Design of a PHM system for electro-mechanical flight controls: a roadmap from preliminary analyses to iron-bird validation

. Literature on PHM is focused on research dedicated to the definition of new algorithms to achieve better failures prognosis or earlier and more accurate fault diagnosis, but lacks of examples on the design of novel PHM frameworks and the practical issues related with their implementation. This paper describes a roadmap for the design of a novel Prognostics and Health Management system while making reference to a real-case scenario applied to electro-mechanical actuators for flight control systems.


Introduction
Literature on PHM systems is mostly focused on the research for novel algorithms or new methodology to isolate a particular fault in a wide range of application fields. Usually the aim of the first type of research is to provide more robust or more accurate RUL predictions, or to lower the required computational effort. The latter is instead often focused on the results achievable through simulated data or through the analysis of data-sets coming from well-prepared experimental campaigns performed under laboratory conditions. Literature on the possible approaches to design and validation of a novel PHM system is however sparse and few contributes can be found. This is especially noticeable in aeronautic applications, where issues like the difficulty of obtaining meaningful in-flight data often puts a cap on the possibility to validate the health monitoring routines developed through simulations or laboratory experiments. This paper describes a generic framework for the design of a novel Prognostics and Health Management system while making reference to a real-case scenario involving the definition of novel prognostics and diagnostics routines for electro-mechanical flight control systems. At first the literature on the subject is examined and discussed; then the system under analysis is presented and its peculiarities detailed, while the approach to PHM design is described. The proposed methodology for the design and validation of a new PHM system can be roughly divided in four parts: preliminary study, high-fidelity modelling and algorithm definition, laboratory validation of the high-fidelity model and finally algorithm integration and validation within an iron-bird set-up. The paper describes each of these passages, highlighting the most critical aspects, possible difficulties and lessons learnt. Starting with the preliminary activities, a FMECA analysis and a survey of the available sensors are performed. Hence the high-fidelity model and its usage aimed at the definition of the diagnostics and prognostics algorithms is described and its interaction with the laboratory experiments detailed. Finally, the integration of the PHM routines within an iron-bird set-up is discussed; the set-up itself is presented, while critical points and practical issues are highlighted. The case study used as reference for this paper is the development of a PHM system for electro-mechanical actuators for flight control systems for a new regionaltransport aircraft. The programme, founded through Clean-Sky 2, is aimed at evaluate the feasibility of such a technology for civil aviation applications, prepare a demonstrator and finally test the integration of the PHM routines within the aircraft systems.

Reference application
The device under investigation is a new direct-drive Electro-Mechanical Actuator (EMA) used for flight control applications. A general scheme of such a system is considered, where three nested control loops (current, speed and position are present. The actuator makes use of a brushless motor to provide power to the aerodynamic surface and the actuator makes use of a brushless motor to provide power to the aerodynamic surface and modify their orientation according to the commands provided by the pilot and the Flight Control Computers (FCCs). From a functional stand-point, this actuator can be divided into a few significant sub-parts; the electronic power and control unit, which modulates the voltage supplied to the electric motor, the electric motor itself, the integrated ballscrew transforming the rotary motion of the electric motor into the linear translation of the user and finally the rod-end, a spherical joint connecting the actuator to the aerodynamic surface. The system is naturally equipped with a number of sensors used for control purposes; phase currents are measured, while a resolver is mounted on the motor shaft to monitor its position, dictate the phases commutation and infer the angular speed. An LVDT is instead integral to the ballscrew and used to precisely measure the position of the enduser, providing this information to the associated control loop. The pilot sends through the FCCs the required position signal, which then constitutes the input to the control system of the single EMA. When dealing with prognostics for Flight Control Systems it is of critical importance to stress that PHM is not expected to replace the traditional monitoring of the possible failures through C-Bit and P-Bit functions and that it is not meant so far to deal with safety-critical issues, mainly due to certification issues and a general lack of an appropriate technological maturity level.

Preliminary analysis
The first step of the proposed approach is a preliminary analysis that covers the design details of the system under analysis and the failure modes which it could encounter. The analysis must hence cover which signals are available, which could be derived from external sources, which sensors could be added to the investigated system and where they could be inserted. The failure modes affecting the system are at first listed and hence investigated through a FMECA analysis tailored for PHM purposes according to [1,2] and reported in [3,4]. The most significant failure modes for each component are studied, their causes, symptoms and failure effects are detailed, while a composite score is computed based on the fault's frequency of occurrence, severity of effects, observability and replaceability of the component. The results are hence ranked and a priority list can be derived, stating which failure modes are more interesting or more probably observable by a Health Monitoring framework. Once that the failure modes have been ranked and priorities have been defined, the focus can shift towards the analysis of the available signals. From a PHM perspective, we can divide the signals potentially obtainable from a system in four major categories: signals available within the system for control purposes, signals potentially available within the vehicle but belonging to systems different from the one under analysis, signals which could be potentially inferred through data fusion or virtual sensors and finally signals currently not available but potentially instrumental or fundamental to the PHM routines. The first category includes the phase currents signals, the angular and linear position of the rotor and the end user provided by the resolver and the LVDT respectively, while the angular and linear speeds that can be inferred by differentiating that information with respect to time. Moreover, belong to this category every control signal (position, speed, current). Not all of these signals are usually made available to components other than the single actuator's Electronic Control Unit (ECU), and that specific, newly designed interfaces could be required. In the second category we can find signals which might be instrumental in the estimate of information of significant importance for a PHM system acting on flight-control actuators. External temperature can be useful in estimating the friction behaviour, or in reducing the effect of temperature variation over the selected features. Information such as the value of the dynamic pressure acting on the wing, aircraft's attitude and Mach number can be instead used to infer a firstapproximation evaluation of the aerodynamic load. To the third category belong measurements which may be obtained by fusing data coming from different systems or from virtual sensors; possible examples for the case study are the aerodynamic force, neglecting gusts load, and the back-electromotive force within the motor phases. Finally, the fourth category comprehends all those signals which are of great interest for PHM but are not usually measured such as, the phase voltages in the electric motor, the DC-Link voltage, or a direct measure of the aerodynamic load. When looking at an existing or under development system, defining which sensors are available and which can be added is however not enough; requirements on the dynamics of such sensors for PHM purposes might in fact be different, and usually more demanding, than the characteristics of the measuring systems commonly used for control or to perform C-Bit and P-Bit operations. Sometimes the bottleneck might be on the acquisition system more than the sensors themselves and redesign of electronics interfaces might be required. A full list of the signals considered available in our case study is reported in Table 1, where they have been classified according to their importance (Mandatory M, Heavily Recommended HR, Recommended, R) their type (Real Sensors RS or virtual sensor VS). Moreover, they are categorized depending on the expected actuator and aircraft conditions providing the most significant information for PHM; the actuator can be moving (MV) or still (S), while the aircraft can be in cruise (CR) or in pre-flight (PF).

Simulation environment
Feeding off the results of the preliminary analysis, the next step of the roadmap is the definition of a high-fidelity simulation environment. Following the work pursued in [5], the simulation environment must be able to correctly represent the system behaviour and its uncertainty, and must accept the introduction of both known sized degradations and naturally evolving ones. This means that the actuators physical characteristics will be drawn from a pool of normally-distributed values centred around the nominal design one and that each variation of the physical characteristics of the device or of its performances in function of temperature, humidity, and applied load is derived from a probabilistic approach. Inputs to the model representing the operational conditions and the commands received by the system under analysis must be as realistic as possible, time dependent and randomized according to reasonable expectations of the application object of the study. From here, the proposed approach follows two consequential steps, needed to provide the data-base to design and test the PHM algorithms. At first, simulations are performed considering several levels of increasing and known fault severity for each considered failure mode, including healthy conditions. This stage is needed to provide an in-depth statistical characterization of the system behaviour under healthy and progressively more and more faulty conditions, hence providing a statistically representative data-set on which extract a set of features. The second step is to pursue time-dependent simulations in which the fault is artificially initiated and hence let free to evolve according to their own physics of failure equations. This operation is required to obtain realistic degradation patterns for each considered failure mode, and hence to test the PHM routines under realistic conditions. With regard to the case study, these tasks have been translated into an in-depth model of the EMA under analysis, comprehensive of a functional model of the Electronic Power Unit [6], and a complete three-phase model for the electric motor [2]. A lumped-parameters model for the ball-screw has been derived from [7], while an in-depth model of the rod-end has been pursued. The most interesting or critical degradation patterns have been modelled as well; issues in the DC-Link and in the MOSFET have been described according to [8], while issues in the electric motor [2] and in the mechanical components have been described following the traditional literature available on the subject. A set of more than 100 simulations for each degradation level for each considered failure mode has been prepared, and the results used to select a number of features according to the requirements of [1], hence presenting high correlation between feature and associated fault and low correlation between feature and other faults. Features behaviour must be studied in function of temperature variations, flight regime and actuator behaviour. In example, some features might be more susceptible to fault presence and evolution during certain flight segments, or during certain operating conditions. In example, features connected with motor windings condition and bearings can be computed only when the actuator is moving [2]. Others, such as some previously obtained for the servovalves of Electro-Hydraulic Servo Actuators might instead provide better information when the actuator is standing still [5]. The application under analysis refers to secondary flight surfaces used for load management and load control operations, meaning that continuous movement of the surfaces is expected. As such, features based around this condition have been deemed feasible.

Algorithms design
A generic framework for PHM of a single system is reported in Fig.1; starting from the extracted features, the PHM algorithms must be able to successfully detect the presence of one or possibly more on-going faults, assess which component is affected and hence assessing the severity of the recognized degradation and predict its evolution in time. All of these steps can be performed according to a wide variety of techniques, ranging from purely data-driven to completely model-based approaches. The choice of the algorithms follows the iterative nature described in [9], and is strictly related to the application and the overall strategy defined for the PHM activities on the platform or on the fleet. Parts or the entirety of the PHM process could be performed on-board, requiring algorithms and post-processing techniques designed to work over data streams. Having to deal with the implementation of these routines on iron-bird hardware, computational effort and RAM availability have been considered as an additional discriminant. For the case under analysis we elected to use a purely data-driven algorithm for fault detection; this methodology is straightforward in the implementation, requires limited computational and memory requirement and is suitable for on-line analysis [10]. The fault detection algorithm provides two outputs; the first is the feature vector f, which elements are the values of each of the computed features. The second output is an alarm vector, which consists of Boolean variables associated to each failure mode. The fault classification is instead pursued via a Linear Support Vector Machine (LSVM). Finally, a prognostic framework based on particle filtering is used to forecast the fault evolution in time and estimate the actuator's Remaining Useful Life. An example of the output of such an algorithm is provided in Fig.2. Remaining Useful Life is estimated by comparing the algorithm projections with a threshold distribution representing the failure conditions, hence allowing to extract the probability distribution of the time-offailure (or End-Of-Life) of the component according to [11].

Laboratory validation
Results provided through realistic simulations may lead to some preliminary or partial conclusions but needs proper validation through experimentation, which needs to assess three major topics; the validation of the proposed model for nominally healthy conditions, the behaviour of the monitored system under faulty conditions and more importantly the validation of the degradation models dictating the expected behaviour of the features with respect to the fault progression. Validation of the model under healthy conditions follows a simple methodology, but requires a higher degree of care with respect to a traditional model identification problem, since the final aim is to validate the dynamic model and the baseline distribution for the selected features, which are usually computed as combination of different signals. This translates into the need of pre-allocating resources to insert additional sensors to the test bench. Validation of the model for degraded conditions is instead more complicated. Theoretically, this step of the development process should see the injection of known, controllable and progressively increasing degradation levels within the real device. The introduction of real, physical degradations on the system under analysis is not always Fig.2. Output of the prognostic routine and dedicated test bench feasible, both from an economical and practical stand point. For EMAs employed in flightcontrol systems, the cost of physically injecting degradations can quickly ramp up, and alternatives, such as physically simulating the fault presence, need to be explored. The second major issue to the validation of the degraded condition model is the requirement to monitor the size or the severity of the tested degradation. PHM is of course aimed at this, but to evaluate how the algorithms and the whole set up fares, we need a precise quantification of the injected fault extension. Validation of the mathematical expressions between features and degradation level obtained through simulations is hence automatically derived from the previous steps. To pursue the validation of the model and the selected features we proposed the preparation of two experimental set-ups. The first, depicted in Fig.2 and described in [12] is dedicated to the whole EMA; it features a new compact design, the possibility to attach external devices or to easily replace the coupling elements to simulate faults in the rod-end. This test bench is equipped with a load-controlled hydraulic actuator and the possibility to pursue software in the loop tests. A dedicated control system with speed compensation allows to avoid drop-off in load control performances up to 10 Hz circa, hence allowing to simulate the presence of gusts or to change the load profile according to the EMA position and the expected operational conditions. The second test bench is instead focused on the ball-screw component, and sports a few additional sensors like dedicated pre-load measurement and optical linear transducers to precisely measure the backlash. The set-up design has been evaluated through an in-depth sensitivity analysis in [13]. The purpose of this double set-up is to prepare an in-depth study on the ball-screw performances under degradation and use these results to simulate these faults within flight-control the test-bench. Not every fault is going to be physically injected due to technical difficulties and the danger than an unchecked failure could represent for the entire test-bench. Electrical faults in particular will be simulated by or by inserting additional resistances in parallel to the electric motor coils or by corrupting the current feedback and the command signals to simulate the presence of an on-going degradation. To limit costs associated with the replacement of the whole actuator, the test schedule has been prepared to leave the most invasive procedures as last.

Iron-bird integration and testing
Laboratory tests are used to verify and eventually adjust the models of the EMAs and of the effects associated with the investigated degradations, but they have limited utility in validating a prognostic algorithm. They are in fact completely missing the time scale of the process and the interaction with the pilots and the other system can only seldomly be described. Moreover, laboratory tests are performed with dedicated commercial components, custom acquisition system and dedicated software for control, simulation and acquisition of data. To provide a more consistent technological demonstrator factoring-in more effectively the time scale, and to verify the feasibility of PHM activities even from the computing hardware perspective, an iron-bird set-up is being prepared. The functional scheme of the portion of the system dedicated to Flight Control Systems (FCSs) is reported in Fig.3; the FCS of the set-up is partially based on real, newly designed actuators and partially by a real-time simulator (Actuation System Simulation Module, ASSM) which features simplified models derived from the high-fidelity environment introduced in Section 4. Since it is too expensive to introduce physical damages on the real system, degradations are introduced on the simulated EMAs according to the models validated through laboratory activities. Signals from all actuators, both real and simulated, are hence collected through a shared-memory architecture and sent to a dedicated unit (the Health Management System Module) which runs the PHM routines. The Health Management System Module has three main tasks: define and send to the ASSM which degradation type to inject and when, analyse the received data and provide results to the user. To limit the computational effort and to disengage the operation of the HMSM from those of the rest of the iron-bird, all the analyses are performed off-line, so no real-time target machine is employed. A Matlab GUI, also depicted in Fig.3, has been designed to allow output of different level of complexity to accommodate for the user experience and performed task. The integration of these routines within the iron-bird hardware is currently on-going. Once the iron-bird is operative, it will be possible to exploit its functionalities to evaluate the performances of the PHM algorithms in high detail. In particular, one of the most interesting capabilities of this approach is the possibility to obtain a "ground truth" distribution of the Remaining Useful Life for predictions performed at specific time stamps. By performing multiple flight simulations starting from the same degradation level, it is theoretically possible to recreate a discrete probability density function associated with the time-of-failure and hence compare this information with the probability distributions generated by the prognostic algorithm; more importantly, such a "ground truth" is the closest representation of the real probability distribution of the time of failure at a certain time instant, which definition is not possible for physical systems, since it would require to bring to failure conditions the exact same components following different combinations of load, command and temperature each time.

Conclusions
A roadmap for the design of a PHM system for electro-mechanical flight control actuator has been described and each step justified. Although specific of the presented application, the roadmap is completely generic and can be broadly applied to any research activity for vehicle-based or equipment-based prognostics. Regarding the specific activity related to EMAs for flight control system, more results will be shared as the validation process is finalized.