Research on the Determination Method of Aircraft Flight Safety Boundaries Based on Adaptive Control

Abstract

Icing is one of the main external environmental factors causing loss of control (LOC) in aircraft. To ensure safe flying in icy conditions, modern large aircraft are all fitted with anti-icing systems. Although aircraft anti-icing technology is becoming more sophisticated as research continues to expand and deepen, the scope of protection provided by anti-icing systems based on existing anti-icing technology is still relatively limited, and in practice, it is difficult to avoid flying with ice even when the anti-icing system is switched on. Therefore, it is necessary to consider providing additional safety strategies in addition to the anti-icing system, i.e., to consider icing safety from the aerodynamic, stability, and control points of view during the aircraft design phase, and to build a complete ice-tolerant protection system combining aerodynamic design methods, flight control strategies and implementation equipment. Based on the modern control theory of adaptive control, this paper presents a new method of envelope protection in icing situations based on a case study of icing, which has the advantages of strong real-time performance and good robustness, and has high engineering application value.

1. Introduction

Generally speaking, flight accidents often occur with certain critical flight parameters exceeding their boundaries [1,2]. In order to achieve the pilot’s anxiety-free manipulation of the aircraft and reduce the pilot’s burden, the envelope value of certain critical flight parameters needs to be limited, i.e., flight safety boundaries protection. Flight safety boundaries protection is an effective means to ensure flight safety for civil aviation aircraft in service. The fundamental strategy to ensure flight safety in complex situations without changing the flight quality and control laws of the aircraft itself is to protect the flight safety boundaries of the complex human-machine-loop system, and to provide intelligent warning and maneuvering guidance.

With the development of flight control technology, commercial aircraft such as the Boeing 777 and Airbus 320 make full use of the advantages of the fly-by-wire control system to ensure that these flight parameters do not exceed their boundaries by pre-setting limiters for key parameters such as attack angle, overload, roll angle, etc. However, the icing on the wings and tail of the aircraft will cause the performance of the aircraft to degrade and cause the flight safety envelope curve to shrink, which may lead to flight accidents if the pilot or autopilot still maneuvers the aircraft within the original flight envelope curve, such as the Comair Airlines airplane crash in 1997. Due to the increase in accidents and incidents caused by icing, the envelope protection system on some aircraft has been improved to take into account the shrinkage of the aircraft flight envelope curve caused by icing and other factors. For example, the stall protection system of ATR-72 aircraft works together with the icing protection system to reduce the limit attack angle corresponding to joystick jitter from 18.1° to 11.2° in icing conditions. However, the change in the limit attack angle is not based on the actual icing conditions, but on the worst icing that occurs at the time of icing airworthiness certification. If more severe icing is encountered in practice, especially in the case of supercooled large droplet SLD icing, the aircraft may stall or lose control at a smaller attack angle. In the 1994 ATR-72 accident, an abnormal roll occurred at an attack angle of 5°, resulting in a stall and crash. Obviously, this is due to the fact that the original envelope value did not change with the actual icing conditions and therefore did not prevent the aircraft from exceeding its safe flight range. For this reason, it is necessary to introduce the concept of adaptive flight boundaries for icing aircraft, to dynamically determine the boundaries in real-time, and to protect the boundaries based on reliable control means [3,4,5,6].

On the hot issue of aircraft safety and reliability analysis, many scholars have performed relevant research. Wang YH of Nanjing University of Aeronautics and Astronautics and others proposed a reliability model of the wing span based on stress-strength interference theory and total probability theorem [7]. Geng QC of Beijing University of Aeronautics and Astronautics and others proposed a novel approach to the Safety Analysis of Civil Aircraft based on Dynamic Fault Tree Analysis [8]. Luo Hao of the Harbin Institute of Technology and others proposed a novel bidirectional gated recurrent unit with a temporal self-attention mechanism (BiGRU-TSAM) to predict RUL [9].

Thus, the safety envelope protection under icing conditions can be summarized into the following two technical problems: (1) the problem of accurate determination of generalized stable boundaries for high-dimensional, uncertain, and strongly nonlinear human-machine-loop complex systems; and (2) the problem of dynamic flight safety boundaries protection and critical safety warning for aircraft based on the determined safety boundaries. In this paper, an in-depth analysis of the two scientific problems above is carried out, a reachable icing aircraft flight safety boundaries determination method is proposed, and an icing flight safety boundaries protection system based on L₁ adaptive control is designed, which provides safe flight under icing conditions. In addition to the anti-icing system, we propose an additional protection strategy.

The main tasks of this paper are:

• Referring to the definition of LOC runaway envelope, this paper innovatively proposes a multi-parameter combination dynamic envelope concept and uses the reachable set theory to calculate the dynamic envelope under different degrees of icing conditions, which will be extended from a single parameter to characterize the flight envelope.
• Using the idea of control limit and command limit, a flight safety boundary protection system based on L₁ adaptive control is designed. Through simulation verification and a wind tunnel virtual flight test, it is verified that the designed boundary protection system can effectively limit the key safety parameters within the safety boundary, which provides an effective safety guarantee for the background aircraft flying with ice.

The remainder of this paper is organized as follows: In the next sections, we first present the definition of flight envelopes. Next, we determine the flight safety envelope by means of the reachable set method. The protection method of the flight safety envelope is then investigated by means of L₁ adaptive stability-increasing control. Finally, the results are verified by system simulation and a virtual flight in a wind tunnel, addressing the objectives of our study. Finally, a discussion and conclusions are provided.

2. Definition of Flight Safety Envelope Curve

The flight range and usage limitations of an aircraft are defined by the parameters of flight speed, altitude, and overload, which are influenced by the aerodynamic and structural factors of the aircraft. Civil transport aircraft usually use the speed-altitude level flight envelope curve, speed-overload envelope curve, sudden wind overload envelope curve, and ambient temperature envelope curve. In the traditional sense, the flight envelope curve refers to the speed-altitude envelope curve, but even if the aircraft is located within this envelope curve, it can still lose control due to a variety of adverse inducing factors (extreme flight conditions, such as icing conditions; thrust or flight control system failure, degradation, etc.; pilot error or inappropriate maneuvering, etc.) In order to study the runaway problem, the flight envelope curve is given a new connotation: the set of flight states in which the aircraft can be safely controlled and the runaway can be easily avoided, which is called the kinetic envelope curve because it is closely related to the dynamics of the aircraft. The envelope of the kinetic envelope curve is called the Kinetic envelope.

As shown in Figure 1, the NASA Langley Research Center and Boeing determined the five kinetic envelope curves of the aircraft by analyzing the 24 aircraft runaway data sets provided by CAST [10] and concluded that flight states outside any three of the five kinetic envelope curves would determine that a flight runaway had occurred. The five kinetic envelope curves were determined. These five dynamic envelope curves are: adverse aerodynamic envelope curve, which consists of the maximum available attack angle and available sideslip angle without dimensionality; abnormal attitude envelope curve, which consists of roll angle and pitch angle; structural integrity envelope curve, which consists of normal overload and pitch angle; and structural integrity envelope curve, consisting of normal overload and dimensionless airspeed; kinetic pitch control envelope curve, consisting of pitch axis maneuver and kinetic pitch angle ($\theta +\dot{\theta }\Delta t$); and kinetic roll control envelope curve, consisting of roll axis maneuver and kinetic roll angle ($\varphi +\dot{\varphi }\Delta t$).

Therefore, in order to study the protection of flight safety boundaries under icing conditions, the concept of multidimensional flight safety boundaries is introduced here. The effect of nonlinear dynamics on flight safety boundaries under icing conditions can be more accurately portrayed by constructing flight safety boundaries with multiparameter combinations [11,12,13,14,15]. The following describes the method of determining flight safety boundaries.

3. Method of Determining Flight Safety Boundaries

Usually, the industry will design the flight envelope curve according to the technical index and performance parameters satisfied by the aircraft, and verify it by means of flight tests to obtain the actual aircraft safety boundaries, such as the altitude-velocity envelope, attitude envelope, weight center of gravity envelope and maneuvering envelope of the aircraft. However, the flight test has the disadvantages of long periods, high cost, and high-risk factors [16,17,18,19,20]. For this reason, it is important to develop a high-precision flight safety boundaries determination method based on modeling and simulation calculation. Considering that the loss of control of aircraft is becoming a major cause of catastrophic accidents in aviation, scholars have carried out a lot of research work on this problem, which involves the accurate determination of dynamic boundaries in complex situations (upset conditions). By analyzing the current state of research at home and abroad, the following methods are commonly used to determine the dynamical boundaries: Bifurcation mutation theory [21], Phase plane method [22], Reachable Set estimation method [23,24,25], Stable region estimation method based on differential manifold [26], Region of Attraction (ROA) estimation method based on the sum of squares (SOS) [27], Neural Network (NN) method [28], etc. Among them, Reachable Set is favored by many scholars for its wide application and outstanding performance, and is applied in the determination of flight safety boundaries. Next, we introduce the reachable-based method for determining flight safety boundaries.

3.1. Reachable Set

The Reachable Set is widely used in security analysis. Reachable has the concepts of forward reachable and reverse reachable.

For a continuous-time nonlinear dynamical system [29]

$$\dot{x}=f(x,u,t)$$

(1)

where $x\in R^m$ denotes the state variable, $u\in U\subseteq R^m$ is the control input, $U\subseteq R^m$ is the tight set, t is the time, and $f(\cdot ,\cdot ,\cdot ):R^n\times U\to R^n$ is a bounded and continuous Lipschitz function, then the solution of the system exists and is unique. Here $T\ge 0$ is defined as an arbitrary time range and $U_{[t,T]}$ represents the control quantity applied at time $[t,T]$, then for any $x\in R^n$, $\tau \in [t,T]$, $u\in U_{[t,T]}$, the solution of the system lies on the unique solution trajectory $\varphi (\tau ,t,x,u)$.

Then the forward reachable can be defined as the set of states within a given initial set that can be reached within a given time range $\tau \in [t,T]$ under a valid control policy $u\in U_{[t,T]}\subseteq R^m$, denoted by $R_F(t,K)$, and K is a given set of states.

Reverse reachable can be defined as the set of all states that reach the specified set of goals for a given effective control policy $u\in U_{[t,T]}\subseteq R^m$ and time range $\tau \in [t,T]$, denoted by $R_B(t,K)$.

$$R_B(t,K)=\left\{x\in R^n\left|\exists u\in U_{[t,T]},\tau \in [t,T],\varphi (\tau ,t,x,u(\cdot ))\in K\right.\right\}$$

(2)

As the study of reachable set theory progressed, the concepts of maximal controllable invariant sets and invariant sets evolved. The maximum controllable invariant set is the set from which any initial state exists with at least one control input $u\in U_{[t,T]}\subseteq R^m$, at any given time $\tau \in [t,T]$, the track remains within the target set $G_0$, denoted by $V(t,K)$.

$$V(t,K)=\left\{x\in R^n\left|\exists u\in U_{[t,T]},\forall \tau \in [t,T],\varphi (\tau ,t,x,u(\cdot ))\in K\right.\right\}$$

(3)

The definition of the invariant set is more demanding than that of the maximum controllable invariant set. It is defined as any initial state from that set where the trajectory never leaves the target set $G_0$ at any control input $u\in U_{[t,T]}\subseteq R^m$ and at any time $\tau \in [t,T]$. Denoted by $I(t,K)$.

$$I(t,K)=\left\{x\in R^n\left|\forall u\in U_{[t,T]},\forall \tau \in [t,T],\varphi (\tau ,t,x,u(\cdot ))\in K\right.\right\}$$

(4)

The inclusive relationship between the three can be seen in Figure 2 below:

From the related literature research at home and abroad, the intersection of reverse reachable, maximum controllable invariant set, invariant set, and positive and reverse reachable can be used as a kinetic safety envelope curve. Figure 2 shows the inclusion relationship between the reverse reachable, invariant set and the maximum controllable invariant set.

3.2. Real-Time Flight Simulation Platform

As seen in Figure 3, a LINKS-RT-based real-time flight simulation platform is shown. As can be seen, the simple simulation platform consists of an upper computer, a lower real-time simulator, a joystick, and a six-degree-of-freedom simulated motion cockpit. The upper computer is connected to the simulated cockpit, forwards pilot control commands to the real-time simulator via Ethernet, and converts the simulation model built on MATLAB/Simulink into C++ code supported by the lower computer’s Vxworks real-time operating system, which is deployed to the real-time simulator for execution. Flight data is also received to drive the 3D flight view simulation software and presented through the display in the simulated cockpit, forming a human-in-the-loop real-time flight simulation environment.

3.3. Construction of 3D Geometric Digital Model of Background Aircraft Icing Configuration

Based on a comprehensive investigation of the relevant overall parameters of typical large passenger aircraft, the background aircraft plane parameters and the geometric parameters related to the size and position of the rudder surface are determined. Its basic geometric parameters are similar to those of the current large passenger aircraft of the same order as Airbus A320, Boeing 737, and C919 aircraft, and it has the basic aerodynamics and flight mechanics characteristics of large passenger aircraft. On this basis, the construction of the three-dimensional geometric digital model is completed, as shown in Figure 4.

The specific parameters of the aircraft are shown in

Table 1. Related parameters of background aircraft.

Name	Symbol	Numerical Value	Unit
aircraft length	L	38.2	m
wing span	b	34.10	m
wing area	S	124.00	m2
average aerodynamic chord	$\overline{c}$	4.15	m
center of mass position	xcg	0.2199 $\overline{c}$	m
center of mass reference position	xcgr	0.25 $\overline{c}$	m
maximum take-off weight of the aircraft	m	72,000	kg
moment of inertia of x-axis	Ixx	1,658,755	kg·m2
moment of inertia of y-axis	Iyy	2,392,630	kg·m2
moment of inertia of z-axis	Izz	384,6326	kg·m2
x-axis inertia	Ixz	155,000	kg·m2

. $\overline{c}$ is Average aerodynamic chord length.

3.4. Determination of Aircraft Dynamics Envelope under Icing Conditions Case

Considering the complexity in calculating the dynamical envelope of the aircraft, the dynamical characteristics of the aircraft are decoupled into longitudinal and transverse heading dynamics based on the small perturbation principle here, and the dynamical boundaries of longitudinal and transverse heading under icing conditions are calculated separately. In this paper, the maximum controllable invariant set is chosen as the kinetic envelope curve.

• Determination of longitudinal dynamics envelope of aircraft under icing conditions

Without considering the effect of the transverse heading parameter (let $\beta =\varphi =p=r=0$), the longitudinal nonlinear dynamics equation of the aircraft can be expressed as

$$\left\{\begin{array}{l}\dot{V}=\frac{1}{m}\left[F_T\cos \alpha -\frac{1}{2}\rho V^{2}S\left(C_{D0}+A{\left(C_L^{\alpha }\left(\alpha -{\alpha }_0\right)-C_{LDM}\right)}^2\right)-mg\sin (\theta -\alpha )\right]\hfill \\ \dot{\alpha }=q-\frac{1}{mV}\left[F_T\sin \alpha +\frac{1}{2}\rho V^{2}S\left(C_L^{\alpha }\left(\alpha -{\alpha }_0\right)+C_{L{\delta }_e}{\delta }_e\right)-mg\cos (\theta -\alpha )\right]\hfill \\ \dot{q}=\frac{\rho S\overline{c}{V}^2}{2I_y}\left[C_{m0}+C_{m{C}_L}{C}_{L\alpha }\left(\alpha -{\alpha }_0\right)+C_{m_{\delta e}}{\delta }_e+C_{m_q}q\frac{c}{2V}+C_{m\dot{\alpha }}\dot{\alpha }\frac{c}{2V}\right]\hfill \\ \dot{\theta }=q\hfill \end{array}\right.$$

(5)

where: V, α and β are flight speed, angle of attack and sideslip angle, ${\delta }_e$, ${\delta }_a$, and ${\delta }_r$ are the deflection angles of the elevator, aileron, and rudder surfaces, respectively.

$$C_L=C_{L\alpha }(\alpha -{\alpha }_0)+C_{L{\delta }_e}{\delta }_e$$

(6)

$$C_D=C_{D0}+A{(C_L^{\alpha }\cdot (\alpha -{\alpha }_0)-C_{LDM})}^2$$

(7)

$$C_l=C_{l\beta }\beta +C_{l{\delta }_r}{\delta }_r+C_{l{\delta }_a}{\delta }_a+C_{lp}p\frac{b}{2V}+C_{lr}r\frac{b}{2V}$$

(8)

$$C_m=C_{m0}+C_{m\alpha }\alpha +C_{mq}q\frac{\overline{c}}{2V}+C_{m\dot{\alpha }}\dot{\alpha }\frac{\overline{c}}{2V}+C_{m{\delta }_e}{\delta }_e$$

(9)

$$C_n=C_{n\beta }\beta +C_{n{\delta }_r}{\delta }_r+C_{n{\delta }_a}{\delta }_a+C_{np}p\frac{b}{2V}+C_{nr}r\frac{b}{2V}$$

(10)

where: $\rho$ is the density of the atmosphere; S is the reference area of the wing, b is the span, $\overline{c}$ is the average aerodynamic chord, $C_{\ast }$ is the aerodynamic force or moment coefficient, and is a function of state variables and control variables; $C_{\ast \ast }$ is the derivative of the aerodynamic force or moment coefficient with respect to the state variable or manipulated variable, and is a function of the state variable and the control variable.

In order to determine the longitudinal flight safety boundaries, the HJ PDE equation needs to be solved according to the Reachable Set. One of the most important steps is to determine the envelope conditions and the optimal solution of the Hamiltonian function. Here the limits of each state parameter are given as $V_{\min }=90 \mathrm{m}/\mathrm{s}$, $V_{\max }=180 \mathrm{m}/\mathrm{s}$, ${\alpha }_{\min }=-4^{\circ }$, ${\alpha }_{\max }={12}^{\circ }$, $q_{\min }=-20 {(}^{\circ }/\mathrm{s})$, $q_{\max }=20 {(}^{\circ }/\mathrm{s})$, ${\theta }_{\min }=-{10}^{\circ }$, and ${\theta }_{\max }={25}^{\circ }$. The input quantities are aircraft thrust $F_T$ and elevator deflection angle ${\delta }_e$, both of which have a range of values: ${\delta }_{e\max }={15}^{\circ }$, ${\delta }_{e\min }=-{30}^{\circ }$, $F_{T\max }=170,000 N$, and $F_{T\min }=9670 N$. Then the envelope condition ${\varphi }_0(x):R^4\to R$ can be taken as

$$\begin{array}{rr}{\varphi }_0(x)=\min & \left\{x_1-V_{\min },V_{\max }-x_1,x_2-{\alpha }_{\min },{\alpha }_{\max }-x_2,\right.\hfill \\ & x_3-q_{\min },q_{\max }-x_3,x_4-{\theta }_{\min },{\theta }_{\max }-\left.x_4\right\}\end{array}$$

(11)

It can be seen at ${\varphi }_0(x)\ge 0$, $x\in K$, ${\varphi }_0(x)<0$ and $x\notin K$. K is the restricted set of state parameters.

The Hamilton function is set to

$$H(x,p,u)=p_1\dot{V}+P_2\dot{\alpha }+P_3\dot{q}+p_4\dot{\theta }$$

(12)

where p₁, p₂, p₃, and p₄ are the partial derivatives of $\varphi (x,t)$ with respect to states $V$, $\alpha$, $q$, and $\theta$ respectively.

In addition to the envelope conditions, solving the HJ PDE equation requires determining the optimal solution $T^{\ast }$, ${\delta }_e^{\ast }$, which in turn determines the safety envelope. Substituting Equation (5) into Equation (12) yields:

$$\begin{array}{cc}\hfill H(x,p)=& \underset{T\in \left[T_{\min },T_{\max }\right]{\delta }_e\in \left[{\widehat{\delta }}_{\min },{\delta }_{\mathrm{emax}}\right]}{\sup }\left\{\frac{F_T}{mV}\left(p_{1}V\cos \alpha -p_2\sin \alpha \right)+\frac{\rho VS{\delta }_e}{2m{I}_y}\right.\left(p_{3}m\overline{c}V{C}_{m_{\delta e}}-p_2{I}_y{C}_{L{\delta }_e}\right)\hfill \\ & -p_1\left[\frac{\rho S{V}^2}{2m}\left(C_{D0}+A{\left(C_L^{\alpha }\left(\alpha -{\alpha }_0\right)-C_{LDM}\right)}^2+g\sin (\theta -\alpha )\right]\right.\hfill \\ & +p_2\left[q-\frac{\rho S}{2m}V{C}_L^{\alpha }\left(\alpha -{\alpha }_0\right)-\frac{g\cos (\theta -\alpha )}{V}\right]\hfill \\ & +p_3\frac{\rho Sc{V}^2}{2I_y}\left[C_{m0}+C_{ma}\left(\alpha -{\alpha }_0\right)+C_{m_q}q\frac{c}{2V}+C_{m_{\dot{\alpha }}}\dot{\alpha }\frac{c}{2V}\right]\hfill \\ & \left.+p_{4}q\right\}\hfill \end{array}$$

(13)

Then the optimal solutions $F_T^{\ast }$ and ${\delta }_e^{\ast }$ are

$$\begin{array}{c}{F}_T^{\ast }=\{\begin{array}{c}{F}_{T\min } p_{1}V\cos \alpha -p_2\sin \alpha \le 0\\ F_{T\max } otherwise\end{array}\\ {\delta }_e^{\ast }=\{\begin{array}{c}{\delta }_{e\min } p_{3}m\overline{c}V{C}_{m\delta e}-p_2{I}_y{C}_{L{\delta }_e}\le 0\\ {\delta }_{e\max } otherwise\end{array}\end{array}$$

(14)

Once the optimal solutions $T^{\ast }$ and ${\delta }_e^{\ast }$ are obtained, the viscous solutions of the HJ PDE equations can be solved based on the level set algorithm to obtain the maximum controllable invariant set and thus the flight safety boundaries. Since there are four calculated state variables, the solution function $\varphi (x,t)$ is defined on $R^4$. Here, for the sake of display, the calculated results are sliced by α-axis and the flight safety envelope curves are plotted for the combinations of V, q, and θ three-dimensional parameters for the clean and heavily-iced configurations calculated up to 2s under different attack angle conditions, as shown in Figure 5.

From Figure 5, we can see that the overall change of the maximum controllable invariant set for clean and heavy icing configurations under different attack angles is not significant, which is due to the fact that the maximum controllable invariant set is a more conservative safety envelope curve, describing the set of absolute safety states of the aircraft, and non-control input variables such as attack angle do not have a significant effect on the maximum controllable invariant set. The effect of non-control input variables such as attack angle on the maximum controllable invariant set is not significant. The icing causes a shrinkage of the safety envelope curve, resulting in a reduced range of available parameters. Compared with the clean configuration, the shrinkage of the safety envelope curve of the heavy icing configuration is mainly reflected in the positive maximum region and the negative minimum region in the theta-q axes, which is due to the reduced lift, increased drag, and reduced stall attack angle of the aircraft due to icing. An excessive positive pitch angle rate is more likely to trigger a positive attack angle overrun in icing conditions, while an excessive negative pitch angle rate is more likely to trigger a negative attack angle overrun. According to the definition of the maximum controllable invariant set, for the state points in this set, it is always possible to find a control to keep the aircraft from exceeding the state limit set C. When the aircraft state points are outside the maximum controllable invariant set, it does not matter what control is used. When the aircraft state point is outside the maximum controllable invariant set, the aircraft will exceed the limit set within at most 2 s, regardless of the control used.

2.

Determination of aircraft transverse heading dynamics envelope under icing conditions

The same method is used to determine the dynamical envelope of the transverse heading of the aircraft under icing conditions. Without considering the effect of the longitudinal parameters (let $\dot{V}=\dot{\alpha }=\dot{\theta }=\dot{q}=q=0$), the nonlinear dynamics equation of the aircraft in the transverse direction can be expressed as:

$$\left\{\begin{array}{l}\dot{\beta }=(p\sin \alpha -r\cos \alpha )+\frac{1}{mV}\left(-F_T\cos \alpha \sin \beta +Y+m{g}_2\right)\hfill \\ \dot{p}=\frac{\rho V^{2}Sb}{2\left(I_x{I}_z-I_{xz}^2\right)}\left[I_z{C}_l\left(Ma,\beta ,p,r,{\delta }_a,{\delta }_r\right)+I_{xz}{C}_n\left(Ma,\beta ,p,r,{\delta }_a,{\delta }_r\right)\right]\hfill \\ \dot{r}=\frac{\rho V^{2}Sb}{2\left(I_x{I}_z-I_{xz}^2\right)}\left[I_{xz}{C}_l\left(Ma,\beta ,p,r,{\delta }_a,{\delta }_r\right)+I_x{C}_n\left(Ma,\beta ,p,r,{\delta }_a,{\delta }_r\right)\right]\hfill \\ \dot{\varphi }=p+r\tan \theta \cos \varphi \hfill \end{array}\right.$$

(15)

The limits of each state parameter of the transverse heading are given here as: ${\beta }_{\min }=-{20}^{\circ }$, ${\beta }_{\max }={20}^{\circ }$, ${\varphi }_{\min }=-{30}^{\circ }$, ${\varphi }_{\max }={30}^{\circ }$, $p_{\min }=-20{(}^{\circ }/\mathrm{s})$, $p_{\max }=20{(}^{\circ }/\mathrm{s})$, $r_{\min }=-20{(}^{\circ }/\mathrm{s})$, $r_{\max }=20{(}^{\circ }/\mathrm{s})$. The input quantities are the aileron deflection angle ${\delta }_a$ and rudder deflection angle ${\delta }_r$ of the aircraft, which are taken as follows: ${\delta }_{a\max }={30}^{\circ }$, ${\delta }_{a\min }=-{30}^{\circ }$, ${\delta }_{r\max }={30}^{\circ }$, ${\delta }_{r\min }=-{30}^{\circ }$; the thrust F_T is used to keep the flight speed constant. Attack angle and pitch angle are the leveling values for the set flight state, i.e., $\alpha ={\alpha }_{trim},\theta ={\theta }_{trim}$. Then the envelope condition $R^4\to R$ can be taken as:

$$\begin{array}{r}l(x)=\min \left\{x_1-{\beta }_{\min },{\beta }_{\max }-x_1,x_2-p_{\min },p_{\max }-x_2\right.\\ x_3-r_{\min },r_{\max }-x_3,x_4-{\varphi }_{\min },{\varphi }_{\max }-\left.x_4\right\}\end{array}$$

(16)

When $l(x)\ge 0,x\in K$, and $l(x)<0$, $x\notin K$. K is the restricted set of status parameters.

The Hamilton function is set to

$$H(x,p,u)=p_1\dot{\beta }+p_2\dot{p}+p_3\dot{r}+p_4\dot{\varphi }$$

(17)

where p₁, p₂, p₃, and p₄ are the partial derivatives of $\varphi (x,t)$ with respect to the states $\beta$, p, r, and $\varphi$, respectively.

Substituting Equation (8) into Equation (10) yields

$$\begin{array}{c}H(x,p)=\underset{{\delta }_a\in [{\delta }_{\min ,},{\sigma }_{\max }]{\sigma }_r\in \left[{\sigma }_{\min },{\sigma }_{\max }\right]}{\sup }\{p_1[p\sin \alpha -r\cos \alpha +\frac{1}{mV}\left(-F_T\cos \alpha \sin \beta +\frac{1}{2}\rho V^{2}S{C}_{Y\beta }\beta +\right.\hfill \\ mg(\cos \alpha \sin \beta \sin \theta +\cos \beta \sin \varphi \cos \theta -\sin \alpha \sin \beta \cos \varphi \cos \theta )]+\hfill \\ p_2\frac{\rho V^{2}Sb}{2\left(I_x{I}_z-I_{xz}{}^2\right)}\{I_Z\left[C_{l\beta }\beta +C_{lp}p\frac{b}{2V}+C_{lr}r\frac{b}{2V}\right]+I_{xz}\left[C_{n\beta }\beta +C_{np}p\frac{b}{2V}+C_{mv}r\frac{b}{2V}\right]\}+\hfill \\ p_3\frac{\rho V^{2}Sb}{2\left(I_x{I}_z-I_{xz}{}^2\right)}\left\{I_x\left[C_{l\beta }\beta +C_{lp}p\frac{b}{2V}+C_{lr}r\frac{b}{2V}\right]+I_x\left[C_{n\beta }\beta +C_{np}p\frac{b}{2V}+C_{nr}r\frac{b}{2V}\right]\right\}+\hfill \\ \frac{\rho V^{2}Sb{\delta }_r}{2\left(I_x{I}_z-I_{xz}{}^2\right)}\left[\frac{\rho VS{p}_1}{2m}{C}_{Y{\delta }_r}{\delta }_r+p_2\left(I_z{C}_{l{\delta }_r}+I_{x\Sigma }{C}_{n{\delta }_r}\right)+p_3\left(I_{xz}{C}_{l{\delta }_r}+I_x{C}_{n{\delta }_r}\right)\right]+\hfill \\ \frac{\rho V^{2}Sb{\delta }_a}{2\left(I_x{I}_z-I_x{}^2\right)}\left[p_2\left(I_z{C}_{l{\delta }_a}+I_{xz}{C}_{n{\delta }_a}\right)+p_3\left(I_{xz}{C}_{l{\delta }_a}+I_x{C}_{n{\sigma }_a}\right)\right]+\hfill \\ \left.p_4(p+r\tan \theta \cos \varphi )\right\}\hfill \end{array}$$

(18)

In order to obtain the maximum controllable invariant set, the optimal solutions ${\delta }_a{}^{\ast }$ and ${\delta }_r^{\ast }$ need to be determined. According to the above equation, the optimal solution is ${\delta }_a{}^{\ast }$ obtained as

$${\delta }_a^{\ast }=\left\{\begin{array}{cc}{\delta }_{a\min }\hfill & \frac{\rho V^{2}Sb}{2\left(I_x{I}_z-I_{xz}{}^2\right)}\left[p_2\left(I_z{C}_{l{\delta }_a}+I_{xz}{C}_{n{\delta }_a}\right)+p_3\left(I_{xz}{C}_{l{\delta }_a}+I_x{C}_{n{\delta }_a}\right)\right]\le 0\hfill \\ {\delta }_{a\max }\hfill & \mathrm{otherwise} \hfill \end{array}\right.$$

(19)

$${\delta }_r^{\ast }=\left\{\begin{array}{cc}{\delta }_{r\min }\hfill & \frac{\rho V^{2}Sb}{2\left(I_x{I}_z-I_{xz}{}^2\right)}\left[\frac{\rho VS{p}_1}{2m}{C}_{Y{\delta }_r}+p_2\left(I_z{C}_{l{\delta }_r}+I_{xz}{C}_{n{\delta }_r}\right)+p_3\left(I_{xz}{C}_{l{\delta }_r}+I_x{C}_{n{\delta }_r}\right)\right]\le 0\hfill \\ {\delta }_{r\max }\hfill & \mathrm{otherwise} \hfill \end{array}\right.$$

(20)

The flight safety envelope curves are given here for different combinations of p, r, and $\varphi$ 3D parameters calculated up to 2 s for different sideslip angles, as shown in Figure 6.

From Figure 6, we can see that the safety envelope curve of both clean and heavy-icing configurations gradually shrinks with the increase of the absolute value of the sideslip angle, and both start from the region of the largest positive region and the region of the smallest negative region between the p-r axes. For the same sideslip angle, the safety envelope curve of the heavily-iced configuration shrinks significantly compared with that of the clean configuration. This is due to the change of static and dynamic stability of the transverse heading caused by icing, which makes the parameters such as p and r more likely to exceed the limits, and therefore the safety envelope shrinks.

4. L₁ Adaptive Stability Augmentation Control Based on Flight Safety Boundaries Protection Method

Authors should discuss the results and how they can be interpreted from the perspective of previous studies and of the working hypotheses. The findings and their implications should be discussed in the broadest context possible. Future research directions may also be highlighted.

Based on the reconfigured flight control law of L₁ adaptive stability augmentation control, an envelope protection system is designed as shown in Figure 7. In this system, the envelope protection module is designed by using command restriction, and the L₁ adaptive stability augmentation control law is applied to this system to compensate for the modeling uncertainty and improve the robustness of the system, thus ensuring that the system has a normal response.

The main functional modules of the systems are:

• Flight safety boundaries determination module. Based on the determination method of flight safety boundaries given in the previous paper, the combination boundaries of airspeed, attack angle, sideslip angle, and roll angle are determined under different icing levels (as shown in the dashed block on the left).
• Envelope restriction protection module of critical flight parameters. This module determines the envelope limit value of key parameters given by the module according to the flight safety boundaries, and uses the command limit to achieve the protection of key safety parameters (as shown in the dashed block on the right). Take the attack angle envelope restriction as an example, the specific design method and framework of the attack angle protection module are given, as shown in Figure 8 below.

In Figure 7, the control principle of this module is that when the attack angle exceeds the limit value, the attack angle envelope limiting function is activated and the attack angle command value is reduced until the attack angle returns to the envelope range. The pitch angle rate q feedback is introduced in the attack angle envelope limiter to improve the system stability of the aircraft under large attack angle conditions, and the final output attack angle command is

$${\alpha }_{com}=\left\{\begin{array}{ll}{\alpha }_{ref}-k_{\alpha 1}\left({\alpha }_{\stackrel{+}{\lim }}-\alpha -k_{q1}q\right)\hfill & {\alpha }_{\stackrel{+}{\lim }}<\alpha +k_{q1}q\hfill \\ {\alpha }_{ref}-k_{\alpha 2}\left({\alpha }_{\stackrel{-}{\lim }}-\alpha -k_{q1}q\right)\hfill & {\alpha }_{\stackrel{-}{\lim }}>\alpha +k_{q1}q\hfill \end{array}\right.$$

(21)

where ${\alpha }_{\lim }^{+}$ and ${\alpha }_{\lim }^{-}$ are the maximum (right envelope value) and minimum (left envelope value) attack angle limits, respectively; $k_{\alpha 1}$, $k_{\alpha 2}$ and $k_{q1}$ are the control gains, the values of which need to be scheduled according to the flight status; ${\alpha }_{ref}$ is the attack angle command entered by the pilot or autopilot.

Similarly, the design principles of the envelope limitation modules for speed, sideslip angle, and roll angle are similar to those of the attack angle envelope limitation module, where the sideslip angle envelope limitation module introduces yaw angle speed r feedback to enhance system stability and the roll angle envelope limitation module introduces roll angle speed p feedback to enhance system stability. It is not repeated here.

3

The flight controller module based on L₁ adaptive stability augmentation control. The module takes the values of key safety parameters output from the envelope limit protection module as input commands, obtains the rudder deflection of the control rudder surface by solving the control law, and inputs them into the aircraft six-degree-of-freedom full-scale dynamics equations for calculation to obtain the dynamic response of the flight attitude and other state parameters.

5. Simulation Verification of Envelope Protection System Based on L₁ Adaptive Stability Augmentation Control

In order to ensure that the critical parameters of the aircraft do not exceed the limits during the flight instructions, an envelope protection system based on L₁ adaptive stability augmentation control is designed in the previous section. The following simulation is carried out to verify the effectiveness of the designed envelope protection system. The simulation system used in this paper is based on a simulation platform built by the group for the prevention and re-routing of aircraft in a classical hazard situation, and the data is obtained using the Monte Carlo method [31]. The simulation conditions are set as follows: the aircraft flies flat at an altitude of 2000 m and a speed of 100 m/s at the initial moment and encounters continuous icing, and leaves the icing region at t = 100 s. During this period, we assume that the icing severity of the aircraft increases linearly from non-icing to heavy-icing, and then remains constant. The simulation conditions are set as follows: The aircraft is maintained in level flight at an altitude of $H=2000 \mathrm{m}$ at a speed of $V=90 \mathrm{m}/\mathrm{s}$. The aircraft encounters icing at $t=0 \mathrm{s}$ and flies through the icing zone at $t=50 \mathrm{s}$. It is assumed that the severity of the aircraft icing increases linearly from non-icing to heavy-icing during this period and then remains constant. Based on the offline flight safety envelope database, the aircraft’s head angle envelope limit for this condition is correspondingly reduced linearly from ${13}^{\circ }~{7.5}^{\circ }$. The aircraft receives a flight command from the pilot at $t=0 s$ with ${\theta }_{ref}={10}^{\circ }$. Roll angle is limited to $-{20}^{\circ }~{20}^{\circ }$ and sideslip angle is limited to $-5^{\circ }~5^{\circ }$. The flight speed command is set as follows: when $0\le t\le 100 \mathrm{s}$, $V_c=100 \mathrm{m}/\mathrm{s}$; $t\ge 100 \mathrm{s}$, $V_c=85 \mathrm{m}/\mathrm{s}$. The flight altitude command is set as follows: when $0\le t\le 30 \mathrm{s}$, $h_c=2000 \mathrm{m}$; $30\le t<100 \mathrm{s}$, $h_c=2110 \mathrm{m}$; when $t\ge 100 \mathrm{s}$, $h_c=2060 \mathrm{m}$. The yaw angle command is set as follows: ${\psi }_c={75}^{\circ }$. The simulation time is set to 200 s. The aerodynamic parameters are also set to be time-varying during the icing process, and the specific expressions are shown in Equation (15).

$${\theta }_{ref}=K_{P\theta }\left(h-h_{ref}\right)+K_{I\theta }{\displaystyle \int \left(h-h_{ref}\right)}dt+K_{D\theta }\left(\dot{h}-{\dot{h}}_{ref}\right)$$

(22)

The dynamic response of each parameter of the aircraft is shown in Figure 9, which is simulated without envelope protection and with envelope protection on.

Due to the effect of aircraft icing, following the flight instructions may lead to the possibility of exceeding some flight parameters of the aircraft. From Figure 8, we can see that in this simulation scenario, the flight speed and roll angle are beyond the limits when the envelope protection system is not turned on. When the envelope protection system is turned on, the flight speed and roll angle are limited to the safe range, and the precise tracking of flight commands is ensured. At the same time, the whole envelope protection system has strong robustness and can maintain a normal response under time-varying aerodynamic parameters.

Envelope Protection Test Verification based on Virtual Test Flight in Wind Tunnel

The wind tunnel virtual flight tests are carried out for the background aircraft in clean configuration and different icing simulation configurations, in which the flight control law of the background aircraft is designed using classical PID control and modern L₁ adaptive control, respectively. In order to further validate the effectiveness of the L₁ adaptive control-based flight safety boundaries protection system, a demonstration test of the background aircraft model boundaries protection under this modern control law configuration was carried out. The test was conducted in the artificial attitude mode, where the model was manipulated by pulling a full stick and inputting attitude angle commands to observe its response characteristics. The pre-test design of attack angle limit range is $-4^{\circ }~{15}^{\circ }$, side slip angle limit range is $-5^{\circ }~5^{\circ }$ and roll angle limit range is $-{20}^{\circ }~{20}^{\circ }$, where the side slip angle limit is achieved by limiting the command range. Figure 10 gives the envelope-limiting response characteristic curves of the attitude angle of the background aircraft model under heavy-icing configuration conditions.

As can be seen in Figure 9, the experimental results show that the envelope-limited response of attitude angle is consistent with the design effect when maneuvering with a full stick under heavy-icing configuration, and the attack angle, sideslip angle, and roll angle responses are all within the protection range. In addition, the response of the whole attitude angle is relatively smooth, but the attack angle response has a small limit ring oscillation when it is close to the stall attack angle.

In summary, the boundary protection system based on L₁ adaptive stability-increasing control designed in this paper has a relatively good effect in common fault protection, compared with traditional boundary protection methods, the method proposed in this paper has the characteristics of good robustness and wide adaptation range, etc., a specific comparison is shown in

Table 2. Advantages and disadvantages of various protection methods.

	$\mathit{\alpha }$	${\mathit{n}}_{\mathit{z}} \mathbf{Limiting} \mathbf{Method}$	L1 Adaptive Stability Augmentation Control Method
advantage	The design is simple, the control law is simple, and the calculation amount is small.	Simple design, safe and reliable.	High applicability, boundary protection can perform real-time operations, and can protect most faults.
disadvantage	It can only limit the flight parameter of the angle of attack, and cannot deal with complex faults.	The amount of control is small and cannot be used for complex faults.	The control law design is complex and requires more envelope data.

.

6. Discussion

In order to achieve intelligent envelope protection for aircraft under icing conditions, this paper investigates the method of determining and protecting flight safety boundaries under icing conditions. The envelope limits of some safety critical parameters (e.g., attack angle) under icing conditions are no longer constant but are variables related to flight status and icing severity.

In order to determine the dynamic multidimensional boundaries under icing conditions, a reachable-based method for determining flight safety boundaries is proposed. The dynamic boundaries under the influence of icing as an unfavorable factor are evaluated by using the maximum controllable invariant set as the dynamic envelope curve, and the dynamic envelope curve data under the influence of multiple unfavorable factors are stored in an offline flight safety boundaries database. The calculation results show that the unfavorable factor of icing will lead to the shrinkage of the dynamics envelope curve, and the pilot needs to pay close attention to the position of the envelope curve in the flight state to prevent the aircraft from falling out of the safety envelope curve due to excessive maneuvering, which will cause flight risks.

An online flight safety boundaries protection system based on an offline database is designed. Based on the offline flight safety boundaries database, the safety envelope curve of the current flight state under icing conditions is estimated online. Based on this, the flight safety boundaries protection system based on L₁ adaptive control is designed with the idea of control restriction and command restriction. Through simulation, it is verified that the proposed icing envelope protection system is fully capable of achieving the flight safety of aircraft in ice-tolerant flight situations. Compared with the traditional icing envelope protection method, the proposed method has the advantages of small computation, strong robustness, good real-time performance, and more comprehensive protection of flight parameters, which has high engineering application value.

The research in this paper can be used as a means of training pilots, and adding what has been performed in this paper to the cyber-physical systems can provide pilots with ground training experience and improve their ability to deal with the dangerous condition of icing in aircraft.