# Design and Analysis of Robust Fault Diagnosis  Schemes for a Simulated Aircraft Model

Authors: M. Benini; M. Bonfè; P. Castaldi; W. Geri; S. Simani
Journal: Journal of Control Science and Engineering
 (2008)

---

## Abstract

Several procedures for sensor fault detection and isolation (FDI) applied to a simulated model of a commercial aircraft are presented. The main contributions of the paper are related to the design and the optimisation of two FDI schemes based on a linear polynomial method (PM) and the nonlinear geometric approach (NLGA). The FDI strategies are applied to the aircraft model, characterised by tight-coupled longitudinal and lateral dynamics. The robustness and the reliability properties of the residual generators related to the considered FDI techniques are investigated and verified by simulating a general aircraft reference trajectory. Extensive simulations exploiting the Monte Carlo analysis tool are also used for assessing the overall performance capabilities of the developed FDI schemes, in the presence of turbulence, measurement, and model errors. Comparisons with other disturbance-decoupling methods for FDI based on neural networks (NNs) and unknown input kalman filter (UIKF) are finally reported.


---

## Body

## 1. Introduction

Increasing demands on reliability for safety critical systems such as aircraft or spacecraft require robust control and fault diagnosis capabilities as these systems are potentially subjected to unexpected anomalies and faults in actuators, input-output sensors, components, or subsystems. Consequently, fault diagnosis capabilities and requirements
for aerospace applications have recently been receiving a great deal of
attention in the research community [1, 2]. A fault diagnosis system needs to detect and isolate the presence and location of the faults, on the basis also of the control system architectures. Development of appropriate techniques and solutions for these tasks are known as the fault detection and isolation (FDI) problem. There are, broadly speaking, two main approaches for addressing the FDI problem, namely, hardware-based and model-based techniques [3, 4]. A common and important approach in model-based techniques is known as the residual-based method. A
number of researchers have developed residual-based methods for dynamic
systems such as the parity space [5], state estimation [6], unknown input observer (UIO), Kalman filters (KFs) [3], and parameter identification [6]. Intelligent techniques [7] can be also exploited. Furthermore, the Massoumnia's geometric method [8] was successfully extended to nonlinear systems [9, 10]. A crucial issue with any FDI scheme is its robustness properties and a viable procedure for practical application of FDI techniques is really necessary. Moreover, robust FDI for the case of aircraft systems and
applications is still an open problem for further research.The first part of this work deals with the residual generator design for the FDI of input-output sensors of a general aviation aircraft subject to turbulence, wind gust disturbances, and measurement noises.
The developed PM scheme belongs to the parity space approach [5] and it is based on an input-output polynomial
description of the system under diagnosis. In particular, the use of
input-output forms allows to easily obtain the analytical description for the disturbance-decoupled residual generators. These dynamic filters, organised into bank structures, are able to achieve fault isolation properties. An appropriate choice of their parameters allows to maximise robustness with respect to both measurement noise and modelling errors, while optimising fault sensitivity characteristics. The development of NLGA methodology is based on the works by De Persis and Isidori [10]. It was shown that the problem of the FDI for
nonlinear systems is solvable if and only if there is an unobservability
distribution that leads to a quotient subsystem which is unaffected by all
faults but one. If such a distribution exists, an appropriate coordinate
transformations in the state space can be exploited for designing a residual generator only for the observable subsystem. This technique was applied for the first time to a vertical takeoff and landing (VTOL) aircraft with reference to a reduced-order model [11]. The NLGA residual generators have been designed in
order to be analytically decoupled from the vertical and lateral components of the wind (gusts and turbulence). Moreover, a new full analytical developed mixed ℋ−/ℋ∞ optimisation is proposed in order to design the NLGA residual generators so that a good tradeoff between the fault sensitivity and the robustness with respect to measurements and model errors is achieved. The designed residual generators have been tested on a PIPER PA-30 aircraft flight simulator that was implemented in Matlab-Simulink environments. With respect to the related works by the same authors [12, 13], the main contribution of this paper regards the enhancement in the designs of the proposed FDI schemes. Moreover, the final performances have been evaluated by adopting a typical aircraft reference trajectory embedding several steady-state flight conditions, such as straight flight phases and coordinated turns. Comparisons with different disturbance-decoupling methods for FDI based on neural networks (NNs) and unknown input Kalman filter (UIKF) have been also provided. Finally, extensive experiments exploiting Monte Carlo analysis are used for assessing the overall
capabilities of the developed FDI methods, in the presence of uncertainty,
measurement, and modelling errors.


## 2. Aircraft Model Overview

This section recalls briefly the description of the monitored aircraft whose main parameters and variables are reported in Table1.Table 1
Nomenclature.
αAngle of attackβAngle of sideslippωRoll rateqωPitch raterωYaw rateϕBank angleθElevation angleψHeading angleneEngine shaft angular rate[Ix0−Ixz0Iy0−Ixz0Iz]Inertia moment matrixVTrue airspeed (TAS)δeElevator deflection angleδaAileron deflection angleδrrudder deflection angleδthThrottle aperture percentageHAltitudeγFlight path anglemAirplane massωu, ωv, ωwWind gust componentsThe considered aircraft simulation model consists of a PIPER PA-30, based on the classical nonlinear6 degrees of freedom (DoF) rigid body formulation [14] whose motion occurs as a consequence of applied forces and moments (aerodynamic, propulsive, and gravitational). A set of local approximations for these forces has been computed and scheduled depending on the values assumed by true airspeed (TAS), curvature radius, flight path angle, altitude, and flap deflection. In this way, it is possible to obtain a mathematical model for each flight condition. This model is suitable for a state-space representation, as it can be made explicit. The parameters in the analytic representation of the aerodynamic actions have been obtained from wind tunnel experimental data, and the aerodynamic actions are expressed along the axes of the wind reference system. It should be observed that aerodynamic forces and moments are not implemented by the classical linearised expressions
(stability derivatives) but by means of cubic splines approximating the
nonlinear experimental curves. The nonlinear 6 DoF model has been completed by means of the PIPER PA-30 propulsion system consisting of two 4-pistons aspirated engines, with the throttle valve aperture δth as input and the overall thrust intensity as output. The overall simulation model, used to perform all the following tests, consists of the aircraft 6 DoF flight dynamics and the engine model completed with the model of input-output sensors, the servo actuators, the atmosphere turbulence Dryden description, the wind gust disturbances, and a classical autopilot. Moreover, the sensor models embed all the possible sources of disturbance (calibration and alignment errors, scale factor, white and coloured noises, limited bandwidth, g-sensitivity, gyro drift, etc.).The linear model used by the proposed PM FDI approach described in Section3 embeds the linearisation both of the 6 DoF model and of the propulsion system as follows:
(1)x˙(t)=Ax(t)+Bc(t)+Ed(t)
with
(2)x(t)=[ΔV(t)Δα(t)Δβ(t)Δpω(t)Δqω(t)Δrω(t)⋯Δϕ(t)Δθ(t)Δψ(t)Δne(t)]T,c(t)=[Δδe(t)Δδa(t)Δδr(t)Δδth(t)]T,d(t)=[wu(t)wv(t)ww(t)]T,
where Δ denotes the variations of the considered variables while c(t) and d(t) are the control inputs and the disturbances, respectively. The disturbance contribution of the wind gusts as air velocity components, wu, wv, and ww, along body axes was also considered. The output equation associated with the model (1) is of the type y(t)=Cx(t), where the rows of C correspond to rows of the identity matrix, depending on the measured variables.On the other hand, regarding the NLGA FDI scheme described in Section4, it requires a nonlinear input affine system [10], but the adopted simulation model of the aircraft does not fulfil this requirement. For this reason, the following simplified aircraft model is used:
(3)V˙=−(CD0+CDαα+CDα2α2)mV2+g(sinαcosθcosϕ−cosαsinθ)+cos⁡αmtpV(t0+t1ne)δth+wvsin⁡α,α˙=−(CL0+CLαα)mV+gV(cos⁡α⁢cos⁡θ⁢cos⁡ϕ+sinα⁢sinθ⁢)+qω+sinαmtpV2(t0+t1ne)δth+cosαVwv,β˙=(CD0+CDαα+CDα2α2)sin⁡β+CYββ⁢cos⁡βmV+gcosθsinϕV+pωsinα−rωcosα+cosαsinβmtpV2(t0+t1ne)δth+1Vwℓ,p˙ω=(Clββ+Clppω)IxV2+(Iy−Iz)Ixqωrω+CδaIxV2δa,q˙ω=(Cm0+Cmαα+Cmqqω)IyV2+(Iz−Ix)Iypωrω+CδeIyV2δe+tdIytpV(t0+t1ne)δth,r˙ω=(Cnββ+Cnrrω)IzV2+(Ix−Iy)Izpωqω+CδrIzV2δr,ϕ˙=pω+(qωsinϕ+rωcosϕ)tanθ,θ˙=qωcosϕ−rωsinϕ,ψ˙=(qωsinϕ+rω⁢cosϕ)cosθn˙e=tnne3+tfne(t0+t1ne)δth,
where C(⋅) are the aerodynamic coefficients; t(⋅) are the engine parameters;  and wv, wl are the vertical and lateral wind disturbance components. In particular, the model of (3) has been obtained on the basis of some assumptions. In particular, the expressions of aerodynamic forces and moments have been represented by means of series expansions in the neighbourhood of the steady-state flight condition, then only the main terms are considered. The engine model has been simplified by linearising the power with respect to the angular rate behaviour in the neighbourhood of the trim point. The second-order coupling between the longitudinal and lateral-directional dynamics have been neglected. The x-body axis component of the wind has been neglected. In fact, the aircraft behaviour is much more sensitive to the y-body and z-body axis wind components. Finally, the rudder effect in the equation describing the β dynamics has been neglected. It is worth noting that Section 5 has shown that the designs and the simulations
of the NLGA residual generators are robust with respect to the last
approximation. In fact, the model of the β dynamics will never be used.


## 3. PM Residual Generators

Let us consider the input-output representation of a continuous-time, time-invariant linear dynamic system affected by faults and
disturbances in the form(4)P(s)y(t)=Qc(s)c(t)+Qd(s)d(t)+Qf(s)f(t),
where y(t)∈ℜm is the output vector, c(t)∈ℜlc is the input vector, d(t)∈ℜld is the disturbance vector, and f(t)∈ℜlf is the fault vector; P(s), Qc(s), Qd(s), and Qf(s) are known polynomial matrices of proper dimensions.Models of type (4) can be frequently found in practice by applying well-known physical laws to describe the input-output dynamical links of various systems. Algorithms to transform multivariable state-space models to equivalent multiple-input-multiple-output (MIMO) polynomial representations and vice versa are available [15]. Suitable software routines for multivariable system transformations have been implemented by the authors in the Matlab environment. In fact, the Matlab software for state-space and transfer function conversions is not able to manage directly MIMO models, since they are considered as concatenations of single-input-single-output (SISO) systems.An important aspect of the residual generator design concerns the decoupling properties of the disturbanced(t). The decoupling can be obtained premultiplying all the terms of (4) by the matrix L(s)∈𝒩l(Qd(s)), that is, the left null-space of the matrix Qd(s):
(5)L(s)P(s)y(t)−L(s)Qc(s)c(t)=L(s)Qf(s)f(t).
Hence, the residual generator for the system of (4) is represented by
(6)R(s)r(t)=L(s)P(s)y(t)−L(s)Qc(s)c(t)=L(s)Qf(s)f(t),
where it is assumed that r(t)∈ℜ and L(s) is a polynomial row vector. The polynomial R(s) can be arbitrarily selected among the polynomials with degree greater than or equal to nr*, where nr* is the maximum row-degree of the pair {L(s)P(s),L(s)Qc(s)}. Moreover, if all the roots of R(s) lie in the open left-half s-plane, it assures the stability of the filter of (6). Without loss of generality, it is assumed that R(0)=1.
Remark 1.
If the matrixQd(s) is of full-column rank (i.e., rankQd(s)=ld), 𝒩l(Qd(s)) has dimension m−ld. Therefore, a polynomial matrix B(s), whose rows represents a minimal polynomial basis of 𝒩l(Qd(s)), has m−ld rows and m columns.This work is focused on the problem of detecting and isolating additive faults acting on the input and output sensors of the monitored system. If the input-output measurements are modelled by the relations of (7):
(7)c*(t)=c(t)+fc(t),y*(t)=y(t)+fo(t),
the system of (4) becomes
(8)P(s)(y*(t)−fo(t))=Qc(s)(c*(t)−fc(t))+Qd(s)d(t),
under the assumptions that Qf(s)f(t)=[−Qc(s),P(s)][fcT(t),foT(t)]T. Thus, the residual generator of (6) is written as
(9)R(s)r(t)=L(s)P(s)y*(t)−L(s)Qc(s)c*(t)=L(s)P(s)fo(t)−L(s)Qc(s)fc(t).Remark 2.
The residual generator described by (7) and (9) can be
seen as an errors-in-variables (EIV) model [16] with respect the input and output variables, as the
measurements that feed the residual function are affected by additive faults. This description highlights the importance of the residual generator in the form of (9).Remark 3.
The diagnostic capabilities of the residual generator of (6) strongly depend on the choice of the terms L(s) and R(s). This paper proposes a method for the design of these
polynomials, under the assumption that f(t) is a scalar and, consequently, Qf(s) is a vector. The rationale of this assumption is commented in Section 3.2 where the fault isolation method is proposed.In the following, the freedom design in the selection of the rows of the polynomial matrixL(s) is investigated when q=m−ld≥2. These degrees of freedom are used to optimise the
sensitivity properties of r(t) with respect to the fault f(t), for example, by maximising the steady-state gain of
the transfer function Gf(s)=L(s)Qf(s)/R(s).Ifbi(s) (i=1,…,q) are the row vectors of the basis B(s), L(s) can be expressed as linear combination of these vectors:
(10)L(s)=∑i=1qkibi(s),
where ki are real constants maximising:
(11)lim⁡s→01R(s)[∑i=1qkibi(s)]Qf(s)=[∑i=1qkibi(0)]Qf(0)
with the constraint
(12)∑i=1qki2=1.
Under these assumptions, when the fault f(t) is a step-function of magnitude F, the steady-state residual value is
(13)lim⁡t→∞r(t)=lim⁡s→0sL(s)Qf(s)R(s)Fs=[∑i=1qkibi(0)]Qf(0)F.
If the following real vectors are defined as
(14)k=[k1k2⋮kq],a=B(0)Qf(0)=[a1a2⋮aq],
the problem of the maximisation of the residual fault sensitivity can be
recast as follows.Proposition 1.
Given the vectora, the vector   k  that maximises the steady-state fault sensitivity, that is, the function W  given by the expression
(15)W=aTk=∑i=1qaiki,
under the constraint of (12), can be found by solving
(16)k=arg⁡max⁡W(k).The solution to the problem described by Proposition1 can be derived as follows. The constraint of (12) describes a hypersphere, whilst the expression of the function of (15) is a hyperplane. The unknown coefficients k must belong to both the hyperplane and the hypersphere. Therefore, the points of tangency between the hypersphere and the hyperplane represents the solutions that maximise or minimise W. As shown below, the solution of the problem described by Proposition 1 exists and is unique.Proof.
From (12), k1 is expressed as a function of k2, k3,…,kq, and it is substituted into (15):
(17)W=a11−k22−k32−⋯−kq2+a2k2+⋯+aqkq.
By computing ∇W=0, that is,
(18)∂W∂k2=12a1−2k21−k22−k32−⋯−kq2+a2=0,∂W∂k3=12a1−2k31−k22−k32−⋯−kq2+a3=0,⋮∂W∂kq=12a1−2kq1−k22−k32−⋯−kq2+aq=0,
and squaring the expression, after algebraic manipulation:
(19)a22=(a22+a12)k22+a22k32+⋯+a22kq2,a32=a32k22+(a32+a12)k32+⋯+a32kq2,⋮aq2=aq2k22+aq2k32+⋯+(aq2+a12)kq2,
an expression in the form of Ax=b is obtained, where
(20)A=[(a22+a12)a22⋯a22a32(a32+a12)⋯a32⋮⋮⋱⋮aq2aq2⋯(aq2+a12)],x=[k22k32⋮kq2],b=[a22a32⋮aq2].
The unknown vector x, under the constraint of (12), can be expressed as follows:
(21)x=[1−∑i=1q−1(A−1b)iA−1b],
where (A−1b)i is the ith element of the vector A−1b. The vector x represents the squares of the solution of the problem of Proposition 1.
Let us indicateΩ the set of the vectors k whose elements are the square roots of the elements of x. As every element can be taken both with signs “+” and “−”, such vectors are 2q. Therefore, the solution k of Proposition 1 can be reformulated as
(22)k=argmax⁡k∈ΩW(k).Remark 4.
The matrixA can be expressed as A=E+a12Iq−1, where E is a matrix with equal columns. If a1≠0, this assumption guarantees the existence of A−1, and consequently the existence and the uniqueness of
the solution A−1b. Obviously, if a1=0 and aj≠0, it is sufficient to express kj as function of the remaining variables and to reapply the same procedure.Remark 5.
The same solution can be found by maximising the function|W|. Due to the symmetry properties, the maximisation of |W| admits two solutions corresponding to the maximum and the minimum of the function W. Moreover, the choice of the quadratic constraint of
(12)
guarantees the unicity of the solution to the problem of Proposition 1.Remark 6.
The problem described by Proposition1 could have been solved also in a numerical way, that is, by searching k that maximises W on the surface of the q-dimensional hypersphere. However, the computational cost of this numerical solution can be a drawback when q is big.


### 3.1. PM Residual Design

Section3 has shown how to maximise the steady-state gain of the continuous-time transfer function Gf(s)=L(s)Qf(s)/R(s) trough a suitable choice of the real vector k (i.e., k=k). The design of the filter of (6) has been completed here by introducing a method for assigning both the zeros and the poles of the continuous-time transfer function Gf(s). The zeros and poles location influences the transient characteristics (maximum overshoot, delay time, rise time, settling
time, etc.) of the filter of (6). In many applications, these characteristics must be kept within tolerable or prescribed limits in order to guarantee good performances of the filter in terms, for example, of fault detection times and false-alarm probabilities.Remark 7.
Whenk=k, the polynomial L(s)Qf(s)=kTB(s)Qf(s) is fixed and no freedom degree is left to arbitrarily assign the zeros. In order to solve this problem, a polynomial vector k(s) can be considered. Under this assumption, L(s) still belongs to the subspace 𝒩l(Qd(s)), where the terms ki are polynomial coefficients.The previous consideration leads to introduce the polynomialE(s)=kT(s)B(s)Qf(s), where k(s) is a q-dimensional polynomial vector whose ith element has the form
(23)ki(s)=∑j=0nkkijsj.
The degree nk and the q×nk coefficients kij are freedom design (j≠0) that are exploited for obtaining the desired roots
of the polynomial E(s). However, in order to maximise the steady-state gain, as shown in Section 3, the following condition must hold:
(24)k(0)=k=[k1k2⋮kq]⟺ki0=ki,i=1,…,q.Definition 1.
H(s) is the reference polynomial whose roots are the zeros to be assigned: (25)H(s)=∑j=0nhhjsj.
Since the constraint of (24) must hold, H(0)=kTB(0)Qf(0). Obviously, this assumption does not provide any
restriction on the roots assignable. Under the previous considerations, the zero assignment and pole placement problem is formulated as follows.Proposition 2.
The degreenk and the coefficients kij have to be determined under the constraint of (24) in order to obtain   E(s)=H(s).Proof.
In Section3, the polynomial vector a(s)=B(s)Qf(s) was defined. Its ith element is a known polynomial of a certain degree, nai. If na is defined as follows:
(26)na=max⁡i=1,…,qnai,
the ith element of a(s) can be always written as a polynomial of degree na:
(27)ai(s)=∑j=0naaijsj
by imposing that aij=0 when j>nai.
AsE(s)=kT(s)a(s), by multiplying (23) and (27), it results
(28)E(s)=∑i=1q∑j=0nk+na(∑α+β=jkiαaiβ)sj=∑j=0nk+naejsj,
where
(29)ej=∑i=1q∑α+β=jkiαaiβ.
Equations (28) and (29) assume that kiα=0 when α>nk and aiβ=0 when β>na. Note that the coefficients e1,…,enk+na depend on the freedom design ki1,…,kink. On the other hand, e0 is fixed as the coefficients ki0 are assigned by (24).
Let us suppose thatnh≤nk+na. By imposing E(s)=H(s), from (29) and (25), the following expressions are
computed:
(30)∑i=1q∑α+β=j(α≠0)kiαaiβ=hj−∑i=1qki0aij,j=1,…,nk+na.
Equations (24) and (30) represent a linear system with nk+na equations and q×nk unknowns, which can be expressed in the classical form Ax=b, where
(31)A=[a10⋯aq00⋯00⋯0⋮⋱⋮a10⋯aq0a1na⋯aqna⋮⋱⋮0⋯0a1na⋯aqna⋮⋱⋮0⋯00⋯0⋱⋮⋱⋮⋮⋱⋮0⋯0a10⋯aq0⋮⋱⋮0⋯00⋯0a1na⋯aqna],x=[k11⋮kq1k12⋮kq2⋮⋮k1nk⋮kqnk],b=[h1−∑i=1qki0ai1⋮hna−∑i=1qki0ainahna+1⋮hna+nk].
The degree nk of the polynomials ki(s) has to be chosen in order to obtain a solvable system (i.e.,  rankA=rank[Ab]).In order to understand the proposed solution, the
following points should be considered.(i)
The choice ofnk must guarantee
that the relations nh≤nk+na are satisfied.(ii)
Whenq≥2, the difference between the number of unknown terms
and the number of equations, that is, (q−1)×nk−na, is greater than zero if nk is selected
sufficiently high.(iii)
Even if the
system admits solutions, the inverse of the matrixA may not exist;
in such case there are infinite solutions and the one associated to the
pseudoinverse of A, that is, A+b can be
computed.Remark 8.
The use of a polynomial vectork(s) instead of a real vector k has the drawback of increasing the complexity of the residual generator. Many FDI applications require that
(32)Gf(s)Gf(0)=F(0)F(s),
where F(s) is an arbitrary polynomial. These cases do not require a k(s) such that E(s)=Gf(0), but it is enough considering k=k and imposing
(33)R(s)=E0(s)F(s)Gf(0)F(0),
where E0(s)=kB(s)Qf(s). However, there is a restriction on the choice of F(s). In fact, due to the realisability condition, deg{F(s)}>nr*−deg{E0(s)}. Moreover, the method cannot be applied if E0(s) admits one or more roots with positive real part, as the residual generator would become unstable. These cases require an approximate solution.Remark 9.
This section is focused on the design of residual generators on the basis of a given reference function with disturbance-decoupling and fault sensitivity maximisation properties. The pole location influences the transient dynamics of the designed residual filters, while the steady-state properties depend on the PM residual design, as it maximises the residual steady-state values with respect to step faults affecting input and output sensors. The poles of the residual functions
could be optimised with respect to both fault and disturbance terms, as shown, for example, in a work by the same authors [17].


### 3.2. PM Fault Isolation

This section addresses the design problem of residual generator banks for the isolation of faults affecting the input and the output sensors. This design is performed by using the disturbance-decoupling method suggested in Section3.To univocally isolate a fault concerning one of theoutput sensors, under the hypotheses that the input sensors and the remaining output sensors are fault-free, a bank of residual generator filters is used. The number of these generators is equal to the number m of the system outputs, and the ith device (i=1,…,m) is driven by all but the ith output and all the inputs of the system. In this case, a fault on the ith output sensor affects all but the ith residual generator.In presence of a fault on thejth output sensor, the measured output y*(t) can be expressed as follows:
(34)y*(t)=y(t)+foj(t),
with
(35)foj(t)=[0⋯0hoj(t)0⋯0]T,
where hoj(t) represents the jth output fault function.In these conditions, the system of (4) becomes
(36)P(s)y*(t)−pj(s)hoj(t)=Qc(s)c(t)+Qd(s)d(t),
where pj(s) is the jth column of the matrix P(s).Let us indicateLoi(s) a polynomial row vector belonging to the basis of the left null space of the matrix [Qd(s)∣pi(s)]. The expression of the ith filter when a fault is acting on the jth output sensor is obtained by multiplying (36) by Loi(s):
(37)Roi(s)roi(t)=Loi(s)Pi(s)y*i(t)−Loi(s)Qc(s)c(t)={Loi(s)pj(s)hoj(t)forj≠i,0forj=i,
where Pi(s) is the matrix
obtained by deleting from P(s) the ith column, and y*i(t) represents the (m−1)-dimensional vector obtained by deleting from y*(t) its ith component.From the comparison between (37) and (6) with f(t)∈ℜ if q′=m−ld−1≥2, the methods shown in Sections 3 and  3.1 can be exploited for the design of the ith filter. In particular, the parameters of this filter can be properly chosen in order to optimise its performances when a fault is acting on the jth output sensor.In more detail, as shown in Section3, Loi(s) is chosen to maximise the steady-state gain in the presence of the fault foj(t). Moreover, as shown in Section 3.1, Roi(s) is chosen to obtain a fixed behaviour of the transfer function due to the fault foj(t).It is worth noting that the similar design technique can be used forinput sensor fault isolation.The problem requirements determine the selection of the specific fault with respect to which the design depends. Most often in practice, it is important to obtaingood performance with respect to all possible faults rather than optimal behaviour with respect to one specific fault. In this situation, a different design of the filter behaviour for each fault situation is needed.


## 3.1. PM Residual Design

Section3 has shown how to maximise the steady-state gain of the continuous-time transfer function Gf(s)=L(s)Qf(s)/R(s) trough a suitable choice of the real vector k (i.e., k=k). The design of the filter of (6) has been completed here by introducing a method for assigning both the zeros and the poles of the continuous-time transfer function Gf(s). The zeros and poles location influences the transient characteristics (maximum overshoot, delay time, rise time, settling
time, etc.) of the filter of (6). In many applications, these characteristics must be kept within tolerable or prescribed limits in order to guarantee good performances of the filter in terms, for example, of fault detection times and false-alarm probabilities.Remark 7.
Whenk=k, the polynomial L(s)Qf(s)=kTB(s)Qf(s) is fixed and no freedom degree is left to arbitrarily assign the zeros. In order to solve this problem, a polynomial vector k(s) can be considered. Under this assumption, L(s) still belongs to the subspace 𝒩l(Qd(s)), where the terms ki are polynomial coefficients.The previous consideration leads to introduce the polynomialE(s)=kT(s)B(s)Qf(s), where k(s) is a q-dimensional polynomial vector whose ith element has the form
(23)ki(s)=∑j=0nkkijsj.
The degree nk and the q×nk coefficients kij are freedom design (j≠0) that are exploited for obtaining the desired roots
of the polynomial E(s). However, in order to maximise the steady-state gain, as shown in Section 3, the following condition must hold:
(24)k(0)=k=[k1k2⋮kq]⟺ki0=ki,i=1,…,q.Definition 1.
H(s) is the reference polynomial whose roots are the zeros to be assigned: (25)H(s)=∑j=0nhhjsj.
Since the constraint of (24) must hold, H(0)=kTB(0)Qf(0). Obviously, this assumption does not provide any
restriction on the roots assignable. Under the previous considerations, the zero assignment and pole placement problem is formulated as follows.Proposition 2.
The degreenk and the coefficients kij have to be determined under the constraint of (24) in order to obtain   E(s)=H(s).Proof.
In Section3, the polynomial vector a(s)=B(s)Qf(s) was defined. Its ith element is a known polynomial of a certain degree, nai. If na is defined as follows:
(26)na=max⁡i=1,…,qnai,
the ith element of a(s) can be always written as a polynomial of degree na:
(27)ai(s)=∑j=0naaijsj
by imposing that aij=0 when j>nai.
AsE(s)=kT(s)a(s), by multiplying (23) and (27), it results
(28)E(s)=∑i=1q∑j=0nk+na(∑α+β=jkiαaiβ)sj=∑j=0nk+naejsj,
where
(29)ej=∑i=1q∑α+β=jkiαaiβ.
Equations (28) and (29) assume that kiα=0 when α>nk and aiβ=0 when β>na. Note that the coefficients e1,…,enk+na depend on the freedom design ki1,…,kink. On the other hand, e0 is fixed as the coefficients ki0 are assigned by (24).
Let us suppose thatnh≤nk+na. By imposing E(s)=H(s), from (29) and (25), the following expressions are
computed:
(30)∑i=1q∑α+β=j(α≠0)kiαaiβ=hj−∑i=1qki0aij,j=1,…,nk+na.
Equations (24) and (30) represent a linear system with nk+na equations and q×nk unknowns, which can be expressed in the classical form Ax=b, where
(31)A=[a10⋯aq00⋯00⋯0⋮⋱⋮a10⋯aq0a1na⋯aqna⋮⋱⋮0⋯0a1na⋯aqna⋮⋱⋮0⋯00⋯0⋱⋮⋱⋮⋮⋱⋮0⋯0a10⋯aq0⋮⋱⋮0⋯00⋯0a1na⋯aqna],x=[k11⋮kq1k12⋮kq2⋮⋮k1nk⋮kqnk],b=[h1−∑i=1qki0ai1⋮hna−∑i=1qki0ainahna+1⋮hna+nk].
The degree nk of the polynomials ki(s) has to be chosen in order to obtain a solvable system (i.e.,  rankA=rank[Ab]).In order to understand the proposed solution, the
following points should be considered.(i)
The choice ofnk must guarantee
that the relations nh≤nk+na are satisfied.(ii)
Whenq≥2, the difference between the number of unknown terms
and the number of equations, that is, (q−1)×nk−na, is greater than zero if nk is selected
sufficiently high.(iii)
Even if the
system admits solutions, the inverse of the matrixA may not exist;
in such case there are infinite solutions and the one associated to the
pseudoinverse of A, that is, A+b can be
computed.Remark 8.
The use of a polynomial vectork(s) instead of a real vector k has the drawback of increasing the complexity of the residual generator. Many FDI applications require that
(32)Gf(s)Gf(0)=F(0)F(s),
where F(s) is an arbitrary polynomial. These cases do not require a k(s) such that E(s)=Gf(0), but it is enough considering k=k and imposing
(33)R(s)=E0(s)F(s)Gf(0)F(0),
where E0(s)=kB(s)Qf(s). However, there is a restriction on the choice of F(s). In fact, due to the realisability condition, deg{F(s)}>nr*−deg{E0(s)}. Moreover, the method cannot be applied if E0(s) admits one or more roots with positive real part, as the residual generator would become unstable. These cases require an approximate solution.Remark 9.
This section is focused on the design of residual generators on the basis of a given reference function with disturbance-decoupling and fault sensitivity maximisation properties. The pole location influences the transient dynamics of the designed residual filters, while the steady-state properties depend on the PM residual design, as it maximises the residual steady-state values with respect to step faults affecting input and output sensors. The poles of the residual functions
could be optimised with respect to both fault and disturbance terms, as shown, for example, in a work by the same authors [17].


## 3.2. PM Fault Isolation

This section addresses the design problem of residual generator banks for the isolation of faults affecting the input and the output sensors. This design is performed by using the disturbance-decoupling method suggested in Section3.To univocally isolate a fault concerning one of theoutput sensors, under the hypotheses that the input sensors and the remaining output sensors are fault-free, a bank of residual generator filters is used. The number of these generators is equal to the number m of the system outputs, and the ith device (i=1,…,m) is driven by all but the ith output and all the inputs of the system. In this case, a fault on the ith output sensor affects all but the ith residual generator.In presence of a fault on thejth output sensor, the measured output y*(t) can be expressed as follows:
(34)y*(t)=y(t)+foj(t),
with
(35)foj(t)=[0⋯0hoj(t)0⋯0]T,
where hoj(t) represents the jth output fault function.In these conditions, the system of (4) becomes
(36)P(s)y*(t)−pj(s)hoj(t)=Qc(s)c(t)+Qd(s)d(t),
where pj(s) is the jth column of the matrix P(s).Let us indicateLoi(s) a polynomial row vector belonging to the basis of the left null space of the matrix [Qd(s)∣pi(s)]. The expression of the ith filter when a fault is acting on the jth output sensor is obtained by multiplying (36) by Loi(s):
(37)Roi(s)roi(t)=Loi(s)Pi(s)y*i(t)−Loi(s)Qc(s)c(t)={Loi(s)pj(s)hoj(t)forj≠i,0forj=i,
where Pi(s) is the matrix
obtained by deleting from P(s) the ith column, and y*i(t) represents the (m−1)-dimensional vector obtained by deleting from y*(t) its ith component.From the comparison between (37) and (6) with f(t)∈ℜ if q′=m−ld−1≥2, the methods shown in Sections 3 and  3.1 can be exploited for the design of the ith filter. In particular, the parameters of this filter can be properly chosen in order to optimise its performances when a fault is acting on the jth output sensor.In more detail, as shown in Section3, Loi(s) is chosen to maximise the steady-state gain in the presence of the fault foj(t). Moreover, as shown in Section 3.1, Roi(s) is chosen to obtain a fixed behaviour of the transfer function due to the fault foj(t).It is worth noting that the similar design technique can be used forinput sensor fault isolation.The problem requirements determine the selection of the specific fault with respect to which the design depends. Most often in practice, it is important to obtaingood performance with respect to all possible faults rather than optimal behaviour with respect to one specific fault. In this situation, a different design of the filter behaviour for each fault situation is needed.


## 4. NLGA Residual Generators

The considered NLGA to the FDI problem is suggested in
[18] and formally developed in [10]. It consists in finding, by means of a coordinate change in the state space and in the output space, an observable subsystem which, if possible, is affected by the fault and not affected by disturbance. In this way, necessary and sufficient conditions for the FDI problem to be solvable are given. Finally, a residual generator can be designed on the basis of the model of the observable
subsystem.More precisely, the approach considers a nonlinear system model in the form(38)x˙=n(x)+g(x)c+ℓ(x)f+p(x)d,y=h(x)
in which the state vector x∈𝒳 (an open subset of ℜℓn), c(t)∈ℜℓc is the control input vector, f(t)∈ℜ is the fault, d(t)∈ℜℓd the disturbance vector (embedding also the faults which have to be decoupled), and y∈ℜℓm the output vector; whilst n(x), ℓ(x), the columns of g(x) and p(x) are smooth vector fields; and h(x) is a smooth map.Therefore, ifP represents the distribution spanned by the column of p(x), the NLGA method can be devised as it follows: first,
determine the largest observability codistribution contained in P⊥, denoted with Ω* [10].Ifℓ(x)∉Ω*, the design procedure can continue, otherwise, the fault is not detectable; whenever the previous condition is satisfied, it can
be found a surjection Ψ1 and a function Φ1 fulfilling Ω*∩span{dh}=span{d(Ψ1∘h)} and Ω*=span{d(Φ1)}, respectively. The functions Ψ(y) and Φ(x) defined as
(39)Ψ(y)=(y¯1y¯2)=(Ψ1(y)H2y),Φ(x)=(x¯1x¯2x¯3)=(Φ1(x)H2h(x)Φ3(x))
are (local) diffeomorphisms, where H2 is a selection matrix (i.e., a matrix in which any row has all 0 entries but one, which is equal to 1), Φ1(x) represents the measured part of the state which is affected by f and not affected by d, and Φ3(x) represents the not measured part of the state which is affected by f and by d.In the new (local) coordinate defined previously, the system of (38) is described by the relations in the
form
(40)x¯˙1=n1(x¯1,x¯2)+g1(x¯1,x¯2)c+ℓ1(x¯1,x¯2,x¯3)f,x¯˙2=n2(x¯1,x¯2,x¯3)+g2(x¯1,x¯2,x¯3)c+ℓ2(x¯1,x¯2,x¯3)f+p2(x¯1,x¯2,x¯3)d,x¯˙3=n3(x¯1,x¯2,x¯3)+g3(x¯1,x¯2,x¯3)c+ℓ3(x¯1,x¯2,x¯3)f+p3(x¯1,x¯2,x¯3)d,y¯1=h(x¯1),y¯2=x¯2
with ℓ1(x¯1,x¯2,x¯3) not identically zero. Denoting x¯2 with y¯2 and considering it as an independent input, it can be singled out the x¯1-subsystem:
(41)x¯˙1=n1(x¯1,y¯2)+g1(x¯1,y¯2)c+ℓ1(x¯1,y¯2,x¯3)f,y¯1=h(x¯1),
which is affected by the single fault f and decoupled from the disturbance vector. This subsystem has been exploited for the design of the residual generator for the FDI of the fault f.As already described in Section2, the proposed NLGA FDI scheme is designed on the basis of a model structure of the input affine type as described in [10].
For this reason, the aircraft simulation model has been simplified and the
nonlinear model of (3) has been considered for the NLGA design.Under these assumptions, by means of computations detailed in [19], the residual generators for detecting the faults affecting the aircraft input sensors are obtained. In particular, the residual generator for the elevator rδe(t), with kδe>0, is described by the relation
(42)ξ˙1=V2m[−(CD0+CDαα+CDα2α2)cos⁡α]+V2m(CL0+CLαα)sin⁡α−g⁢sin⁡θ+−Vqωsin⁡α−(Cm0+Cmαα+Cmqqω)mtdV2−(Iz−Ix)mtdpωrω−CδemtdV2δe+kδe[(Vcos⁡α−Iymtdqω)−ξ1],rδe=(Vcos⁡α−Iymtdqω)−ξ1.
The aileron residual generator rδa(t), with kδa>0, has the form
(43)ξ˙2=(Clββ+Clppω)IxV2+(Iy−Iz)Ixqωrω+CδaIxV2δa+kδa(pω−ξ2),rδa=pω−ξ2.
The rudder residual generator rδr(t), with kδr>0, is written in the form
(44)ξ˙3=(Cnββ+Cnrrω)IzV2+(Ix−Iy)Izpωqω+CδrIzV2δr+kδr(rω−ξ3),rδr=rω−ξ3.
The throttle residual generator rδth(t), with kδth>0, has the form
(45)ξ˙4=tnne3+tfne(t0+t1ne)δth+kδth(ne−ξ4),rδth=ne−ξ4.Remark 10.
It is worth observing that each residual generator is affected by a single input sensor fault and is decoupled from the wind components and the faults affecting the remaining input sensors. This feature
can be obtained by defining a differentp(x) for each residual generator design [19]. In this way, the tuning of the residual generator
gains kδe, kδa, kδr, and kδth can be carried out independently. Finally, by a straightforward analysis, the positive sign of each gain is a necessary and sufficient condition for the asymptotic stability of the dynamics (42)–(45).
A procedure optimising the tradeoff between the fault sensitivity and the robustness to the modelling errors and disturbances of the generic residual generator is proposed in the next section.


### 4.1. NLGA Robustness Improvement

The proposed NLGA-based scheme consists of two design steps:(1)
the structural decoupling of critical disturbances (wind gust and turbulence) and critical modelling errors can be obtained as described in Section4;(2)
the nonlinear residual generators robustness is improved by minimising the effects of both noncritical disturbances and modelling errors, whilst maximising the fault effects on the residual signals.
In order to apply the robustness improvement procedure presented in this section, the considered framework is restricted to suitable scalar components of the x¯1-subsystem (41). In
particular, the vectors x¯1 and y¯1 are decomposed as follows:
(46)x¯1=[x¯11x¯1c],y¯1=[y¯11y¯1c],
where x¯11∈ℜ, y¯11∈ℜ, and, correspondingly, it follows that
(47)n1(⋅)=[n11(⋅)n1c(⋅)],g1(⋅)=[g11(⋅)g1c(⋅)],ℓ1(⋅)=[ℓ11(⋅)ℓ1c(⋅)]
Let us consider the following conditions:
(48)y¯11=h11(x¯11)y¯1c=h1c(x¯1c)ℓ11(⋅)≠0,
where h11(⋅) is a smooth map and h1c(⋅) is an invertible smooth map. It is important to highlight that if the constraints (48) are
satisfied, the decomposition (46)-(47) can always be applied to obtain the following x¯11-subsystem:
(49)x¯˙11=n11(x¯11,y¯1c,y¯2)+g11(x¯11,y¯1c,y¯2)c+ℓ11(x¯11,y¯1c,y¯2,x¯3)f,y¯11=h11(x¯11).
As can be seen in [19], the conditions (48) are satisfied for the considered aircraft application, hence, from now on, the scalar x¯11-subsystem (49) is
referred to in place of the x¯1-subsystem (41).It can be noted that the tuning of the residual generator gains, in the framework of thex¯11-subsystem (49), cannot
be properly carried out. In fact, the critical disturbances are structurally decoupled but the noncritical ones are not considered. For this reason, to achieve robustness of the residual generators, the tuning of the gains is performed by embedding the description of the noncritical disturbances in the x¯11-subsystem as follows:
(50)x¯˙11=n11(x¯11,y¯1c,y¯2)+g11(x¯11,y¯1c,y¯2)c+ℓ11(x¯11,y¯1c,y¯2,x¯3)f+e(x¯11,y¯1c,y¯2,x¯3)ζ,y¯11=x¯11+ν,
where, to simplify the treatment without loss of generality (accordingly to the considered aircraft application), the state variable x¯11 is supposed to be directly measured. Moreover, the variable ν∈ℜ is the measurement noise on x¯11. Finally, the variable ζ∈ℜ and the related scalar field e(⋅) represent the noncritical effects which have not been considered in the simplified aircraft model (3) used for the NLGA scheme.The following system, which is referred to asfilter form, represents a generic scalar residual generator (based on the
subsystem (50)) to which (42)–(45) belong as a
particular case
(51)ξ˙f=n11(y¯11,y¯1c,y¯2)+g11(y¯11,y¯1c,y¯2)c+kf(y¯11−ξf),rf=y¯11−ξf,
where the gain kf has to be tuned in order to minimise the effects of the disturbances ζ and ν whilst maximise the effects of the fault f on the residual rf. The quantification both of the disturbances and of
the fault effects on the residual can be obtained by defining the estimation error
(52)xf=x¯11−ξf,
which allows to write the following equivalent residual model:
(53)x˙f=n11(x¯11,y¯1c,y¯2)−n11(y¯11,y¯1c,y¯2)+g11(x¯11,y¯1c,y¯2)c−g11(y¯11,y¯1c,y¯2)c+ℓ11(x¯11,y¯1c,y¯2,x¯3)f+e(x¯11,y¯1c,y¯2,x¯3)ζ−kfxf−kfν,rf=xf+ν.
In order to apply the effective mixed ℋ−/ℋ∞ approach [3, 20] to tune kf, the system (53) has to be linearised in the neighbourhood of a stationary flight condition, as suggested in [2] with reference to the ℋ∞ optimisation of nonlinear unknown input observers. It is worth observing that the considered aircraft application is characterised by small excursions of the state, input, and output variables with respect to their trim values x¯10, x¯30, c0, y¯10, and y¯20, hence the robustness of the nonlinear residual generator is achieved. The linearisation of (53) is the following:
(54)x˙f=−kfxf−kfν+mf+q⌣ζ⌣,rf=xf+ν,
where
(55)a′=∂n11(⋅)∂x¯11|(x¯10,y¯20),b=g11(⋅)|(x¯10,y¯20),m=ℓ11(⋅)|(x¯10,y¯20,x¯30),q=e(⋅)|(x¯10,y¯20,x¯30),q⌣ζ⌣=qζ−a′ν.
Now, it is important to note that in place of the residual generators in the filter form (51), the following observer form of the residual generators can be used:
(56)ξ˙o=n11(ξo,y¯1c,y¯2)+g11(ξo,y¯1c,y¯2)c+ko(y¯11−ξo),ro=y¯11−ξo.
For the same reasons previously described, the estimation error xo is introduced:
(57)xo=x¯11−ξo,
hence
(58)x˙o=n11(x¯11,y¯1c,y¯2)−n11(ξo,y¯1c,y¯2)+g11(x¯11,y¯1c,y¯2)c−g11(ξo,y¯1c,y¯2)c+ℓ11(x¯11,y¯1c,y¯2,x¯3)f+e(x¯11,y¯1c,y¯2,x¯3)ζ−koxo−koν,ro=xo+ν.
The linearisation of (58) is
(59)x˙o=(a′−ko)xo−koν+mf+qζ,ro=xo+ν.
Both the linearised models (54) and (59) of the residual generators in the filter form and observer form, respectively, can be represented by the following general form:
(60)x˙=(a−k)x+(E1−kE2)ε+mf,r=x+E2ε
with E1=[e110] as well as the following positions:
(61)general formxεrake11E2filter formxf[ζ⌣ν]rf0kfq⌣[01]observer formxo[ζν]roakoq[01].
On the basis of (60) and
(61), the mixed ℋ−/ℋ∞ [3, 20] procedure is developed for the robustness improvement of the residual generators both in the filter and observer form. Since the considered NLGA residual generators are scalar, the ℋ−/ℋ∞ procedure leads to a new analytical solution.The following definition will be used throughout the section.Definition 2.
The normsℋ∞ and ℋ− of a stable transfer function G are defined as
(62)‖G‖∞=sup⁡ω≥0σ¯[G(jω)],‖G‖−=σ¯[G(j0)],
where σ¯ represents the maximum singular value, whilst σ¯ the minimum singular value.
The problem of the tradeoff between disturbances robustness and fault sensitivity is stated as follows.Problem 1 (Mixedℋ−/ℋ∞ Residual Robustness Improvement).
Given two scalarsβ>0 and γ>0, find the set 𝒦 defined as:
(63)K={k∈ℜ:(a−k)<0,‖Grε‖∞<γ,‖Grf‖−>β},
where
(64)Grε(s)=(s−a+k)−1(E1−kE2)+E2,(65)Grf(s)=(s−a+k)−1m.
In order to obtain the analytical solution of Problem 1, the following propositions are given.Proposition 3.
For allk∈ℜ,(a−k)<0, then
(66)‖Grε‖∞2=max⁡{1,(e112+a2)(k−a)2},(67)sup⁡{k∈ℜ:(a−k)<0}‖Grε‖∞=+∞.Proof.
From the definition (64)
(68)Grε(s)=[e11s−a+ks−as−a+k],
hence it is possible to write
(69){σ¯[Grε(jω)]}2=e112(k−a)2+ω2+a2+ω2(k−a)2+ω2=(e112+a2)+ω2(k−a)2+ω2
so that it follows
(70)‖Grε‖∞2=sup⁡ξ≥0(e112+a2)+ξ(k−a)2+ξ.
From the last expression, it is straightforward to obtain (66) and (67).Proposition 4.
The set(71)Kγ={k∈ℜ:(a−k)<0,‖Grε‖∞<γ,⁢γ>1}
is given by
(72)k>k¯with⁢k¯=a+e112+a2γ.Proof.
By means of Proposition3, it is possible to write
(73)(e112+a2)(k−a)2<γ2,
which holds for
(74)k>a+e112+a2γ.Proposition 5.
Ifγ>1, then {∥Grf∥−:∥Grε∥∞<γ} is given by
(75)0<‖Grf‖−<βmax⁡(γ)whereβmax⁡(γ)=mγe112+a2.Proof.
From the definition (65), it results Grf(s)=m/(s−a+k) and assuming, without loss of generality, that m>0, it follows ∥Grf∥−=m/(k−a). By imposing ∥Grf∥−>β with β>0, the constraint k<a+(m/β) has to hold. Then, by recalling the result of Proposition 4, the maximum feasible value of β fulfilling the constraint ∥Grε∥∞<γ is given by
(76)k¯=a+mβmax⁡(γ),
hence
(77)βmax⁡(γ)=mk¯−a=mγe112+a2.Theorem 1.
Givenγ>1 and β∈]0,βmax(γ)[, the set 𝒦 fulfilling the constraints of Problem 1 is given by
(78)K={k∈ℛ:k∈]k¯,k¯[,⁢k¯=a+mβmax⁡(γ),⁢k¯=a+mβ}.Proof.
The proof of the theorem is not reported, as it is straightforward from Propositions3, 4, and 5.Remark 11.
Let us consider the following performance index to maximise(79)J=‖Grf‖−‖Grε‖∞.
From (66), it follows
(80)‖Grε‖∞={1,k>(a+e112+a2)e112+a2k−a,a<k≤(a+e112+a2)
hence
(81)J={mk−a,k>(a+e112+a2),me112+a2,a<k≤(a+e112+a2).
From (81), it can be observed that
(82)J=mk−a<me112+a2,k>(a+e112+a2).
In this way, the maximum value of the performance index J is
(83)Jmax⁡=me112+a2∀k∈KJ={k∈ℜ:a<k≤(a+e112+a2)}.
The method proposed in this paper guarantees the maximum value of the performance index J as well as the constraints ∥Grε∥∞<γ and ∥Grf∥−>β if β≥m/e112+a2.
In fact, fromβ≥m/e112+a2 it follows
(84)‖Grf‖−=mk−a>β≥me112+a2,
hence k<(a+e112+a2).
Finally, from (75) it is
always possible to find a β such that
(85)me112+a2≤β≤βmax(γ)∀γ>1.
On the basis of Theorem 1, k can be designed by means of the following procedure.Procedure 1.
(1) Chooseγ>1 to obtain a desired level of disturbance attenuation.
(2) Computeβmax(γ) and choose β∈]0,βmax(γ)[ to obtain a desired level of fault sensitivity.
(3) Choosek∈]k¯,k¯[, with k¯=a+m/βmax(γ) and k¯=a+m/β.
(4) Apply the chosen gaink to the kf of (51) or to the ko of (56) if the NLGA
residual generator is in the filter form or in the observer form, respectively.


## 4.1. NLGA Robustness Improvement

The proposed NLGA-based scheme consists of two design steps:(1)
the structural decoupling of critical disturbances (wind gust and turbulence) and critical modelling errors can be obtained as described in Section4;(2)
the nonlinear residual generators robustness is improved by minimising the effects of both noncritical disturbances and modelling errors, whilst maximising the fault effects on the residual signals.
In order to apply the robustness improvement procedure presented in this section, the considered framework is restricted to suitable scalar components of the x¯1-subsystem (41). In
particular, the vectors x¯1 and y¯1 are decomposed as follows:
(46)x¯1=[x¯11x¯1c],y¯1=[y¯11y¯1c],
where x¯11∈ℜ, y¯11∈ℜ, and, correspondingly, it follows that
(47)n1(⋅)=[n11(⋅)n1c(⋅)],g1(⋅)=[g11(⋅)g1c(⋅)],ℓ1(⋅)=[ℓ11(⋅)ℓ1c(⋅)]
Let us consider the following conditions:
(48)y¯11=h11(x¯11)y¯1c=h1c(x¯1c)ℓ11(⋅)≠0,
where h11(⋅) is a smooth map and h1c(⋅) is an invertible smooth map. It is important to highlight that if the constraints (48) are
satisfied, the decomposition (46)-(47) can always be applied to obtain the following x¯11-subsystem:
(49)x¯˙11=n11(x¯11,y¯1c,y¯2)+g11(x¯11,y¯1c,y¯2)c+ℓ11(x¯11,y¯1c,y¯2,x¯3)f,y¯11=h11(x¯11).
As can be seen in [19], the conditions (48) are satisfied for the considered aircraft application, hence, from now on, the scalar x¯11-subsystem (49) is
referred to in place of the x¯1-subsystem (41).It can be noted that the tuning of the residual generator gains, in the framework of thex¯11-subsystem (49), cannot
be properly carried out. In fact, the critical disturbances are structurally decoupled but the noncritical ones are not considered. For this reason, to achieve robustness of the residual generators, the tuning of the gains is performed by embedding the description of the noncritical disturbances in the x¯11-subsystem as follows:
(50)x¯˙11=n11(x¯11,y¯1c,y¯2)+g11(x¯11,y¯1c,y¯2)c+ℓ11(x¯11,y¯1c,y¯2,x¯3)f+e(x¯11,y¯1c,y¯2,x¯3)ζ,y¯11=x¯11+ν,
where, to simplify the treatment without loss of generality (accordingly to the considered aircraft application), the state variable x¯11 is supposed to be directly measured. Moreover, the variable ν∈ℜ is the measurement noise on x¯11. Finally, the variable ζ∈ℜ and the related scalar field e(⋅) represent the noncritical effects which have not been considered in the simplified aircraft model (3) used for the NLGA scheme.The following system, which is referred to asfilter form, represents a generic scalar residual generator (based on the
subsystem (50)) to which (42)–(45) belong as a
particular case
(51)ξ˙f=n11(y¯11,y¯1c,y¯2)+g11(y¯11,y¯1c,y¯2)c+kf(y¯11−ξf),rf=y¯11−ξf,
where the gain kf has to be tuned in order to minimise the effects of the disturbances ζ and ν whilst maximise the effects of the fault f on the residual rf. The quantification both of the disturbances and of
the fault effects on the residual can be obtained by defining the estimation error
(52)xf=x¯11−ξf,
which allows to write the following equivalent residual model:
(53)x˙f=n11(x¯11,y¯1c,y¯2)−n11(y¯11,y¯1c,y¯2)+g11(x¯11,y¯1c,y¯2)c−g11(y¯11,y¯1c,y¯2)c+ℓ11(x¯11,y¯1c,y¯2,x¯3)f+e(x¯11,y¯1c,y¯2,x¯3)ζ−kfxf−kfν,rf=xf+ν.
In order to apply the effective mixed ℋ−/ℋ∞ approach [3, 20] to tune kf, the system (53) has to be linearised in the neighbourhood of a stationary flight condition, as suggested in [2] with reference to the ℋ∞ optimisation of nonlinear unknown input observers. It is worth observing that the considered aircraft application is characterised by small excursions of the state, input, and output variables with respect to their trim values x¯10, x¯30, c0, y¯10, and y¯20, hence the robustness of the nonlinear residual generator is achieved. The linearisation of (53) is the following:
(54)x˙f=−kfxf−kfν+mf+q⌣ζ⌣,rf=xf+ν,
where
(55)a′=∂n11(⋅)∂x¯11|(x¯10,y¯20),b=g11(⋅)|(x¯10,y¯20),m=ℓ11(⋅)|(x¯10,y¯20,x¯30),q=e(⋅)|(x¯10,y¯20,x¯30),q⌣ζ⌣=qζ−a′ν.
Now, it is important to note that in place of the residual generators in the filter form (51), the following observer form of the residual generators can be used:
(56)ξ˙o=n11(ξo,y¯1c,y¯2)+g11(ξo,y¯1c,y¯2)c+ko(y¯11−ξo),ro=y¯11−ξo.
For the same reasons previously described, the estimation error xo is introduced:
(57)xo=x¯11−ξo,
hence
(58)x˙o=n11(x¯11,y¯1c,y¯2)−n11(ξo,y¯1c,y¯2)+g11(x¯11,y¯1c,y¯2)c−g11(ξo,y¯1c,y¯2)c+ℓ11(x¯11,y¯1c,y¯2,x¯3)f+e(x¯11,y¯1c,y¯2,x¯3)ζ−koxo−koν,ro=xo+ν.
The linearisation of (58) is
(59)x˙o=(a′−ko)xo−koν+mf+qζ,ro=xo+ν.
Both the linearised models (54) and (59) of the residual generators in the filter form and observer form, respectively, can be represented by the following general form:
(60)x˙=(a−k)x+(E1−kE2)ε+mf,r=x+E2ε
with E1=[e110] as well as the following positions:
(61)general formxεrake11E2filter formxf[ζ⌣ν]rf0kfq⌣[01]observer formxo[ζν]roakoq[01].
On the basis of (60) and
(61), the mixed ℋ−/ℋ∞ [3, 20] procedure is developed for the robustness improvement of the residual generators both in the filter and observer form. Since the considered NLGA residual generators are scalar, the ℋ−/ℋ∞ procedure leads to a new analytical solution.The following definition will be used throughout the section.Definition 2.
The normsℋ∞ and ℋ− of a stable transfer function G are defined as
(62)‖G‖∞=sup⁡ω≥0σ¯[G(jω)],‖G‖−=σ¯[G(j0)],
where σ¯ represents the maximum singular value, whilst σ¯ the minimum singular value.
The problem of the tradeoff between disturbances robustness and fault sensitivity is stated as follows.Problem 1 (Mixedℋ−/ℋ∞ Residual Robustness Improvement).
Given two scalarsβ>0 and γ>0, find the set 𝒦 defined as:
(63)K={k∈ℜ:(a−k)<0,‖Grε‖∞<γ,‖Grf‖−>β},
where
(64)Grε(s)=(s−a+k)−1(E1−kE2)+E2,(65)Grf(s)=(s−a+k)−1m.
In order to obtain the analytical solution of Problem 1, the following propositions are given.Proposition 3.
For allk∈ℜ,(a−k)<0, then
(66)‖Grε‖∞2=max⁡{1,(e112+a2)(k−a)2},(67)sup⁡{k∈ℜ:(a−k)<0}‖Grε‖∞=+∞.Proof.
From the definition (64)
(68)Grε(s)=[e11s−a+ks−as−a+k],
hence it is possible to write
(69){σ¯[Grε(jω)]}2=e112(k−a)2+ω2+a2+ω2(k−a)2+ω2=(e112+a2)+ω2(k−a)2+ω2
so that it follows
(70)‖Grε‖∞2=sup⁡ξ≥0(e112+a2)+ξ(k−a)2+ξ.
From the last expression, it is straightforward to obtain (66) and (67).Proposition 4.
The set(71)Kγ={k∈ℜ:(a−k)<0,‖Grε‖∞<γ,⁢γ>1}
is given by
(72)k>k¯with⁢k¯=a+e112+a2γ.Proof.
By means of Proposition3, it is possible to write
(73)(e112+a2)(k−a)2<γ2,
which holds for
(74)k>a+e112+a2γ.Proposition 5.
Ifγ>1, then {∥Grf∥−:∥Grε∥∞<γ} is given by
(75)0<‖Grf‖−<βmax⁡(γ)whereβmax⁡(γ)=mγe112+a2.Proof.
From the definition (65), it results Grf(s)=m/(s−a+k) and assuming, without loss of generality, that m>0, it follows ∥Grf∥−=m/(k−a). By imposing ∥Grf∥−>β with β>0, the constraint k<a+(m/β) has to hold. Then, by recalling the result of Proposition 4, the maximum feasible value of β fulfilling the constraint ∥Grε∥∞<γ is given by
(76)k¯=a+mβmax⁡(γ),
hence
(77)βmax⁡(γ)=mk¯−a=mγe112+a2.Theorem 1.
Givenγ>1 and β∈]0,βmax(γ)[, the set 𝒦 fulfilling the constraints of Problem 1 is given by
(78)K={k∈ℛ:k∈]k¯,k¯[,⁢k¯=a+mβmax⁡(γ),⁢k¯=a+mβ}.Proof.
The proof of the theorem is not reported, as it is straightforward from Propositions3, 4, and 5.Remark 11.
Let us consider the following performance index to maximise(79)J=‖Grf‖−‖Grε‖∞.
From (66), it follows
(80)‖Grε‖∞={1,k>(a+e112+a2)e112+a2k−a,a<k≤(a+e112+a2)
hence
(81)J={mk−a,k>(a+e112+a2),me112+a2,a<k≤(a+e112+a2).
From (81), it can be observed that
(82)J=mk−a<me112+a2,k>(a+e112+a2).
In this way, the maximum value of the performance index J is
(83)Jmax⁡=me112+a2∀k∈KJ={k∈ℜ:a<k≤(a+e112+a2)}.
The method proposed in this paper guarantees the maximum value of the performance index J as well as the constraints ∥Grε∥∞<γ and ∥Grf∥−>β if β≥m/e112+a2.
In fact, fromβ≥m/e112+a2 it follows
(84)‖Grf‖−=mk−a>β≥me112+a2,
hence k<(a+e112+a2).
Finally, from (75) it is
always possible to find a β such that
(85)me112+a2≤β≤βmax(γ)∀γ>1.
On the basis of Theorem 1, k can be designed by means of the following procedure.Procedure 1.
(1) Chooseγ>1 to obtain a desired level of disturbance attenuation.
(2) Computeβmax(γ) and choose β∈]0,βmax(γ)[ to obtain a desired level of fault sensitivity.
(3) Choosek∈]k¯,k¯[, with k¯=a+m/βmax(γ) and k¯=a+m/β.
(4) Apply the chosen gaink to the kf of (51) or to the ko of (56) if the NLGA
residual generator is in the filter form or in the observer form, respectively.


## 5. FDI Performance Estimation

To show the diagnostic characteristics brought by the application of the proposed FDI schemes to general aviation aircrafts, some numerical results obtained in the Matlab and Simulink environments are reported. The final performances that are achieved with the developed FDI schemes are finally reported. These performances are evaluated by means of extensive simulations applied to the aircraft simulation model. This section presents also some comparisons of the developed PM and NLGA FDI strategies with NN and UIKF FDI schemes.The designed PM residual generator filters are fed by the4 component input vector c(t) and the 9 component output vector y(t) acquired from the simulation aircraft model previously described. In particular, a bank of 4 residual generator filters has been used to detect input sensor faults regarding the 4 input control variables. Moreover, in order to obtain the fault isolation properties, each residual generator function of the considered bank is fed by all but one of the 4 control input signals and by the 9 output variables. Obviously, the residual generator bank has been designed to be decoupled from the 3 component wind disturbance vector d(t)=[wu(t),wv(t),ww(t)]T. As to the NLGA residual generator filters, the aircraft synthesis model of (3), adopted for the design, is simplified with respect to the simulation model. Analogously to the PM, the approximations of the NLGA synthesis nonlinear model are related to a particular steady-state flight condition. For this reason, the switching for the NLGA FDI scheme is also required when a generic reference trajectory is followed. Hence, it is important to evaluate the robustness characteristic of a single design of NLGA
residual generators when a large set of flight conditions is dealt with.It is worth noting that the aircraft reference trajectories are typically made up of a sequence of steady-state flight conditions, each
one described by the associated input state output set point and the linearised model of (1).
As a consequence, all the FDI linear techniques are usually implemented by
switching among the residual generators related to the different steady-state flight conditions. The target of this work is to reduce the switching by adopting robust PM residual generators. In particular, the robustness is achieved by using the same residual generators for a large set of flight conditions. The chosen single steady-state flight condition for designing both of the PM and of the NLGA residual
generators is a coordinated turn characterised as follows:
(i)
the true
airspeed is50 m/s;(ii)
the curvature
radius is1000 m;(iii)
the
flight-path angle is0°;(iv)
the altitude is330 m;(v)
the flap
deflection is0°.
This represents one of most general flight condition due to the coupling of the longitudinal and lateral dynamics. Moreover, it is used in simulation to highlight the performances of the proposed methods in the nominal flight condition.Regarding the PM, the detection properties of the filters in terms of fault sensitivity and disturbance rejection can be achieved according to Section3. The synthesis of the dynamic filters for FDI has been performed by choosing a suitable linear combination of residual generator functions. This choice has to maximise the steady-state gain of the transfer functions between input sensor fault signals. The roots of the R(s) polynomial matrix have been optimised for maximising the fault detection promptness, as well as to minimise the occurrence of false alarms. In order to assess the PM diagnosis technique, different fault sizes have been simulated on each sensor. Single faults in the input sensors have been generated by producing abrupt (step) and ramp (slowly developing) faults in the input signals c(t). The residual signals indicate fault occurrence according to whether their values are lower or higher than the thresholds fixed
in fault-free conditions. The residual processing methods can be based on
simple residual geometrical analysis or comparison with fixed thresholds
[3]. More complex residual evaluation can rely on statistical properties of the residuals and hypothesis testing [6], or based on adaptive thresholds, that is, the so-called threshold selector [21].In this paper, the threshold test for FDI is performed with the logic described by (86):
(86)r¯−νσr≤r(t)≤r¯+νσrforf(t)=0,r(t)<r¯−νσr⁢orr(t)>r¯+νσrforf(t)≠0,
that is, the comparison of r(t) with respect its statistical normal characteristics. r¯ and σr2 are the normal values for the mean and variance of the fault-free residual, respectively. In order to separate normal from faulty behaviour, the tolerance parameter ν (normally ν≥3) is selected and properly tuned. Hence, by a proper choice of the parameter ν, a good tradeoff can be achieved between the maximisation of fault detection probability and the minimisation of false-alarm
probability. In practice, the threshold values depend on the residual error amount due to measurement errors, linearised model approximations, and disturbance signals that are not completely decoupled.Thus, in this case, a suitable value ofν=4 for the computation of the positive and negative thresholds in (86) has been considered. To summarise the performances of the PM FDI scheme, the minimal detectable step faults on the various input sensors are collected in Table 2.Table 2
PM FDI technique: minimalstep faults with ν=4.
ci(t)VariableFault sizeDelay timeElevatorδe2°18 sAileronδa3°6 sRudderδr4°8 sThrottle
aperture %δth2%15 sOn the other hand, the minimal detectable ramp faults
are reported in Table3.Table 3
PM FDI technique: minimalramp faults with ν=4.
ci(t)VariableFault sizeDelay timeElevatorδe0.11°/s26 sAileronδa0.50°/s11 sRudderδr0.49°/s12 sThrottle
aperture %δth0.13°/s19 sConcerning the NLGA, the synthesis of the residual generators has been performed by using filter gains that optimise the fault sensitivity and reduce as much as possible the occurrence of false alarms due to model uncertainties and to disturbances not completely decoupled. This robustness requirement has been fulfilled by designing the residual gains
according to the Procedure1. For example, with reference to the fourth residual generator, Procedure 1 has led to Kδth=1 which satisfies the norm bounds γ=1.2 and β=400. This guarantees a good separation of the residual signal with ∥f∥ℒ2≥0.05 and ∥d∥ℒ2≤10, where ℒ2-norm is considered.In order to assess the NLGA diagnosis technique, single step and ramp faults have been used. Moreover, also in this case the threshold values have been chosen in simulation according to (86). A suitable value of ν=8 for the computation of the positive and negative thresholds in (86) has been considered. For what concern NLGA FDI scheme, the minimal detectable step faults on the various input sensors are summarised in Table 4.Table 4
NLGA FDI technique: minimalstep faults with ν=8.
ci(t)VariableFault sizeDelay timeElevatorδe2°5 sAileronδa2°3 sRudderδr2°6 sThrottle
aperture %δth6%3 sOn the other hand, the minimal detectable input sensor ramp faults are reported in Table5.Table 5
NLGA FDI technique: minimalramp faults with ν=8.
ci(t)VariableFault sizeDelay timeElevatorδe0.21°/s11 sAileronδa0.45°/s12 sRudderδr0.32°/s10 sThrottle
aperture %δth0.15°/s15 sThe minimal detectable step fault values in Tables2, 3, 4 and 5 are expressed in the unit of measure of the sensor signals. The fault step sizes and ramp slopes are relative to the case in which the occurrence of a fault is detected and isolated as soon as possible. The detection delay times represent the worst case results, as they are evaluated on the basis of the time taken by the slowest residual function to cross the settled threshold. These experiments represent a further validation of the residual generator robustness with respect to the fault type, as the the residual function sensitivity was optimised only with respect to step faults.As an example, Figure1 shows the 4 PM residual functions generated for the complete trajectory. On the basis of the fault-free and faulty conditions, this bank provides the correct isolation of the considered input sensor ramp fault.PM residuals for the 1st input sensor ramp faultfc1(t) isolation with ν=4.
(a)(b)(c)(d)The horizontal lines represent the levels of the fault-free thresholds that are settled according to test (86) with ν=4. The first residual function depicted in Figure 1, provides also the isolation of the fault fc(t) regarding the 1st input sensor.The second example of Figure2 shows the 4 residual functions generated by the NLGA filter bank applied to the complete aircraft trajectory. The horizontal lines represent the thresholds with ν=12. Note that, due to the NLGA design technique, only
the 1st residual related to the δe signal of the filter bank is sensitive to a ramp fault affecting the 1st input sensor.NLGA residuals for the 1st input sensor fault isolation withν=12.
(a)(b)(c)(d)


### 5.1. Reliability and Robustness Evaluation

In this section, the robustness characteristics of the proposed PM and NLGA FDI schemes have been evaluated and compared also with respect to the UIKF scheme [3] and the NN technique [7]. In particular, a bank of UIKF has been exploited for diagnosing faults of the monitored process. This technique seems to be robust with respect to the modelling uncertainties, the
system parameter variations, and the measurement noise, which can obscure the performance of an FDI system by acting as a source
of false faults. The procedure recalled here requires the design of
a UIKF bank and the basic scheme is the standard
one: a set of measured variables of the system is compared with the
corresponding signals estimated by filters to generate residual functions. The diagnosis has been performed by detecting the changes of UIKF residuals caused by a fault. The FDI input sensor scheme exploits a number of KF equal to the number of input variables. Each filter is designed to be insensitive to a different input sensor of the process and its disturbances (the so-called unknown inputs). Moreover, the considered UIKF bank was obtained by following the design technique described in [3, Section 3.5, pages 99–105], whilst the noise
covariance matrices were estimated as described in [22, Section 3.3, pages 70–74 and Section 4.6, pages 130-131]. Each of the 4 UIKF of the bank was decoupled from both one input sensor fault and the wind gust disturbance component, thus providing the optimal filtering of the input-output measurement noise sequences. On the other hand, a dynamic NN bank has been exploited in order to find the dynamic connection from a particular fault regarding the input sensors to a particular residual. In this case, the learning capability of NN is used for identifying the nonlinear dynamics of the monitored plant. The dynamic NN provides the prediction of the process output with an arbitrary degree of accuracy, depending on the NN structure, its parameters, and a sufficient number of neurons. Once the NN has been properly trained, the residuals have been computed as the difference between predicted and measured process outputs. The FDI is therefore achieved by monitoring
residual changes. The NN learning is typically an offline procedure. Normal operation data are acquired from the monitored plant and are exploited for the NN training. Regarding the NN FDI method and according to a generalised observer scheme (GOS) [3], a bank of 4 time-delayed three-layers multilayer perceptron (MLP) NN with 15 neurons in the input layer, 25 neurons in the hidden layer, and 1 neuron in the output layer is implemented. Each NN was designed to be insensitive to each input sensor fault, and the NN were trained in order to provide the optimal output prediction on the basis of the training pattern and target sequences [7].In the following of this section, the performances of the different FDI schemes have been evaluated by considering a more complex aircraft
trajectory. This has been obtained by means of the
guidance and control functions of a standard autopilot which stabilises the aircraft motion towards the reference trajectory as depicted in Figure3. The reference trajectory is
made up of 4 branches (2 straight flights and 2 turn flights) so that a closed path is obtained. It is worth observing that only 2 steady-state flight conditions are used to follow alternatively the 4 branches of the reference trajectory:
(i)
straight
flight condition: true airspeed =50 [m/s]; radius
of curvature =∞; flight-path angle=0°; altitude=330 [m]; flap
deflection=0°;(ii)
turn flight
condition: true airspeed =50 [m/s]; radius
of curvature =1000 [m];
flight-path angle =0°; altitude =330 [m]; flap deflection =0°.Figure 3
Aircraft complete trajectory example.The reference turn flight condition is used to design the PM and the NLGA filters. The achieved results are reported in Tables2 and 4, respectively. The performed tests represent a also a possible reliability evaluation of the considered FDI techniques. In fact, in this case the diagnosis requires that the residual generators are robust with respect to the flight conditions that do not match the nominal trajectory used for the design.As an example, the fault-free and faulty residuals generated by the designed NN and UIKF banks are shown in Figures4 and 5, respectively.NN residuals withramp fault.
(a)(b)(c)(d)UIKF residuals withramp fault.
(a)(b)(c)(d)Table6 summarises the results obtained by considering the observers and filters (corresponding to the PM, NLGA, UIKF, and NN) for the input sensor FDI whose parameters have been designed and optimised for the steady-state coordinated turn represented by the 2nd reference flight condition of the complete trajectory. Table 6 reports the performances of the considered FDI techniques in terms of the minimal detectable step faults on the various input sensors, as well as the corresponding parameters ν for the residual evaluation of (86). The mean detection delay is also reported in
Table 6 in order to compare the effectiveness of the different FDI schemes.Table 6
Performances of the FDI schemes for a complete aircraft trajectory.
VariablePMNLGAUIKFNNν41295δe4°3°4°3°δa5°3°5°4°δr5°3°4°4°δth7%10%11%12%Mean detection delay26 s25 s31 s27 sThe choice ofν has been performed with reference to the particular flight conditions involved in the complete trajectory following. In particular, the selected value of ν for each FDI observer or filter represents a tradeoff between two objectives, that is, for increasing the residual fault sensitivity and promptness, as well as for minimising the occurrence of false alarms due to the switching among the reference flight conditions needed to stabilise the aircraft motion towards the reference trajectory. Table 6 shows how the proper design of the parameter ν allows to obtain good performances with all the considered FDI schemes, hence the robustness with respect to the proposed complete trajectory is always achieved.It is worth noting that the NLGA has a theoretical advantage by taking into account the nonlinear dynamics of the aircraft. However, the behaviour of the related nonlinear residual generators is quite sensitive to the model uncertainties due to variation of the flight condition. In fact, the NLGA FDI scheme requires high values ofν which have to be increased (from 8 to 12 in this work) when the aircraft motion regarding the complete trajectory is considered in place of the nominal flight condition. In particular, even though the analysis was restricted just to the aircraft turn phase of the complete trajectory, a performance worsening would happen, since the steady-state condition (nominal flight condition) is quite far to be reached. However, the filter design based on the NLGA lead to a satisfactory fault detection, above all in terms of promptness. On the other hand, regarding the PM, it is rather simple to note the good FDI performances, even if optimisation stages can be required. The ν values selected for the PM are lower, but the related residual fault sensitivities are even smaller. Similar comments can be made for the UIKF and NN techniques.The simulation model applied to the complete trajectory is an effective way to test the performances of the proposed FDI methods with respect to modelling mismatch and measurement errors. The obtained results demonstrate the reliability of the PM-, NLGA-, UIKF-, and NN-based FDI
schemes as long as proper design procedures are adopted.


### 5.2. Monte Carlo Analysis

In this section, further experiment results have been reported. They regard the performance evaluation of the developed FDI scheme with respect to uncertainty acting on the system. Hence, the simulation of different fault-free and faulty data sequences was performed by exploiting the aircraft Matlab-Simulink simulator and aMonte Carlo analysis implemented in the Matlab environment. The Monte Carlo tool is useful at this stage as the FDI performances depend on the residual error magnitude due to the
system uncertainty, as well as the signal c(t) and y(t) measurement errors. It is worth noting how the Monte Carlo simulations have been achieved by perturbing the parameters of the PM filter residuals by additive white Gaussian noises with standard deviation values equal to a fixed percentage p of the element values. The same experiments have been performed by statistically varying the main parameters of the NLGA filters. In these conditions, the Monte Carlo analysis represents a further method for estimating the reliability and the robustness of the developed FDI schemes, when applied to the considered aircraft.For robustness and reliability experimental analysis of the FDI schemes, some performance indices have been used. The performances of the FDI method are then evaluated on a number of Monte Carlo runs equal to1000. This number of simulations is carried out to determine the indices listed below with a given degree of accuracy.False-Alarm Probability (rfa): the number of wrongly detected faults divided by
total fault cases.Missed-Fault Probability(rmf): for each fault, the total number of undetected
faults, divided by the total number of times that the fault case occurs.True Detection/Isolation Probability (rtd, rti): for a particular fault case, the number of times
it is correctly detected/isolated, divided by total number of times that the
fault case occurs.Mean Detection/Isolation Delay (τmd, τmi): for a particular fault case, the average
detection/isolation delay time.These indices are hence computed for the number of Monte Carlo simulations and for each fault case. Table7 summarises the results obtained by considering the PM dynamic filters for the input sensor FDI for a complete aircraft trajectory and with p=10%.Table 7
PM Monte Carlo analysis withν=4 and p=10%.
Faulty sensorrfarmfrtd,  rtiτmd,  τmiδe0.0020.0030.99727 sδa0.0010.0010.99918 sδr0.0020.0030.99725 sδth0.0030.0020.99835 sThe same analysis can be applied again to the residual generated by means of the NLGA, NN, and UIKF FDI schemes. The results are summarised in Tables8, 9 and 10.Table 8
NLGA Monte Carlo analysis withν=12 and p=10%.
Faulty sensorrfarmfrtd,  rtiτmd,  τmiδe0.0030.0040.99630 sδa0.0020.0020.99815 sδr0.0010.0010.99923 sδth0.0040.0030.99732 sTable 9
NN Monte Carlo analysis withν=5.
Faulty sensorrfarmfrtd,  rtiτmd,  τmiδe0.0040.0050.99533 sδa0.0030.0030.99723 sδr0.0040.0040.99629 sδth0.0050.0030.99738 sTable 10
UIKF Monte Carlo analysis withν=9.
Faulty sensorrfarmfrtd,  rtiτmd,  τmiδe0.0030.0040.99626 sδa0.0020.0020.99817 sδr0.0010.0020.99826 sδth0.0040.0030.99737 sTables7, 8, 9 and 10 show how the proper design of the dynamic filters with a proper choice of the FDI thresholds allow to achieve false-alarm and missed-fault probabilities less than 0.6%, detection and isolation probabilities bigger than 99.4%, with minimal detection and isolation delay times.
The results demonstrate also that Monte Carlo simulation is an effective tool for testing and comparing the design robustness of the proposed FDI methods with respect to modelling uncertainty (p=10%) and fixed measurement errors. This last simulation
technique example hence facilitates an assessment of the reliability of the developed, analysed, and applied FDI methods.


## 5.1. Reliability and Robustness Evaluation

In this section, the robustness characteristics of the proposed PM and NLGA FDI schemes have been evaluated and compared also with respect to the UIKF scheme [3] and the NN technique [7]. In particular, a bank of UIKF has been exploited for diagnosing faults of the monitored process. This technique seems to be robust with respect to the modelling uncertainties, the
system parameter variations, and the measurement noise, which can obscure the performance of an FDI system by acting as a source
of false faults. The procedure recalled here requires the design of
a UIKF bank and the basic scheme is the standard
one: a set of measured variables of the system is compared with the
corresponding signals estimated by filters to generate residual functions. The diagnosis has been performed by detecting the changes of UIKF residuals caused by a fault. The FDI input sensor scheme exploits a number of KF equal to the number of input variables. Each filter is designed to be insensitive to a different input sensor of the process and its disturbances (the so-called unknown inputs). Moreover, the considered UIKF bank was obtained by following the design technique described in [3, Section 3.5, pages 99–105], whilst the noise
covariance matrices were estimated as described in [22, Section 3.3, pages 70–74 and Section 4.6, pages 130-131]. Each of the 4 UIKF of the bank was decoupled from both one input sensor fault and the wind gust disturbance component, thus providing the optimal filtering of the input-output measurement noise sequences. On the other hand, a dynamic NN bank has been exploited in order to find the dynamic connection from a particular fault regarding the input sensors to a particular residual. In this case, the learning capability of NN is used for identifying the nonlinear dynamics of the monitored plant. The dynamic NN provides the prediction of the process output with an arbitrary degree of accuracy, depending on the NN structure, its parameters, and a sufficient number of neurons. Once the NN has been properly trained, the residuals have been computed as the difference between predicted and measured process outputs. The FDI is therefore achieved by monitoring
residual changes. The NN learning is typically an offline procedure. Normal operation data are acquired from the monitored plant and are exploited for the NN training. Regarding the NN FDI method and according to a generalised observer scheme (GOS) [3], a bank of 4 time-delayed three-layers multilayer perceptron (MLP) NN with 15 neurons in the input layer, 25 neurons in the hidden layer, and 1 neuron in the output layer is implemented. Each NN was designed to be insensitive to each input sensor fault, and the NN were trained in order to provide the optimal output prediction on the basis of the training pattern and target sequences [7].In the following of this section, the performances of the different FDI schemes have been evaluated by considering a more complex aircraft
trajectory. This has been obtained by means of the
guidance and control functions of a standard autopilot which stabilises the aircraft motion towards the reference trajectory as depicted in Figure3. The reference trajectory is
made up of 4 branches (2 straight flights and 2 turn flights) so that a closed path is obtained. It is worth observing that only 2 steady-state flight conditions are used to follow alternatively the 4 branches of the reference trajectory:
(i)
straight
flight condition: true airspeed =50 [m/s]; radius
of curvature =∞; flight-path angle=0°; altitude=330 [m]; flap
deflection=0°;(ii)
turn flight
condition: true airspeed =50 [m/s]; radius
of curvature =1000 [m];
flight-path angle =0°; altitude =330 [m]; flap deflection =0°.Figure 3
Aircraft complete trajectory example.The reference turn flight condition is used to design the PM and the NLGA filters. The achieved results are reported in Tables2 and 4, respectively. The performed tests represent a also a possible reliability evaluation of the considered FDI techniques. In fact, in this case the diagnosis requires that the residual generators are robust with respect to the flight conditions that do not match the nominal trajectory used for the design.As an example, the fault-free and faulty residuals generated by the designed NN and UIKF banks are shown in Figures4 and 5, respectively.NN residuals withramp fault.
(a)(b)(c)(d)UIKF residuals withramp fault.
(a)(b)(c)(d)Table6 summarises the results obtained by considering the observers and filters (corresponding to the PM, NLGA, UIKF, and NN) for the input sensor FDI whose parameters have been designed and optimised for the steady-state coordinated turn represented by the 2nd reference flight condition of the complete trajectory. Table 6 reports the performances of the considered FDI techniques in terms of the minimal detectable step faults on the various input sensors, as well as the corresponding parameters ν for the residual evaluation of (86). The mean detection delay is also reported in
Table 6 in order to compare the effectiveness of the different FDI schemes.Table 6
Performances of the FDI schemes for a complete aircraft trajectory.
VariablePMNLGAUIKFNNν41295δe4°3°4°3°δa5°3°5°4°δr5°3°4°4°δth7%10%11%12%Mean detection delay26 s25 s31 s27 sThe choice ofν has been performed with reference to the particular flight conditions involved in the complete trajectory following. In particular, the selected value of ν for each FDI observer or filter represents a tradeoff between two objectives, that is, for increasing the residual fault sensitivity and promptness, as well as for minimising the occurrence of false alarms due to the switching among the reference flight conditions needed to stabilise the aircraft motion towards the reference trajectory. Table 6 shows how the proper design of the parameter ν allows to obtain good performances with all the considered FDI schemes, hence the robustness with respect to the proposed complete trajectory is always achieved.It is worth noting that the NLGA has a theoretical advantage by taking into account the nonlinear dynamics of the aircraft. However, the behaviour of the related nonlinear residual generators is quite sensitive to the model uncertainties due to variation of the flight condition. In fact, the NLGA FDI scheme requires high values ofν which have to be increased (from 8 to 12 in this work) when the aircraft motion regarding the complete trajectory is considered in place of the nominal flight condition. In particular, even though the analysis was restricted just to the aircraft turn phase of the complete trajectory, a performance worsening would happen, since the steady-state condition (nominal flight condition) is quite far to be reached. However, the filter design based on the NLGA lead to a satisfactory fault detection, above all in terms of promptness. On the other hand, regarding the PM, it is rather simple to note the good FDI performances, even if optimisation stages can be required. The ν values selected for the PM are lower, but the related residual fault sensitivities are even smaller. Similar comments can be made for the UIKF and NN techniques.The simulation model applied to the complete trajectory is an effective way to test the performances of the proposed FDI methods with respect to modelling mismatch and measurement errors. The obtained results demonstrate the reliability of the PM-, NLGA-, UIKF-, and NN-based FDI
schemes as long as proper design procedures are adopted.


## 5.2. Monte Carlo Analysis

In this section, further experiment results have been reported. They regard the performance evaluation of the developed FDI scheme with respect to uncertainty acting on the system. Hence, the simulation of different fault-free and faulty data sequences was performed by exploiting the aircraft Matlab-Simulink simulator and aMonte Carlo analysis implemented in the Matlab environment. The Monte Carlo tool is useful at this stage as the FDI performances depend on the residual error magnitude due to the
system uncertainty, as well as the signal c(t) and y(t) measurement errors. It is worth noting how the Monte Carlo simulations have been achieved by perturbing the parameters of the PM filter residuals by additive white Gaussian noises with standard deviation values equal to a fixed percentage p of the element values. The same experiments have been performed by statistically varying the main parameters of the NLGA filters. In these conditions, the Monte Carlo analysis represents a further method for estimating the reliability and the robustness of the developed FDI schemes, when applied to the considered aircraft.For robustness and reliability experimental analysis of the FDI schemes, some performance indices have been used. The performances of the FDI method are then evaluated on a number of Monte Carlo runs equal to1000. This number of simulations is carried out to determine the indices listed below with a given degree of accuracy.False-Alarm Probability (rfa): the number of wrongly detected faults divided by
total fault cases.Missed-Fault Probability(rmf): for each fault, the total number of undetected
faults, divided by the total number of times that the fault case occurs.True Detection/Isolation Probability (rtd, rti): for a particular fault case, the number of times
it is correctly detected/isolated, divided by total number of times that the
fault case occurs.Mean Detection/Isolation Delay (τmd, τmi): for a particular fault case, the average
detection/isolation delay time.These indices are hence computed for the number of Monte Carlo simulations and for each fault case. Table7 summarises the results obtained by considering the PM dynamic filters for the input sensor FDI for a complete aircraft trajectory and with p=10%.Table 7
PM Monte Carlo analysis withν=4 and p=10%.
Faulty sensorrfarmfrtd,  rtiτmd,  τmiδe0.0020.0030.99727 sδa0.0010.0010.99918 sδr0.0020.0030.99725 sδth0.0030.0020.99835 sThe same analysis can be applied again to the residual generated by means of the NLGA, NN, and UIKF FDI schemes. The results are summarised in Tables8, 9 and 10.Table 8
NLGA Monte Carlo analysis withν=12 and p=10%.
Faulty sensorrfarmfrtd,  rtiτmd,  τmiδe0.0030.0040.99630 sδa0.0020.0020.99815 sδr0.0010.0010.99923 sδth0.0040.0030.99732 sTable 9
NN Monte Carlo analysis withν=5.
Faulty sensorrfarmfrtd,  rtiτmd,  τmiδe0.0040.0050.99533 sδa0.0030.0030.99723 sδr0.0040.0040.99629 sδth0.0050.0030.99738 sTable 10
UIKF Monte Carlo analysis withν=9.
Faulty sensorrfarmfrtd,  rtiτmd,  τmiδe0.0030.0040.99626 sδa0.0020.0020.99817 sδr0.0010.0020.99826 sδth0.0040.0030.99737 sTables7, 8, 9 and 10 show how the proper design of the dynamic filters with a proper choice of the FDI thresholds allow to achieve false-alarm and missed-fault probabilities less than 0.6%, detection and isolation probabilities bigger than 99.4%, with minimal detection and isolation delay times.
The results demonstrate also that Monte Carlo simulation is an effective tool for testing and comparing the design robustness of the proposed FDI methods with respect to modelling uncertainty (p=10%) and fixed measurement errors. This last simulation
technique example hence facilitates an assessment of the reliability of the developed, analysed, and applied FDI methods.


## 6. Conclusion

The paper provided the development and application of two FDI techniques based on a PM scheme and on an NLGA method, respectively. The PM procedure led to residual generators optimising the tradeoff between disturbance-decoupling and fault sensitivity. Moreover, the application of the PM FDI scheme resulted robust with respect to
model uncertainties. On the other hand, the NLGA relies on a novel design
scheme based on the structural decoupling of disturbances and modelling errors, Thus, the mixedℋ−/ℋ∞ optimisation of the tradeoff between fault sensitivity, disturbances, and modelling errors has been proposed. The PM and NLGA residual generators were tested by considering a nonlinear aircraft simulator model that takes into account also the wind gusts, the Dryden turbulence, the input-output sensors measurement errors, as well as the engine and the servo actuators. Moreover, in order to verify the robustness characteristics and the achievable performances of the approaches, the simulation results considered a typical aircraft reference trajectory consisting of several steady-state flight conditions. The effectiveness of the developed PM and NLGA FDI schemes was shown by simulations and a comparison with widely used data-driven and model-based disturbance-decoupling FDI schemes, such as NN and UIKF diagnosis methods, was provided. The reliability and the robustness properties of the proposed residual generators to model uncertainty and disturbances and
measurement noise for the aircraft nonlinear model were investigated via Monte Carlo simulations. Further works extensive comparative studies for robustness of the FDI algorithms when applied to real data.



---

*Source: 274313-2008-03-30.xml*