benchmark for assessing the results showed in this paper. Future works will focus on the improvement of the isolation performance by means of the introduction of further sensors.