Final Report Summary - RECONFIGURE (REconfiguration of CONtrol in Flight for Integral Global Upset REcovery)
Executive Summary:
The RECONFIGURE project aimed to investigate and develop advanced aircraft guidance and control (G&C) technologies that will facilitate the automated handling of off-nominal and abnormal events, while simultaneously alleviating the pilots’ task and optimising the aircraft performance. This automatism and optimization must be performed while maintaining the aircraft current safety levels, which is compliant with present-day regulations. More concretely, these objectives are intended to be accomplished by researching and developing advanced Flight Parameter Estimation (FPE), Fault Detection and Diagnosis (FDD) and Fault Tolerant Control (FTC) techniques, which contribute to extend as long as possible the nominal aircraft G&C functionalities.
The RECONFIGURE project lasted from January 2013 until June 2016, and hence was performed over a 42-month period.
RECONFIGURE achieved the principal aims of the project, and significant progress has been made on FDD and FTC for large civil aircraft. The results are expected to contribute to the state-of-the-art improvement at low TRL levels (TRL 4), which should in time lead to improvements in the current state-of-practice to higher TRL levels.
The RECONFIGURE project aims were achieved through research and development in the techniques of:
• Flight Parameter Estimation (FPE)
• Fault Detection and Diagnosis (FDD)
• Fault Tolerant Control (FTC)
while considering for these techniques:
• Integration issues and approaches for estimation, diagnosis and GNC
• Clearance approaches for the above type of systems
From an academic point of view, the results of the project are excellent. A large number of advanced G&C techniques were developed, consolidated and/or proved through the project phases. The use of a high-fidelity benchmark problem to motivate the academic developments and serve as the basis for the algorithm design and assessment, drove the academic partners to perform the first steps in the industrialisation of the advanced G&C techniques under consideration – in short a first step in “bridging the gap”. This allowed for the assessment of the ease with which different techniques can be applied in an industrial setting, considering standard aspects, such as their performance and robustness, and also more applied aspects, such as the ease for design tuning and certification, and the algorithm computational load. As a result of these activities, many advances in the basic academic advanced G&C techniques have been made and the techniques have been matured greatly, especially for application to the aeronautical sector. These achievements have been reported to the wider community through a number of dissemination channels (conference papers, journal papers, conference invited sessions, and an international industrial workshop).
From an industrial point of view, the results of the project are very satisfactory, even if there is still a long way between a TRL 4 design, and a certified and flying solution. The techniques and developed algorithms were tested up to TRL 4 on the high-fidelity aircraft benchmark problem provided by Airbus. On this benchmark and its scenarios, covering actuator, sensor and environment extreme events (e.g. failures, large winds), the algorithms were tested in a non-real-time simulator (DEIMOS FES), and a flight simulator environment (Airbus). As a final testing of the best designs, this testing was extended to scenarios derived from real flight events, in some cases using real flight data (e.g. wind profiles). More V&V activities would be needed, and on more representative facilities, including flight simulators, “Iron Bird”, actuator and system integrated benches and finally real flight tests, to evaluate fully the designs and make stronger conclusions on the developed techniques. This would in turn necessitate further consolidation of the designs and their implementation. However, the RECONFIGURE project results do represent a convincing first step towards the implementation of advanced FDD/FTC solutions. The project also represents a natural continuation and important enhancement over the results and advancements of earlier R&D activities, such as the EU FP7 project ADDSAFE.
As a final consideration, taking into account the work performed, the results achieved and the advances made, it is considered that the RECONFIGURE project has contributed and will contribute to the long term goal of “Full-time, all-event available fly-by-wire”.
Project Context and Objectives:
Fly-By-Wire (FBW) is the industrial standard for large civil aircraft. It offers advantages in aircraft safety and performance, and has contributed to the great progress seen in the aviation sector over the last few decades. These large civil FBW aircraft rely on hardware redundancy and fail-safe approaches to accommodate abnormal/off-nominal situations, such as the multitude of failure cases that can arise in the complex engineering system that is the large modern civil aircraft of today. Key technologies in this accommodation of abnormal/off-nominal situations are that of onboard Fault Detection and Diagnosis (FDD) and Fault Tolerant Control (FTC).
The state-of-practice at, for example European civil manufacturers of large aircraft, employs FDD and FTC technology based on hardware redundancy for FDD, in order to perform consistency tests, cross checks and built-in-tests, and the switching to alternate and robust control laws in the case of the detection of an abnormal event for FTC. This current approach and state-of-practice is fully satisfactory and aligns well with the aircraft certification process. Each control law is designed off-line for different levels of robustness and each includes a set of specific Guidance, Navigation and Control (GNC) functions which assist the pilot all along the flight. Even though this state-of-practice is safe, it is known to decrease the ease of the piloting task (e.g. increased workload) and leads to a non-optimal configuration of the aircraft. This motivates further investigation and research into the handling of abnormal situations in modern FBW civil aircraft.
The European RECONFIGURE (REconfiguration of CONtrol in Flight for Integral Global Upset REcovery) 7th Framework Program (FP7) project took as a baseline reference this state-of-practice industrial approach for the handling of abnormal situations and failures. The project aimed to improve it through the investigation and development of advanced aircraft GNC technologies, for onboard FDD and FTC, that facilitate the automated handling of abnormal and off-nominal events, and that optimize the aircraft status and flight. These technologies aim to extend the operation of the current GNC functionalities that assist the pilot and to optimize the aircraft performance in such abnormal and off-nominal events.
For upcoming and future aircraft, extending GNC functions would contribute to the development of an easier-to-handle aircraft, which will result in decreased pilot workload. To achieve this aim of furthering investigation and research into the handling of abnormal/off-nominal situations in modern FBW civil aircraft, the RECONFIGURE consortium was constructed with ten beneficiaries from seven European countries. These are:
Elecnor Deimos (Spain, Portugal), Airbus and ONERA (France), DLR (Germany), MTA SZTAKI (Hungary), TU Delft (Netherlands), the University of Exeter, University of Cambridge and University of Bristol (UK), and IplusF (Spain).
The project was coordinated by Elecnor Deimos in Madrid. This marriage of European industries, universities and research establishments provided a good balance of competencies in the pertinent fields of aerospace, GNC, FDD and FTC. Importantly, the project consortium allows for an effective and efficient transfer of the new and low TRL technologies, as proposed by academia (TRL levels 1 to 3), to industry (limited to TRL level 4 in this project).
The kick-off of the project was on February 2013 at Elecnor Deimos premises in Madrid and concluded with a Final Meeting and International Workshop on June 2016 at Airbus facilities in Toulouse.
RECONFIGURE was a three-and-a-half-year project divided in 5 work-packages (WP0 to WP4), these decomposed into a total of 13 sub-work packages. The project strived to combine the synergies between the scientific and the technological (i.e. industrial) partners at all levels of the research, development and V&V cycles of the project.
WP 1 “Industrial Benchmark & Assessment Tools” was active during the first two years of the project and focused on defining the benchmark problem and in developing the associated metrics, guidelines and software assessment tools. This is where the high-fidelity aircraft model and fault scenarios were defined, along with the V&V process, tools and metrics. This WP was highly industrially oriented, although the scientific partners supported the definition of the problem, to bring in their theoretical perspective.
WP 2 “Advanced G&C Design and Clearance Methods and Tools” started in parallel to WP1 and lasted for two years and a half. It was the main scientific development component of the project, as it focused in enhancing the current signal- and model-based Fault Parameter Estimation (FPE), Fault Detection and Diagnosis (FDD) and Fault Tolerant Control (FTC) methods, as well as in researching integration and clearance methods.
WP 3 “Industrial V&V” aimed to evaluate effectiveness, maturity and ultimately the Technological Readiness Level (TRL) of the developed designs by applying a traditional industrial Verification and Validation (V&V) process in two steps:
• verification of the designs in a Functional Engineering Simulator (FES) with traditional Monte Carlo analyses, complemented by worst-case search tools, and
• validation of the designs using the Airbus V&V process, including tests with pilot-in-the-loop simulations, and in demanding scenarios inspired by in-fight events.
In addition to this, it included a demonstration of the designs with the better performances, using Airbus V&V facilities.
Three basic pillars supported the RECONFIGURE project technical activities in these work packages, in addition to the relevant expertise of the project consortium members in the different areas under investigation.
RECONFIGURE Problem (WP1). This provided the context, motivation and basis for industrial relevance for the work performed. In particular, it provided:
• The benchmark scenarios (flight conditions, off-nominal and failure scenarios, etc)
• High-fidelity aircraft models, including Flight Control System (FCS) elements and protections
The Technological Solutions (WP2). Research and development lines for the technologies development in the areas of:
• Advanced parameter and fault estimation/diagnosis approaches (FPE and FDD)
• Reconfigurable guidance and control approaches (FTC)
• Integrated approaches for estimation, diagnosis and active G&C
• Advanced analytical and simulation-based clearance approaches
Assessment Tools and Metrics (WP1, WP3). Basis for industrial assessment and V&V:
• Non-real-time simulation infrastructure: Functional Engineering Simulator (FES), including benchmark scenarios, aircraft models and FDD/FTC designs
• Flight simulator, using Airbus V&V facilities and processes
Project Results:
RESULTS
The importance and relevance of the investigations performed within the project is achieved on the basis of the industrial representativeness of the benchmark, i.e. the aircraft model and fault problematic. Moreover, the final goal of the project was to validate the more promising designs in the actual Airbus’ flight control system V&V setup, which ensures industry-wide acceptance of the results.
Following the breakdown of activities and the objectives of the project, the layout of the results summary is as follows:
1. Benchmark
2. Industrial Verification and Validation (V&V) tools
3. Advanced G&C FPE, FDD and FTC methods
4. Pilot-in-the-loop Industrial V&V results
1. BENCHMARK
The benchmark consists mainly of: (i) a very high-fidelity nonlinear aircraft model which served as a platform for FDI/FTC design and the simulation of (ii) realistic fault scenarios and abnormal situations. The development of the benchmark also implied the definition of industrial constraints and requirements for real-time implementation, as well as the definition of the industrial V&V process and constraints.
This section focuses first on the aircraft model development and its release to the consortium, and then on the industrial scenarios.
Aircraft model
Although the aircraft model will inherit components from the benchmarks used in previous European projects, it represents a notable increase in the Technological Readiness Level (TRL) for the simulation model. This increase in TRL is required due to the specific need to access more deeply the flight control system, demanding a relatively strong development effort from Airbus side.
To be fully representative of the aircraft and system dynamics, it was decided to deliver an in-flight validated nonlinear model of the aircraft. It included a model of all the closed-loop components: flight dynamics, and also actuators, sensors, flight control computers, etc. The simulation tool containing the aircraft model was developed within Airbus to design the flight control laws and protections, including the nonlinear domains for general handling qualities studies. The development simulator was then used to test and tune control laws with a pilot in the loop. This simulator is fitted with wind tunnel data and some but limited real flight data. Consequently this simulator will never replace the flight test as the ultimate validation tool, as some uncertainty is remaining. The first version of this model was developed in 1984 for the A320 based on wind tunnel data.
Because of Airbus’s development framework and proprietary restrictions, this model was provided to the consortium as a black box, with restricted input/output information. Thanks to the black box format, the consortium benefited from using: (i) a precise nonlinear model of the aircraft flight mechanics adjusted from wind tunnel data and limited flight test data; (ii) actuator models developed with the support of Airbus’ suppliers and Airbus testing facilities teams; and (iii) realistic sensor models’ behavior. This is based on the functional description delivered by Airbus’ suppliers but adapted in a Matlab/Simulink interface to only consider the required features for flight control design. Transient features as sensors power-on, as well as internal monitoring of the sensors are removed. A particular focus may be done in the engine model. Because of the complex task and specific knowledge required for engine modelling, from Airbus point of view, the engine model is a black box delivered by the engine supplier and integrated to the overall aircraft simulation platform. Finally, several other models completed the simulator architecture, such as a ground effect model for landing and taxing simulation purposes, a wind model to simulate representative disturbances based on the average wind and turbulence defined by the user and many others (hydraulic and electrical systems, fuel system, atmospheric model, etc.). Overall the simulation tool is composed of 38 different models.
However, in order to enable the different partners to test their own FDD / FTC designs, Airbus extracted a part of the flight control computer in a Simulink model. This includes the baseline controller with interfaces to plug each partners’ designs. The entire control law design is presented in a Matlab/Simulink environment. The benchmark architecture is completed by a Matlab-based interface that handles: characteristics of the scenario; data flow from aircraft model (sensors outputs) to the control laws; commands computed by the control law to the aircraft model (actuators inputs) and; the synchronization of the incoming/outgoing signals.
The benchmark provided to the partners was complemented with a simplified version of the aircraft model. This simplified version allowed the project partners to preliminary tune their FDD and FTC algorithms. The structure of the simplified benchmark is composed of a linear model of the aircraft, the linear part of the baseline controller and simplified actuator and sensor models. The linear model of the aircraft is a linearized version of the flight dynamics at a given flight point. However, the user has the option to define the flight point where the model should be linearized. Hence, the partners can choose as many design points as needed to tune their FDD/FTC algorithms. With regards to the linear part of the baseline controller, this is essentially the same law as the fully representative model but without the compensations handling the time-varying behaviour of the aircraft. The simplified actuator model is a second order transfer function with rate and amplitude limitations, while the sensor model is simplified to a filter and a time-delay. Finally, it has to be remarked that all the features of the simplified models are open to the partners, who can modify them if needed for FDD/FTC concerns.
Industrial scenarios
Three faulty/abnormal scenarios were under consideration, covering a comprehensive spectrum of events: sensor faults, robustness to uncertain aerodynamic effects, and actuator faults.
Sensor faults
Information extracted from the sensors can be used as a control or as a scheduling parameter. If used as a control parameter, the associated GNC function is basically affected when the measurements are partially erroneous or not available anymore. In the case of its use as a scheduling parameter, the FCS is usually designed to be robustly stable to errors in the measurement. For example, the speed parameter is very challenging due to the strong aerodynamic discrepancies between the high-speed (cruise) and the low-speed (landing approach) regimes. These discrepancies can have a strong effect on the pre-computed flight control law, inducing also a degradation of the associated GNC functions, under some specific circumstances. Two sub-scenarios are considered, involving two key flight parameters: AoA and Calibrated AirSpeed (CAS).
The first scenario was devoted to control reconfiguration in case of a detected total loss of CAS and AoA information, whatever the root cause and the way to detect it. CAS and AoA loss can be simultaneous or slightly delayed and was assumed that they are not recovered later on during the flight. It means that different kinds of sensor degradation were not considered, i.e. only the consequence is of interest. Although this is a more FTC-oriented scenario, it is recognized that upstream FPE strategies could be also useful and complement the developments here. Two strategies could be possible: either keep the basic controller structure and only change its gains, or switch to a new (advanced) controller, in which case the option must also implement the switching strategy. FTC requirements include maintaining the longitudinal normal law as part of the inner-loop, so as to be able to easily manually fly the aircraft. The outer-loop objective is to maintain altitude hold and level change capability, while keeping the aircraft away from angle of attack and speed limits.
The second scenario is dedicated to CAS and AoA sensor fault detection and parameter estimation. Large civil aircraft are generally equipped with 3 dedicated sensors for each of these measurements. Erroneous behaviours of 2 to 3 sources of CAS or AoA are considered, with the possibility of accounting for both abnormal behaviours leading up to 8 possible scenarios (with only two faulty measurements a total of up to 6 faulty possibilities). Additive and substitutive faults were considered: oscillation, jamming, bias, runaway, NRZ (Non-Return to Zero) and increased noise level. For each sensor, the faults were always of the same type. Different kinds of faults were not considered simultaneously (e.g. oscillation on one AoA sensor and bias on the second AoA sensor). The main FDD requirement is to provide a valid and accurate, voted value (so-called “consolidated”) for the flight control law computation and to isolate the faulty probes. The maximum acceptable error on the consolidated value was provided to the partners according to industrial requirements, as well as the probability of false alarm (no degradation of the operational reliability) and of missed detection. FTC requirements are the same as for the first scenario.
Robustness to uncertain aerodynamic effects: icing conditions
Icing conditions can significantly alter the shape of the wings and thus aircraft control and protections can be challenging. The consequence of progressive ice accretion is a deep modification of the pitching moment and lift coefficients, as well as a degradation of the closed-loop response at high AoA. There were no FDD requirements in this scenario. FTC requirements include an efficient AoA protection compliant with typical performance constraints. The designs had to be robust to different ice accretion forms and to any other un-commanded control surface motion (e.g. airbrakes runaway). FPE strategies are also applicable here in support to the FTC activation (e.g. estimating aerodynamic coefficients changes). Finally, it should be noted that de-icing devices exist, but their effect will not be taken into account in this work.
Actuator faults
Current industrial FDD algorithms dedicated to actuator faults provide sufficient performance to optimize structural constraints. Under some specific circumstances, even if very improbable, successive redundant actuator faults can lead to the loss of the associated control surface. This induces degradation of the control law performance (e.g. time response, damping, precision, etc.) leading to loss of associated GNC functions, with a possible switch to a more “direct” law and an increase in the pilot workload. Assuming perfect detection of actuator loss, it is then of interest to work on control law modification to provide: (i) control performance and extended flight envelop protection; (ii) optimal guidance and trajectory planning. This third scenario allowed simulating representative detected actuator loss situations in a high-fidelity environment. In more detail, a control surface was considered as fully lost after an abnormal event (e.g. faulty electronic component or mechanical breakage). The situation was assumed known and the fault detected by an FDD strategy. There were no FDD requirements. The FTC objective was set to help maintain efficient manual control while keeping nominal AoA protection. Due to the reduction in the number of control surfaces, the optimum aircraft response performance cannot be guaranteed for the full range of pilot inputs. Thus, the aircraft response needs to be maintained as long as the remaining actuators are not saturated (i.e. for small pilot inputs).
Additionally, detection and compensation of stall load was proposed in this category of scenario, although this is not considered as an actual actuator fault situation. Stall load configuration occurs in flight when overly strong aerodynamic forces apply on the control surfaces, preventing them from achieving the commanded position. The control surface seems to be temporarily jammed (locked-in-place) at its current position. The goal is to detect and confirm that the control surface is stuck, to discriminate with a faulty event, and to estimate the control surface deflection and the duration of the stall load phase. The detection logic should trigger only beyond a given difference D, between the command and the achieved control surface position. The proposed designs must be compliant with requirements on the detection time and probabilities of false alarm and missed detection.
2. INDUSTRIAL VERIFICATION & VALIDATION TOOLS
The advanced G&C and FDI and FTC challenge tackled in RECONFIGURE consisted mainly in sensor and actuator malfunctions. The importance and relevance of the studies carried out within the project arose, on the one hand, due to the industrial representativeness of the benchmark proposed by Airbus, and on the other hand, the industrial validation of the more promising designs using Airbus V&V tools.
The first branch of the V-cycle is the development phase. It starts with the aircraft specification corresponding to the “top level requirements”: the definition of the needs, the choice of concepts, control laws, technologies, etc. The aircraft is decomposed into sub-parts, called systems, which are specified in the next step. The systems are decomposed in subparts called “equipment” (e.g. a Flight Control Computer, FCC), which are then specified. At this step, this specification can be used in a desktop simulator to fly the aircraft in its environment to check that it satisfies the performance and safety requirements before the associated code is even implemented in the equipment. This specification is also used in a development-simulator, a real cockpit where all systems and environment are simulated. After equipment specification, the corresponding flight code is generated and implemented in the hardware equipment. The second part of the V-cycle can then start. This integration phase consists of a thorough validation campaign on different test benches, from the simplest ones (an actuator bench) to more complete ones (the “Iron Bird”). The validation phase ends with flight tests and the overall V-cycle ends with the certification process. RECONFIGURE addressed the development phase: from advanced G&C design coding to high-fidelity development simulators. Indeed, a key step for the successful transfer to the aeronautics practitioners of the developed FDD and FTC methods was their demonstration on standardized industrial validation processes. The proposed validation was a two-steps process: first, an industrial software assessment tool (FES) is used and, secondly, validation on Airbus development simulators was performed.
Functional Engineering Simulator
The Functional Engineering Simulator (FES), developed by Elecnor Deimos, is a non-real-time simulator based on Simulink, Matlab and XML that includes the Airbus aircraft benchmark, as well as robustness and performances analysis tools for all the fault scenarios defined in the project. The FES is not currently part of the industrial V-cycle.
The simulator features all the necessary functionalities to support the performance assessment of the algorithms under study, such as Monte Carlo simulation, parametric simulation and the computation of performance indices and metrics. Furthermore, the simulator provides an interface with DLR's MOPS optimisation tool, with the aim to provide an alternative approach to robustness analysis by continuously searching the parameter space to spot worst-case parameter combinations among the flight scenarios defined within the simulator.
The validation of flight control laws is a key aspect to the aircraft industry. For this purpose, the principal civil aircraft manufacturers build dedicated verification facilities that, in general, are not accessible to the FDD/FTC research community. These facilities are often specifically designed for a particular aircraft programme and are based on in-house custom platform developments.
The main objectives of the RECONFIGURE-FES are:
• To provide a realistic numerical simulation environment for the benchmark failure scenarios
• To support the integration and assessment of the FDD/FTC algorithms designed within the project
Therefore, RECONFIGURE FES covers the industrial verification phase of the design validation process inside an affordable simulation environment, yet providing the highest representativeness of the underlying dynamic system, thanks to the benchmark and models provided by Airbus.
Industrial Validation Test-Benches
From an aircraft manufacturer point of view, all new types of equipment and software installed in the cockpit and in the aircraft avionics compartment must be tested thoroughly, including checking their connection to the other aircraft equipment, as well as their integration.
For the RECONFIGURE project, a non-real-time flight simulator facility at Airbus was employed for the industrial validation. This permitted achieving TRL 4. While not formally a high TRL, the very high fidelity of the Benchmark ensured that this achievement was industrially relevant.
3. ADVANCED G&C FPE, FDD AND FTC METHODS
Several Fault Detection and Diagnosis (FDD), Fault Tolerant Control (FTC) and integrated FDD/FTC techniques were considered within WP2 of the RECONFIGURE project as candidates to improve the state-of-practice in FDD and FTC. These cover both data-driven (model-free) and model-based approaches, and were selected based on an extensive review of the technical state-of-the-art. The techniques are mastered by the project consortium and therefore their effectiveness in providing the basis for the solution of each of the benchmark scenarios was evaluated in detail in the project.
WP2 was subdivided into the following sub-WPs:
o WP2.1: Parameter and Fault Estimation/Diagnosis Approaches
o WP2.2: Reconfigurable G&C Approaches
o WP2.3: Integrated Estimation/Diagnosis/G&C Approaches
o WP2.4: Integration and Clearance Approaches
The main tasks performed on each of the aforementioned sub-WPs are summarized in the sequel.
Parameter and fault estimation/diagnosis approaches
This sub-WP was led by DLR and additionally involved the following partners: DEIMOS, DLR, ONERA, SZTAKI, TUDELFT, UNEXE, and UCAM.
The objective of this work package was to study, develop and apply advanced estimation and diagnosis approaches for aircraft guidance and control parameters and faults. A distinction was made between parameter and fault, as well as between estimation and diagnosis. Diagnosis involves examining the health status of the aircraft to determine if a fault or failure has occurred, and, if so, where and what type of fault. Estimation involves the determination of the value of an aircraft parameter even with incomplete, inaccurate or uncertain information. Methods for estimation and diagnosis can be interchangeably used to diagnose/estimate parameters and/or faults depending on the situation, motivating the joint study of estimation and diagnosis methods.
There are two specific benchmark cases directly applicable to WP2.1:
1) “Robustness/Performance trade-off in case of sensors faults”
2) “Robustness to aerodynamic changes”.
The first scenario concerns the estimation of the value or the diagnosis of faults in those Flight Control System (FCS) parameters that, to the current state-of-practice, are difficult to be robustly obtained, such as airspeed or angle-of-attack measurements. The second one focuses on estimating/diagnosing those events that can change the aerodynamics of the aircraft, such as icing or loss of slat/flap information.
As a starting point, diagnosis and estimation methods suitable to address the identification of aircraft abnormal conditions affecting the flight control system have been surveyed and evaluated with respect to how they address the fundamental identification problems, their robustness, and their suitability for tackling the defined benchmark cases. The methods are classified broadly as:
Model-based approaches
These approaches use models, or derive models from Input/Output (I/O) data, to examine the closed-loop behaviour. They include, for example: robust filtering, on-line parameter estimation, and multi-model diagnosis approaches.
Model-free approaches
These approaches monitor the closed-loop behaviour using only measured I/O signals. They include techniques that track error threshold violation, as well as falsification methods.
The research and development activities have been divided into three phases: RTD, application and evolution. In the RTD phase, the methods surveyed in an earlier task are investigated and/or developed taking into account the information from the benchmark cases. In the application phase, the partners applied the selected methods to the appropriate scenarios and the resulting designs have been submitted to the industrial verification and validation activities. In the following evolution phase, lessons learnt during the previous application phase were used to immediately benefit the maturation of the applied approaches.
Finally, a total of 17 designs were submitted and documented for validation and verification concerning the following benchmark problems defined in WP1.1:
Detected loss of attack (AoA) and airspeed (VCAS) sensors (scenario Sc1.1)
DLR - Robust fixed gain C*-like longitudinal control law with protections based on VCAS estimate, load factor and pitch attitude
ONERA - Frequency Domain Model Identification coupled with modal LFT controller for indirect adaptive control
- Flight Parameter Estimation using an Extended Kalman Filter coupled with modal LFT controller for indirect adaptive control
UNEXE - LPV sliding mode observers for sensor FTC with erroneous scheduling parameter measurements
UCAM - Robust Backup Control Law for Missing VCAS/AoA
Undetected loss of angle of attack (AoA) and airspeed (VCAS) sensors (scenario Sc1.2)
DEIMOS - Gain-scheduling H∞/mixed-μ robust Fault Detection and Isolation (FDI)
- Kalman Filtering-based multiple-model FDI and Fault Tolerant Control (FTC)
DLR - Advanced Air data sensor monitoring based on nullspace determination, optimization and advanced signal based techniques
SZTAKI - Multiple model adaptive Calibrated airspeed estimation with Kalman Filter bank
TUDELFT - Moving-horizon estimation for VCAS and AoA sensor faults
UNEXE - Sliding Mode Observers for fault detection of uncertain LPV systems with imperfect scheduling parameter knowledge
Icing scenarios (scenario Sc2.1)
DEIMOS - Gain-scheduling H∞/mixed-μ robust inner-loop controller
UCAM - Extended Kalman Filter (EKF) and Model Predictive Control (MPC) -based indirect adaptive control for icing
Actuator loss (scenario Sc3.1)
SZTAKI - Nullspace Based Control Input Reallocation
TUDELFT - Fault-tolerant Reconfigurable Model Predictive Control
UCAM - Reconfigurable control in an MPC-for-tracking architecture
UNEXE - Fault tolerant integral sliding mode control allocation scheme
The development of robust fault diagnosis/parameter estimation methods is a prerequisite for the design of advanced fault tolerant control laws with event-driven reconfiguration capabilities. The main advantages of those methods include safety, reliability, and performance improvement in automatization of ground and air vehicles to assist pilots/drivers in all possible scenarios and to make missions more optimal.
Reconfigurable G&C approaches
This sub-WP was led by ONERA and included the participation of the following partners: DEIMOS, DLR, ONERA, SZTAKI, TUDELFT, UNEXE, UCAM and UoB.
The objective of this work package was to study, develop and apply advanced reconfigurable G&C design approaches. These techniques can be construed as smooth switches between the “normal”, “alternate” and “direct” control laws driven by, first and foremost, the safety of the aircraft, and then by a desire to optimize performance. The techniques had to strive to achieve this goal by: (i) facilitating the continuous operation, or at least for longer time and with a less abrupt switch-off, of the G&C functions already on-board; and (ii) using alternate solutions to accommodate, alleviate or reduce the impact of the abnormal/off-nominal events.
All the benchmark cases defined in WP1.1 are applicable to this WP, but the most relevant are “Robustness to aerodynamic changes” and “Control & Guidance in case of detected actuators loss”. Both problems entailed direct application of reconfiguration strategies.
As a starting point, reconfigurable G&C approaches suitable to cover “normal”, “alternate” and “direct” control laws ensuring stable control of the aircraft and at the same time optimizing its performances, have been surveyed and evaluated with respect to how they address the fundamental control problems, their robustness, and their suitability for tackling the defined benchmark cases. The methods are classified broadly as:
o Multiple-Model Approaches
o Inherent Robust Sliding Mode Controllers interlaced with Control Allocation Methods
o Model Predictive Control
o H∞-Control
o Linear Parameter Varying Control Methods
o Direct Adaptive Control Methods
o Indirect Adaptive Control Methods
Similarly to WP2.1 the research and development activities have been divided into three phases: RTD, application and evolution.
By the end of this sub-WP, 19 designs have been submitted and documented for a preliminary validation and verification concerning the following benchmark problems defined in WP1.1:
Detected loss of angle of attack (AoA) and airspeed (VCAS) sensors (scenario Sc1.1)
DLR - Robust fixed gain C*-like longitudinal control law with protections based on VCAS
estimate, Nz and Theta
ONERA - Frequency Domain Model Identification coupled with modal LFT controller for indirect adaptive control
ONERA - Flight Parameter Estimation using an Extended Kalman Filter coupled with modal LFT controller for indirect adaptive control
UNEXE - LPV sliding mode observers for sensor FTC with erroneous scheduling parameter measurements
UCAM - Robust Backup Control Law for Missing VCAS/AoA
Undetected loss of angle of attack (AoA) and airspeed (VCAS) sensors (scenario Sc1.2)
DEIMOS - Gain-scheduling H∞/mixed-μ robust FDI
- Kalman Filtering-based Multiple-Model FDI and FTC
DLR - Advanced Air data sensor monitoring based on nullspace determination, optimization and advanced signal based techniques
SZTAKI - Calibrated airspeed estimation with Kalman Filter bank
TUDELFT - Moving-horizon estimation for VCAS and AOA sensor faults
UNEXE - Sliding Mode Observers for Fault Detection of Uncertain LPV Systems with Imperfect Scheduling Parameter Knowledge
Icing scenarios (scenario Sc2.1)
DEIMOS - Gain-scheduling H∞/mixed-μ robust inner loop controller
UCAM - EKF+MPC-based indirect adaptive control for icing
Actuator loss (scenario Sc3.1)
SZTAKI - Nullspace Based Control Input Reallocation
TUDELFT - Fault-tolerant Reconfigurable Model Predictive Control
UCAM - Reconfigurable control in an MPC-for-tracking architecture
UNEXE - Fault tolerant integral sliding mode control allocation scheme
UoB - Classical Root locus based C*-like longitudinal control law
- Robust H∞ fixed order based C*-like longitudinal control law
Moreover, 7 designs, one per partner, have been evaluated in more detail during an industrial validation and verification.
The combination of robust fault diagnosis methods (WP2.1) with the advanced event-driven reconfiguration or fault tolerant control methods of WP2.2 or WP2.3 has been successfully illustrated.
Integrated estimation/diagnosis/G&C approaches
TUDELFT led WP2.3 which additionally involved the following partners: DEIMOS, DLR, ONERA, SZTAKI, TUDELFT, UNEXE, UCAM, and UoB.
The objective of this work package was to study, develop and apply integrated design approaches and tools for estimation, diagnosis and reconfigurable G&C. It is well known that in the presence of uncertainties, an integrated design of the estimation/diagnosis/G&C functions is more suitable than their independent design and subsequent integration. This results from the masquerading of information resulting from robust (reconfigurable) G&C functions, which can dramatically reduce the performance of the estimation/diagnosis functions on which they rely. Also, the influence of estimation/diagnosis speed, computational delays, and the switching between the functions can result in potential practical limitations. All these interaction issues between the three types of functions (estimation, diagnosis, and G&C) limit the use of advanced methods for each of them.
Integrated design approaches tackle the above interaction problem by designing the G&C and the estimation/diagnosis systems simultaneously. In this manner, direct information is used during the design phase about the masking effects that the G&C has on the estimation/diagnosis performance, as well as the effects of the estimated/diagnosed signal on the G&C. Abnormal events accommodation and, for specific cases, reconfiguration of the design can be performed automatically and with certain theoretical guarantees for specific synthesis techniques yielding a streamlined design with improved V&V and certification guarantees. All the benchmark cases defined in WP1.1 are applicable to this WP.
As a starting point, integrated estimation, diagnosis and guidance/control approaches have been surveyed and evaluated with respect to how they address the fundamental control problems, their robustness, and their suitability for tackling the defined benchmark cases. The methods are classified broadly as:
o Multiple-Model Adaptive Control
o Integrated Adaptive Control Approaches
o Supervisory Fault Tolerant Control Using LPV Methods
o Data-Driven Fault-Tolerant Control o Sliding Mode Control and Control Allocation
o Adaptive and Fault-Tolerant Model Predictive Control
o H∞-Integrated FDD/FTC
o Linear Parameter Varying Gain
As in the previous sub-WPs, the research and development activities have been divided into three phases: RTD, application and evolution.
Finally, 18 designs have been submitted and documented for validation and verification concerning the following benchmark problems defined in WP1.1:
Detected loss of attack (AoA) and airspeed (VCAS) sensors (scenario Sc1.1)
DLR - Robust fixed gain C*-like longitudinal control law with protections based on VCA estimate, load factor and pitch attitude
ONERA - Frequency Domain Model Identification coupled with modal LFT controller for indirect adaptive control
- Flight Parameter Estimation using an Extended Kalman Filter coupled with modal LFT controller for indirect adaptive control
UNEXE - LPV sliding mode observers for sensor FTC with erroneous scheduling parameter measurements
UCAM - Robust Backup Control Law for Missing VCAS/AoA
Undetected loss of angle of attack (AoA) and airspeed (VCAS) sensors (scenario Sc1.2)
DEIMOS - Gain-scheduling H∞/mixed-μ robust fault detection and isolation (FDI)
- Kalman Filtering-based multiple-model FDI and fault tolerant control (FTC)
DLR - Advanced Air data sensor monitoring based on nullspace determination, optimization and advanced signal based techniques
SZTAKI - Calibrated airspeed estimation with Kalman Filter bank
TUDELFT - Moving-horizon estimation for VCAS and AoA sensor faults
UNEXE - Sliding Mode Observers for fault detection of uncertain LPV systems with imperfect scheduling parameter knowledge
Icing scenarios (scenario Sc2.1)
DEIMOS - Gain-scheduling H∞/mixed-μ robust inner loop controller
UCAM - Extended Kalman Filter (EKF) and Model Predictive Control (MPC) -based indirect adaptive control for icing
Actuator loss (scenario Sc3.1)
SZTAKI - Nullspace Based Control Input Reallocation
TUDELFT - Fault-tolerant Reconfigurable Model Predictive Control
UCAM - Reconfigurable control in an MPC-for-tracking architecture
UNEXE - Fault tolerant integral sliding mode control allocation scheme
Detection and compensation of stall load (scenario Sc3.3)
UoB - H-infinity and non-smooth H-infinity fixed order structure
Moreover, 7 designs, one per partner, have been evaluated in more detail during an industrial validation and verification.
Integration and Clearance Approaches
WP2.4 was led by UCAM and was participated by: DEIMOS, DLR, ONERA, SZTAKI, TUDELFT, UNEXE, and UCAM.
The objective of this work package was to study, develop, and apply advanced clearance approaches for aircraft estimation, diagnosis and reconfigurable G&C, taking specifically into account their integration issues. Both topics, integration and clearance, are related since components integration is often times the “show stopper” for clearance of a design. This is because these issues are usually not directly taken into account in the design phase and require time-consuming ad-hoc solutions and fine tuning of the different components being integrated for their clearance. FCS design clearance (which precedes aircraft certification) typically relies on probabilistic Monte-Carlo or parameter-gridding, and despite being the de-facto standard in industry, it can only offer limited probabilistic guarantees while not ensuring full parameter and scattering coverage. Moreover, new G&C functions envisioned in the future (i.e. autonomous systems or those considered in RECONFIGURE) are challenging the traditional approach in terms of cost and coverage. Thus, in order to promote the widespread use of the proposed methods in the aeronautics industry, the issues of integration and clearance must be examined and advanced solutions explored.
As a starting point, integration and clearance issues, together with the available clearance methods have been surveyed, taking into account the existing Airbus state-of-practice, the RECONFIGURE benchmark cases, the V&V process to be followed during the project, and the descriptions of the methods proposed under the auspices of work packages WP2.1 “Parameter and Fault Estimation/Diagnosis Approaches”, WP2.2 “Reconfigurable G&C Approaches” and WP2.3 “Integrated Estimation/Diagnosis/G&C Approaches”.
The methods surveyed are classified broadly as:
o Optimisation-Based Clearance Approaches
o Linear Fractional Representation (LFR)/Linear Fractional Transformation (LFT) Based Approaches for Integration and Clearance of FDI/FTC Flight Control Systems
o Enhanced µ-Analysis Techniques for Clearance
o IQC-based Analysis of LTI and LPV Systems
o Certification of Real-Time Aspects of Model Predictive Control
o Stability Analysis of Model Predictive Control
o Gap Metric and ν-Gap Metric Approaches for Clearance of Control Laws
The research and development activities have been divided into two phases: RTD and application. This reflects that the WP started later in the project to allow accumulation of know-how and experience on the methods to be cleared. In the RTD phase, the methods surveyed in the previous task were investigated and/or developed taking into account the information from the benchmark cases. In the application phase, the partners applied the developed approaches to the designs produced within the scope of WP2.1 WP2.2 and WP2.3 in the context of the benchmark problems defined in WP1.1. In particular, the following techniques were applied by each partner:
DEIMOS – LFT-modelling and µ-analysis applied to gain-scheduled H∞/mixed-µ robust control in clean configuration scenarios.
– Optimization-based clearance (Hybrid Differential Evolution) applied to gain-scheduled H∞/mixed-µ robust inner loop controller for control in undetected icing conditions.
DLR – Multi-objective worst-case optimization-based clearance of control performance, applied to integrated FDD/FTC control law for undetected VCAS/AoA faults.
– Multi-objective worst-case optimization-based clearance of FDI performance, applied to FDD design.
ONERA – Off-line validation of adaptive gain-scheduled flight controllers, using IQC and skew-µ analysis, applied to LFT gain-scheduled control design with online estimation of stability derivatives for missing VCAS/AoA scenario.
SZTAKI – Pilot-in-the-loop simulations to verify absence of Pilot Induced Oscillations, applied to nullspace based allocation method for reconfiguration in case of stuck elevators.
TUDELFT – Certification of real-time termination of MPC solver with bounds on primal feasibility violation and suboptimality, guarantees of recursive feasibility and closed-loop stability, with application to linear RECONFIGURE benchmark.
UNEXE – Analysis of LPV sliding mode observers for fault estimation, to reconstruct undetected VCAS/AoA faults.
UCAM – Clearance of control laws using formal methods (quantifier elimination algorithms and MetiTarski theorem prover), with application to robust backup control law for detected VCAS/AoA fault scenario.
4. Pilot-in-the-loop Industrial V&V results
In order to achieve the goals of the project, a detailed project plan for the Design, Development and Verification (DDV) activities was established early in the project. This was maintained and updated throughout the project. While the activities were performed continuously over the 42-month period of the project, certain milestones were of particular relevance:
• The development of the Airbus benchmark as a high-fidelity model of the system, the corresponding products of the aircraft LTI models, the benchmark scenario definitions, and the benchmark specification (stability and performance requirements).
• The development of the Deimos FES, which includes the Airbus benchmark, and in its two versions: a preliminary version to support algorithm design and analysis, and a final version for the formal verification.
• The GNC, FDD and FTC algorithm designs in their two versions: version 1 based on the design cycle using the benchmark and linear LTI models for design and analysis, and version 2 updated after the verification test campaign on the FES. For version 1, each partner developed multiple designs to cover different benchmark scenarios, while for version 2 only one design was provided/selected per partner, corresponding to that selected for testing on the Airbus Flight Simulator.
Verification
The verification was performed by DEIMOS, on designs provided by: DEIMOS, DLR, ONERA, SZTAKI, TUDELFT, UNEXE, and UCAM.
An extensive simulation campaign was employed with the DEIMOS FES to cover all the abnormal and fault baseline scenarios. It was additionally included a set of robustness scenarios, where no faults were included in the system to assess the algorithms’ performance in nominal flight. Within this set, consisting of 27 simulation sets, a total of 2023 runs were executed for each design proposed. It was also included a long flight test condition, consisting of 5 hours, to ensure the algorithms remained stable numerically.
The designs proposed were different for each of the scenarios, and the techniques employed for their design to reach the objectives that were chosen included: Gain scheduling H∞, Fixed gain C*, Nullspace determination and optimization, LPV sliding mode observers, Kalman filters and Model Predictive control.
The total number of simulations performed in the complete set of campaigns, considering all the scenarios tested for the different designs from the partners, was 65234 runs, divided into 903 simulation sets. This shows that the campaign was extensive and also highlights the justification to automate the assessment of the designs using the FES and its common metrics.
This FES test campaign was executed twice in the project. Firstly, for the full set of designs, covering the range of scenarios considered by the partners. The results of this test campaign were then analysed by Airbus to determine the better designs and those to be further tested on Airbus facilities. This sub-selection of the designs was then tuned and tested again (by the partners locally) on the full FES test campaign, to provide a final evaluation prior to the testing on Airbus facilities. The selection of the designs for further testing was performed by Airbus using a team on engineering covering different disciplines, considering the results of the FES campaign, and also employing the Airbus experience on which designs would perform best in an industrial setting.
This two step approach proved to be very effective, allowing for the consideration of a large number of design methods, strategies and their design solutions, for the different failure/off-nominal scenarios defined within the Airbus Benchmark, their testing in a thorough and fully representative test environment in the FES, and then the further tuning and retesting of the better designs. Significant improvements were seen through this two-step approach, and the concentration of the final design effects on the design solution of each partners to be tested on Airbus V&V facilities.
It is noted that, as part of this two-step process, the designs were ported into the Airbus Simulink library. This allowed for the consideration of the real-time computation load of the designs using a standardized industrial analysis approach.
Validation
The verification was performed by AIRBUS, on designs provided by: DEIMOS, DLR, ONERA, SZTAKI, TUDELFT, UNEXE, and UCAM.
To complete the automated FES campaign, an even more industry-oriented V&V campaign was set up allowing to put a human in the loop for typical industrial tests, complemented by the simulation of real incident-inspired simulations. Only one design per team was selected based on the FES campaign results.
This validation on the standardized V&V processes used by industry is a key step for the successful transfer to the aeronautics sector of the developed diagnosis methods. This transfer was one of the most important technological objectives of the project.
The selected designs to be validated come from the technology development phase consisting of preliminary and detailed design and code prototyping/integration (see subsection above). It also included the very long and strong Airbus’ experience in aircraft system industrial validation in general, and specifically the industrial development and validation of Flight Control Computer software.
The validation work performed implied two main steps:
1. Preparation of the experimental set-ups for industrial validation.
In a first step, a graphical tool allowed specifying the overall implementation of the FDD/FTC designs (i.e. computer aided-specification). A limited set of graphical symbols (adder, filters, integrator, look-up tables, etc.) was used to describe each part of the submitted designs.
2. Industrial validation on Airbus test facilities.
Once the selected designs were implemented, the designs were validated using thorough simulation campaigns. The validation consisted in two steps: first testing each design on the scenario for which it was designed, including failure cases and robustness scenarios. Most designs performed well in this test, due to the fact that they had passed the testing and assessment using the FES.
The second step was testing the designs on an even more challenging scenario, using real incident-inspired tests. More than 20 families of tests were performed, covering the 4 aforementioned Benchmark Scenarios. Each family consists of several test scenarios to be simulated in different flight and aircraft configurations and related to the scenario of interest, covering robustness and performances assessment.
As an example of the testing, one can comment:
• In-service wind scenarios: several 3-D wind profiles have been reconstructed from in-flight parameters recording. They correspond e.g. to windshear or severe turbulence in cruise. They are used to test the design robustness and are indicated for sensor fault scenarios.
• Change of slat and flap configuration, from clean configuration (surfaces retracted) to full configuration (extended). This changes the aircraft aerodynamics and the de facto lift coefficient. This kind of scenarios is also well indicated for sensor fault scenarios.
• Gentle roll: in order to check the aircraft roll stability under icing conditions, successive fast return roll manoeuvers are simulated when the aircraft AoA is very close to the maximum AoA before stall.
The validation campaigns were performed by the Airbus’ V&V teams, with support from the design teams of the partners. The results showed an acceptable performance for the majority of the designs, with some degradation seen during the extended tests using real incident-inspired tests. This was corrected during the validation maturation of the designs, especially for the sensor failure scenarios.
The first conclusions are that all designs show good robustness w.r.t. typical manoeuvres. Under windy conditions, the robustness was found to be more difficult to ensure, especially for windshear scenarios. But it must be recognized that some of the simulated winds correspond to very aggressive situations at the limit of what could be expected in-flight. Performances are generally good. From the control-oriented scenarios (e.g. FTC), it is sometimes tricky to assess the design performances, for example in the case of interference with existing protections. The Airbus baseline controller contains a lot of protections which cannot be fully removed for the tests. For the FDD scenarios, some designs show that it is possible to improve the current state-of-practice, but the worst scenario combining simultaneous AoA and CAS faults is difficult to cover; only a few of the designs were able to perform well for all the sensor fault cases.
The V&V campaign results, as well as the lessons learnt, have shown that the industrial transfer depends on a better understanding of the methods, which in some cases are still considered as quite complex by the main industrial stakeholder in Airbus. However, in conclusion, the V&V campaigns are considered as very promising from an industrial point of view.
Demonstration
The demonstration was performed during the “International Workshop on FDIR and Reconfiguration Control in Flight”.
Six of the most promising designs were demonstrated, as done for the industrial validation. The demo was performed during the course of an afternoon by the Airbus’ V&V team in their industrial test-benches, in the presence of the attendees, and successfully showed the effectiveness of the designs and their achieved TRL.
Potential Impact:
The activities of dissemination and exploitation were considered within work package WP4.2 and WP4.3.
To maximize the dissemination of the project achievements most results were submitted to leading journals, conferences and workshops with a focus on the technologies, tools and methodologies that covered the activities involved in the project.
Dissemination
The general objectives of the dissemination activities were:
• To ensure maximum awareness and visibility of the achievements and results of the project particularly in influential aerospace bodies.
• To make known new methodologies and standards that could be obtained as a part of the project results and to encourage their use to carry on this line of investigation.
• To promote the use of the new technology developed and tested in the project, across companies and institutions who have an interest in FDD, FPE and FDIR systems.
To obtain as much diffusion of the project results as possible, across all the areas, several forms of dissemination media were used to achieve the objective:
• Demonstration/final meeting where the industrial partners (Airbus and DEIMOS) will invite certification and policy-making authorities in the aeronautics and space sector.
• Conferences and workshops attendance.
• Scientific publications as well as specialized and general information press.
• Project web site
• Direct participation of project partners in influential aerospace organizations.
• Organization of specialized events at established conferences (e.g. invited sessions)
In the course of the project, there were:
• 11 journal articles published (others are under review)
• 46 conference articles published
• 6 conference invited/special sessions, either dedicated to RECONFIGURE or co-lead by the RECONFIGUER consortium
• One international workshop on RECONFIGURE, conducted over three days, and with 49 atendees from Europe and the US
During the course of the project a number of special sessions, at different high profile conferences have been organised by members of the consortium. These have included:
• Fault Detection, Isolation and Reconfiguration in Aerospace Systems: On-line Learning and Adaptive Methods (American Control Conference, Portland, 2014)
• Fault Detection, Isolation, and Reconfiguration in Aerospace Systems: Verification and Off-line Model-based Methods (American Control Conference, Portland, 2014)
• European Efforts towards Advanced Fault Diagnosis and Fault Tolerant Control for Civil Aircraft: The FP7 RECONFIGURE Project. (IFAC World Congress, 2014)
• RECONFIGURE Project: Theoretical and Practical Contributions towards Advanced Real-Time FDD and FTC for Civil Aircraft, (IFAC Safeprocess, Paris, 2015)
• RECONFIGURE FP7 Project for Advanced Real-Time FDD and FTC for Civil Aircraft: Contributions and Results, (3rd Conference on Control and Fault-Tolerant Sys-tems, SysTol'16, 2016)
• FDI/FTC for Aerospace: From Theory to Applications, (The International Federation of Automatic Control, 20th IFAC Symposium on Automatic Control in Aerospace - ACA 2016)
The workshop provided a forum for the dissemination of the activities performed and results obtained from the project. The three day workshop brought together leading actors from European industry and academia in the aeronautical and aerospace sectors, and took place in one of Europe’s aeronautical hubs in Toulouse, at Airbus facilities. It aimed to show the European state-of-the-art and state-of-practice in FDIR and FTC for aeronautical and aerospace vehicles, providing an understanding of the industrial problem, the solution process and the latest academic and industrial solution methods. The workshop included presentations from selected European experts in the aeronautical and aerospace communities, and from the RECONFIGURE consortium members. It also included live demonstrations of the RECONFIGURE results using Airbus’ facilities, to encourage the exchange of information and ideas.
There is also currently one special editional journal issue being developed based on the results of the RECONFIGURE project.
Exploitation
The possibility of intellectual protection via a patent was always open in the project. In that case, the inventing partner or partners were to bring the attention of the Steering & Management Committee for consideration of every intention to protect (or otherwise) the intellectual property generated during the course of the Project.
List of Websites:
http://reconfigure.deimos-space.com/
Dr. Murray Kerr (Deimos Space SLU)
murray.kerr@deimos-space.com
The RECONFIGURE project aimed to investigate and develop advanced aircraft guidance and control (G&C) technologies that will facilitate the automated handling of off-nominal and abnormal events, while simultaneously alleviating the pilots’ task and optimising the aircraft performance. This automatism and optimization must be performed while maintaining the aircraft current safety levels, which is compliant with present-day regulations. More concretely, these objectives are intended to be accomplished by researching and developing advanced Flight Parameter Estimation (FPE), Fault Detection and Diagnosis (FDD) and Fault Tolerant Control (FTC) techniques, which contribute to extend as long as possible the nominal aircraft G&C functionalities.
The RECONFIGURE project lasted from January 2013 until June 2016, and hence was performed over a 42-month period.
RECONFIGURE achieved the principal aims of the project, and significant progress has been made on FDD and FTC for large civil aircraft. The results are expected to contribute to the state-of-the-art improvement at low TRL levels (TRL 4), which should in time lead to improvements in the current state-of-practice to higher TRL levels.
The RECONFIGURE project aims were achieved through research and development in the techniques of:
• Flight Parameter Estimation (FPE)
• Fault Detection and Diagnosis (FDD)
• Fault Tolerant Control (FTC)
while considering for these techniques:
• Integration issues and approaches for estimation, diagnosis and GNC
• Clearance approaches for the above type of systems
From an academic point of view, the results of the project are excellent. A large number of advanced G&C techniques were developed, consolidated and/or proved through the project phases. The use of a high-fidelity benchmark problem to motivate the academic developments and serve as the basis for the algorithm design and assessment, drove the academic partners to perform the first steps in the industrialisation of the advanced G&C techniques under consideration – in short a first step in “bridging the gap”. This allowed for the assessment of the ease with which different techniques can be applied in an industrial setting, considering standard aspects, such as their performance and robustness, and also more applied aspects, such as the ease for design tuning and certification, and the algorithm computational load. As a result of these activities, many advances in the basic academic advanced G&C techniques have been made and the techniques have been matured greatly, especially for application to the aeronautical sector. These achievements have been reported to the wider community through a number of dissemination channels (conference papers, journal papers, conference invited sessions, and an international industrial workshop).
From an industrial point of view, the results of the project are very satisfactory, even if there is still a long way between a TRL 4 design, and a certified and flying solution. The techniques and developed algorithms were tested up to TRL 4 on the high-fidelity aircraft benchmark problem provided by Airbus. On this benchmark and its scenarios, covering actuator, sensor and environment extreme events (e.g. failures, large winds), the algorithms were tested in a non-real-time simulator (DEIMOS FES), and a flight simulator environment (Airbus). As a final testing of the best designs, this testing was extended to scenarios derived from real flight events, in some cases using real flight data (e.g. wind profiles). More V&V activities would be needed, and on more representative facilities, including flight simulators, “Iron Bird”, actuator and system integrated benches and finally real flight tests, to evaluate fully the designs and make stronger conclusions on the developed techniques. This would in turn necessitate further consolidation of the designs and their implementation. However, the RECONFIGURE project results do represent a convincing first step towards the implementation of advanced FDD/FTC solutions. The project also represents a natural continuation and important enhancement over the results and advancements of earlier R&D activities, such as the EU FP7 project ADDSAFE.
As a final consideration, taking into account the work performed, the results achieved and the advances made, it is considered that the RECONFIGURE project has contributed and will contribute to the long term goal of “Full-time, all-event available fly-by-wire”.
Project Context and Objectives:
Fly-By-Wire (FBW) is the industrial standard for large civil aircraft. It offers advantages in aircraft safety and performance, and has contributed to the great progress seen in the aviation sector over the last few decades. These large civil FBW aircraft rely on hardware redundancy and fail-safe approaches to accommodate abnormal/off-nominal situations, such as the multitude of failure cases that can arise in the complex engineering system that is the large modern civil aircraft of today. Key technologies in this accommodation of abnormal/off-nominal situations are that of onboard Fault Detection and Diagnosis (FDD) and Fault Tolerant Control (FTC).
The state-of-practice at, for example European civil manufacturers of large aircraft, employs FDD and FTC technology based on hardware redundancy for FDD, in order to perform consistency tests, cross checks and built-in-tests, and the switching to alternate and robust control laws in the case of the detection of an abnormal event for FTC. This current approach and state-of-practice is fully satisfactory and aligns well with the aircraft certification process. Each control law is designed off-line for different levels of robustness and each includes a set of specific Guidance, Navigation and Control (GNC) functions which assist the pilot all along the flight. Even though this state-of-practice is safe, it is known to decrease the ease of the piloting task (e.g. increased workload) and leads to a non-optimal configuration of the aircraft. This motivates further investigation and research into the handling of abnormal situations in modern FBW civil aircraft.
The European RECONFIGURE (REconfiguration of CONtrol in Flight for Integral Global Upset REcovery) 7th Framework Program (FP7) project took as a baseline reference this state-of-practice industrial approach for the handling of abnormal situations and failures. The project aimed to improve it through the investigation and development of advanced aircraft GNC technologies, for onboard FDD and FTC, that facilitate the automated handling of abnormal and off-nominal events, and that optimize the aircraft status and flight. These technologies aim to extend the operation of the current GNC functionalities that assist the pilot and to optimize the aircraft performance in such abnormal and off-nominal events.
For upcoming and future aircraft, extending GNC functions would contribute to the development of an easier-to-handle aircraft, which will result in decreased pilot workload. To achieve this aim of furthering investigation and research into the handling of abnormal/off-nominal situations in modern FBW civil aircraft, the RECONFIGURE consortium was constructed with ten beneficiaries from seven European countries. These are:
Elecnor Deimos (Spain, Portugal), Airbus and ONERA (France), DLR (Germany), MTA SZTAKI (Hungary), TU Delft (Netherlands), the University of Exeter, University of Cambridge and University of Bristol (UK), and IplusF (Spain).
The project was coordinated by Elecnor Deimos in Madrid. This marriage of European industries, universities and research establishments provided a good balance of competencies in the pertinent fields of aerospace, GNC, FDD and FTC. Importantly, the project consortium allows for an effective and efficient transfer of the new and low TRL technologies, as proposed by academia (TRL levels 1 to 3), to industry (limited to TRL level 4 in this project).
The kick-off of the project was on February 2013 at Elecnor Deimos premises in Madrid and concluded with a Final Meeting and International Workshop on June 2016 at Airbus facilities in Toulouse.
RECONFIGURE was a three-and-a-half-year project divided in 5 work-packages (WP0 to WP4), these decomposed into a total of 13 sub-work packages. The project strived to combine the synergies between the scientific and the technological (i.e. industrial) partners at all levels of the research, development and V&V cycles of the project.
WP 1 “Industrial Benchmark & Assessment Tools” was active during the first two years of the project and focused on defining the benchmark problem and in developing the associated metrics, guidelines and software assessment tools. This is where the high-fidelity aircraft model and fault scenarios were defined, along with the V&V process, tools and metrics. This WP was highly industrially oriented, although the scientific partners supported the definition of the problem, to bring in their theoretical perspective.
WP 2 “Advanced G&C Design and Clearance Methods and Tools” started in parallel to WP1 and lasted for two years and a half. It was the main scientific development component of the project, as it focused in enhancing the current signal- and model-based Fault Parameter Estimation (FPE), Fault Detection and Diagnosis (FDD) and Fault Tolerant Control (FTC) methods, as well as in researching integration and clearance methods.
WP 3 “Industrial V&V” aimed to evaluate effectiveness, maturity and ultimately the Technological Readiness Level (TRL) of the developed designs by applying a traditional industrial Verification and Validation (V&V) process in two steps:
• verification of the designs in a Functional Engineering Simulator (FES) with traditional Monte Carlo analyses, complemented by worst-case search tools, and
• validation of the designs using the Airbus V&V process, including tests with pilot-in-the-loop simulations, and in demanding scenarios inspired by in-fight events.
In addition to this, it included a demonstration of the designs with the better performances, using Airbus V&V facilities.
Three basic pillars supported the RECONFIGURE project technical activities in these work packages, in addition to the relevant expertise of the project consortium members in the different areas under investigation.
RECONFIGURE Problem (WP1). This provided the context, motivation and basis for industrial relevance for the work performed. In particular, it provided:
• The benchmark scenarios (flight conditions, off-nominal and failure scenarios, etc)
• High-fidelity aircraft models, including Flight Control System (FCS) elements and protections
The Technological Solutions (WP2). Research and development lines for the technologies development in the areas of:
• Advanced parameter and fault estimation/diagnosis approaches (FPE and FDD)
• Reconfigurable guidance and control approaches (FTC)
• Integrated approaches for estimation, diagnosis and active G&C
• Advanced analytical and simulation-based clearance approaches
Assessment Tools and Metrics (WP1, WP3). Basis for industrial assessment and V&V:
• Non-real-time simulation infrastructure: Functional Engineering Simulator (FES), including benchmark scenarios, aircraft models and FDD/FTC designs
• Flight simulator, using Airbus V&V facilities and processes
Project Results:
RESULTS
The importance and relevance of the investigations performed within the project is achieved on the basis of the industrial representativeness of the benchmark, i.e. the aircraft model and fault problematic. Moreover, the final goal of the project was to validate the more promising designs in the actual Airbus’ flight control system V&V setup, which ensures industry-wide acceptance of the results.
Following the breakdown of activities and the objectives of the project, the layout of the results summary is as follows:
1. Benchmark
2. Industrial Verification and Validation (V&V) tools
3. Advanced G&C FPE, FDD and FTC methods
4. Pilot-in-the-loop Industrial V&V results
1. BENCHMARK
The benchmark consists mainly of: (i) a very high-fidelity nonlinear aircraft model which served as a platform for FDI/FTC design and the simulation of (ii) realistic fault scenarios and abnormal situations. The development of the benchmark also implied the definition of industrial constraints and requirements for real-time implementation, as well as the definition of the industrial V&V process and constraints.
This section focuses first on the aircraft model development and its release to the consortium, and then on the industrial scenarios.
Aircraft model
Although the aircraft model will inherit components from the benchmarks used in previous European projects, it represents a notable increase in the Technological Readiness Level (TRL) for the simulation model. This increase in TRL is required due to the specific need to access more deeply the flight control system, demanding a relatively strong development effort from Airbus side.
To be fully representative of the aircraft and system dynamics, it was decided to deliver an in-flight validated nonlinear model of the aircraft. It included a model of all the closed-loop components: flight dynamics, and also actuators, sensors, flight control computers, etc. The simulation tool containing the aircraft model was developed within Airbus to design the flight control laws and protections, including the nonlinear domains for general handling qualities studies. The development simulator was then used to test and tune control laws with a pilot in the loop. This simulator is fitted with wind tunnel data and some but limited real flight data. Consequently this simulator will never replace the flight test as the ultimate validation tool, as some uncertainty is remaining. The first version of this model was developed in 1984 for the A320 based on wind tunnel data.
Because of Airbus’s development framework and proprietary restrictions, this model was provided to the consortium as a black box, with restricted input/output information. Thanks to the black box format, the consortium benefited from using: (i) a precise nonlinear model of the aircraft flight mechanics adjusted from wind tunnel data and limited flight test data; (ii) actuator models developed with the support of Airbus’ suppliers and Airbus testing facilities teams; and (iii) realistic sensor models’ behavior. This is based on the functional description delivered by Airbus’ suppliers but adapted in a Matlab/Simulink interface to only consider the required features for flight control design. Transient features as sensors power-on, as well as internal monitoring of the sensors are removed. A particular focus may be done in the engine model. Because of the complex task and specific knowledge required for engine modelling, from Airbus point of view, the engine model is a black box delivered by the engine supplier and integrated to the overall aircraft simulation platform. Finally, several other models completed the simulator architecture, such as a ground effect model for landing and taxing simulation purposes, a wind model to simulate representative disturbances based on the average wind and turbulence defined by the user and many others (hydraulic and electrical systems, fuel system, atmospheric model, etc.). Overall the simulation tool is composed of 38 different models.
However, in order to enable the different partners to test their own FDD / FTC designs, Airbus extracted a part of the flight control computer in a Simulink model. This includes the baseline controller with interfaces to plug each partners’ designs. The entire control law design is presented in a Matlab/Simulink environment. The benchmark architecture is completed by a Matlab-based interface that handles: characteristics of the scenario; data flow from aircraft model (sensors outputs) to the control laws; commands computed by the control law to the aircraft model (actuators inputs) and; the synchronization of the incoming/outgoing signals.
The benchmark provided to the partners was complemented with a simplified version of the aircraft model. This simplified version allowed the project partners to preliminary tune their FDD and FTC algorithms. The structure of the simplified benchmark is composed of a linear model of the aircraft, the linear part of the baseline controller and simplified actuator and sensor models. The linear model of the aircraft is a linearized version of the flight dynamics at a given flight point. However, the user has the option to define the flight point where the model should be linearized. Hence, the partners can choose as many design points as needed to tune their FDD/FTC algorithms. With regards to the linear part of the baseline controller, this is essentially the same law as the fully representative model but without the compensations handling the time-varying behaviour of the aircraft. The simplified actuator model is a second order transfer function with rate and amplitude limitations, while the sensor model is simplified to a filter and a time-delay. Finally, it has to be remarked that all the features of the simplified models are open to the partners, who can modify them if needed for FDD/FTC concerns.
Industrial scenarios
Three faulty/abnormal scenarios were under consideration, covering a comprehensive spectrum of events: sensor faults, robustness to uncertain aerodynamic effects, and actuator faults.
Sensor faults
Information extracted from the sensors can be used as a control or as a scheduling parameter. If used as a control parameter, the associated GNC function is basically affected when the measurements are partially erroneous or not available anymore. In the case of its use as a scheduling parameter, the FCS is usually designed to be robustly stable to errors in the measurement. For example, the speed parameter is very challenging due to the strong aerodynamic discrepancies between the high-speed (cruise) and the low-speed (landing approach) regimes. These discrepancies can have a strong effect on the pre-computed flight control law, inducing also a degradation of the associated GNC functions, under some specific circumstances. Two sub-scenarios are considered, involving two key flight parameters: AoA and Calibrated AirSpeed (CAS).
The first scenario was devoted to control reconfiguration in case of a detected total loss of CAS and AoA information, whatever the root cause and the way to detect it. CAS and AoA loss can be simultaneous or slightly delayed and was assumed that they are not recovered later on during the flight. It means that different kinds of sensor degradation were not considered, i.e. only the consequence is of interest. Although this is a more FTC-oriented scenario, it is recognized that upstream FPE strategies could be also useful and complement the developments here. Two strategies could be possible: either keep the basic controller structure and only change its gains, or switch to a new (advanced) controller, in which case the option must also implement the switching strategy. FTC requirements include maintaining the longitudinal normal law as part of the inner-loop, so as to be able to easily manually fly the aircraft. The outer-loop objective is to maintain altitude hold and level change capability, while keeping the aircraft away from angle of attack and speed limits.
The second scenario is dedicated to CAS and AoA sensor fault detection and parameter estimation. Large civil aircraft are generally equipped with 3 dedicated sensors for each of these measurements. Erroneous behaviours of 2 to 3 sources of CAS or AoA are considered, with the possibility of accounting for both abnormal behaviours leading up to 8 possible scenarios (with only two faulty measurements a total of up to 6 faulty possibilities). Additive and substitutive faults were considered: oscillation, jamming, bias, runaway, NRZ (Non-Return to Zero) and increased noise level. For each sensor, the faults were always of the same type. Different kinds of faults were not considered simultaneously (e.g. oscillation on one AoA sensor and bias on the second AoA sensor). The main FDD requirement is to provide a valid and accurate, voted value (so-called “consolidated”) for the flight control law computation and to isolate the faulty probes. The maximum acceptable error on the consolidated value was provided to the partners according to industrial requirements, as well as the probability of false alarm (no degradation of the operational reliability) and of missed detection. FTC requirements are the same as for the first scenario.
Robustness to uncertain aerodynamic effects: icing conditions
Icing conditions can significantly alter the shape of the wings and thus aircraft control and protections can be challenging. The consequence of progressive ice accretion is a deep modification of the pitching moment and lift coefficients, as well as a degradation of the closed-loop response at high AoA. There were no FDD requirements in this scenario. FTC requirements include an efficient AoA protection compliant with typical performance constraints. The designs had to be robust to different ice accretion forms and to any other un-commanded control surface motion (e.g. airbrakes runaway). FPE strategies are also applicable here in support to the FTC activation (e.g. estimating aerodynamic coefficients changes). Finally, it should be noted that de-icing devices exist, but their effect will not be taken into account in this work.
Actuator faults
Current industrial FDD algorithms dedicated to actuator faults provide sufficient performance to optimize structural constraints. Under some specific circumstances, even if very improbable, successive redundant actuator faults can lead to the loss of the associated control surface. This induces degradation of the control law performance (e.g. time response, damping, precision, etc.) leading to loss of associated GNC functions, with a possible switch to a more “direct” law and an increase in the pilot workload. Assuming perfect detection of actuator loss, it is then of interest to work on control law modification to provide: (i) control performance and extended flight envelop protection; (ii) optimal guidance and trajectory planning. This third scenario allowed simulating representative detected actuator loss situations in a high-fidelity environment. In more detail, a control surface was considered as fully lost after an abnormal event (e.g. faulty electronic component or mechanical breakage). The situation was assumed known and the fault detected by an FDD strategy. There were no FDD requirements. The FTC objective was set to help maintain efficient manual control while keeping nominal AoA protection. Due to the reduction in the number of control surfaces, the optimum aircraft response performance cannot be guaranteed for the full range of pilot inputs. Thus, the aircraft response needs to be maintained as long as the remaining actuators are not saturated (i.e. for small pilot inputs).
Additionally, detection and compensation of stall load was proposed in this category of scenario, although this is not considered as an actual actuator fault situation. Stall load configuration occurs in flight when overly strong aerodynamic forces apply on the control surfaces, preventing them from achieving the commanded position. The control surface seems to be temporarily jammed (locked-in-place) at its current position. The goal is to detect and confirm that the control surface is stuck, to discriminate with a faulty event, and to estimate the control surface deflection and the duration of the stall load phase. The detection logic should trigger only beyond a given difference D, between the command and the achieved control surface position. The proposed designs must be compliant with requirements on the detection time and probabilities of false alarm and missed detection.
2. INDUSTRIAL VERIFICATION & VALIDATION TOOLS
The advanced G&C and FDI and FTC challenge tackled in RECONFIGURE consisted mainly in sensor and actuator malfunctions. The importance and relevance of the studies carried out within the project arose, on the one hand, due to the industrial representativeness of the benchmark proposed by Airbus, and on the other hand, the industrial validation of the more promising designs using Airbus V&V tools.
The first branch of the V-cycle is the development phase. It starts with the aircraft specification corresponding to the “top level requirements”: the definition of the needs, the choice of concepts, control laws, technologies, etc. The aircraft is decomposed into sub-parts, called systems, which are specified in the next step. The systems are decomposed in subparts called “equipment” (e.g. a Flight Control Computer, FCC), which are then specified. At this step, this specification can be used in a desktop simulator to fly the aircraft in its environment to check that it satisfies the performance and safety requirements before the associated code is even implemented in the equipment. This specification is also used in a development-simulator, a real cockpit where all systems and environment are simulated. After equipment specification, the corresponding flight code is generated and implemented in the hardware equipment. The second part of the V-cycle can then start. This integration phase consists of a thorough validation campaign on different test benches, from the simplest ones (an actuator bench) to more complete ones (the “Iron Bird”). The validation phase ends with flight tests and the overall V-cycle ends with the certification process. RECONFIGURE addressed the development phase: from advanced G&C design coding to high-fidelity development simulators. Indeed, a key step for the successful transfer to the aeronautics practitioners of the developed FDD and FTC methods was their demonstration on standardized industrial validation processes. The proposed validation was a two-steps process: first, an industrial software assessment tool (FES) is used and, secondly, validation on Airbus development simulators was performed.
Functional Engineering Simulator
The Functional Engineering Simulator (FES), developed by Elecnor Deimos, is a non-real-time simulator based on Simulink, Matlab and XML that includes the Airbus aircraft benchmark, as well as robustness and performances analysis tools for all the fault scenarios defined in the project. The FES is not currently part of the industrial V-cycle.
The simulator features all the necessary functionalities to support the performance assessment of the algorithms under study, such as Monte Carlo simulation, parametric simulation and the computation of performance indices and metrics. Furthermore, the simulator provides an interface with DLR's MOPS optimisation tool, with the aim to provide an alternative approach to robustness analysis by continuously searching the parameter space to spot worst-case parameter combinations among the flight scenarios defined within the simulator.
The validation of flight control laws is a key aspect to the aircraft industry. For this purpose, the principal civil aircraft manufacturers build dedicated verification facilities that, in general, are not accessible to the FDD/FTC research community. These facilities are often specifically designed for a particular aircraft programme and are based on in-house custom platform developments.
The main objectives of the RECONFIGURE-FES are:
• To provide a realistic numerical simulation environment for the benchmark failure scenarios
• To support the integration and assessment of the FDD/FTC algorithms designed within the project
Therefore, RECONFIGURE FES covers the industrial verification phase of the design validation process inside an affordable simulation environment, yet providing the highest representativeness of the underlying dynamic system, thanks to the benchmark and models provided by Airbus.
Industrial Validation Test-Benches
From an aircraft manufacturer point of view, all new types of equipment and software installed in the cockpit and in the aircraft avionics compartment must be tested thoroughly, including checking their connection to the other aircraft equipment, as well as their integration.
For the RECONFIGURE project, a non-real-time flight simulator facility at Airbus was employed for the industrial validation. This permitted achieving TRL 4. While not formally a high TRL, the very high fidelity of the Benchmark ensured that this achievement was industrially relevant.
3. ADVANCED G&C FPE, FDD AND FTC METHODS
Several Fault Detection and Diagnosis (FDD), Fault Tolerant Control (FTC) and integrated FDD/FTC techniques were considered within WP2 of the RECONFIGURE project as candidates to improve the state-of-practice in FDD and FTC. These cover both data-driven (model-free) and model-based approaches, and were selected based on an extensive review of the technical state-of-the-art. The techniques are mastered by the project consortium and therefore their effectiveness in providing the basis for the solution of each of the benchmark scenarios was evaluated in detail in the project.
WP2 was subdivided into the following sub-WPs:
o WP2.1: Parameter and Fault Estimation/Diagnosis Approaches
o WP2.2: Reconfigurable G&C Approaches
o WP2.3: Integrated Estimation/Diagnosis/G&C Approaches
o WP2.4: Integration and Clearance Approaches
The main tasks performed on each of the aforementioned sub-WPs are summarized in the sequel.
Parameter and fault estimation/diagnosis approaches
This sub-WP was led by DLR and additionally involved the following partners: DEIMOS, DLR, ONERA, SZTAKI, TUDELFT, UNEXE, and UCAM.
The objective of this work package was to study, develop and apply advanced estimation and diagnosis approaches for aircraft guidance and control parameters and faults. A distinction was made between parameter and fault, as well as between estimation and diagnosis. Diagnosis involves examining the health status of the aircraft to determine if a fault or failure has occurred, and, if so, where and what type of fault. Estimation involves the determination of the value of an aircraft parameter even with incomplete, inaccurate or uncertain information. Methods for estimation and diagnosis can be interchangeably used to diagnose/estimate parameters and/or faults depending on the situation, motivating the joint study of estimation and diagnosis methods.
There are two specific benchmark cases directly applicable to WP2.1:
1) “Robustness/Performance trade-off in case of sensors faults”
2) “Robustness to aerodynamic changes”.
The first scenario concerns the estimation of the value or the diagnosis of faults in those Flight Control System (FCS) parameters that, to the current state-of-practice, are difficult to be robustly obtained, such as airspeed or angle-of-attack measurements. The second one focuses on estimating/diagnosing those events that can change the aerodynamics of the aircraft, such as icing or loss of slat/flap information.
As a starting point, diagnosis and estimation methods suitable to address the identification of aircraft abnormal conditions affecting the flight control system have been surveyed and evaluated with respect to how they address the fundamental identification problems, their robustness, and their suitability for tackling the defined benchmark cases. The methods are classified broadly as:
Model-based approaches
These approaches use models, or derive models from Input/Output (I/O) data, to examine the closed-loop behaviour. They include, for example: robust filtering, on-line parameter estimation, and multi-model diagnosis approaches.
Model-free approaches
These approaches monitor the closed-loop behaviour using only measured I/O signals. They include techniques that track error threshold violation, as well as falsification methods.
The research and development activities have been divided into three phases: RTD, application and evolution. In the RTD phase, the methods surveyed in an earlier task are investigated and/or developed taking into account the information from the benchmark cases. In the application phase, the partners applied the selected methods to the appropriate scenarios and the resulting designs have been submitted to the industrial verification and validation activities. In the following evolution phase, lessons learnt during the previous application phase were used to immediately benefit the maturation of the applied approaches.
Finally, a total of 17 designs were submitted and documented for validation and verification concerning the following benchmark problems defined in WP1.1:
Detected loss of attack (AoA) and airspeed (VCAS) sensors (scenario Sc1.1)
DLR - Robust fixed gain C*-like longitudinal control law with protections based on VCAS estimate, load factor and pitch attitude
ONERA - Frequency Domain Model Identification coupled with modal LFT controller for indirect adaptive control
- Flight Parameter Estimation using an Extended Kalman Filter coupled with modal LFT controller for indirect adaptive control
UNEXE - LPV sliding mode observers for sensor FTC with erroneous scheduling parameter measurements
UCAM - Robust Backup Control Law for Missing VCAS/AoA
Undetected loss of angle of attack (AoA) and airspeed (VCAS) sensors (scenario Sc1.2)
DEIMOS - Gain-scheduling H∞/mixed-μ robust Fault Detection and Isolation (FDI)
- Kalman Filtering-based multiple-model FDI and Fault Tolerant Control (FTC)
DLR - Advanced Air data sensor monitoring based on nullspace determination, optimization and advanced signal based techniques
SZTAKI - Multiple model adaptive Calibrated airspeed estimation with Kalman Filter bank
TUDELFT - Moving-horizon estimation for VCAS and AoA sensor faults
UNEXE - Sliding Mode Observers for fault detection of uncertain LPV systems with imperfect scheduling parameter knowledge
Icing scenarios (scenario Sc2.1)
DEIMOS - Gain-scheduling H∞/mixed-μ robust inner-loop controller
UCAM - Extended Kalman Filter (EKF) and Model Predictive Control (MPC) -based indirect adaptive control for icing
Actuator loss (scenario Sc3.1)
SZTAKI - Nullspace Based Control Input Reallocation
TUDELFT - Fault-tolerant Reconfigurable Model Predictive Control
UCAM - Reconfigurable control in an MPC-for-tracking architecture
UNEXE - Fault tolerant integral sliding mode control allocation scheme
The development of robust fault diagnosis/parameter estimation methods is a prerequisite for the design of advanced fault tolerant control laws with event-driven reconfiguration capabilities. The main advantages of those methods include safety, reliability, and performance improvement in automatization of ground and air vehicles to assist pilots/drivers in all possible scenarios and to make missions more optimal.
Reconfigurable G&C approaches
This sub-WP was led by ONERA and included the participation of the following partners: DEIMOS, DLR, ONERA, SZTAKI, TUDELFT, UNEXE, UCAM and UoB.
The objective of this work package was to study, develop and apply advanced reconfigurable G&C design approaches. These techniques can be construed as smooth switches between the “normal”, “alternate” and “direct” control laws driven by, first and foremost, the safety of the aircraft, and then by a desire to optimize performance. The techniques had to strive to achieve this goal by: (i) facilitating the continuous operation, or at least for longer time and with a less abrupt switch-off, of the G&C functions already on-board; and (ii) using alternate solutions to accommodate, alleviate or reduce the impact of the abnormal/off-nominal events.
All the benchmark cases defined in WP1.1 are applicable to this WP, but the most relevant are “Robustness to aerodynamic changes” and “Control & Guidance in case of detected actuators loss”. Both problems entailed direct application of reconfiguration strategies.
As a starting point, reconfigurable G&C approaches suitable to cover “normal”, “alternate” and “direct” control laws ensuring stable control of the aircraft and at the same time optimizing its performances, have been surveyed and evaluated with respect to how they address the fundamental control problems, their robustness, and their suitability for tackling the defined benchmark cases. The methods are classified broadly as:
o Multiple-Model Approaches
o Inherent Robust Sliding Mode Controllers interlaced with Control Allocation Methods
o Model Predictive Control
o H∞-Control
o Linear Parameter Varying Control Methods
o Direct Adaptive Control Methods
o Indirect Adaptive Control Methods
Similarly to WP2.1 the research and development activities have been divided into three phases: RTD, application and evolution.
By the end of this sub-WP, 19 designs have been submitted and documented for a preliminary validation and verification concerning the following benchmark problems defined in WP1.1:
Detected loss of angle of attack (AoA) and airspeed (VCAS) sensors (scenario Sc1.1)
DLR - Robust fixed gain C*-like longitudinal control law with protections based on VCAS
estimate, Nz and Theta
ONERA - Frequency Domain Model Identification coupled with modal LFT controller for indirect adaptive control
ONERA - Flight Parameter Estimation using an Extended Kalman Filter coupled with modal LFT controller for indirect adaptive control
UNEXE - LPV sliding mode observers for sensor FTC with erroneous scheduling parameter measurements
UCAM - Robust Backup Control Law for Missing VCAS/AoA
Undetected loss of angle of attack (AoA) and airspeed (VCAS) sensors (scenario Sc1.2)
DEIMOS - Gain-scheduling H∞/mixed-μ robust FDI
- Kalman Filtering-based Multiple-Model FDI and FTC
DLR - Advanced Air data sensor monitoring based on nullspace determination, optimization and advanced signal based techniques
SZTAKI - Calibrated airspeed estimation with Kalman Filter bank
TUDELFT - Moving-horizon estimation for VCAS and AOA sensor faults
UNEXE - Sliding Mode Observers for Fault Detection of Uncertain LPV Systems with Imperfect Scheduling Parameter Knowledge
Icing scenarios (scenario Sc2.1)
DEIMOS - Gain-scheduling H∞/mixed-μ robust inner loop controller
UCAM - EKF+MPC-based indirect adaptive control for icing
Actuator loss (scenario Sc3.1)
SZTAKI - Nullspace Based Control Input Reallocation
TUDELFT - Fault-tolerant Reconfigurable Model Predictive Control
UCAM - Reconfigurable control in an MPC-for-tracking architecture
UNEXE - Fault tolerant integral sliding mode control allocation scheme
UoB - Classical Root locus based C*-like longitudinal control law
- Robust H∞ fixed order based C*-like longitudinal control law
Moreover, 7 designs, one per partner, have been evaluated in more detail during an industrial validation and verification.
The combination of robust fault diagnosis methods (WP2.1) with the advanced event-driven reconfiguration or fault tolerant control methods of WP2.2 or WP2.3 has been successfully illustrated.
Integrated estimation/diagnosis/G&C approaches
TUDELFT led WP2.3 which additionally involved the following partners: DEIMOS, DLR, ONERA, SZTAKI, TUDELFT, UNEXE, UCAM, and UoB.
The objective of this work package was to study, develop and apply integrated design approaches and tools for estimation, diagnosis and reconfigurable G&C. It is well known that in the presence of uncertainties, an integrated design of the estimation/diagnosis/G&C functions is more suitable than their independent design and subsequent integration. This results from the masquerading of information resulting from robust (reconfigurable) G&C functions, which can dramatically reduce the performance of the estimation/diagnosis functions on which they rely. Also, the influence of estimation/diagnosis speed, computational delays, and the switching between the functions can result in potential practical limitations. All these interaction issues between the three types of functions (estimation, diagnosis, and G&C) limit the use of advanced methods for each of them.
Integrated design approaches tackle the above interaction problem by designing the G&C and the estimation/diagnosis systems simultaneously. In this manner, direct information is used during the design phase about the masking effects that the G&C has on the estimation/diagnosis performance, as well as the effects of the estimated/diagnosed signal on the G&C. Abnormal events accommodation and, for specific cases, reconfiguration of the design can be performed automatically and with certain theoretical guarantees for specific synthesis techniques yielding a streamlined design with improved V&V and certification guarantees. All the benchmark cases defined in WP1.1 are applicable to this WP.
As a starting point, integrated estimation, diagnosis and guidance/control approaches have been surveyed and evaluated with respect to how they address the fundamental control problems, their robustness, and their suitability for tackling the defined benchmark cases. The methods are classified broadly as:
o Multiple-Model Adaptive Control
o Integrated Adaptive Control Approaches
o Supervisory Fault Tolerant Control Using LPV Methods
o Data-Driven Fault-Tolerant Control o Sliding Mode Control and Control Allocation
o Adaptive and Fault-Tolerant Model Predictive Control
o H∞-Integrated FDD/FTC
o Linear Parameter Varying Gain
As in the previous sub-WPs, the research and development activities have been divided into three phases: RTD, application and evolution.
Finally, 18 designs have been submitted and documented for validation and verification concerning the following benchmark problems defined in WP1.1:
Detected loss of attack (AoA) and airspeed (VCAS) sensors (scenario Sc1.1)
DLR - Robust fixed gain C*-like longitudinal control law with protections based on VCA estimate, load factor and pitch attitude
ONERA - Frequency Domain Model Identification coupled with modal LFT controller for indirect adaptive control
- Flight Parameter Estimation using an Extended Kalman Filter coupled with modal LFT controller for indirect adaptive control
UNEXE - LPV sliding mode observers for sensor FTC with erroneous scheduling parameter measurements
UCAM - Robust Backup Control Law for Missing VCAS/AoA
Undetected loss of angle of attack (AoA) and airspeed (VCAS) sensors (scenario Sc1.2)
DEIMOS - Gain-scheduling H∞/mixed-μ robust fault detection and isolation (FDI)
- Kalman Filtering-based multiple-model FDI and fault tolerant control (FTC)
DLR - Advanced Air data sensor monitoring based on nullspace determination, optimization and advanced signal based techniques
SZTAKI - Calibrated airspeed estimation with Kalman Filter bank
TUDELFT - Moving-horizon estimation for VCAS and AoA sensor faults
UNEXE - Sliding Mode Observers for fault detection of uncertain LPV systems with imperfect scheduling parameter knowledge
Icing scenarios (scenario Sc2.1)
DEIMOS - Gain-scheduling H∞/mixed-μ robust inner loop controller
UCAM - Extended Kalman Filter (EKF) and Model Predictive Control (MPC) -based indirect adaptive control for icing
Actuator loss (scenario Sc3.1)
SZTAKI - Nullspace Based Control Input Reallocation
TUDELFT - Fault-tolerant Reconfigurable Model Predictive Control
UCAM - Reconfigurable control in an MPC-for-tracking architecture
UNEXE - Fault tolerant integral sliding mode control allocation scheme
Detection and compensation of stall load (scenario Sc3.3)
UoB - H-infinity and non-smooth H-infinity fixed order structure
Moreover, 7 designs, one per partner, have been evaluated in more detail during an industrial validation and verification.
Integration and Clearance Approaches
WP2.4 was led by UCAM and was participated by: DEIMOS, DLR, ONERA, SZTAKI, TUDELFT, UNEXE, and UCAM.
The objective of this work package was to study, develop, and apply advanced clearance approaches for aircraft estimation, diagnosis and reconfigurable G&C, taking specifically into account their integration issues. Both topics, integration and clearance, are related since components integration is often times the “show stopper” for clearance of a design. This is because these issues are usually not directly taken into account in the design phase and require time-consuming ad-hoc solutions and fine tuning of the different components being integrated for their clearance. FCS design clearance (which precedes aircraft certification) typically relies on probabilistic Monte-Carlo or parameter-gridding, and despite being the de-facto standard in industry, it can only offer limited probabilistic guarantees while not ensuring full parameter and scattering coverage. Moreover, new G&C functions envisioned in the future (i.e. autonomous systems or those considered in RECONFIGURE) are challenging the traditional approach in terms of cost and coverage. Thus, in order to promote the widespread use of the proposed methods in the aeronautics industry, the issues of integration and clearance must be examined and advanced solutions explored.
As a starting point, integration and clearance issues, together with the available clearance methods have been surveyed, taking into account the existing Airbus state-of-practice, the RECONFIGURE benchmark cases, the V&V process to be followed during the project, and the descriptions of the methods proposed under the auspices of work packages WP2.1 “Parameter and Fault Estimation/Diagnosis Approaches”, WP2.2 “Reconfigurable G&C Approaches” and WP2.3 “Integrated Estimation/Diagnosis/G&C Approaches”.
The methods surveyed are classified broadly as:
o Optimisation-Based Clearance Approaches
o Linear Fractional Representation (LFR)/Linear Fractional Transformation (LFT) Based Approaches for Integration and Clearance of FDI/FTC Flight Control Systems
o Enhanced µ-Analysis Techniques for Clearance
o IQC-based Analysis of LTI and LPV Systems
o Certification of Real-Time Aspects of Model Predictive Control
o Stability Analysis of Model Predictive Control
o Gap Metric and ν-Gap Metric Approaches for Clearance of Control Laws
The research and development activities have been divided into two phases: RTD and application. This reflects that the WP started later in the project to allow accumulation of know-how and experience on the methods to be cleared. In the RTD phase, the methods surveyed in the previous task were investigated and/or developed taking into account the information from the benchmark cases. In the application phase, the partners applied the developed approaches to the designs produced within the scope of WP2.1 WP2.2 and WP2.3 in the context of the benchmark problems defined in WP1.1. In particular, the following techniques were applied by each partner:
DEIMOS – LFT-modelling and µ-analysis applied to gain-scheduled H∞/mixed-µ robust control in clean configuration scenarios.
– Optimization-based clearance (Hybrid Differential Evolution) applied to gain-scheduled H∞/mixed-µ robust inner loop controller for control in undetected icing conditions.
DLR – Multi-objective worst-case optimization-based clearance of control performance, applied to integrated FDD/FTC control law for undetected VCAS/AoA faults.
– Multi-objective worst-case optimization-based clearance of FDI performance, applied to FDD design.
ONERA – Off-line validation of adaptive gain-scheduled flight controllers, using IQC and skew-µ analysis, applied to LFT gain-scheduled control design with online estimation of stability derivatives for missing VCAS/AoA scenario.
SZTAKI – Pilot-in-the-loop simulations to verify absence of Pilot Induced Oscillations, applied to nullspace based allocation method for reconfiguration in case of stuck elevators.
TUDELFT – Certification of real-time termination of MPC solver with bounds on primal feasibility violation and suboptimality, guarantees of recursive feasibility and closed-loop stability, with application to linear RECONFIGURE benchmark.
UNEXE – Analysis of LPV sliding mode observers for fault estimation, to reconstruct undetected VCAS/AoA faults.
UCAM – Clearance of control laws using formal methods (quantifier elimination algorithms and MetiTarski theorem prover), with application to robust backup control law for detected VCAS/AoA fault scenario.
4. Pilot-in-the-loop Industrial V&V results
In order to achieve the goals of the project, a detailed project plan for the Design, Development and Verification (DDV) activities was established early in the project. This was maintained and updated throughout the project. While the activities were performed continuously over the 42-month period of the project, certain milestones were of particular relevance:
• The development of the Airbus benchmark as a high-fidelity model of the system, the corresponding products of the aircraft LTI models, the benchmark scenario definitions, and the benchmark specification (stability and performance requirements).
• The development of the Deimos FES, which includes the Airbus benchmark, and in its two versions: a preliminary version to support algorithm design and analysis, and a final version for the formal verification.
• The GNC, FDD and FTC algorithm designs in their two versions: version 1 based on the design cycle using the benchmark and linear LTI models for design and analysis, and version 2 updated after the verification test campaign on the FES. For version 1, each partner developed multiple designs to cover different benchmark scenarios, while for version 2 only one design was provided/selected per partner, corresponding to that selected for testing on the Airbus Flight Simulator.
Verification
The verification was performed by DEIMOS, on designs provided by: DEIMOS, DLR, ONERA, SZTAKI, TUDELFT, UNEXE, and UCAM.
An extensive simulation campaign was employed with the DEIMOS FES to cover all the abnormal and fault baseline scenarios. It was additionally included a set of robustness scenarios, where no faults were included in the system to assess the algorithms’ performance in nominal flight. Within this set, consisting of 27 simulation sets, a total of 2023 runs were executed for each design proposed. It was also included a long flight test condition, consisting of 5 hours, to ensure the algorithms remained stable numerically.
The designs proposed were different for each of the scenarios, and the techniques employed for their design to reach the objectives that were chosen included: Gain scheduling H∞, Fixed gain C*, Nullspace determination and optimization, LPV sliding mode observers, Kalman filters and Model Predictive control.
The total number of simulations performed in the complete set of campaigns, considering all the scenarios tested for the different designs from the partners, was 65234 runs, divided into 903 simulation sets. This shows that the campaign was extensive and also highlights the justification to automate the assessment of the designs using the FES and its common metrics.
This FES test campaign was executed twice in the project. Firstly, for the full set of designs, covering the range of scenarios considered by the partners. The results of this test campaign were then analysed by Airbus to determine the better designs and those to be further tested on Airbus facilities. This sub-selection of the designs was then tuned and tested again (by the partners locally) on the full FES test campaign, to provide a final evaluation prior to the testing on Airbus facilities. The selection of the designs for further testing was performed by Airbus using a team on engineering covering different disciplines, considering the results of the FES campaign, and also employing the Airbus experience on which designs would perform best in an industrial setting.
This two step approach proved to be very effective, allowing for the consideration of a large number of design methods, strategies and their design solutions, for the different failure/off-nominal scenarios defined within the Airbus Benchmark, their testing in a thorough and fully representative test environment in the FES, and then the further tuning and retesting of the better designs. Significant improvements were seen through this two-step approach, and the concentration of the final design effects on the design solution of each partners to be tested on Airbus V&V facilities.
It is noted that, as part of this two-step process, the designs were ported into the Airbus Simulink library. This allowed for the consideration of the real-time computation load of the designs using a standardized industrial analysis approach.
Validation
The verification was performed by AIRBUS, on designs provided by: DEIMOS, DLR, ONERA, SZTAKI, TUDELFT, UNEXE, and UCAM.
To complete the automated FES campaign, an even more industry-oriented V&V campaign was set up allowing to put a human in the loop for typical industrial tests, complemented by the simulation of real incident-inspired simulations. Only one design per team was selected based on the FES campaign results.
This validation on the standardized V&V processes used by industry is a key step for the successful transfer to the aeronautics sector of the developed diagnosis methods. This transfer was one of the most important technological objectives of the project.
The selected designs to be validated come from the technology development phase consisting of preliminary and detailed design and code prototyping/integration (see subsection above). It also included the very long and strong Airbus’ experience in aircraft system industrial validation in general, and specifically the industrial development and validation of Flight Control Computer software.
The validation work performed implied two main steps:
1. Preparation of the experimental set-ups for industrial validation.
In a first step, a graphical tool allowed specifying the overall implementation of the FDD/FTC designs (i.e. computer aided-specification). A limited set of graphical symbols (adder, filters, integrator, look-up tables, etc.) was used to describe each part of the submitted designs.
2. Industrial validation on Airbus test facilities.
Once the selected designs were implemented, the designs were validated using thorough simulation campaigns. The validation consisted in two steps: first testing each design on the scenario for which it was designed, including failure cases and robustness scenarios. Most designs performed well in this test, due to the fact that they had passed the testing and assessment using the FES.
The second step was testing the designs on an even more challenging scenario, using real incident-inspired tests. More than 20 families of tests were performed, covering the 4 aforementioned Benchmark Scenarios. Each family consists of several test scenarios to be simulated in different flight and aircraft configurations and related to the scenario of interest, covering robustness and performances assessment.
As an example of the testing, one can comment:
• In-service wind scenarios: several 3-D wind profiles have been reconstructed from in-flight parameters recording. They correspond e.g. to windshear or severe turbulence in cruise. They are used to test the design robustness and are indicated for sensor fault scenarios.
• Change of slat and flap configuration, from clean configuration (surfaces retracted) to full configuration (extended). This changes the aircraft aerodynamics and the de facto lift coefficient. This kind of scenarios is also well indicated for sensor fault scenarios.
• Gentle roll: in order to check the aircraft roll stability under icing conditions, successive fast return roll manoeuvers are simulated when the aircraft AoA is very close to the maximum AoA before stall.
The validation campaigns were performed by the Airbus’ V&V teams, with support from the design teams of the partners. The results showed an acceptable performance for the majority of the designs, with some degradation seen during the extended tests using real incident-inspired tests. This was corrected during the validation maturation of the designs, especially for the sensor failure scenarios.
The first conclusions are that all designs show good robustness w.r.t. typical manoeuvres. Under windy conditions, the robustness was found to be more difficult to ensure, especially for windshear scenarios. But it must be recognized that some of the simulated winds correspond to very aggressive situations at the limit of what could be expected in-flight. Performances are generally good. From the control-oriented scenarios (e.g. FTC), it is sometimes tricky to assess the design performances, for example in the case of interference with existing protections. The Airbus baseline controller contains a lot of protections which cannot be fully removed for the tests. For the FDD scenarios, some designs show that it is possible to improve the current state-of-practice, but the worst scenario combining simultaneous AoA and CAS faults is difficult to cover; only a few of the designs were able to perform well for all the sensor fault cases.
The V&V campaign results, as well as the lessons learnt, have shown that the industrial transfer depends on a better understanding of the methods, which in some cases are still considered as quite complex by the main industrial stakeholder in Airbus. However, in conclusion, the V&V campaigns are considered as very promising from an industrial point of view.
Demonstration
The demonstration was performed during the “International Workshop on FDIR and Reconfiguration Control in Flight”.
Six of the most promising designs were demonstrated, as done for the industrial validation. The demo was performed during the course of an afternoon by the Airbus’ V&V team in their industrial test-benches, in the presence of the attendees, and successfully showed the effectiveness of the designs and their achieved TRL.
Potential Impact:
The activities of dissemination and exploitation were considered within work package WP4.2 and WP4.3.
To maximize the dissemination of the project achievements most results were submitted to leading journals, conferences and workshops with a focus on the technologies, tools and methodologies that covered the activities involved in the project.
Dissemination
The general objectives of the dissemination activities were:
• To ensure maximum awareness and visibility of the achievements and results of the project particularly in influential aerospace bodies.
• To make known new methodologies and standards that could be obtained as a part of the project results and to encourage their use to carry on this line of investigation.
• To promote the use of the new technology developed and tested in the project, across companies and institutions who have an interest in FDD, FPE and FDIR systems.
To obtain as much diffusion of the project results as possible, across all the areas, several forms of dissemination media were used to achieve the objective:
• Demonstration/final meeting where the industrial partners (Airbus and DEIMOS) will invite certification and policy-making authorities in the aeronautics and space sector.
• Conferences and workshops attendance.
• Scientific publications as well as specialized and general information press.
• Project web site
• Direct participation of project partners in influential aerospace organizations.
• Organization of specialized events at established conferences (e.g. invited sessions)
In the course of the project, there were:
• 11 journal articles published (others are under review)
• 46 conference articles published
• 6 conference invited/special sessions, either dedicated to RECONFIGURE or co-lead by the RECONFIGUER consortium
• One international workshop on RECONFIGURE, conducted over three days, and with 49 atendees from Europe and the US
During the course of the project a number of special sessions, at different high profile conferences have been organised by members of the consortium. These have included:
• Fault Detection, Isolation and Reconfiguration in Aerospace Systems: On-line Learning and Adaptive Methods (American Control Conference, Portland, 2014)
• Fault Detection, Isolation, and Reconfiguration in Aerospace Systems: Verification and Off-line Model-based Methods (American Control Conference, Portland, 2014)
• European Efforts towards Advanced Fault Diagnosis and Fault Tolerant Control for Civil Aircraft: The FP7 RECONFIGURE Project. (IFAC World Congress, 2014)
• RECONFIGURE Project: Theoretical and Practical Contributions towards Advanced Real-Time FDD and FTC for Civil Aircraft, (IFAC Safeprocess, Paris, 2015)
• RECONFIGURE FP7 Project for Advanced Real-Time FDD and FTC for Civil Aircraft: Contributions and Results, (3rd Conference on Control and Fault-Tolerant Sys-tems, SysTol'16, 2016)
• FDI/FTC for Aerospace: From Theory to Applications, (The International Federation of Automatic Control, 20th IFAC Symposium on Automatic Control in Aerospace - ACA 2016)
The workshop provided a forum for the dissemination of the activities performed and results obtained from the project. The three day workshop brought together leading actors from European industry and academia in the aeronautical and aerospace sectors, and took place in one of Europe’s aeronautical hubs in Toulouse, at Airbus facilities. It aimed to show the European state-of-the-art and state-of-practice in FDIR and FTC for aeronautical and aerospace vehicles, providing an understanding of the industrial problem, the solution process and the latest academic and industrial solution methods. The workshop included presentations from selected European experts in the aeronautical and aerospace communities, and from the RECONFIGURE consortium members. It also included live demonstrations of the RECONFIGURE results using Airbus’ facilities, to encourage the exchange of information and ideas.
There is also currently one special editional journal issue being developed based on the results of the RECONFIGURE project.
Exploitation
The possibility of intellectual protection via a patent was always open in the project. In that case, the inventing partner or partners were to bring the attention of the Steering & Management Committee for consideration of every intention to protect (or otherwise) the intellectual property generated during the course of the Project.
List of Websites:
http://reconfigure.deimos-space.com/
Dr. Murray Kerr (Deimos Space SLU)
murray.kerr@deimos-space.com
