DESIGN OF HIGHLY REDUNDANT FAULT TOLERANT CONTROL FOR AIRCRAFT ELEVATOR SYSTEM

Muhammad Tayyeb FAST National University of Computer and Emerging Sciences, Chiniot Faisalabad Campus, Department of Electrical Engineering, Punjab, Pakistan Umar Riaz FAST National University of Computer and Emerging Sciences, Chiniot Faisalabad Campus, Department of Electrical Engineering, Punjab, Pakistan Arslan Ahmed Amin FAST National University of Computer and Emerging Sciences, Chiniot Faisalabad Campus, Department of Electrical Engineering, Punjab, Pakistan


INTRODUCTION Fault Tolerant Control
Fault Tolerant Control (FTC) is a strategy to increase the reliability of a machine to prevent failure in the events of faults. A fault is defined as a deviation of a system parameter from nominal values and failure is defined as a complete breakdown of the system. The FTC enables a critical system to accommodate such faults that lead it to failure. The failure of critical systems such as aircraft, nuclear facilities and unmanned air vehicles used for critical missions cannot be tolerated, therefore, FTC systems are incorporated in these to enhance their reliability for safety purposes. The FTC systems can be designed by introducing redundancies in the systems. These redundancies can be analytical and hardware. In the analytical redundancy, FTC systems are designed mainly of two types: active and passive. In the active type, fault detection, isolation, and controller reconfiguration are performed making it complex, slow and high computational cost but it has the advantage of a wide range of faults detection capability. In the passive type, robust control is designed to accommodate all faults and uncertainties in the systems making it a relatively simple and faster one. But it suffers from the disadvantage of limited faults handling capability for only the considered faults. A hybrid of both of these has also been proposed with the passive part to react fast to certain faults and active part for post fault performance optimization. [1]- [4] The hardware redundancy is the most reliable way to increase the reliability of the machine in which an actual component is installed parallel to the main component to perform the same function. In case of failure of the main component, the parallel backup component is used to perform the same task thereby preventing the failure of the system. The popular methods for hardware redundancy are Dual Redundancy (DR) and Triple Modular Redundancy (TMR). In the dual redundancy, two components are used as primary and standby; standby to perform function automatically in case of failure of the primary one as shown in Figure 1. In the Triple Modular Redundancy (TMR), three components perform the same function with a voter block to generate single output from the three channels. In case of failure of one channel, the voter produces output from the other two healthy channels neglecting the faulty one as shown in Figure 2. But in case of simultaneous failure of any two channels at a time, the TMR system gets failed as a limiting case [5]- [7]. The proposed Modified Triple Modular Redundancy (MTMR) fulfills the gap of conventional TMR by continuing operation in case of si-

Aircraft Control System
The elevator is a flight control area usually located at the rear of the aircraft. It controls the pitch angle of aircraft to control the lift of the wing and the angle of attack [8]- [12]. The lift is usually attached to the tailplane or horizontal stability. As the airplane progressed, the air enters from the nose to the tail. When the elevator is lifted, the airflow acting on it will tilt the nose upwards. When the elevator descends, the airflow will cause the aircraft to land. Therefore, during the takeoff process, you have to lift the elevators, and in the process of decent, they will be lowered. A simple diagram for aircraft control is shown in Figure 3. A typical standard control system for the elevator works with the help of a control stick in the cockpit and is intensely filled by the control instrument of the elevator. The action of the elevator control systems is begun when the control stick is moved forward or backward. When the stick is moved towards right, it incites the control interfaces that moves the elevator control ring wrench. The ring wrench sends advancement to the power part via control linkage. In this manner, the power instrument prompts a push-pull tube, which diverts the elevator up or down. If the pressure-driven system fails, the chamber can be separated. In this condition, the control works physically via the linkage of the system to initiate the elevators.

Elevator Structure
A normal aircraft comprises of two lifts, one on each side of the body, linked to the horizontal tail. It has two units for primary flight control which are called "Primary Flight Control Units (PFCU)". Two inner right and left actuators and two outer left and right actuators connected to the left and right elevator. The outer actuators contain a separate hydraulic circuit but inner actuators contain a shared hydraulic circuit. The elevator is divided into two parts which are the left and right elevator. A simple diagram for the elevator control system is shown below in Figure 4. When the airplane is flying at the correct level, the position of the actuator should stabilize at a constant value. The fault detection system recognizes failures in the following cases: 1. When the actuator position increases or decreases from zero to 10 cm. 2. When the position of actuator changes in a fast manner. 3. When the change in pressure occurs very quickly.

Elevator Control System
A simple block diagram of MATLAB control scheme [10] is shown in Figure 5. In this block, the diagram plant represents the elevator control of aircraft. The pilot command is given to the controller with the help of the pilot command block. The controller sends the control points to the plant and readings of the plant are taken by the help of sensors. Signal controlling and failures block takes input from sensors and according to this input, it sends the signal to logic mode block, controller and elevator system of aircraft. The logic of fault detection sets up's the system to recover from hydraulic circuit failure.
So, after taking the readings form mode logic, the signal controlling block and pilot command, the controller will control the elevators accordingly. To upgrade the security of the aircraft, the lift control system contains the following excess parts. 1. Two primary flight control units. 2. Two control modules per actuator full range control law and limited range control law. 3. Three pressure-driven circuits that drive the actuators. 4. Four independent hydraulic actuators. Sensors take the readings from elevator control of aircraft and give the output to signal controlling and failure block. This block after examining the signal gives his output to the model logic block. The model logic block has four modes which are given as.  The output of the model logic block goes to a MUX and this MUX gives the output to controller and plant. The controller has three inputs which are, mode, setpoint, and position. Then at the end controller gives its output to the plant. A simple Matlab block diagram representation is shown in Figure 6. The plant also gets input from the signal controlling and failure block. Failures can be injected into this model with the help of the Failure Injection Unit. The forces acting on an aircraft and basic coordinate axes are given below. If it is assumed that the change in pitch angle of aircraft will not change the speed of aircraft under any conditions then the longitudinal equations of motion for aircraft are written as given below. (1) By taking the Laplace transform of above modelling equations the transfer function is given as By simplifying the above transfer function, we have (10) Now the state space is drawn as (11) As the output is pitch angle so the output is given below (12) A variety of control methods are investigated on the issue of FTC. In [13], [14], authors have researched two types of sliding mode harmonics with unknown param-eters and disturbing stuff for different chaos systems. In [15] the authors have covered the sliding mode control points for the electro-hydraulic actuator system of liquid power. Another examination outskirts as neural systems [16], stochastic systems [17]- [19] or TS fuzzy systems [20]- [22] have been additionally perceived as best sliding mode control applications. Still, a few experiments on FTC have been made on aircraft, the accomplished outcomes have been either directed around issues of sensors or on faults of the actuator. In the literature [23], the deficiency estimating strategy for wind turbine gearbox is considered. It expects to pass judgment on the future activity status of the gearbox, Figure the improvement pattern, gauge the life of the apparatus, and give the reference and premise to the activity and upkeep of the breeze turbine. In [24], the flaw pattern forecast and adapting procedures of the Auxiliary Power Unit (APU) on huge and medium-sized common aeronautics flying machines were examined. The clamorous time arrangement forecast and the mix of the BP neural system dependent on shortcoming analysis strategy were utilized in disappointment pattern expectation. Both [25], [26] have anticipated the deficiency patterns for the airplane rudder issue. In this research, it is proposed that in the case of any failure happening in the aircraft elevator control system, other remaining components of the aircraft will not be disturbed. It is also proposed that the sensors which are used in this aircraft elevator control system are redundant. The new control method is accomplished by neglecting the coefficients of the elevators showing failure. This new control scheme is also completed by replacing the faulty component for the sensors. This article breaks down the shortcomings qualities and its sorts and estimates of the aircraft elevator control systems. At that point, the pattern examination innovation is talked about and an issue pattern trademark investigation calculation is created. In this paper, the pattern of the flight control systems flaw examination is accomplished by the help of lift faults loss. The Rest of the paper is sorted out as follows: Section 2 is dedicated to the proposed fault detection system for an elevator system of aircraft, its control laws, actuators, sensors and failure injection in the model. Section 3 presents the results and discussion. So finally, the conclusion of the paper is provided in section 4.

Switching Process
A simple flowchart for the control system of the elevator of an aircraft is shown below in Figure 6. When the flight mission starts then the pre-calculation block gives its instructions to the decision-making box where "η" is called performance improvement coefficient and "ηo" is given by the system. The performance improvement factor is measured in percentages.

Figure 6: Flowchart of the Switching Mechanism
To increase the performance of the fault tolerant flight control system a Trimmable Horizontal Stabilizer (THS) is also used. When the improvement coefficient is not improved then the controller Ce will not be selected, but if it is improved then controller Ces will be selected [27]. So, in the case when a fault occurs in the elevator control system of an aircraft, then this control scheme will resolve this fault very perfectly. In an emergency, when the electrical flight control system fails, there is no possibility of controlling the elevator components of the aircraft. Such an inconvenience is particularly undesirable regarding failures at fast flights when the elevator control fails just on one side of the aircraft while the control on the opposite side is as yet operable. In such a circumstance impermissible unbalances happen regarding flight moves concerning the basic stacking or worry of the airship. A normal aircraft has two lifts, one on each side of the fuselage which is connected to the flat tails.

Control Logic for Fault Detection
All the actuators can have the following five modes which are listed below.
1. Isolated mode 2. Standby mode 3. Off mode 4. Passive mode 5. Active mode These operating modes are also named as the substates of parallel states. Normally the left and right outer actuators always take a start in active mode and inner left and right actuators take a start in standby mode. When fault tolerant control system detects a fault in hydraulic circuits of outer actuators then it stops the operation of outer actuators by disabling them and also it activates the inner actuators in place of outer actuators. The failure due to pressure is detected when change is pressure occurs suddenly. When an aircraft is flying accurately at a level then there should be a constant value of actuator position. When a sudden change occurs in the value of the position of actuator then the fault is detected. Fault tolerant control system solves the fault and after solving faults it enables the working of faulty actuators or faulty hydraulic systems. The assumptions of the study include zero switching time of the operation of sensors and actuators and zero seconds communication delay. Practically a certain minimum time delays occur in the operation of system components and communication. The limitation of the proposed MTMR algorithm is the failure of the system in case of simultaneous failure of all three channels. Another limitation will be a little increase in the weight of the aircraft due to which slightly more powerful engines will be required to achieve regular thrust for flight operations.

MEASUREMENTS Sensors for Measurement
In sensors block, four sensors have been used. These sensors take input from the plant and give it to a MUX and this MUX gives the output of sensors to the signal controlling block. Two sensors are used to measure left and right outer actuator positions and the other two sensors are used to measure the right inner and outer actuator positions. A block diagram of the sensors block is shown in Figure 7.

Implementation of MTMR Assembly
The MTMR assembly is implemented as shown in Figure  8 in which three control ports are used to provide the health signal to the assembly. The internal architecture of MTMR assembly is shown in Figure 9 which shows its implementation with three blocks: Control block with ANDs gates inside, Voting Block Port Selector for selection of input ports of the voter, and Voter Block to perform voting functions. The control block passes output from the healthy sensors to voter block which further produces a single output from

CONTROLLER DESIGN FOR ELEVATOR CONTROL SYSTEM
The controller takes input form signal conditioning & failure, mode logic, and pilot command. Then it gives one output to the plant. The inner structure of the controller is shown in Figure 10. The controller has one left control law and one right control law. Each control law has three inputs which are position, setpoint, and mode. Then both left and right control laws provide the left control point and right control point respectively. After comparison, these control points are given to the plant.

Left and Right Control Laws
The left and right control laws contain direct link (DL) control law and IO control law. It also contains a selector which selects only one output from DL control law or IO control law or live output from the subsystem. The diagram for the left and right control law is shown in Figure 11. Both the DL and IO control laws operate on the trigging pulse which is given by the help of a trigger. The input of both control laws is position and set point.

IO Control Law
The IO control law uses PID (Proportional+ Integral+ Derivative) controller. This PID controller takes two inputs which are position and set point and then it gives one output to the selector. The selector gives the control point which it selects from IO control law or DL control law and live mode. The proportional, derivative and integral parameters are adjusted manually for the PID controller as shown in Table 1.

Elevator Control System
The plant has three blocks, which are left elevator, right  elevator, and actuators block as shown in Figure 12. The actuator block has four input points. 1 st point is the control point input, 2 nd is the hydraulic pressure input, 3 rd is mode input and 4 th is the input for piston velocity. This block gives the left piston force to the left elevator and right piston force to the right elevator. Both these elevators compare the elevator position and elevator velocity and give the output to MUX and this MUX stables the elevator positions according to the instruction from left elevator control and right elevator control. The piston velocity is given to actuators via feedback of elevator velocity.

RESULTS AND DISCUSSION
This paper suggests a Highly Redundant Fault Tolerant Control (HRFTC) policy for the aircraft to accommodate faults in the critical sensors and actuators. Modified Triple Modular Redundancy (MTMR) has been proposed for the sensors and Dual Redundancy (DR) has been proposed for the actuators as described in figures 1 and 2. The aircraft control system was demonstrated in Figure 3. Both elevators move up and down together by moving the yoke forward and backward as shown in Figure 12 Elevator System of Aircraft Figure 4. The main block diagram representation for the elevator control system is given in Figure 5 which shows how different blocks are interconnected with each other. The methodology of control system design has been elaborated in Figure 6. The Measurements procedure by sensros in MTMR assembly has been elaborated in Figure 7. The implementation of MTMR assembly has been discussed in Figures 8 and 9. The working of control laws, pilot order, signal conditioning, and failure are elaborated in section 4. PID controller is used for the adjustment of the position of the elevator by comparing it with a set point. Then left and right control laws are explained. Both the control laws use the IO & DL control schemes. The IO control law uses the PID controller and DL control law uses gain adjustment mechanism. The values of gain and PID controller parameters are adjusted manually. Then 5 modes of actuators are explained which are isolated, standby, off, passive and active. The simulation results show that when a fault occurs, the system detects it successfully and tolerates it quickly without disturbing the flight of aircraft. The study is very much significant for the avionics industry for manufacturing highly reliable machines for human and environmental safety.

Reliability Analysis
In this section, the reliability analysis of the MTMR system has been carried out to justify the greater reliability of the system. Let R 1 , R 2 and R 3 denote the reliabilities of individual components and R TMR denotes the overall reliability of TMR system. Mathematically, reliability function of TMR can be determined as follows: If R=0.9, or R TMR =0,972 or 97.2% The architecture of the proposed MTMR is similar to the conventional TMR, as shown in Figure 2 with some additional control features. Since the conventional TMR cannot provide output in case of a fault in two channels, the MTMR will be able to provide output in this condition with the only single healthy channel. Thus, the proposed MTMR is an advanced version and more reliable than conventional TMR. The reliability function of the MTMR is thus calculated as follows: where R MTMR represents the reliability of the MTMR sensors assembly.
If R=0.9, R MTMR =0.999 or 99.9%. We see that the reliability of the overall system has increased from 97.2% to 99.9% in the proposed MTMR system.

Comparison
The comparison of the proposed HRFTC algorithm is carried out with existing literature [10], [11], [28]. The main contribution is the highest reliability by introducing hardware redundancy for the sensors in MTMR architecture. In all work, no hardware redundancy was considered for the sensors. This paper fulfills this gap in the literature. The inclusion of hardware redundancy though will increase the size, weight, and cost of the aircraft system but its high-reliability benefits surpass these drawbacks as one flight failure can cause in-compensable loss. Therefore, it is reasonable to introduce this highly reliable MTMR architecture in the sensors. The engines required for thrust would be slightly of higher rating to achieve the same flight properties.

CONCLUSIONS
Elevators play a big role in the pitch movement of aircraft, landing, and takeoff of the aircraft. When failure is injected in an elevator with the help of the failure injection unit, the fault detection system detects the fault and then puts the faulty portion to the off mode and runs the standby system in place of a faulty system. This paper proposes a Highly Redundant Fault Tolerant Control (HRFTC) policy for the aircraft to accommodate faults in the critical sensors and actuators. Modified Triple Modular Redundancy (MTMR) has been proposed for the sensors and Dual Redundancy (DR) has been proposed for the actuators. The working of control laws, pilot order, signal conditioning, and failure are elaborated. Furthermore, the PID controller is used for the adjustment of the position of the elevator by comparing it with a set point. The results show that when a fault occurs, the system detects it successfully and tolerates it quickly without disturbing the flight of aircraft. Future works may include further increasing the reliability of MTMR systems. Virtual actuator design and control through sliding mode control may also be considered for safe flight systems.

Funding
The author(s) received no financial support for the research, authorship, and/or publication of this article.

Conflict of Interest
The author(s) declare no conflict of interest in preparing this paper.