Control system actuation fault monitoring

• US 7,822,493 B2
• Filed: 01/03/2008
• Issued: 10/26/2010
• Est. Priority Date: 01/03/2008
• Status: Expired due to Fees

• Current Assignee: The Boeing Co.
• Original Assignee: The Boeing Co.
• Inventors: Enns, Russell J., Mossman, David C., Dahman, Jonathan B.
• Primary Examiner(s): Jarrett; Ryan A
• Application Number:
  US11/969,150
• Publication Number:
  US 20090177292A1
• Time in Patent Office: 1,027 Days
• Field of Search: 700/21, 700/29, 700/30, 700/33, 700/34, 700/35, 700/54, 700/79, 701/3, 701/4, 701/11, 701/12, 701/14
• US Class Current: 700/29
• CPC Class Codes: G05B 23/0235 based on a comparison with predetermined threshold or range, e.g. "classical methods", carried out during normal operation; threshold adaptation or choice; when or how to compare with the threshold
• CPC Class Codes: G05B 23/0254 based on a quantitative model, e.g. mathematical relationships between inputs and outputs; functions: observer, Kalman filter, residual calculation, Neural Networks

Abstract

Methods and apparatus for monitoring and detecting failures in the actuation of a control system, such as a flight control system for an aircraft, include defining a nominal model of the control system in terms of the state variables of the control system, defining a model of an asymmetric “actuation monitoring envelope” that dynamically bounds a range that measured state variables of the system are allowed to take during operation of the system as a function of the nominal system state model, monitoring a signal corresponding to a state variable of the system during operation thereof, and detecting a failure in the actuation of the control system when the monitored signal exceeds the bounds of the monitoring envelope.

Claims

1. A method for monitoring and detecting failures in the actuation of a control system, the method comprising:

defining a nominal model of the control system in terms of the state variables of the control system;

defining a model of an asymmetric actuation monitoring envelope that dynamically bounds a range that measured state variables of the system are allowed to take during operation of the system as a function of the nominal system state model, the monitoring envelope including a first subsystem defining an upper bound of the monitoring envelope and a second subsystem defining a lower bound of the monitoring envelope, each subsystem comprising a closed loop feedback system including a system loop closure, a fast system dynamics model, a slow system dynamics model, a switch, a system non-linearity model, a system lumped tolerances model and a signal saturation model;

and using a processor;

selecting between the respective fast and slow system dynamics models of the subsystems with the respective switches thereof so as to define the maximum permissible monitoring envelope upper and lower bounds as a function of variations in the respective system dynamics and non-linearity models of each subsystem during system operation;

monitoring a signal corresponding to a state variable of the system during operation thereof; and

,

detecting a failure in the actuation of the control system when the monitored signal exceeds the bounds of the monitoring envelope.

2. The method of claim 1, wherein defining the monitoring envelope comprises accounting for the dynamics and non-linearities of each element of the control system and the respective variations therein during system operation.

3. The method of claim 1, further comprising using a processor to delay a signal input to the respective slow systems dynamic model of each submodule by at least two signal sample periods.

4. The method of claim 1, further comprising using a processor to delay a declaration of a failure in the actuation of the control system for a period of time, the magnitude of the delay being a function of the magnitude of the amount by which the monitored signal exceeds the bounds of the monitoring envelope.

5. The method of claim 1, wherein the control system comprises a plurality of stages, and further comprising defining a respective actuation monitoring envelope model for each of the stages of the system.

6. The method of claim 1, wherein all of the elements of the monitoring envelope are implemented in discrete-time, and further comprising

converting continuous time element parameters to discrete time element parameters.

7. Apparatus for monitoring and detecting failures in the actuation of a control system, the apparatus comprising:

a nominal model of the control system defined in terms of the state variables of the control system;

a model of an asymmetric actuation monitoring envelope that dynamically bounds a range that measured state variables of the system are allowed to take during operation of the system defined as a function of the nominal system state model, the monitoring envelope including a first subsystem defining an upper bound of the monitoring envelope and a second subsystem defining a lower bound of the monitoring envelope, each subsystem comprising a closed loop feedback system including a system loop closure, a fast system dynamics model, a slow system dynamics model, a switch, a system nonlinearity model, a system lumped tolerances model and a signal saturation model;

means for selecting between the respective fast and slow system dynamics models of the subsystems with the respective switches thereof so as to define the maximum permissible monitoring envelope upper and lower bounds as a function of variations in the respective system dynamics and non-linearity models of each subsystem during system operation;

means for monitoring a signal corresponding to a state variable of the system during operation thereof; and

,

means for detecting a failure in the actuation of the control system when the monitored signal exceeds the bounds of the monitoring envelope.

8. The monitoring apparatus of claim 7, wherein the monitoring envelope accounts for the dynamics and non-linearities of each element of the control system and the respective variations therein during system operation.

9. The monitoring apparatus of claim 7, further comprising means in each of the respective system loop closures of each subsystem for delaying a signal input to the respective slow systems dynamic model thereof by at least two signal sample periods.

10. The monitoring apparatus of claim 7, further comprising means for delaying a declaration of a failure in the actuation of the control system for a period of time, the magnitude of the delay being a function of the magnitude of the amount by which the monitored signal exceeds the bounds of the monitoring envelope.

11. The monitoring apparatus of claim 7, wherein the control system comprises a plurality of stages, and further comprising a respective actuation monitoring envelope model defined for each of the stages of the system.

12. The monitoring apparatus of claim 7, wherein all of the elements of the monitoring envelope are implemented in discrete-time, and further comprising

means converting continuous time element parameters to discrete time element parameters.

13. The monitoring apparatus of claim 7, wherein the respective loop closures of each subsystem comprises a controller.

14. The apparatus of claim 7, wherein the monitored control system comprises a flight control system of an aircraft.

15. The apparatus of claim 14, further comprising means for switching the control of the aircraft to a backup system upon the detection of an actuation failure.

16. The apparatus of claim 14, wherein the flight control system comprises a fly-by-wire (FBW) control system with a mechanical backup or a mechanical control system with a partial authority electrical control system.

17. A method for monitoring and detecting failures in the actuation of an aircraft control system, the method comprising:

defining a nominal model of the control system in terms of the state variables thereof;

defining a model of an asymmetric actuation monitoring envelope that accounts for the dynamics and non-linearities of each element of the control system and the respective variations occurring therein during system operation, and that dynamically bounds a range that measured state variables of the system are allowed to take during operation of the system as a function of the nominal system state model, the monitoring envelope comprising

first and second envelope subsystem models respectively defining upper and lower bounds of the monitoring envelope,

each subsystem model comprising a closed loop feedback system, including a system loop closure, a fast system dynamics model, a slow system dynamics model, a switch, a system non-linearity model, a system lumped tolerances model and a signal saturation model;

and using a processor;

selecting between the respective fast and slow system dynamics models of the subsystems with the respective switches thereof so as to define the maximum permissible monitoring envelope upper and lower bounds as a function of variations in the respective system dynamics and non-linearity models of each subsystem during system operation;

delaying a signal input to the respective slow systems dynamic model of each sub-module by at least two signal sample periods;

monitoring a signal corresponding to a state variable of the system during operation thereof; and

,

detecting a failure in the actuation of the control system when the monitored signal exceeds the bounds of the monitoring envelope.

18. The method of claim 17, wherein the aircraft control system comprises a plurality of stages, and further comprising defining a respective actuation monitoring envelope model for each of the stages of the system.

19. Apparatus for monitoring and detecting failures in the actuation of an aircraft control system, the apparatus comprising:

a nominal model of the control system defined in terms of the state variables thereof;

a model of an asymmetric actuation monitoring envelope that accounts for the dynamics and non-linearities of each element of the control system and the respective variations therein during system operation and that dynamically bounds a range that measured state variables of the system are allowed to take during operation of the system defined as a function of the nominal system state model, the monitoring envelope comprising

first and second envelope subsystem models respectively defining upper and lower bounds of the monitoring envelope,

each subsystem model comprising a closed loop feedback system, including a system loop closure, a fast system dynamics model, a slow system dynamics model, a switch, a system non-linearity model, a system lumped tolerances model and a signal saturation model;

means for selecting between the respective fast and slow system dynamics models of the subsystems with the respective switches thereof so as to define the maximum permissible monitoring envelope upper and lower bounds as a function of variations in the respective system dynamics and non-linearity models of each subsystem during system operation;

means in each of the respective system loop closures of each subsystem for delaying a signal input to the respective slow systems dynamic model thereof by at least two signal sample periods.

means for monitoring a signal corresponding to a state variable of the system during operation thereof; and

,

means for detecting a failure in the actuation of the control system when the monitored signal exceeds the bounds of the monitoring envelope.

20. The monitoring apparatus of claim 19, further comprising means for delaying a declaration of a failure in the actuation of the control system for a period of time, the magnitude of the delay being a function of the magnitude of the amount by which the monitored signal exceeds the bounds of the monitoring envelope.