Numerical Simulation for Redundant Electro-Hydrostatic Servo-Actuators under Certain Special Conditions

Abstract

This work presents some numerical simulations, performed using AMESim software, for a system composed by two redundant servo-actuators. Certain operating conditions are taken into account for these two electro-hydrostatic servo-actuators, which are coupled to the command surface (aileron) of a transport aircraft. We first considered the situation of slight asymmetries in the construction of the servo-actuators, then a situation in which one servo-actuator fails at maximum flight speed, and then at a medium flight speed, and finally we considered the effect of gusts upon the system. Small differences in the construction of the servo-actuators were taken into consideration by modifying each of the pump displacements, one by +2% and one by −2%, from the nominal value. It is possible that many other asymmetries exist in the construction of servo-actuators, such as different liquid leakages in the cylinders or pumps, small differences in the controller coefficients, and so on. These differences should be taken into account in future works. Our results provide evidence that, under some operation situations of redundant servo-actuators, significant overstresses can appear in one servo-actuator, leading to a decrease in the time for which the system operates correctly.

1. Introduction

The use of electro-hydrostatic servo-actuators on aircraft has seen important developments in recent decades. This trend is justified on the one hand by the necessity of replacing electro-hydraulic servo-actuators fed in centralized systems, and on the other hand by the development of high-power electronic components that make it possible to build high-performance controllers, with the power required to drive aircraft command surfaces.

The necessity of replacing hydraulic servo-actuators with electro-hydrostatic ones arose from two well-known airliners catastrophes in the 1980s—the Sioux City and Japan Airlines 123 catastrophes. Both incidents occurred due to the loss of hydraulic feeds in all three of the redundant hydraulic systems in the airliners. At that time, the reliability of this configuration, with three redundant hydraulic systems, was considered sufficiently safe for airliner control. The failure situation of all three systems appeared in a relative short period of time, one after another. The failure mode was similar in both two airliners. A structural failure or an engine failure led to the hydraulic feeding pipes breaking in all three systems, resulting in hydraulic liquid loss. As a consequence, all command servo-actuators stopped, and the airliners could no longer be controlled. The pipe breakages occurred in the tail area. This is the only area of the aircraft where all hydraulic systems have feeding pipes. Here, it is necessary to feed the redundant rudder and elevator servos, and therefore it is necessary for all hydraulic systems to reach this zone using hydraulic pipes. In all other areas of the aircraft, hydraulic pipes are distributed so that structural damage cannot lead to the failure of all hydraulic systems at the same time. Even today, reconditioning techniques for hydraulic pipes are being developed, and their effects are being studied [1], whereas in the cases of those airliner accidents, nothing could be done during flight.

Electric power distribution is expected to be more reliable in this regard. Electric cables are more resistant, and while electrical insulation damage can lead to the burning of some electrical fuses and parts of the electrical power system stopping, the entire electrical power system will not be affected. The remaining parts of the electrical system will be able to operate a subset of the electro-hydrostatic servo-actuators in order to land safely.

One big problem in the construction of electro-hydrostatic servo-actuators is the electric motor controller. It has to manage a large amount of electric power (kilowatts or tens of kilowatts) under conditions with hard variations. Solutions to this problem have improved with the development of more efficient electronic power components in recent years.

Studies concerning electro-hydrostatic servo-actuators on aircraft began to be performed in the 1990s, with the first flight test with such a servo-actuator being performed in 1997 by NASA. Research results started to be published during that time [2,3]. Step by step, research results have materialized supporting the diversification of technical solutions and their applications [4,5,6,7]. Simplified schemes with bilateral rod cylinders became more sophisticated architectures using one rod cylinder and incorporating different solutions to balance the flow difference between the cylinder chambers. Electro-hydrostatic servo-actuators were translated from aircraft to automat manipulators, industrial robots, and other industrial drives. Researchers improved both the mechanical–hydraulic aspects [2,4,5,6] as well as the automatic control solutions [3,8]. There have been studies concerning the dynamic performance of electro-hydrostatic servo-actuators [9,10]. These papers present and elaborate on mathematical models for electro-hydrostatic servos and propose different control techniques in order to improve their dynamic properties and make them suitable use on board aircraft. Design and analysis procedures have been developed for redundant configurations of electro-hydrostatic servo-actuators [11,12,13]. The present state of the art and perspectives on the future of electro-hydrostatic servo-actuators can be found in [14]. In [15], control techniques for electro-hydrostatic servos are presented in consideration of conditions of parametric uncertainty. Most research has concerned electro-hydrostatic servos with asymmetrical cylinders. These have the advantage of using asymmetric cylinders, which are more compact, while the servo architecture and control techniques are more sophisticated [16,17]. Control techniques for electromechanical servos in aircraft that can be extended to electro-hydrostatic servos are presented in [18]. The effect of some of the construction parameters of axial piston pumps in electro-hydrostatic servos was studied in [19]. Techniques for jamming detection I electro-hydrostatic servos on board an airliner are presented in [20].

To date, there have been no studies on the functioning of redundant configurations under special situations that can often appear in practice. One frequent situation is that in which small differences in the construction of the two redundant servo-actuators appear. These small differences can appear as part of the fabrication process, be due to controller adjustment, or arise as a result of different levels of wear over time. Sometimes, a servo-actuator is taken from an aircraft, checked, and put on to another aircraft. A second situation is that where one servo-actuator fails and passes into stand-by mode. In this case, it is necessary to know how the servo-actuator that is still functional will behave—if and under what conditions it will produce sufficient force, how system dynamic performances will be affected, and whether auto-oscillations will appear. A last situation is the effect of gusts upon the command surface. Only the effect upon the aileron when it is maintained in neutral position is considered. The stick is maintained in a fixed neutral position, and a gust stresses the aileron; we study the aileron behavior when driven by the two redundant servos.

Using AMESim software, Rev 13 SL 3 from Siemens, some operational scenarios of redundant electro-hydrostatic servo-actuators are simulated. The configuration consists of two electro-hydrostatic servos disposed in parallel and linked to an airliner aileron. The system parameters were chosen in order to satisfy the standard requirements of airliner servo-actuators. The dimensioning procedure is beyond the scope of this work.

Simulations aim to study the behavior of the servos under different specific situations. Small differences between the servo parameters are taken into account. In practice, the following differences can appear: small difference in controller adjustment, small differences in the construction of system components, or the servos being subjected to different levels of wear. The situation considered consists of differences of±2% with respect to the nominal value of pump displacement.

2. Flight Control Redundancy

Due to the flight controls being critical elements for flight safety, redundancy is built in so to avoid the occurrence of total failure of all flight controls. There are several types of redundancy techniques for flight controls in airliners. On the one hand, the command surface is split into many sections (two, three, or even more), with each section having its own drives. When the drives of one section fail, they transition into a neutral stand-by position, and the remaining sections are able to control the aircraft, albeit with degraded performance. The airliner can be brought safely on to a runway. Moreover, each section has many drives. When one drive fails, the other drives can ensure that the section remains functional, even with a worse dynamic performance. These redundancy techniques were used in the classical systems employing electro-hydraulic servo-actuators, and are also used in modern PBW (power by wire) systems with electro-hydrostatic servo-actuators. In practice, when many control surfaces exist for an airliner control (e.g., two ailerons, two elevators, etc.), each section will be driven by two servo-actuators. If there is only one control surface for the movement of an airliner (e.g., one rudder), it will be driven by a minimum of three servo-actuators.

When the same command surface is driven by two or many servos, the problem arises that not all servos are identical, even if they are of the same type. Small differences in construction can appear, and these differences can result in the servos functioning very differently. We present some cases in this study.

3. Studied System Configuration

The study presented here estimates the external aileron drive of a Boeing 787 airliner. We consider an aileron driven by two electro-hydrostatic servo-actuators with performance characteristics as presented in

Table 1. Estimated electro-hydrostatic servoperformances.

Useful force at positive aileron deflection [kN]	51.6
Useful force at negative aileron deflection [kN]	−61.38
Useful stroke [mm]	34.2
Aileron moment of inertia [kgm2]	7.98

.

Electro-hydrostatic servo-actuators were designed in order to use existing components in the producers’ catalogues. Therefore, we chose components with the characteristics presented in

Table 2. Component characteristics.

Hydraulic cylinder
Piston diameter [mm]	76
Rod diameter [mm]	38
Stroke [mm]	45
Gear pump
Displacement [cm3]	3.12
Maximum pressure [bar]	300
Minimum speed [rpm]	700
Maximum speed [rpm]	6000
Hydro-accumulator
Volume [dm3]	0.32
Maximum pressure [bar]	210
Gas supply pressure [bar]	130
Check valve
Nominal flow [l/min]	6
Maximum pressure [bar]	500
Pressure-limiting valve
Nominal flow [l/min]	20
Opening pressure[bar]	240
Electric motor
Power[kW]	4
Feeding voltage[VDC]	±270
Nominal speed [rpm]	3000
Nominal torque [Nm]	12.7

.

The simulation scheme, also presented in [12], is shown in Figure 1.

From a control point of view, the electric motor is fed from a controlled current source. This source is part of a control loop for motor speed. The control loop is of the proportional type, with a gain of 1, and is provided with output limits in order to maintain the motor feeding current in the ±300 A range. An external loop of the PID type with output signal limits controls the servo-actuator output. A low-pass filter is implemented as an aperiodic block in order to cancel out high-frequency disturbances resulting from dry friction in the system. Mathematical models of the used components can be found in [21].

In Figure 2, the redundant system with two electro-hydrostatic servo-actuators is presented.

The aileron is considered to be subject to rotational inertia, and is linked to a rotation spring that represents the aerodynamic forces. Aileron inertia was considered to be 7.98 kgm² and a value of 306 Nm/° was assumed for the spring elastic constant.

To simulate the small differences between the servo-actuators, we considered one pump with an increase in displacement of 2% compared to the nominal value and one pump with a decrease in displacement of 2% compared to the nominal value. In practice, other differences can also appear between the servos, such as differences in leakage between the cylinders, small differences between the controller’s coefficients, the electric motors having slightly different characteristics, or there being slightly different levels of friction in the servos.

4. Test Signals Used in This Study

In theoretical studies, the most frequently employed test signals are step, ramp, and sinusoidal signals. In this study, we aim to achieve results that are as realistic as possible. Step signals are important from a theoretical point of view, but on airliners, command signals applied to command surfaces have limitations with respect to speed, on the one hand due to the limits of what is possible for the pilot, and on the other hand due to necessity of limiting the structural stresses to which the airliner is subjected. In servo-actuator design, a maximum steering speed of 45°/s is considered for airliner ailerons. Therefore, we considered a ramp signal ranging from zero to the maximum steering angle with a speed of 45°/s, and a sinusoidal signal at maximum amplitude reaching a maximum speed of 45°/s. The maximum steering amplitude was assumed to be20°, so the corresponding sinusoidal frequency was 0.36 Hz.

5. Operational Situations Tested

In this work, a number of operational situations were tested for this system. These situations are not normal operational situations, but are situations that can appear relatively frequently in practice. The first situation is presented in Figure 3, where a small difference between the servo parameters appears, and a ramp signal with parameters as described above is applied.

It can be observed that, in terms of aileron steering, the command is followed very well. Only a very small override exists, as well as some oscillations that are very quickly dampened. With respect to the rod forces, the situation is not so good. Important differences are present (about 26% of the stall force of one servo). It is interesting to note that this difference decreases very slowly (over about 6–7 s—a very long time for this application). One servo opens the pressure-limiting valve, while the other servo presents a slow pressure increase in the high-pressure chamber.

Pressure oscillations appear in the servos due to the compressibility of hydraulic liquid. In fact, this is an interaction between the compressibility of the hydraulic liquid, the inertia of the command surface, aerodynamic forces, and the automatic controller. If the system is linearized and we determine the transfer function, we will find one pole of this function located near the imaginary axis, reflecting the limit of stability. Cancellation of these auto-oscillations can be achieved either by means of a better control technique, or by better tuning of the PID controller. However, the possibilities for tuning the PID controller employed in this work are limited, so it would be necessary to implement a robust control technique. Such pressure auto-oscillations, and even position auto-oscillations, appear frequently in electro-hydraulic and electro-hydrostatic servos when the controller is not well tuned. This phenomenon was observed experimentally in the laboratory.

A frequency analysis is useful for automatic systems, especially in the case of aircraft servos, but such a study was beyond the scope of this paper. We aim to provide evidence of some of the problems that can arise under the conditions described in this work.

The second situation is represented by the sinusoidal signal with a frequency of 0.36 Hz and an amplitude of 20°, see Figure 4. In this situation, too, the aileron follows the command very well, but important differences in the rod forces appear. One servo reaches the stall force at the maximum amplitude and the pressure-limiting valve opens, the other produces a force that is about 30% smaller.

Variations in pressure when the servo input includes rapid variations, as in this situation, do not reflect the problem of the limit of stability; therefore, there is nothing to observe at the lower scale, and there are no small pressure oscillations. This was also observed experimentally in the laboratory. Small auto-oscillations appear when the servo is fixed in one stationary position.

These two situations lead to a situation in which one servo is overstressed and the other is underloaded. One servo being overstressed results in overstress of the pump motor, leading to overload of the electronic controller. This results in a decrease in the time for which the servo will remain functional. It is important to notice these force differences appear at a displacement variation of only 2% with respect to the nominal value in each pump.

In classic electro-hydraulic servos, fed from the centralized hydraulic source in the airliner, small differences in construction lead to small differences in rod forces, but the servo itself will not be overstressed. In such cases, only aileron torsion will be upset. Servo-valves, hydraulic cylinders, and other components are not subjected to overstress conditions. The hydraulic system maintains its nominal feeding pressure, and no components are overstressed.

It should be noted that in electro-hydrostatic servo systems, these differences can be amplified over time. Overstressed pumps will wear faster, displacement differences will be amplified, and this process will become accelerated. To increase the length of time for which the servos function correctly in tandem, a useful strategy is to pair them on the basis of their parameters (like transistors in electronic power circuits), as well as to introduce a section to monitor symmetry of servo functioning. In this way, the overstress in one servo can be cancelled out, with wear being balanced between the two servos, thus increasing system lifetime.

The third situation concerns the failure of one servo. In this situation, it was assumed that in the moment of failure, the by-pass valve of the hydraulic cylinder in the failed servo will open, and the pump motor will be cut off from the feeding source. To perform this simulation, we assumed that the current source output was switched to a ballast resistor to take the source current. The servo configuration employed for this case is presented in Figure 5.

At the moment of failure, the failed servo will behave like a high-friction rod in the system. Its force will always be resistant friction force. The simulation results are shown in Figure 6.

It can be observed that, as expected, the failed servo produces resistant friction, and the functioning servo stalls. The servo is not able to steer the command surface at the maximum angle anymore. However, it is able to steer the aileron at about half of the maximum amplitude.

We assume here failure occurs at maximum flight speed, when the aerodynamic forces are at their maximum level. In such a situation, the pilot has the option to maintain the flight speed, overstressing the remaining servo, or to reduce the flight speed such that the aerodynamic forces are decreased by one half. This requires a decrease in flight speed by $1/\sqrt{2}$ of the maximum flying speed. For example, if the maximum flight speed is 950 km/h, the flight speed will need to be reduced to 675 km/h. By reducing the elastic constant for the spring simulating the aerodynamic forces to one-half, the results presented in Figure 7 were obtained.

In Figure 7,it can be observed that after the failure of one servo, the function of the remaining servo remains almost unchanged. Its force increases a little bit in order to drive the aileron, but it is not overstressed. Nevertheless, small aileron oscillations with a frequency of about 10 Hz occur around the required position. In this case, the system resonance has not been sufficiently well dampened. It is necessary to study whether this frequency fits with the structural resonance frequency or with the Von Karman vortex frequency, in order to avoid structural damage to the airliner.

The failed servo does not produce any active force, but it produces dry friction due to the hydraulic cylinder seals. This is the reason for the occurrence of pressure oscillations in this case. Dry friction is also present when the servo is functioning correctly, but the amount of friction is very low compared to the active hydraulic force. When one of the servos fails, the other servo takes on the friction force of the failed servo. The failed servo no longer has a smooth movement, because it no longer has hydraulic force. This is the reason for the very-high-frequency pulsations of pressure. Because the drive rigidity drops to one-half in this situation, the interaction between servo rigidity and aileron inertia lead to small oscillations in the aileron around the prescribed position. These are complex phenomena. Aerodynamic forces also make a contribution here. At high speed (Figure 6), the higher aerodynamic forces have a stabilizing effect, but the remaining servo will stall. At lower speeds, the aerodynamic forces are not so high that the servo will stall, but the stability will also be decreased. To ensure smooth movement of the aileron under all flight conditions, robust adaptive control is necessary. This cannot be accomplished only by means of the PID control employed in this work.

The final simulation situation is gust system behavior. To this end, the simulation scheme was modified according to Figure 8.

One more input is introduced into the system, consisting of a torque moment applied to the rotation inertia simulating the aileron. The spring that simulates the aerodynamic forces is removed. On this input, a step input of 907 Nm and a sinusoidal signal with a frequency of 1 Hz and the same amplitude were applied. Torque moments applied to the aileron represent about 10% of the maximum aerodynamic moments at the maximum flight speed and maximum aileron deflection. Stick input was considered to be zero. The simulation results are presented in Figure 9 and Figure 10.

The system has sufficient rigidity for both step and sinusoidal gust. Maximum aileron deflection is 0.4° for step gust, but this peak decreases very quickly, while small oscillations of 0.1° remain in the system. For the sinusoidal gust, the peak deflection is about 0.12°, and aileron response consists of many superimposed sinusoids. Due to the small deflection of the aileron in this case, significant differences between the rod forces no longer appear in either situation.

6. Conclusions

On the basis of the simulations, it was noticed that with small differences between the values of pump displacement, important differences in rod force appeared, even when the aileron movement was within the required parameters. Such differences lead to the overstress of one servo, meaning that this servo will suffer wear more rapidly. Structural torsion of the aileron will occur. We consider a force balancing system to be necessary, either using compensation springs or by improving the control loop. In this way, servo lifetime will be increased.

If one of the servos fails at maximum flying speed, the servo that is still functioning will be able to steer the aileron only at about half the maximum stroke. If the flying speed is decreased by about 30%, the functioning servo will be able to steer the aileron at the maximum stroke. Here, it is necessary to emphasize that, for airliners, maximum aileron steering is not typically used at maximum flying speed. The aerodynamic control moments in this case would be too high to maintain good control of the airliner. High aileron amplitudes are only used at low flying speeds close to take-off and landing speeds, and in the corresponding simulations presented in this work, a single servo was sufficient to achieve maximum deflection of the aileron under good conditions. However, small oscillations due to the diminishing drive rigidity occur. Aileron inertia and aerodynamic forces are sufficient to maintain these small oscillations with a frequency of about 10 Hz, superimposed on the command response. Complex interaction between hydraulic liquid compressibility, aileron inertia, aerodynamic force, and the automatic controller bring the system to a stability limit, which manifests as small self-entertained oscillations. These oscillations can be canceled out by using more efficient control techniques or a tuning of the PID controller different from the one used in this paper. However, additional tuning in flight, following the failure of a servo, is not possible. In this case, a robust controller is preferable.

It is important, when designing an airliner, that the frequency of the servo auto-oscillations does not fit with the structural frequencies or the von Karman vortex frequencies.

In the gust response case, the system has a sufficiently high rigidity, and seems to haveno problems. Small differences between the servoparameters have negligible effects.