FM 5 11:30

Proceedings of the 37th IEEE Conference on Decision & Control Tampa, Florida USA December 1998

Failure Detection and Identification and Fault Tolerant Control. using the IMM-KF with applications to the Eagle-Eye UAV
Constantino Rag0 Ravi Prasanth Raman K. Mehra Scientific Systems Company, Inc. (SSCI) 500 West Cummings Park, Suite 3000 Woburn, MA, 01801 e-mail: tino@ssci.com Robert Fortenbaugh Bell Helicopter - Textron P.O. Box 482 Fort W o r t h , TX 76101

Abstract
In this paper we describe a novel approach t o Sensor/Actuator Failure Detection and Identification (FDI) and Fault Tolerant Control based on the Interacting Multiple Model (IMM) Kalman Filter approach. Failures are mapped into different (and unique) statespace model representations. The IMM algorithm computes (on-line) the posterior probability of each failure model, that can be interpreted as a failure indicator. The fault tolerant control approach presented in the paper is based on a multiple model control law, where an optimal controller is designed for each actuator failure model, and the control action is a combination of the individual outputs of each controller weighted by the posterior probability associated with that model. The new FDI-FTC approach was tested on a linear simulation of Bell Helicopters Eagle-Eye Unmanned Air Vehicle (UAV). All single sensor and actuator failures were detected and properly identified, as well as some simultaneous failures. The controller performance was virtually unaffected by sensor failures, and performed well in the presence of actuator failures, stabilizing the aircraft and performing the desired maneuver in all cases.
1 Introduction

are surveyed in [2, 4, 61, but most of them do not deal with the state estimation problem. The new IMM-FDI approach provides not only fast detection and proper identification of failures, but also robust state estimation even during failure conditions. Also, in the case of actuator failures, the IMM-FDI approach has a natural extension into a Fault Tolerant Control scheme. In this paper we will concentrate on only sensor and actuator failures; other types of failures (for example structure failures/ battle damage) may require a different approach and will be considered in the future. In the next sections we will describe the new FDI approach (based on the Interacting Multiple Model (IMM) Kalman filter), its application to sensor and actuator FDI, and a Fault Tolerant Control based on a Multiple Model LQG controller. The last section presents some results obtained using a linear simulator of the Eagle-Eye UAV dynamics, sensor and act,uator systems constructed from data provided by Bell Helicopter. 2 The Interacting Multiple Model Filter A brief description of the IMM filter is presented next. The problem can be formulated as that of finding the optimal state estimate for a system whose dynamics can be represented by:
xk+l

Modern flight control systems rely on hardware redundancy to overcome failures of sensors and actuators. This is an expensive approach, and still it requires fast and reliable failure detection and identification. It is also common for the control loop to use an estimate of the systems state to compute the control action; in these situations failure information becomes critical and the estimation/FDI filter should provide a reliable state estimate under failure conditions (as long as the system remains observable). Different methods for FDI
This research was supported through contract N00019-96C-2055 from NAWC-Aircraft Division Activity, Patuxent River, MD .

= A ~ x ~ + B ~ u ~ + w ;
=

zk

CiXk

+ Dill: + Wi

(1)

(where j = 1 : M corresponds to model M J ) and the system can jump from one model to another at any time. Failures can be represented by a jump from one model t o another. Failures can occur at any time, and the system can recover from certain failures (backup sensor, unlocked actuator, etc). A block diagram of the IMM filter is shown in Figure 1. Given the whole measurement set Z k at time IC ( Z k = k { z ~ } ~ the = ~ optimal ) state estimate at time IC, j i k is the

0-7803-4394-8198 $1 0.000 1998 IEEE

4208

conditional expected value E { x k ( Z k } . Using the total probability theorem, the posterior probability density function (pdf) of the state conditioned on the measurement set is given by:
M

,i
pk
01 $k-lJk01 pk- 1 Ik- 1 zk

-1 2k-llk-l

- 11 k -

-,,
pk-llk-

Am xk-lJk-l
p;ilk-l

. .

Interact i0.n Mixing prob./Initial condition calculation

xk-l\k-

observations

F7,rI

[.Fy;l

I 1 1
,
Pk;1

Mode probabilit update

likelihood where pjk is model Mj posterior probability at time k. Assuming that each element of the sum is Gaussian, then the prior pdf is a Gaussian mixture and can be approximated (via moment matching) by a single Gaussian:

+
State estimate and covariance combinatio

kklk Pk]k

p (xklz-,M~) M

?ilktPklk

Gk

pck

current estimates

Figure 1: Block diagram for the IMM filter

This last equation implies that the initial condition for filter j model is a mixture of the initial conditions of each filter (ai-,) weighted by the corresponding mixing probabilities plj. The posterior probabilities of each model are computed on-line as follows: be interpreted as a switch from the nominal (normaloperation) model to a failure model. Usually, there are several different types of possible failures, hence, a set of failure hypothese (models) should be considered. In the IMM-FDI formulation, each failure hypothesis corresponds to a different model (l),and is constructed with its corresponding set of A, B, C , D and covariance matrices. Actuator failures will correspond t o a change in the matrices B and D and/or the covariance of the process noise w, while sensor failures will correspond to a modification of matrix C and/or the covariance of the sensor noise U. For the IMM algorithm, a priori reliability information about the UAV sensors/actuators is used to formulate a transition probability matrix. The actual values of p i j are design parameters, usually selected based on what each model represents, a przorz reliability information about failures and a trade-off between false alarms and delay to detect a failure. Posterior probabilities for each model, computed online by the IMM algorithm, reflect the likelihood that the observed set of measurements correspond to a particular model. These probabilities (of each model being correct) can be used as failure indicators: if the highest probability corresponds to one of the failure models, then it can be concluded that the system has failed, and the failure type is the one associated with that model. As we will see in the next sections, there is no need to do a hard selection, except maybe for display purposes.
4 Sensor failure detection and identification

And the mixing probabilities can be computed as:

where pzj is the prior transition probability from model M iat time k - 1 t o model M j at time k, i.e.:
paj

= P ( M k = M j p I k - 1 =Mi)

(5)

3 Failure detection using IMM filters

The use of a single model (a compromise model) in the estimation/control algorithms results in poor performance in the presence of failures (sometimes leading to an unstable closed loop), and the estimates are incomplete in the sense that they lack information relevant to the failure or other system changes. The Interacting Multiple Model (IMM, see [l])filter is one technique which has seen recent interest because of its ability t o track rapid changes in dynamic systems. The application of IMM for solving the FDI problem was first proposed and investigated in [ 5 ] . Actuator/Sensor failures can be represented by a change in the model representing the dynamics/measurements of the system. The failure itself can

The sensor FDI system consists of a bank of IMM filters, one for each sensor. Each filter uses a no-failure model and a failure (no-signal) model associated with

4209

the sensor as described. in the next section. This scheme (having one IMM filter for each sensor) has two main advantages: 1) more than one simultaneous sensor failure can be detected and identified and 2) it permits handling sensors with different data rates (using a sequential update scheme). Each sensor may have more than one channel (for example, a gyro provides three measurements simultaneously), therefore the failure models associated with each sensor may include single channel failures as well as complete failure. 4.1 Sensor failure models In the sensor IMM-FDI scheme presented here, for each sensor (with its own data rate), the IMM-FDI system uses two models (or hypothese):

5.1 Actuator failure models The actuator FDI system uses a single IMM filter with M 1 models ( M : # of actuators). There is one no-failure model plus a failure model for each actuator: The failure model implemented in this case corresponds to a common type of failure known as "floating" (or zero-momentum) actuator failure. In this type of failure, the effector surface snaps from the commanded position to a zero-momentum position, and remains there. This type of failure easily modeled in state space by zeroing the corresponding column of the B matrix. For example, a failure of the second actuator will be modeled by a Bactmatrix with a null 2nd column:

HO - No-failure model: the sensor is working properly i.e. the output consists of the corresponding signal plus noise. The measurement matrix ( C )
corresponding t o this model is the nominal one. and similarly, the 2th row of the Dactwill also be zero.

Failure model: none of the channels in the sensor are working, i.e. the output consists of noise only. The corresponding model has null C and D matrices. Single channel failures (for a multichannel sensor) can be represented by additional models with null rows. For example, a failure of the second channel from n channel sensor will be represented by:
c11

5.2 The combined sensor/actuator FDI system The actuator FDI system receives information about sensor status from the sensor FDI systems. This information is summarized in the estimated C matrix. The sensor FDI system performs an on-line estimation given by:

c12

...

Cnl

Cn2

...

Cnn

Other types of failures to be considered are those where the sensor (or a single channel) becomes noisier than normal. In this case, the measurement matrix C will remain unchanged, but the corresponding measurement noise covariance matrix (R) will be scaled to represent the power increment of the measurement noise.

where C i is the measurement matrix for sensor Efailure model a, N F is the number of failure models for each sensor, N is the number of sensors and 1 1 1 is the corresponding posterior probability of model i (for sensor x) as given by the IMM filter. The matrix C ( k ) summarizes all the information contained in the sensor-FDI system about sensor failures up to time IC. In a similar way, the actuator-FDI systtm computes a n estimate of Bact and Dact (Bactand Dact)that summarizes all the information the actuator-FDI systems contains at time IC about actuator failures. A block diagram of the combined Actuator/Sensor-FDI system is shown in Figure 2.

5 Actuator failure detection and identification

Actuator failures are handled by a second FDI system, independent (up to certain degree) from the sensor FDI system. The actuator IMM-FDI system comprises of a no-failure model, plus one failure model for each actuator. As explained in section 5.2 special attention should be given t o the interaction between both FDI systems; information about sensor failures should be passed along t o the actuator FDI systems, and actuator failure information should be passed along to the sensor FDI system. Actuator failures introduce changes in the response of the system, forcing the controller to modify the control law in order to maintain performance (and sometimes stability). The scheme adopted here t o modify -on-line- the control law is based on the Multiple Model - Fault Tolerant Control discussed in the next section.

6 Multiple Model

- Fault Tolerant Control (MM-FTC)

From the control point of view, sensor failures are treated differently from actuator failures. Sensor failures do not require any modification of the control law; the only requirement is that the estimator provides the controller with an accurate estimate of the system state after the sensor failure. Conversely, actuator failures imply a change in the system dynamics, and therefore 4210

require a change in the control law in addition to accurate estimates. The MM-FTC implemented here consists of a linear combination of individual controllers. Each individual controller is designed to stabilize the system in the presence of a particular actuator failure. The control signal is a weighted sum of the individual controller outputs, where the weights are the posterior probabilities (computed by the actuator IMM-FDI) associated with each actuator failure model. Each control block uses the state estimates provided by the IMMFDI filter. A block diagram of the integrated IMM-FDI and MM-FTC is shown in Figure 2

7.2 Eagle-Eye UAV sensor FDI results For the example at hand (Eagle-Eye UAV), the measurement vector is composed of up t o 13 elements.
---vIOOHz
50Hz 25Hz

P Q R AYH

ip0%

xeye H H T A S
12.5Hr 31%

7 Simulation Results
All the results presented next were obtained using a linear simulator of the Eagle-Eye UAV. Before discussing these results, we will present a brief description of the Eagle-Eye dynamics, sensors and actuators.
7.1 The Eagle-Eye UAV The Bell Helicopter Eagle-Eye tiltrotor UAV, shown in Figure 3, combines vertical takeoff and landing capabilities with the ability to perform most of the tactical and strategic missions envisioned for UAVs. The Eagle-Eye has 8.2 ft. diameter rotors and is powered by a single turboshaft engine. The rotors are driven by a transmission connected to drive shafts in each wing, and a pair of 90 deg. gearboxes at the wingtips. The nacelles have a range between 0 deg. (airplane mode) and 93 deg. (3 deg. aft of vertical) in helicopter mode. The aircraft has no rudders, relying on differential collective for yaw control at low nacelle angles. This design innovation takes advantage of thrust vector control to create a powerful yaw control and saves weight by eliminating two actuators (for a complete description of the Eagle-Eye as well as flight test results, see [3]).

where GJ, 0 , @, P, Q, R, GJ are Euler angles and angular rates, k e , 7je .are..North and East component of ground-speed [ H , H , H ] are altitude, Inertial vertical velocity and acceleration (Note: barometric altitude measurements were used (worst case scenario) instead of more accurate radar altimeter measurements.), [AY] is body axis lateral acceleration and [TAS]is true air speed. These measurements are obtained through 5 different sensors, each one with its own data rate. Because of the difference in the sensor output rate, the IMM algorithm had to be modified as follows: 0 For the 100 Hz measurements, the IMM update is computed in the standard way. 0 For the rest of the sensors, the IMM proceeds in a sequential fashion: If there is a measurement available from the 50 Hz rate sensor, the filter performs a sequential update (no prediction computation - prediction has already been done and updated by the 100 Hz filters) 0 The same sequential update is done for each group of measurements present at any given time This implementation allows the posterior of each hypothesis to be updated as the corresponding data is made available. The results shown next correspond to a simultaneous double sensor failure: both the Euler angle sensor (roll, pitch and yaw - data rate 25 Hz), and the altitude, altitude rate and true air speed sensor (data rate 3 Hz) failed during the period 3.5sec16sec (see Figures 4 and 6). After an initial transient of approximately 0.5 sec (see Figure 5) all sensors are detected as working properly; at 3.5 sec both failures are detected (corresponding failure indicators jump to values near 1). At 16 sec., backup sensors replace the failed ones; this is reflected in a switching of the failure indicators, back to normal operation shortly after 16 sec. The estimates corresponding t o the states whose measurements were not available during the failure period are still very accurate (see Figures 4 and 6). It should also be noted that the performance of the closed loop system was almost unaffected by these failures because of the fast detection and identification and the robust state estimation performed by the IMM-FDI filter.

7.3 Eagle-Eye UAV actuator FDI results In the Eagle-Eye UAV there are seven actuator inputs, that are on-line derived (through the mixing equations) from the primary control inputs. These actuators are:
Collective positions for left and right rotors [Blc~ B , l c ~ ] : Longitudinal cyclic positions for left and right rotors

[OOL,@ O R ] :

Figure 3: The Eagle-Eye UAV 421 1

Ucommatrd

uprim

Uact

Eagle-Eye UAV
c

measurements

_3( )

Mixing Matrix

Dynamics (Sensor/ Act. Failures)

_____----------FCS (No Act. Fail)

I

--_-_-----_--*
i(k)
C(k)

IMM-FDI Sensor Failures

+ I -

FCS (Act. 1 Fail)

0
I L

IMM-FDI B(k),D(k) Actuator Failures4

2(k)

I
I

I I I I I

__-_---------J

I I I
I

(Act. n Fail)

I I I I I

Combined Actuator/Sensor FDI System

Figure 2: Block diagram for the integrated Sensor/Actuator IMM-FDI and Fault Tolerant Control.
301
I

0
1

w&

14

16

16

0.5
0

0
1

-2

14

16

L
1 8

0.5

E+
4

0 0
2
4

10

12

14

16

18

20

20

9
3

e15

10

12

14

16

18

20

Time (9%)

Figure 4: Simultaneous sensor failures results. Top: vertical command (hover-to-climb maneuver); Middle: vertical rate; Bottom: altitude (true: solid line, measurements: dashed line, IMMFDI estimates: dash-dotted line.

Figure 5: Sensor failure indicators for the simultaneous sensor failure scenario.
presence of combined (simultaneous) sensor and actuator failures. The failure scenario consists of a left rotor longitudinal cyclic actuator failure [3sec-l0sec] and a ground speed sensor failure ( k e and ye, 12.5 Hz rate) [3.5sec-l6sec]. Both failures were properly detected and identified (see Figure 8 and 9) and the MM-FTC was able to complete the desired maneuver.

[FLPL,FLPR]: Left and right flaperon deflec[EL EV ] :

tions Elevator Deflection

The FDI system uses seven actuator failure models (floating actuator failure type), plus a normal operation model. All individual actuator failures were detected and properly identified, and the MM-FTC was able to stabilize the aircraft in all conditions. We also tested the performance of the IMM-FDI/MMC in the

8 Conclusions
The results presented in this paper clearly demonstrate the robust and fault tolerant capabilities of the IMM

4212

002,
0

,
0 1 2 4 6 20

100 M sensor ~osterm prob.

I 02 ,
-004
14

16

18

-0 06

10

12

14

16

18

0.5

0 1
0 1

4 6
14

. 16 18

-0 4

0
x 10-

10

12

14

16

16

20

"

"

'

"

"

Time (sec)

10

12

14

16

18

Time (sec)

Figure 6: Euler roll, pitch and yaw angles for the simultaneous sensor failure scenario (true: solid line, measurements: dashed line, estimates: dashdot line).
30

Figure 9: Sensor failure indicators for the combined actuator/sensor failure scenario.
based FDI and MM-FTC as applied to the Eagle-Eye UAV. The IMM-FDI and MM-FTC system was able to: detect and identify all single sensor failures rapidly and reliably; detect and identify multiple (simultaneous) sensor failures; detect and identify actuator failures; detect, identify and control the UAV under combined (simultaneous) actuator and sensor failures. The accurate estimation of the UAV state in the presence of sensor failures by the IMM-FDI system results in a hover maneuver without any modification of the control law. We have concentrated on a hover maneuver only, but there is reason to believe that the results will hold for other maneuvers also. The IMM-FDI systems can be easily modified t o take into account other types of failures, as well as additional sensors.

"0

f ' g
-2

5
g
a

-4

-6 0
30

10

12

14

16

18

20

20

0
2 4

10 Time I*)

12

14

16

18

20

References

Figure 7: Combined actuator/sensor failure results. Top: vertical command (hover-to-climb maneuver); Middle: vertical rate; Bottom: altitude (true: solid line, measurements: dashed line, IMM-FDI estimates: dash-dotted line.

,
05

Col!ecwew y n . le11 s,oW

[l] Y. Bar-Shalom and X.R. Li. Estimation and Tracking: Principles, Techniques and Software. Artech House, Inc., 1993. [2] M. Basseville and I. Nikiforov. Detection of Abrupt Changes: Theory and Applications. Prentice Hall, 1993. [3] R. L. Fortenbaugh, K. E. Builta, and K. J. Schulte. Development and testing of flying qualities for manual operation of a tiltrotor UAV. In Proceedings of the 51st Annual Forum of the American Helicopter Society, pages 1-22, 1995.

[4] R. Isermann. Integration of fault detection and diagnosis methods. In IFAC Symposium on Fault De-

1k

'

0.5 0

k ,

I ,

tection, Supervision and Safety for Technical Processes - SAFEPROCESS 94, Helsinki, Finland, 1994. [5] R.K. Mehra, C. Rago, and S. Seereram. Failure Detection and Identification using a Nonlinear Inter-

active Multiple Model (IMM) Filtering Approach with Aerospace Applications. In 11th IFAC Symposium o n

System Identification, Session:System Identification in Aeronautics, Fukuoka, Japan, July 1997. [6] H.E. Rauch. Intelligent fault diagnosis and control reconfiguration. I E E E Control Systems, 1994. 4213