Development of an Active Fault Tolerant Flight Control Strategy

Abstract

This chapter deals with the next step following the design of an FDD system, i.e. appropriate recovery strategies, based on all available actuator/sensor/communication resources. An active fault tolerant flight control strategy based on H
∞
design tools is presented. The Fault Tolerant Control (FTC) strategy operates in such a way that once a fault is detected and confirmed by an FDD unit, a compensation loop is activated for safe recovery. A key feature of the proposed strategy is that the added FTC loop keeps unchanged the in-service control laws facilitating the certification of the whole approach and limiting the underlying Verification and Validation activities. The methodology is applied to actuator fault accommodation of a large commercial aircraft during landing approach. The results, obtained from a piloted 6-DoF flight simulator, will be presented and discussed. The application is taken from the GARTEUR project. The problem studied in this chapter is that of design and analysis of an active flight fault-tolerant control system. The chapter presents a practical case study taken from the European GARTEUR project (Flight Mechanics Action Group 16) on fault-tolerant control. Piloted flight simulator experiments are presented which show that fault tolerance can be achieved provided that there exists sufficient onboard control authority.

Full text

Development of an Active Fault-Tolerant Flight Control Strategy
Jérôme Cieslak,∗David Henry,†and Ali Zolghadri‡
University of Bordeaux I, 33405 Talence, France
and
Philippe Goupil§
Airbus France, 31060 Toulouse Cedex 09, France
DOI: 10.2514/1.30551
This paper discusses the design of an active fault-tolerant flight control strategy for improvement of the
operational control capability of the aircraft system. The research work draws expertise from actions undertaken
within the European Flight Mechanics Action Group [FM-AG(16)] on fault-tolerant control, which develops a
collaborative effort in Europe to create new fault-tolerant control technologies that significantly advance the goals of
the aviation safety. The methodology is applied to a trimmable horizontal stabilizer runaway fault occurring in a
large transport aircraft. The goal is to provide a self-repairing capability to enable the pilot to land the aircraft safely.
The fault-tolerant control strategy works in such a way that once the fault is detected by the fault detection and
isolation unit, a compensation loop is activated for safe recovery. A key feature of the proposed strategy is that the
design of the fault-tolerant control loop is done independently of the nominal autopilot and the nominal flight control
system in place. Nonlinear simulation results demonstrate the effectiveness of the proposed fault-tolerant control
scheme.
Nomenclature
EPR= thrust engine position
h= altitude
ih= stabilizer deflection
p= body roll rate
q= body pitch rate
r= body yaw rate
VTAS = true air speed
xe= distance in the Xedirection
ye= distance in the Yedirection
= angle of attack
= angle of sideslip
a = aileron deflections
e = elevator deflections
f=flap deflections
r= rudder deflections
sp= spoilers
= angle of pitch
’= angle of roll
= angle of yaw
I. Introduction
THE need for increased flight safety and aircraft reliability leads
to the design of reconfigurable fault-tolerant control systems.
Such systems could manage adequately faulty situations and are
supposed to help the crew to recover control capabilities quickly.
Fault-tolerant control (FTC) strategy is one solution to tackle this
problem and has received considerable attention from the control
research community and aeronautical engineering in the past couple
of decades (for a survey, see, for instance, [1–3]). The main objective
of fault-tolerant control is to maintain the specified performance of a
system in the presence of faults. Two approaches can be
distinguished in this area: the passive and the active approaches. In
the passive approach, the control algorithm is designed so that the
system is able to achieve its given objectives, in healthy as well as in
faulty situations. Unfortunately, achieving robustness to certain
faults is only possible at the expense of decreased nominal
performance. The active approaches react actively to fault events by
using a reconfiguration mechanism. Consequently, this ensures
nominal performances in fault-free situations. This is a great benefit
of active FTC approaches.
An active FTC is characterized by an online and real-time fault
detection and isolation (FDI) and a reconfiguration mechanism. This
scheme requires its control law to react to faults through
reconfiguration and FDI modules [4]. Many studies based on a
possible known-fault scenario have contributed to the development
of active FTC strategy for aeronautical systems (see, for instance,
[3,5–7]). The goal is to maintain overall system stability and
acceptable performance in spite of the occurrence of faults by
reconfiguring the nominal control law when a fault is detected by the
FDI unit. The FDI mechanism is supposed to detect and diagnose any
relevant failure that could lead to flight performance degradation.
This shall be done sufficiently early and in compliance with the
stringent operational and flight dynamics constraints, to set up timely
safe recovery actions and to improve the situation awareness of the
crew.
The main difficulty that appears when integrating the different
units to build a reliable active FTC law is that each individual
subsystem is assumed to operate correctly: its output is instan-
taneously available to provide decisions/actions to other subsystems.
This implies some interactions between the reconfigurable controller
and the FDI unit (as mentioned, for instance, in [2,8,9]). To take into
account this interaction, one solution could be the progressive
accommodation scheme proposed in [10]. The goal is to minimize
the effects of control inappropriateness during time-delay
reconfiguration. However, in this case, computational burden could
be a critical factor, and stability management remains a major issue.
Received 19 February 2007; revision received 18 June 2007; accepted for
publication 25 July 2007. Copyright © 2007 by the American Institute of
Aeronautics and Astronautics, Inc. All rights reserved. Copies of this paper
may be made for personal or internal use, on condition that the copier pay the
$10.00 per-copy fee to the Copyright Clearance Center, Inc., 222 Rosewood
Drive, Danvers, MA 01923; include the code 0731-5090/08 $10.00 in
correspondence with the CCC.
∗Ph.D. Student, Automatic Control Group, Intégration du Matériau au
Système (IMS) Laboratory, 351 Cours de la Liberation; jerome.cieslak@
laps.ims-bordeaux.fr (Corresponding Author).
†Associate Professor, Automatic Control Group, Intégration du Matériau
au Système (IMS) Laboratory, 351 Cours de la Liberation; david.henry@
laps.ims-bordeaux.fr.
‡Professor, Automatic Control Group, Intégration du Matériau au Système
(IMS) Laboratory, 351 Cours de la Liberation; ali.zolghadri@laps.
ims-bordeaux.fr.
§Aeronautic Engineer, Flight Control System, 316 Route de Bayonne;
philippe.goupil@airbus.com.
JOURNAL OF GUIDANCE,CONTROL,AND DYNAMICS
Vol. 31, No. 1, January–February 2008
135

Some works combine a fault-tolerant controller with a diagnostic
filter. In [11], the authors use the standard H1setting to design a
nominal controller and a robust detection filter. In this configuration,
the primal Youla parameterization of all stabilizing controllers is
selected to ensure the fault compensation, with the assurance that
closed-loop stability is maintained in the presence of fault. In [12],
the dual Youla parameterization is used for determining the set of all
faulty processes that can be stabilized by the (nominal) control law. It
is shown that both fault diagnosis and fault-tolerant control can be
combined in the same architecture, and this is an interesting
framework for analyzing the relationship between FDI and FTC.
However, to cope with performance degradation when faults are not
detected by the FDI, the authors proposed to activate the fault-
tolerant controller all the time. As a consequence, their approach is
equivalent to a passive FTC scheme. Other works are based on linear
parameter-varying (LPV) techniques [13,14]. The idea is to use the
residual output of the FDI scheme jointly with some subspace of the
system states as scheduling parameters of the LPV fault-tolerant
controller.
In this paper, an attempt is made to provide an active FTC strategy
that addresses the aforementioned issues. The application is related
to ongoing research is undertaken within a Group for Aeronautical
Research and Technology in Europe (GARTEUR) program to assess
the capability of active FTC schemes on a realistic design problem.
The proposed active FTC strategy is based on H1control theory
and it is applied to an aircraft suffering from degraded stabilizer
control effectiveness. A key feature of the proposed strategy is that
the design of the FTC loop is done independently of the nominal
autopilot and the nominal flight control system (FCS) already in
place. The paper is organized as follows. Section II introduces FTC
concepts. Section III is devoted to the analysis of the proposed FTC
architecture, and Sec. IV presents the application and simulation
results.
II. Problem Statement
Motivated by several aircraft accidents at the end of the 1970s, in
particular, the crash of an American Airlines DC-10 in Chicago in
1979, research on self-repairing or reconfigurable fault-tolerant flight
control has become a very active research topic in the last decades. In
this context, the European Flight Mechanics Action Group 16 [FM-
AG(16)] on fault-tolerant control GARTEUR program was
established to demonstrate the capability and viability of
reconfiguration schemes on a realistic nonlinear design problem.
As part of this research, a simulation benchmark based on the Boeing
747-100/200 large transport aircraft was developed for the integrated
assessment of FTC methods [15–17]. This aircraft was chosen
because its wide array of characteristics (26 control surfaces and 4 jet
engines) makes it representative of most of the commercial airplanes
flying today. The test scenarios that are an integral part of the
benchmark were selected to provide challenging assessment criteria
to evaluate the potential of the FTC methods investigated. The
benchmark test maneuvers correspond to the landing approach. A
schematic overview of these maneuvers is given in Fig. 1.
In the benchmark, the pilot commands are replaced by signals
generated by the benchmark scenario generator. The aircraft is a
B747 fitted with its standard autoflight system, as shown in Fig. 2.
The autoflight system integrates a longitudinal and a lateral
controller. Each controller contains inner and outer loops. Referring
to Fig. 2, the autoflight system consists of the FCS that forms the
inner control loop and an outer loop represented by the autopilot
system (autothrottle is not implemented yet). In addition, an onboard
FDI unit was placed within the simulator. Five faulty scenarios
(essentially actuator faults) and the El Al Flight 1862 in Bijlmermeer
in 1992 [18] catastrophic accident are considered in the benchmark.
The faulty situation investigated in this paper consists of the
motion of the extreme positions of the trimmable horizontal stabilizer
(THS) surface at the maximum rate limit (i.e., 0:5 deg =s),
occurring when the airplane is in normal flight (i.e., first part of the
maneuver, see Fig. 1). More precisely, the THS fault corresponds to a
hardware malfunction. Hence, we assume that it is not possible to act
on the faulty THS surface to accommodate it or put it into its neutral
position. For the studied flight trajectory, the aircraft is in the so-
called altitude select pitch mode. Consequently, the dynamic
behavior of the transport aircraft is given by the longitudinal motion.
The goal we pursue is to develop a FTC scheme to accommodate
stabilizer failure using the remaining control surfaces (the elevator
surfaces). It should be pointed out that the maximum deflection in the
positive direction of the THS surface (i.e., 3 deg) and to a negative
position (up to 5 deg) can be fully compensated using this strategy.
However, the movement to its extreme negative position (i.e.,
12 deg) cannot be compensated, due to the physical limitations of
the elevator deflections.
Following the basic ideas presented in [19], we propose to tackle
the design of the FTC loop according to the block diagram of Fig. 3.
The proposed reconfigurable flight control and safety recovery
scheme is made of three parts: an FDI part represented by Hys,
Hus, and decision-making rules, which continuously generates a
fault-indicating signal r; an FTC part represented by ~
Kswhich
generates an additional control signal ~
uto be added to the nominal
control signal uoin a faulty situation; and a FTC activation
mechanism to activate the FTC strategy. Once again, the overall FTC
strategy works in such a way that in a fault-free situation, the FTC
Fig. 1 Test maneuvers studied in the benchmark.
136 CIESLAK ET AL.

loop is not activated, leaving the aircraft controlled only by the
autoflight control system. When the FTC strategy is activated, the
control law is reconfigured by adding the signal ~
uto the nominal
control signal uo. The activation of this loop is done by using a
switching logic; that is, the autoflight control system is not removed
when no fault is present and, consequently, the overall scheme
ensures nominal flight performance in fault-free situations. This is
one major advantage of the proposed method.
This proposed active FTC architecture implies some important
issues. The first question concerns the activation delay of the strategy
FTC. During this time interval, the faulty system is controlled by the
nominal control law that has not been designed for faulty situations.
This problem is also highly related to the time-delay detection of the
FDI part. In this paper, we will present a method that addresses this
problem efficiently. Next, as can be seen in Fig. 3, in fault-free
situation, the FTC scheme is in open loop. Then an important
requirement for FTC scheme is that the interconnection of Hys,
Hus, and ~
Ks, depicted in Fig. 3, must be stable. Because Hys
and Husare stable detection filters, this problem is equivalent to the
stability requirement of ~
Ks. This will be discussed in Sec. IV.
Another important aspect is the availability of the FDI mechanism. In
the case of analytical redundancy, the representations of the filters
Hysand Husare also available. The decision-making rules that
activate the FTC strategy are then monitored by the residual signal r.
The diagram in Fig. 3 can then be represented by the diagram of
Fig. 4, in which Knsis the autoflight control system and Gsis the
model of aircraft dynamics. The FTC design problem is now
equivalent to the design of a dynamic fault-tolerant controller ~
Ks
that ensures input/output insensitivity in some sense, despite the
presence of the fault.
Problem 1: Suppose that the faulty system is stabilizable. The goal
is to design a stable controller ~
Ksto produce the new control signal:
utuot ~
Ksrt(1)
such that the stability of the feedback system and the required control
objectives are guaranteed for the considered THS fault. Using an H1
formulation, this means that ~
Ksshould satisfy the following
constraint:
kFlP1s;~
Ksk1<
1(2)
where P1sis deduced from Kns,Gs,Hys, and Hususing
some linear-fractional manipulations, and 1denotes some FTC
performance level to achieve. Here, FlP1s;~
Ks corresponds to
the lower linear-fractional transformation of P1sby ~
Ks.
When the FDI mechanism is available onboard, the FTC problem
can be seen as the design of a filter 
Ks(Fig. 5). The onboard FDI
unit is also used to manage the activation switch. In this case, the
synthesis problem can be formulated as follows:
Problem 2: Suppose that the faulty system is stabilizable. The goal
is to design a stable controller 
Ksto produce the new control signal:
~
ut 
Ksyt
uot
 (3)
such that the stability of the feedback system and the required control
objectives are guaranteed for the considered THS fault. Using an H1
formulation, this means that 
Ksshould verify
kFlP2s;
Ksk1<
2(4)
where P2sis deduced from Knsand Gsafter some linear-
fractional algebra manipulations, and 2represents some perform-
ance level to achieve.
Remark 1: Referring to the setup diagrams in Fig. 4 and 5, it is
natural to ask about the stability of the FTC loop due to the presence
of the switch. Here, we assume that once a fault is detected, the switch
is definitively activated and the compensation signal ~
uremains active
all the time. The remaining problem then concerns the transient
behavior of ~
u. To avoid bumps, a solution to manage this problem is
given in Appendix B.
III. Analysis of the FTC System
Before proceeding to the design of the FTC loop for the FM-AG
(16) benchmark, the structure of the FTC system presented in Fig. 4 is
analyzed to highlight some interesting features with respect to the
interaction between the FDI and FTC units.
A. Analysis of the FTC Loop
Consider the general setup shown in Fig. 5. Let A; B; C; D,
~
A; ~
B; ~
C; ~
D,Au;B
u;C
u;D
u, and Ay;B
y;C
y;D
ybe the state-
space representations of Gs,~
Ks,Hus, and Hys, respectively.
The FTC loop state-space model 
Ps, which includes Gs,~
Ks,
Hus, and Hys, is given by

P:8
>
>
>
<
>
>
>
:
_
xc
_
xu

A11 A12
0Au

xc
xu

B1
Bu

uo
yC1C2xc
xu

D
puo
(5)
Fig. 2 Benchmark setup.
Fig. 3 Benchmark setup associated with the proposed AFTC strategy.
Fig. 4 General FTC setup with an analytical redundancy.
Fig. 5 General FTC setup with an onboard FDI scheme.
CIESLAK ET AL. 137

where the matrices A11,A12 ,B1,C1,C2, and D
Pare deduced from the
preceding state-space representations as follows:
A11

ABM ~
DDyCBM
~
CBM
~
DCy
~
BDyCDM ~
DDyC~
A~
BDyDM ~
C~
BIDyDM ~
DCy
ByIDM ~
DDyCB
yDM ~
CA
yByDM ~
DCy
0
B
@1
C
A
(6)
A12 
BM ~
DCu
~
BIDyDM ~
DCu
ByDM ~
DCu
0
@1
A(7)
B1
BMI~
DDu
~
BDuDyDMI~
DDu
ByDMI~
DDu
0
@1
A(8)
C1CDM ~
DDyCDM
~
CDM
~
DCy(9)
C2DM ~
DCu(10)
D
pDMI~
DDu(11)
MI~
DDyD1(12)
and xcxT~
xTxT
yT;x,~
x,xy, and xuare, respectively, the state
of Gs,~
Ks,Hys, and Hus.
From Eq. (5), it can be seen that the poles of 
Psare given by the
eigenvalues of A11 and Au. Note that the expression of A11 does not
contain Au,Bu,Cu,orDumatrices; it follows that Hus(stable filter)
has no effect on the stability of 
Ps. This analysis justifies the choice
to take the signal uofor the FDI instead of u. In the latter case, an
internal loop appears, vanishing the property observed here.
B. Analysis of the Overall Loop
Now we consider the diagram of Fig. 5, in which the state-space
representations of Knsand 
Psare given by An;B
n;C
n;D
nand
Ap;Bp;Cp;Dp, respectively. Let xnbe the state vector of Kns.
Direct calculations lead to the following closed-loop state-space
model:
8
>
>
>
<
>
>
>
:
_
x
p
_
xn

AT
x
p
xn

BTyref
yCT
x
p
xn

DTyref
(13)
where AT,BT,CT, and DTare given by
ATA
pB
pDnyNC
pB
pCnB
pDnyND
pCn
BnyNCpAnBnyNDpCn

(14)
BTB
pIDnyND
pDnDnref
Bnref BnyNDpDnref

(15)
CTNC
pND
pCn(16)
DTND
pDnref (17)
NIDpDny1(18)
BnBnref Bny(19)
DnDnref Dny(20)
and x
pxT~
xTxT
yxT
uT.
Equation (13) shows that the stability of the overall loop depends
on the stability of the FDI filter. This is an expected and rather evident
result. Then Eq. (13) reveals that FDI and FTC dynamics are highly
coupled.
C. Some Outlines for the Design
The preceding analysis allows an outline for the design of an
integrated FTC/FDI unit. A nice feature of the proposed FTC
architecture presented in Fig. 3 is that 
Ksfilter can be seen as the set
of all admissible FDI/FTC units that achieves some level of
performance 2. This suggests the following design procedure. First,
design 
Ksaccording to some FTC objectives (see Problem 2).
Once 
Ksis designed, the challenge is to deduce from 
Ksthe FDI
parts Hysand Husand the FTC part ~
Ks. The suggested
procedure will consist of designing Hysand Husand then to
integrate the FDI performance specifications into the FTC design
procedure. Thus, the obtained FDI/FTC couple is the solution of the
problem of integrated FTC/FDI units design, if and only if this couple
belongs to the set 
Ks; that is, if
kFlfP2s;F
lFs;~
Ksgk1<
2(21)
where Fsis the diagnostic filter composed by the Hysand Hus
filters. This situation can be illustrated as shown in Fig. 6.
IV. FM-AG(16) Garteur FTC Problem
We now consider the problem of designing the FTC loop to
compensate THS runaway failures. We assume that an onboard-
fault-diagnosis unit that detects and isolates this fault type is
available. Thus, the problem becomes that of designing the filter

Kssuch that Eqs. (3) and (4) are achieved.
A. Modeling the Boeing 747 Aircraft Dynamics
The Boeing 747-100/200 model includes aircraft aerodynamic
model and engines. In addition, actuator and sensor characteristics
are taken into account, together with models for wind, atmospheric
turbulence, and faults [15,16,20]. The aerodynamic forces and
moments are defined in terms of aerodynamic coefficients. These
coefficients are stated in the form of lookup tables. They are
functions of a wide set of parameters (pitch angle, angle of attack,
true airspeed, altitude, etc.). The dimension of the aircraft output
vector is 142. However, all output signals are not necessary to control
the aircraft. Indeed, the FCS (inner control loop) uses only 16
measured signals and the autopilot that corresponds to the outer
control loop needs 67 measured signals. The dynamic behavior of the
aircraft is described by a nonlinear state representation:
Fig. 6 Set of all admissible FDI/FTC units.
138 CIESLAK ET AL.

_
xNLtfxNL t;u
NLt (22)
yNLtgxNL t;u
NLt  vt(23)
where xNL,uNL , and yNL are the state, input, and output vectors,
respectively, of the full aircraft nonlinear model [the input and state
components are given in Appendix A (see Tables A1 and A2)], and v
are the measurement noises that are assumed to be normal Gaussian-
distributed random signals. The interested reader can refer to [15] for
a complete description of the aircraft output vector. In this
formulation, we assume that model parameters (mass and inertia) are
fixed to their nominal values.
Once a trim condition is established for the nonlinear aircraft
model, a linear model is generated to capture the dynamics around
the point: h1000 m;VTAS 133:8m=s;m263;000 kg; and
M0:3977, where h,VTAS,m, and Mdenote, respectively, the
altitude, the aircraft velocity, the mass of the aircraft, and the Mach
number.
Simplified models for the longitudinal and lateral modes can then
be derived to obtain a better physical insight into the modes and their
interactions. These models are widely used in aeronautical
engineering and are not developed here. Because the aircraft stays
in the pitch mode for the considered fault, only the longitudinal mode
is considered. Here, the longitudinal mode is represented by the
following state equations:
_
xtAxtBut
ytCxtvt(24)
where the longitudinal state vector is defined by
xq; VTAS ;;;hT;ue;i
hTis the control input vector;
and yq; VTAS ;;h; _
hTis the measured output vector (see
Appendix A for the definition of all variables).
Taking into account the THS runaway faults, the following linear
state-space model is derived from Eq. (24):
_
xtAxtBeutBffTHSt
ytCxtvt(25)
where Beand Bfare matrices of appropriate dimensions deduced
from B. The input signals ue correspond to the elevator
defections, and fTHS ihdenotes the THS fault [hardware
malfunction (see Sec. II)]. Note that this model is clearly an
approximation of the real faulty behavior of the aircraft. Figure 7
shows linear and nonlinear simulation results. It can be seen that the
linearized model responses are close to the responses of the nonlinear
model given in Eqs. (22) and (23).
B. Modeling the Autoflight Control System
The autoflight system integrates a longitudinal and a lateral
controller [21]. For the considered flight trajectory (longitudinal
motion), the implemented autoflight control system is represented in
Fig. 8. It can be seen on the figure that the elevator control system is
composed of two control loops. The inner and outer control loops
adequately manage the elevator control surface e to control the
altitude. The THS position is controlled by thumb switches on the
pilot and copilot control wheels (actions given by the test scenarios).
As classically designed in the aeronautical engineering, it can be seen
that the autoflight control system remains in a gain-schedule-based
controller, in which the scheduling parameters are hand VTAS .K1,
K2,K3,K4,K5, and K6are constant gains and K7sand K8sare
dynamic controllers designed to keep stability and performances
during a longitudinal flight.
Because it is assumed that VTAS keeps (almost) constant value
during the considered flight trajectory, it is obvious to obtain (from
the structure illustrated in Fig. 8) a linear model Knsfor the
autoflight system. Thus, it turns out that the global model of the
Boeing 747 (i.e., aircraft, actuator, sensor dynamics, and autoflight
system) has the structure illustrated in Fig. 5.
C. Design of 
Ks
The problem is now to design a stable controller 
Kssuch that
kFlP2s;
Ksk1<
2
(see the discussion in Sec. II). To this end, a mixed-sensitivity H1
synthesis is proposed. The setup diagram used for the design problem
is given on Fig. 9.
Wp1sand Wp2sare weighting functions used to shape the
transfer functions SFTCsand RFTC sgiven by
SFTCsIGusKns 
KsI
Kns
 1
Gfs
(26)
RFTCsKns 
KsI
Kns

SFTCs(27)
where the transfer functions Guand Gfare, respectively, given by
GusCsI A1Be
and
GfsCsI A1Bf
A,Be,Bf, and Cmatrices are defined according to Eq. (25). SFTC and
RFTC also refer, respectively, to the faulty sensitivity function and the
faulty sensitivity function of the controlled input.
Using some linear-fractional algebra manipulations, the problem
illustrated in Fig. 9 becomes the problem presented Fig. 10. Then

Kscan be computed by using any standard robust control design
method. However, as outlined in Sec. II, 
Ksoperates in an open-
loop manner in a fault-free situation. Therefore, 
Ksmust be
designed to be stable. Linear matrix inequality (LMI)-based
solutions exist in the literature [22,23] that address the stability of

Ks. To avoid duplicating published materials, we will not present
the solution. The interested reader can refer to [22,23] for necessary
backgrounds.
The weighting function Wp1swas chosen to impose a small
damping ratio on altitude h(m) and pitch rate q(rad=s) in the
faulty situation, and Wp2swas fixed to take into account actuator
saturation phenomena. More precisely, W1
p2sis a low-pass filter
used to attenuate the energy of the control signal applied to
elevator surfaces such that the control-signal behavior keeps
smooth (high-frequency filter action). The final choice for Wp1s
and Wp2sare
Wp1s5;6:1045s1
1:104s1;1:10512;5s1
25:105s1
W11s;W
14s (28)
Wp2sdiag0;10;2s1
1;4:102s1;0;10;2s1
1;4:102s1;0;10;2s1
1;4:102s1;0;10;2s1
1;4:102s1(29)
CIESLAK ET AL. 139


Ksis then synthesized following the method described earlier.
The SDPT3-3.02 solver [24] is used for numerical computations.
Figure 11 shows frequency responses obtained with 
Ks.
As can be seen,

TfTHS!hj! <W1
14 j!8!

TfTHS!qj! <W1
11 j!8!
and

TfTHS!ej! <W1
p2j!8!
indicating that the computed FTC controller 
Ksachieves the
desired performance level.
Fig. 7 Dynamic behavior of linear and nonlinear models for THS fault and without noises.
Fig. 8 Autoflight control system for the considered flight trajectory.
Fig. 9 FTC synthesis problem.
Fig. 10 Design of the fault-tolerant controller.
140 CIESLAK ET AL.

D. Nonlinear Simulation Results
The controller 
Ksis implemented within the FM-AG(16)
GARTEUR nonlinear simulator of the Boeing 747 aircraft of Fig. 5.
The faulty scenario corresponds to the THS fault (the THS sur-
face moves quickly to the extreme position of 3 deg) occurring at
t5s. To emphasize the benefit of the proposed FTC scheme, the
same simulation is carried out when the system is only controlled by
the standard B747 control system (no FTC). Figure 12 illustrates the
behavior of the aircraft for the system controlled by the autoflight
control system alone and when FTC strategy is engaged.
It can be seen that with the designed FTC scheme, the aircraft
maintains normal flight trajectory (i.e., the aircraft stays at the
selected altitude). However, when the aircraft is controlled by the
conventional FCS, it does not stay at the desired altitude. Figure 13
more precisely illustrates the behavior of the aircraft via the altitude
h, the pitch rate q, the velocity VTAS , the pitch angle , the altitude rate
_
h, and the control signals e for the two control schemes. As can be
seen from Fig. 13, when the FTC scheme is in place, the controlled
system keeps acceptable flying condition (i.e., quick compensation
of the fault, with the damping ratio almost null on input/output
system signals).
Fig. 11 Post analysis of 
Ks.
Fig. 12 Aircraft response: THS runaway fault (3deg).
CIESLAK ET AL. 141

Furthermore, it can be seen that, as expected, the elevator
deflections do not violate the position and rate limits (the deflection
and rate limits for the elevators are 23 deg; 17 degand
37 deg =s, respectively).
Figure 14 illustrates the behavior of the load factor nz. As can be
seen, the magnitude of undesirable transients on nzcaused by the
occurrence of fault is reduced when the FTC strategy is in place.
From a practical point of view, the aircraft exhibits smaller
excursions in altitude, airspeed, etc. Note that when the aircraft is
only controlled by the conventional autoflight control system,
undesirable transient behaviors appear between 20 and 27 s. A
Fig. 13 Aircraft responses due to THS runaway fault (3deg).
Fig. 14 Load factor: THS runaway fault (3deg). Fig. 15 Aircraft response: THS runaway fault (5deg).
142 CIESLAK ET AL.

deeper investigation into these situations reveals an inappropriate
gain scheduling of the autoflight.
Remark 2: Following Remark 1, the activation of the switch may
cause some undesirable bumps. To overcome this problem, a
solution is discussed in Appendix B. Here, such a bumpless solution
was revealed to be unnecessary.
Another simulation is performed when the THS goes to the
negative position 5 deg at the maximum rates. Figures 15–17
illustrate the results. As can be seen, the FTC law performs as
expected.
Finally, another failure mode for the THS surface is studied.
The new faulty scenario corresponds to an oscillatory scenario
occurring at t5s. The time period and the amplitude of the
oscillation are fixed to 34 s and 4 deg, respectively. These failure
characteristics were chosen because they can degrade the aircraft
handling quality.
Fig. 16 Aircraft responses due to THS runaway fault (5deg).
Fig. 17 Load factor: THS runaway fault (5deg). Fig. 18 Aircraft response: oscillatory THS fault.
CIESLAK ET AL. 143

Figure 18 illustrates the behavior of the aircraft. It can be seen that
when the FTC strategy operates, the aircraft has a flight trajectory
close to the normal trajectory (i.e., the aircraft stays at the selected
altitude). Figure 19 more precisely illustrates the behavior of the
aircraft through the altitude h, the pitch rate q, the velocity VTAS , the
pitch angle , the altitude rate _
h, and the control signals e. The load
factor response nzis given in Fig. 20. As can be seen, the magnitude
of undesirable transients on nz, caused by the occurrence of fault, is
reduced when the FTC strategy performs. Also, the results show that
the fault is compensated without violating the elevator deflection
limitations.
V. Conclusions
This paper presents ongoing research undertaken within the FM-
AG(16) of the GARTEUR project. This research aims at
demonstrating the capability and viability of modern FDI/FTC
methods on a realistic nonlinear aircraft model and to enhance critical
flight safety issues. The faulty situation studied here corresponds to
movement to an extreme position of the trimmable horizontal
stabilizer (THS) occurring when the airplane is in normal flight.
Because the design of the FDI part is not of primary interest in this
work, we used information coming from available onboard detection
mechanisms to activate the fault-tolerant controller. From a practical
point of view, the proposed approach has some advantages over
existing FTC. The proposed FTC design method uses some well-
known and robust numerical tools commonly used in the robust
control community (linear matrix inequalities). Another advantage is
that the design of the FTC loop is done independently of the existing
flight control system. In fact, the FTC system works in a way that
when a fault is detected, the control law is reconfigured in real time by
adding a loop activated to compensate the faults. This is an
interesting aspect of this design scheme, because the overall scheme
Fig. 19 Aircraft responses due to the oscillatory fault of the THS.
Fig. 20 Load factor: oscillatory fault of the THS.
144 CIESLAK ET AL.

ensures specified nominal flight performance in fault-free situations.
When hardware-redundancy FDI mechanisms are not available,
further investigations are necessary to extract the optimal analytical
FDI unit from the set of all admissible (joint) FDI/FTC units 
Ks.
This is a topic of future research.
Appendix A: State and Input Definition
Appendix B: Bumpless Scheme
The activation of the FTC strategy is done using a switching logic
and thus may cause some undesired phenomena such as bumps or
actuator saturations. In fact, the difference between the states of
nominal control law and the states of switching control law leads to
these bumps. Figure B1 presents the proposed solution to manage
these undesired bumps. The aim is to drive 
Ksbefore the switch by
a gain Fs, such that ~
u7 !0and
7 ! y
uo

according to
8
>
>
>
<
>
>
>
:
~
u
K
Fs

x
y
uo

2
43
5
(B1)
where also denotes the control signal of 
Ksbefore the switch, 
x
the state vector of 
Ks, and Fsis the static gain to design.
Different approaches can be used to design Fs. Here, we proposed
to use the idea initially proposed by [25] and applied to the FTC
problem in [7]. To compute Fs, the following quadratic criterion is
minimized:
J~
u; 1
2Z1
0~
uTWu~
uy
uo

T
Wey
uo
 dt
(B2)
where Wuand Weare constant positive-definite weighting matrices
of appropriate dimensions. Wuand Weallow us to define the desired
objectives; that is, if it is desirable to minimize the magnitude of ~
u,
then we should choose a high value for Wu. So at switching time ts
(the time at which the fault is detected), we have ~
uts7 !0, then
uts7 !uots. Hence, there are no bump effects. Similarly, if we
want to reduce the energy of
y
uo

then the value of Wemust be set to be high. Then at ts, we have
ts7 ! yts
uots

So there is no discontinuity between and
y
uo

at switching time. This means that from a practical point of view, a
tradeoff between minimizing the magnitude of ~
uand
y
uo

must be done.
Once Wuand Wehave been chosen, the solution is given by (the
interested reader can refer to [25] for more details)
Fs
N
BT
DTWu
CT
We
BT
M
CTWu
D
NW
e
B
NW
eT

T
(B3)
where 
Mand 
Nare defined according to

MATB1(B4)

N 
DTWu
DWe1(B5)
The matrix is the definite-positive stationary solution of the
following algebraic Riccati equation:
AATBC0(B6)
Table A1 State definition of the Boeing 747
Symbol Name Unit
px
NL (1): body roll rate rad=s
qx
NL (2): body pitch rate rad=s
rx
NL (3): body yaw rate rad=s
VTAS xNL (4): true air speed m=s
x
NL (5): angle of attack rad
x
NL (6): angle of sideslip rad
’x
NL (7): angle of roll rad
x
NL (8): angle of pitch rad
x
NL (9): angle of yaw rad
hx
NL (10): altitude m
xexNL (11): distance in Xedirection m
yexNL (12): distance in Yedirection m
Table A2 Input definition of the Boeing 747
Symbol Name Unit
a UNL (1): four aileron deflections deg
spUNL (2): 12 spoilers deg
e UNL (3): four elevator deflections deg
ihUNL (4): stabilizer deflection deg
rUNL (5): two rudder deflections deg
fUNL (6): two flap deflections deg
EPRUNL (7): four thrust engine positions ——
gear UNL (8): gear position ——
Fig. B1 FTC architecture with the bumpless scheme.
CIESLAK ET AL. 145

The matrices A,B, and Care given by
A
A
B
N
DTWu
C(B7)
B
B
N
BT(B8)
C
CTWuI
D
N
DTWu
C(B9)
where 
A; 
B; 
C; 
Ddenotes the state-space matrices of 
Ks.
Remark B.1: Using this strategy, we assume that Fshas access to
the controller states 
x. It is a modest assumption because most
modern controllers will be realized in software form, and so the states
will be computer variables.
Remark B.2: The proposed scheme is a unidirectional solution that
permits reducing the undesirable bumpless effects for the switch
from the nominal situation to the failure situation. Indeed, let ts2be
the time at which the switching from the failure situation to the
nominal situation is done. Just before the switch at time t
s2, the
controller 
Ksachieves the following equation:
8
>
>
>
>
>
<
>
>
>
>
>
:
~
u
Ky
uo

Fs

x
y
uo

2
43
5
(B10)
Then the control signal applied to the system at t
s2is given by
ut
s2u0t
s2~
ut
s2
After the switch, at time t
s2, the controller 
Ksis derived by
Eq. (B1). Then we have
ut
s2uot
s2
Hence, to avoid the undesirable bumps, the sufficient and necessary
condition is that ~
ut
s27 !0. Unfortunately, because at time t
s2the
FTC strategy is activated, it is not possible to modify on the controller

Ks. The discontinuity due to the switch of the failure situation to
the nominal situation is thus related to the dynamics of the FTC loop
that would be activated at the switching time.
Acknowledgment
The authors would like to thank E. Prempain from the Control and
Instrumentation Research Group, University of Leicester, for his
helpful comments and for reviewing the initial manuscript.
References
[1] Zhang, Y., and Jiang, J., “Bibliographical Review on Reconfigurable
Fault-Tolerant Control Systems,”5th IFAC Symposium on Fault
Detection, Supervision and Safety of Technical Processes (SAFE-
PROCESS’03), International Federation of Automatic Control,
Washington, DC, 2003, pp. 265–276.
[2] Zhang, Y. M., and Jiang, J., “Issues on Integration of Fault Diagnosis
and Reconfigurable Control in Active Fault-Tolerant Control Systems,”
6th IFAC Symposium on Fault Detection, Supervision and Safety of
Technical Processes (SAFEPROCESS ’06) [CD-ROM], International
Federation of Automatic Control, Washington, DC, 2006.
[3] Steinberg, M., “Historical Overview of Research in Reconfigurable
Flight Control,”Proceedings of the Institution of Mechanical
Engineers, Part G (Journal of Aerospace Engineering), Vol. 219,
No. 4, 2005, pp. 263–275.
doi:10.1243/095441005X30379
[4] Staroswiecki, M., and Gehin, A. L., “From Control to Supervision,”
Annual Reviews in Control, Vol. 25, 2001, pp. 1–11.
doi:10.1016/S1367-5788(01)00002-5
[5] Moerder, D. D., Halyo, N., Broussard, J. R., and Caglayan, A. K.,
“Application of Precomputed Control Laws In a Reconfigurable
Aircraft Flight Control System,”Journal of Guidance, Control, and
Dynamics, Vol. 12, No. 3, 1989, pp. 325–333.
[6] Huzmezan, M., and Maciejowski, J. M., “Reconfigurable Flight
Control of a High Incidence Research Model Using Predictive
Control,”International Conference on Control, Inst. of Electrical and
Electronics Engineers, Piscataway, NJ, 1998, pp. 1169–1174.
[7] Chen, J., and Patton, R. J., “Fault-Tolerant Control Using LMI Design,”
European Control Conference (ECC’01), Inst. of Electrical and
Electronics Engineers, Piscataway, NJ, 2001.
[8] Cieslak, J., Henry, D., and Zolghadri, A., “A Methodology for the
Design of Active Fault Tolerant Control Systems,”6th IFAC
Symposium on Fault Detection, Supervision and Safety of Technical
Processes (SAFEPROCESS ’06) [CD-ROM], International Federation
of Automatic Control, Washington, DC, 2006.
[9] Maki, M., Jiang, J., and Hagino, K., “A Stability Guaranteed Active
Fault-Tolerant Control System Against Actuator Failures,”Proceed-
ings of the 40th IEEE Conference on Decision and Control, Inst. of
Electrical and Electronics Engineers, Piscataway, NJ, Dec. 2001,
pp. 1893–1898.
[10] Staroswiecki, M., Yang, H., and Jiang, B., “Progressive Accom-
modation of Aircraft Actuator Faults,”6th IFAC Symposium on Fault
Detection, Supervision and Safety of Technical Processes (SAFE-
PROCESS ’06) [CD-ROM], International Federation of Automatic
Control, Washington, DC, 2006.
[11] Campos-Delagado, D. U., Palacios, E. R., and Espinoza-Trejo, D. R.,
“Fault Accommodation Strategy for LTI Systems Based on GIMC
Structure: Additive Faults,”44th IEEE Conference on Decision and
Control, Inst. of Electrical and Electronics Engineers, Piscataway, NJ,
2005, pp. 6292–6297.
[12] Neimann, H., and Stoustrup, J., “Passive Fault Tolerant Control of a
Double Inverted Pendulum: A Case Study,”Control Engineering
Practice, Vol. 13, No. 8, 2005, pp. 1047–1059.
doi:10.1016/j.conengprac.2004.11.002
[13] Ganguli, S., Marcos, A., and Balas, G., “Reconfigurable LPV Control
Design for B-747-100/200 Longitudinal Axis,”Proceedings of the
American Control Conference, Vol. 5, Inst. of Electrical and
Electronics Engineers, Piscataway, NJ, 2002, pp. 3612–361710.1109/
ACC.2002.1024489.
[14] Gaspar, P., Szaszi, I., and Bokor, J., “Reconfigurable Control Structure
to Prevent the Rollover Of Heavy Vehicles,”Control Engineering
Practice, Vol. 13, No. 6, 2005, pp. 699–711.
doi:10.1016/j.conengprac.2004.06.003
[15] Van der linden, C. A. A. M., “DASMAT-Delft University Aircraft
Simulation Model and Analysis Tool,”Delft Univ. of Technology,
Rept LR-781, Delft, The Netherlands, 1996.
[16] Smaili, M. H., “FLIGHTLAB 747 Benchmark for Advanced Flight
Control Engineering v4.03,”Delft Univ. of Technology, Delft, The
Netherlands, 1999.
[17] Lombaerts, T. J. J., Joosten, D. A., Breeman, J., Smaili, H., Van den
Boom, T. J. J., Chuk, Q. P., Mulder, J. A., and Verhaegen, M.,
“Assessment Criteria as Specifications for Reconfiguring Control,”
AIAA Guidance, Navigation, and Control Conference and Exhibit,
Keystone, CO, AIAA Paper 2006-6331, 21–24 Aug. 2006.
[18] Smaili, M. H., Breeman, J., Lombaerts, T. J. J., and Joosten, D. A., “A
Simulation Benchmark for Integrated Fault Tolerant Flight Control
Evaluation,”AIAA Modeling and Simulation Technologies Confer-
ence, AIAA Paper 2006-6471, Aug. 2006.
[19] Zhou, K., and Ren, Z., “A New Controller Architecture for High
Performance, Robust, and Fault-Tolerant Control,”IEEE Transactions
on Automatic Control, Vol. 46, No. 10, 2001, pp. 1613–1618.
doi:10.1109/9.956059
[20] Marcos, A., “A Linear Parameter Varying Model of the Boeing 747-
100/200 Longitudinal Motion,”M.S. Thesis, Univ. of Minnesota,
Minneapolis, MN, 2001.
[21] Hanke, C., and Nordwall, D. R., “The Simulation of a Jumbo Jet
Transport Aircraft,”Vol. 2, The Boeing Company, Rept. D6-30643,
1970.
[22] Chilali, M., and Gahinet, P., “H1Design with Pole Placement
Constraints: An LMI Approach,”IEEE Transactions on Automatic
Control, Vol. 41, No. 3, Mar. 1996, pp. 358–367.
doi:10.1109/9.486637
[23] Scherer, C., Gahinet, P., and Chilali, M., “Multiobjective Output-
Feedback Control via LMI Optimization,”IEEE Transactions on
Automatic Control, Vol. 42, No. 7, July 1997, pp. 896–911.
doi:10.1109/9.599969
[24] Toh, K. C., Todd, M. J., and Tütüncü, R. H., “SDPT3 a MATLAB
146 CIESLAK ET AL.

Software Package for Semidefinite Programming,”Optimization
Methods and Software, Gordon & Breach, Berkshire, England, U.K.,
1998.
[25] Turner, M. C., and Walker, D. J., “Linear Quadratic Bumpless
Transfer,”Automatica, Vol. 36, No. 8, 2000, pp. 1089–1101.
doi:10.1016/S0005-1098(00)00021-2
CIESLAK ET AL. 147