A new active asymmetry monitoring and control technique applied to critical aircraft flap control system failures

Asymmetry limitation requirements between left and right wing flap surfaces play an important role in the design of the implementation of the secondary flight control system of modern airplanes. In fact, especially in the case of sudden breaking of one of the torsion bars of the flap transmission line, the huge asymmetries that can rapidly develop could compromise the lateral-directional controllability of the whole aircraft (up to cause catastrophic occurrences). Therefore, in order to guarantee the aircraft safety (especially during take-off and landing flight phase in which the effects of asymmetries could generate uncontrollable aircraft attitudes), it is mandatory to timely detect and neutralize these asymmetries. The current monitoring techniques generally evaluate the differential angular position between left and right surfaces and, in most the events, limit the Flaps Control System (FCS) asymmetries, but in severe fault conditions (e.g. under very high aerodynamic loads), unacceptable asymmetries could be generated, compromising the controllability of the aircraft. To this purpose, in this paper the authors propose a new active monitoring and control technique capable of detecting the increasing angular error between the different flap surfaces and that, after stopping the whole actuation system, acts on the portion of the actuation line still connected to the PDU to minimize the FCS asymmetries.


Introduction
Flap actuation, in most commercial and military aircraft, is composed by a centrally located Power Drive Unit (PDU), a transmission and a number of actuators. Secondary flight controls shall comply with these main requirements: discrete command type, aerodynamic coefficients modification and actuation during take-off and landing phases. Depending on the requested performance, structural and interface requirements, different configurations have been used in the design of such actuation systems. PDU's can be hydromechanical or electromechanical, either single or dual motor type. In the last case, the two motors outputs can be either torque or speed summed. As described in [1], the mechanical transmission generally consists of torque tubes connecting PDU output with the actuators; high-speed, flexible drive shafts are also used in small commercial aircraft.
Final actuators are usually linear-type, reversible screw actuators (e.g. ballscrew or rollerscrew) though some solutions still use less efficient components like the acme and lead screws; some solutions are also based upon rotary type systems. Such systems must prevent asymmetries between the left and right wing flaps in case of shaft failure (detected by a dedicated asymmetry monitoring system), and to hold the surfaces in the commanded position following the shutoff command given when no actuation is required. If the actuators use an irreversible screw, the aforementioned requirements are intrinsically accomplished; otherwise, as shown in [2], if the actuators are reversible (i.e. higher efficiency) a brake system is necessary: • controlled wingtip brakes (one for each wing), engaged in order to slow down the system after a failure has been positively identified ( Figure 1); • self-acting irreversibility brakes within each actuator, activating when the actuator output overruns the input shaft ( Figure 2).

Aims of work
This work aims to propose a new active monitoring and control technique capable of detecting the increasing angular error between the different flap surfaces and that, after stopping the whole actuation system, acting on the portion of the actuation line still connected to the PDU in order to minimize the Flaps Control System (FCS) asymmetries. A dedicated Matlab-Simulink numerical model, consistent with the FCS architecture proposed by the authors in [4], is used to evaluate the performances of the proposed asymmetry algorithm; in particular, its performances are compared with the ones provided by more conventional flap monitoring strategies.

Secondary flights control system
Flaps and slats are devices mounted on the trailing edges of the wings of a fixed-wing aircraft and typically used to alter the lift characteristics of a wing, in order to shorten takeoff and landing runs lowering the stall speed and increasing the drag. The asymmetry limitation between left and right wing flaps represents one of the most critical design requirements as regards actuation, monitoring and position control of these systems.
During normal operating conditions, the typical asymmetry between right and left flaps is generally very small since some physical non-linear phenomena contribute to this asymmetry during the actuation under non symmetrical loads, a value lower than 0.05%, as regards the backlash, and lower than 0.5%, for the elastic deflection (percentages referring to full flap travel). Generally, small asymmetries do not significantly degrade the manoeuvrability and controllability of the aircraft, but it must be noted that larger asymmetries or other failures are capable of degrading or compromising proper functioning: a conservative safe-life approach is then used in the design process.
A mechanical failure can occur in any component of the actuation system (shafts, PDU, actuators), but PDU or actuator fail results in the inability to operate the affected flap system. Such a failure condition is not critical to the flight safety, as it is the case of large asymmetries between the left and right surfaces resulting from uncontrolled shaft failures. In fact, if a shaft failure occurs the following events take place: the part of the actuation system upstream of the fracture point keeps rotating with the PDU in the commanded direction until a shutoff command is not given to the PDU, while the portion of the shaft system downstream of the fracture point exhibits a behaviour that depends on its design characteristics. If the actuators are irreversible [1], this part of the system decelerates rapidly to a stop, since aerodynamic loads acting on the high-lift surfaces cannot back-drive the actuators and the small kinetic energy is dissipated by irreversibility losses. Vice versa, in case of reversible actuators, aerodynamic loads are capable of back driving the failed part, which can accelerate when subjected to large loads due to its low inertia. In this case, the actuation system must be either equipped with wingtip brakes ( Figure 1) or with proper irreversibility devices ( Figure 2). These two configurations are, respectively, based on: • controlled wingtip brakes (WTB); • self-acting irreversibility brakes (i.e. No-Back Brakes or NBB) within each actuator.
The relative merits of the three solutions (non-reversible actuators, reversible actuators with wingtip brakes, reversible actuators with irreversibility brakes) and which of the three is the better solution is widely described in [1][2][3]. Nowadays the most widely used architecture for high-medium performance aircrafts employs the reversible actuators with wingtip brakes and centrally located PDU (dual motor type for operational reliability) since it is cheaper and more efficient, so this architecture is considered in the present work. In must be noted that, in this case, an asymmetry between the surfaces upstream and downstream of the failure develops as long as the PDU is running and the wingtip brakes are not engaged. This developing asymmetry must be early identified and a corrective action taken in order to keep its maximum value within a safe limit by means of appropriate monitoring devices equipped with suitable software whose selection is dealt in [1][2]. Further, it should be noted that when a failure occurs in the wingtip brakes (reversible actuators architecture), a flight safety critical condition can arise, e.g. following a previous shaft failure or when irreversible actuators turn to be reversible or when the supply pressure of the hydraulic system drops under a defined value. The monitoring system must be able to detect and properly correct these failures (as widely reported in [4]).

Actuation system modelling
In order to evaluate the performance of the said active asymmetry control technique, in a previous work the authors evaluated many physical actuation systems commonly used onboard of modern aircraft, selecting as reference the Airbus A330 flap actuation system [4] (  The Power Control Unit (PCU) transforms hydraulic power into mechanical power to drive flap surfaces by means of the kinematic line composed by torque shafts, gearbox, and universal joints. Every PCU is fed by two different hydraulic supplies, to give a hot redundancy for aircraft safety and it is generally composed by PDU, SVALVE, POB and Relief Valves. The above mentioned system is equipped with reversible ballscrew mechanical actuators; in order to overcome the problems reported in the previous section, proper irreversibility devices are needed. In particular, as shown in Figure 3, the irreversibility of the whole transmission is performed by means of two wing-tip brakes located at the two outer ends of the shaft system. When a mechanical transmission break occurs (in reversible systems), in order to stop the flap surfaces for each wing, the monitoring and control system engages the WTB friction disks, reducing the input pressure of the hydraulic Power Supply, in order to develop a proper braking torque.
To develop and test the proposed active asymmetry monitoring and control technique authors modified an existing numerical simulation model, developed by Dalla Vedova et al. and widely described in [4]. This model is implemented in Matlab/Simulink® environment and is conceived to test innovative FCS layouts and evaluate performance and robustness of new asymmetry monitoring. The numerical model reported in Figure 4 is consistent with physical system described in the previous paragraph ( Figure 3) and is described in [4]. The numerical model reported in Figure 4 is consistent with physical model described in the previous paragraph ( Figure 3) and is widely described in [4]. The SFCC subsystem simulates the Slat/Flaps Control Computer functions (e.g. a PID controller closing the position loop) [2] and the related monitoring and asymmetry control algorithms (described in the chapter 5). The dynamic response of the servovalves driving the PDUs is simulated by subsystems Flapper-Nozzle SV (i.e. athird order electromechanical model calculating the SV spool displacement [5][6][7][8]) and Fluid Dynamic SV Model (calculating the differential pressure P12 as a function of the spool dynamics and the flow rate QJ [9][10][11][12][13]). The subsystem PDU is a second order numerical model simulating the global power drive units' behaviours [3]. The mechanical transmission models (i.e. Fast, Intermediate and Slow Shaft) calculate the global response of the motion transmission evaluating several nonlinearities i.e. dry friction acting on bearings, hinges and ballscrews [14][15][16][17][18][19][20], backlash and stiffness of torque shaft and gear boxes [4], and transient PSR hydraulic behaviour [2].

Aircraft dynamics, autopilot and asymmetry monitoring
A simplified model of the aircraft lateral-directional dynamics and related autopilot functions has been implemented to assess the effects induced on the aeroplane attitude by the failures of the flap actuation system. The lateral-directional dynamics is modelled as reported in [2], whereas the autopilot control laws have been implemented using a nonlinear parallel PID architecture, which although simplified is adequate to approximate the actual autopilot control within the objective of the present work [4]. By measuring the aircraft roll angle, the autopilot PID controller develops the commands to the ailerons and the rudder. These flight controls are, in turn, simulated as second-order systems having speed and position saturations [3]. The aircraft data selected for the simulations are typical of a commercial jet aircraft; this choice is purely illustrative because the behaviour of the aircraft following the failure of the flap is substantially similar for all types of aircraft.
In several real (commercial) application, the flaps asymmetry monitoring technique is commonly based on the detection of the differential position between left and right flap surfaces [2]; its use generally slightly reduces the asymmetry, but in some cases (e.g. high aerodynamic load), it may have unacceptable behaviours. To overcome these issues, the authors developed several monitoring strategies in [2][3][4]. For this purpose, the authors modified the PID controller implemented in the SFCC subsystem (Fig. 4), integrating the said asymmetry monitoring techniques. The evaluation of their effectiveness was performed using the aforementioned Simulink test bench (shown in chapter 4), evaluating the ability of the different techniques to limit the asymmetry following a torque shaft fracture.
In this work the authors considered the differential position control technique (referred in [2] as technique type 1), that performs the flaps asymmetry detection by comparing the electrical signals of the position transducers placed at the ends of left and right shaft subsystems; if this difference is higher than a defined limit ∆θ Lim (previously set on the base of the system specification to be large enough to avoid false positives but sufficiently reduced to prevent the onset of excessive asymmetries) for more than a given evaluation time, an failure is recognized, and shut-off procedure is activated to engage the WTBs.

Proposed active asymmetry monitoring and control technique
The development of new active monitoring techniques aims to enhance the performance of the FCSs, minimizing the flaps asymmetry resulting from a catastrophic breakdown of mechanical transmission. In fact, while remaining within the expected tolerances, this asymmetry can however reduce the controllability of the aircraft in crucial phases of the flight such as the approach landing runway or take-off (both characterized by assets, flight speed and proximity to the ground such to make any uncontrolled manoeuvre or limitation of authority of the primary controls critical). Therefore authors propose a new active logic, already integrated with the said monitoring techniques, able to reduce the asymmetry following a fault and the subsequent emergency intervention of the control system. This way, by acting on the flaps still controlled by the FCS to decrease the asymmetry, the system allows increasing the margin of controllability of the aircraft.
Referring to the block diagram of Figure 5, the proposed procedure operates as follows. After the type 1 monitoring has detected the error (identifying a flaps asymmetry value that exceeds, for a given pre-established time interval, the maximum allowable asymmetry value ∆θ Lim ), the system must activate the shutdown procedure (by switching from the "Ok" block to the "Stop" block of Figure 5). Therefore, after an appropriate time interval (evaluated by an internal logic counter and calibrated on the FCS dynamics to guarantee the transmission stop), the monitoring must identify the failure e.g. torque shaft breaks or hydraulics depressurisation. In fact, in case of mechanical transmission breakdown, the system must determine which mobile surfaces are still driven by PDUs (to understand which surfaces must be kept still and which can be operated to minimise the flaps asymmetry, while avoiding false positive alarms or accidental WTB releases).
To this purpose, we introduced the two angular flap errors ∆M R and ∆M L , defined as: where θ M , θ SR and θ SL respectively represent the instantaneous angular positions of the PDU mechanical output, of the right flap and of the left flap (all reduced to the slow shaft through transmission reduction ratios). The eventual shaft failure and the damaged transmission branch are identified by comparing the angular flap errors ∆M R and ∆M L with an acceptance threshold D∆M RL defined as a function of the transmission (e.g. compliance, mechanical play and dynamic response). The surfaces still connected to the PDU determine minimal errors (fundamentally related to the transmission compliance); instead, the error related to surfaces downstream of the break diverges quickly. Subsequently, the FCS reactivates the portion of the plant still controlled by the PDU (pressurising the hydraulic lines and releasing the relative WTBs) and then, through the position feedback loop, it drives the controlled surfaces to minimises the global flaps asymmetry. Figure 5 shows the logical structure of the proposed thecnique; the parameters ∆M R , ∆M L and D∆M R are respectively reported as DeltaMR, DeltaML and DDeltaMRL.
For instance, if the monitoring and control system detects an asymmetry, the proposed algorithm stops both mobile surfaces (acting on shut-off valves). Then it compares the angular flap errors ∆M R and ∆M L with the acceptance threshold D∆M RL and, if torque shaft break is detected, it provides to the identification and corrective actuation of the flap surface still in operation (i.e. driven by PDUs). It must be noted that, after stopping, this system must be able to restore the movement of the still operating flap surfaces. Therefore, WTBs must generate the appropriate braking torque avoiding permanent deformations or damages that could prevent their subsequent release during the asymmetry recovery.

Numerical results
Several simulations have been run to evaluate the performance of the proposed active monitoring technique, considering a sudden mechanical failure of the transmission shaft under very high aerodynamic load (i.e. equal to 75% of servomechanism stall load).
For instance, Figure 6 shows the simulation results for the cases of deploying flaps with reversible actuators under very high opposing loads; this load acts as opposing to the flap deployment. For all the simulations the right torque shaft failure occurs at time = 0.4 s, while the actuation system is running at the rated speed, following the system start up time.
The upper graph represents the response of the FCS equipped with the simple type 1 differential position control technique [2]. In contrast, the lower graph shows the response of the same actuation system but equipped with type 1 monitoring integrating the proposed active asymmetry mitigation method. In particular, as regards the lower graph of Figure 6, it should be noted that the part of the actuation system downstream of the fault decelerates very quickly under the action of the very high opposing load. Subsequently, after stopping, it starts to accelerate backward until this asymmetry is recognized and WTBs engage providing its braking torque to block the system. Meanwhile, the other part of the system is driven by the PDU until the asymmetry monitor provides the shutdown command. Therefore, after an appropriate stop transient governed by the incremental counter shown in Figure 5, the active monitoring identifies the fault location, reactivating the transmission branch still connected to the PDU and guiding it to minimize the overall flaps asymmetry. Note that in Figure 6 ThSL and ThSR reppresent the left and right flaps positions, ThA is the deflection angle of the ailerons and RoA is the aircraft roll angle (all expressed in deg).