Laboratory test methodology for evaluating the effects of electromagnetic disturbances on fault-tolerant control systems

Control systems for advanced aircraft, especially those with relaxed static stability, will be critical to flight and will, therefore, have very high reliability specifications which must be met for adverse as well as nominal operating conditions. Adverse conditions can result from electromagnetic disturbances caused by lightning, high energy radio frequency transmitters, and nuclear electromagnetic pulses. Tools and techniques must be developed to verify the integrity of the control system in adverse operating conditions. The most difficult and illusive perturbations to computer based control systems caused by an electromagnetic environment (EME) are functional error modes that involve no component damage. These error modes are collectively known as upset, can occur simultaneously in all of the channels of a redundant control system, and are software dependent. A methodology is presented for performing upset tests on a multichannel control system and considerations are discussed for the design of upset tests to be conducted in the lab on fault tolerant control systems operating in a closed loop with a simulated plant

Real-time closed-loop simulation and upset evaluation of control systems in harsh electromagnetic environments

Digital control systems for applications such as aircraft avionics and multibody systems must maintain adequate control integrity in adverse as well as nominal operating conditions. For example, control systems for advanced aircraft, and especially those with relaxed static stability, will be critical to flight and will, therefore, have very high reliability specifications which must be met regardless of operating conditions. In addition, multibody systems such as robotic manipulators performing critical functions must have control systems capable of robust performance in any operating environment in order to complete the assigned task reliably. Severe operating conditions for electronic control systems can result from electromagnetic disturbances caused by lightning, high energy radio frequency (HERF) transmitters, and nuclear electromagnetic pulses (NEMP). For this reason, techniques must be developed to evaluate the integrity of the control system in adverse operating environments. The most difficult and illusive perturbations to computer-based control systems that can be caused by an electromagnetic environment (EME) are functional error modes that involve no component damage. These error modes are collectively known as upset, can occur simultaneously in all of the channels of a redundant control system, and are software dependent. Upset studies performed to date have not addressed the assessment of fault tolerant systems and do not involve the evaluation of a control system operating in a closed-loop with the plant. A methodology for performing a real-time simulation of the closed-loop dynamics of a fault tolerant control system with a simulated plant operating in an electromagnetically harsh environment is presented. In particular, considerations for performing upset tests on the controller are discussed. Some of these considerations are the generation and coupling of analog signals representative of electromagnetic disturbances to a control system under test, analog data acquisition, and digital data acquisition from fault tolerant systems. In addition, a case study of an upset test methodology for a fault tolerant electromagnetic aircraft engine control system is presented

A monitor for the laboratory evaluation of control integrity in digital control systems operating in harsh electromagnetic environments

This paper presents a strategy for dynamically monitoring digital controllers in the laboratory for susceptibility to electromagnetic disturbances that compromise control integrity. The integrity of digital control systems operating in harsh electromagnetic environments can be compromised by upsets caused by induced transient electrical signals. Digital system upset is a functional error mode that involves no component damage, can occur simultaneously in all channels of a redundant control computer, and is software dependent. The motivation for this work is the need to develop tools and techniques that can be used in the laboratory to validate and/or certify critical aircraft controllers operating in electromagnetically adverse environments that result from lightning, high-intensity radiated fields (HIRF), and nuclear electromagnetic pulses (NEMP). The detection strategy presented in this paper provides dynamic monitoring of a given control computer for degraded functional integrity resulting from redundancy management errors, control calculation errors, and control correctness/effectiveness errors. In particular, this paper discusses the use of Kalman filtering, data fusion, and statistical decision theory in monitoring a given digital controller for control calculation errors

Aircraft Loss-of-Control Accident Prevention: Switching Control of the GTM Aircraft with Elevator Jam Failures

Switching control, servomechanism, and H2 control theory are used to provide a practical and easy-to-implement solution for the actuator jam problem. A jammed actuator not only causes a reduction of control authority, but also creates a persistent disturbance with uncertain amplitude. The longitudinal dynamics model of the NASA GTM UAV is employed to demonstrate that a single fixed reconfigured controller design based on the proposed approach is capable of accommodating an elevator jam failure with arbitrary jam position as long as the thrust control has enough control authority. This paper is a first step towards solving a more comprehensive in-flight loss-of-control accident prevention problem that involves multiple actuator failures, structure damages, unanticipated faults, and nonlinear upset regime recovery, etc

Experimental Validation: Subscale Aircraft Ground Facilities and Integrated Test Capability

Experimental testing is an important aspect of validating complex integrated safety critical aircraft technologies. The Airborne Subscale Transport Aircraft Research (AirSTAR) Testbed is being developed at NASA Langley to validate technologies under conditions that cannot be flight validated with full-scale vehicles. The AirSTAR capability comprises a series of flying sub-scale models, associated ground-support equipment, and a base research station at NASA Langley. The subscale model capability utilizes a generic 5.5% scaled transport class vehicle known as the Generic Transport Model (GTM). The AirSTAR Ground Facilities encompass the hardware and software infrastructure necessary to provide comprehensive support services for the GTM testbed. The ground facilities support remote piloting of the GTM aircraft, and include all subsystems required for data/video telemetry, experimental flight control algorithm implementation and evaluation, GTM simulation, data recording/archiving, and audio communications. The ground facilities include a self-contained, motorized vehicle serving as a mobile research command/operations center, capable of deployment to remote sites when conducting GTM flight experiments. The ground facilities also include a laboratory based at NASA LaRC providing near identical capabilities as the mobile command/operations center, as well as the capability to receive data/video/audio from, and send data/audio to the mobile command/operations center during GTM flight experiments

Detecting Controller Malfunctions in Electromagnetic Environments

Verifying the integrity of control computers in adverse operating environments is a key issue in the development, validation, certification, and operation of critical control systems. Future commercial aircraft will necessitate flight-critical systems with high reliability requirements for stability augmentation, flutter suppression, and guidance and control. Operational integrity of such systems in adverse environments must be validated. This paper considers the problem of applying dynamic detection techniques to monitoring the integrity of fault tolerant control computers in critical applications. Specifically, this paper considers the detection of malfunctions in an aircraft flight control computer (FCC) that is subjected to electromagnetic environment (EME) disturbances during laboratory testing. A dynamic monitoring strategy is presented and demonstrated for the FCC from glideslope engaged until flare under clear air turbulence conditions using a detailed simulation of the B737 Autoland. The performance of the monitoring system is analyzed

B-737 Linear Autoland Simulink Model

The Linear Autoland Simulink model was created to be a modular test environment for testing of control system components in commercial aircraft. The input variables, physical laws, and referenced frames used are summarized. The state space theory underlying the model is surveyed and the location of the control actuators described. The equations used to realize the Dryden gust model to simulate winds and gusts are derived. A description of the pseudo-random number generation method used in the wind gust model is included. The longitudinal autopilot, lateral autopilot, automatic throttle autopilot, engine model and automatic trim devices are considered as subsystems. The experience in converting the Airlabs FORTRAN aircraft control system simulation to a graphical simulation tool (Matlab/Simulink) is described

Neutron Particle Effects on a Quad-Redundant Flight Control Computer

This paper describes a single-event upset experiment performed at the Los Alamos National Laboratory. A closed-loop control system consisting of a Quad-Redundant Flight Control Computer (FCC) and a B737 simulator was operated while the FCC was exposed to a neutron beam. The purpose of this test was to analyze the effects of neutron bombardment on avionics control systems operating at altitudes where neutron strikes are probable. The neutron energy spectrum produced at the Los Alamos National Laboratory is similar in shape to the spectrum of atmospheric neutrons but much more intense. The higher intensity results in accelerated life tests that are representative of the actual neutron radiation that a FCC may receive over a period of years