Model-Based Condition-Monitoring and Jamming-Tolerant Control of an Electro-Mechanical Flight Actuator with Differential Ball Screws

Abstract

The work deals with the development of deterministic model-based condition-monitoring algorithms for an electromechanical flight control actuator with fault-tolerant architecture, in which two permanent magnets synchronous motors are coupled with differential ball screws in speed-summing paradigm, so that the system can operate even after a motor fault, an inverter fault or a mechanical jamming. To demonstrate the potential applicability of the system for safety-critical aerospace applications, the failure transients related to major fault modes have to be characterised and analysed. By focusing the attention to jamming faults, a detailed nonlinear model of the actuator is developed from physical first principles and experimentally validated in both time and frequency domains for normal condition and with different types of jamming. The validated model is then used to design the condition-monitoring algorithms and to characterize the system failure transient, by simulating mechanical blocks in different locations of the transmission. The operability after the fault, obtained via fault-tolerant control strategy and position regulator reconfiguration, is also verified, by highlighting and discussing possible enhancements and criticalities.

1. Introduction

1.1. Research Context

The aircraft electrification is surely one of the most important and strategic initiatives currently supporting the innovation of the aviation industry [1,2]. This manifests in two basic concepts: the more-electric aircraft and the more-electric propulsion (way to the all-electric long-term targets). In particular, the more-electric aircraft concept entails the gradual replacement of onboard systems based on mechanical, hydraulic, or pneumatic power sources with electrically-powered ones, aiming to reduce weight and costs, to optimize energy and to increase eco-compatibility and reliability of future aircrafts [3,4,5,6]. One of the key technological enablers for pursuing these challenging objectives is the electro-mechanical actuation [7,8,9]. The applicability of Electro-Mechanical Actuators (EMAs) in aerospace is well proved in terms of load and speed performances [10,11,12,13,14], but it still entails several concerns in terms of safety and reliability [15,16,17,18,19]. In civil aircrafts, EMAs are often avoided for safety-critical functions (flight controls, brakes, landing gears, nose wheel steering), essentially because the statistical database on components fault modes is poor [20]. Electrical and electronic faults are currently not critical for aerospace applications of EMAs, since they can be effectively counteracted via hardware redundancy, without significant impacts on weight and volumes [21,22,23,24,25,26]. On the other hand, mechanical faults are more problematic. The most feared fault mode is surely the mechanical jamming, which is the final consequence of the progressive degradation of loaded metallic contacts in the EMA gear train. The wear and fatigue in the materials initially imply increased friction and lower efficiency (affecting power consumption and control performances), or increased freeplay (with possible impacts on aeroservoelastic stability of flight movables), while in the long term they can lead to mechanical blocks. Potentially, the jamming of a primary flight surface is a failure with catastrophic consequences, which can make useless any architecture based on either parallel or grouped actuators. The survivability to jamming is thus one of the major challenges in the development of EMAs for safety-critical aerospace applications.

Many research efforts have been and are made to protect EMAs from jamming, by applying both prognostic and diagnostic monitoring methods, aiming at anticipating (i.e., avoiding), or detecting and isolating the fault, respectively. The prognostic solution, though potentially overwhelming [27,28,29,30], is nowadays far from being applicable to airworthy systems, so that diagnostic approaches are typically preferred [31,32].

The diagnostic monitoring requires that fault detection and isolation (FDI) algorithms are implemented and real-time executed by onboard control electronics [33,34,35,36], so that, in case of a detected jamming, redundant mechanical channels or unlock devices can be engaged [37,38]. Depending on how the mechanical redundancy is applied, after the fault compensation, the EMA can maintain its functionality, or it can be reverted in a stand-by mode, so that jamming-operative or jamming-safe EMAs are respectively obtained. In fact, for each primary flight movable, the mechanical redundancy can be applied at load-level (by splitting the movable and using a jamming-safe EMA on each part), at actuator-level (using multiple jamming-safe EMAs on a single movable), or at subsystem-level (using a single jamming-operative EMA on a single movable). The use of jamming-tolerant transmissions in EMAs clearly increases the design complexity, but it strongly simplifies the system integration with respect to architectures with multiple actuators. On the other hand, the FDI algorithms of a jamming-operative (more generally fail-operative) EMA are expected to be more sophisticated and prone to errors.

1.2. Motivations of the Research

Provided that fail-operative EMAs are the preferred solution for the primary flight controls of more-electric aircrafts, a key aspect entails the design and the verification of appropriate condition-monitoring systems. Apart from the need of limiting the number of additional sensors and algorithms, a special attention must be paid to the monitoring approach itself. Literature identifies three basic methods: knowledge-based, signal-based and model-based approaches [39,40]. In knowledge-based approaches, there is no a priori knowledge (i.e., model) of the physics-of-failure, but it is reconstructed from a large volume of historical data, by means of artificial intelligence techniques. Signal-based approaches instead utilize coarse pre-defined information about the system behaviour and the diagnostic output is directly generated by analysing the system signals. Finally, in model-based approaches, the diagnosis is obtained from the comparison of system measurements with a priori information provided by mathematical models, through the generation and analysis of residual quantities [41].

The condition-monitoring of a primary flight control EMA, which must be executed in real-time and with minimum FDI latency, surely requires a model-based approach, but different techniques can be applied. Since nonlinearities, disturbances, environment and loads can significantly affect actuators response, an in-depth knowledge of both normal and faulty behaviours is required. The crucial problem entails the knowledge of faulty dynamics and failure transients in complex systems with a huge number of fault modes.

In data-driven model-based techniques, this knowledge is achieved via experiments, by artificially injecting the major faults and measuring the system response during and after the fault [20,28,29,42,43]. This method provides more accurate predictions, but rigging costs are often prohibitive and the FDI strongly depends on tested conditions.

In deterministic model-based techniques, which this paper refers to, the knowledge of dynamics with faults is derived from a mathematical model, capable of simulating the faults occurrence by physical first-principles [33,34,35,36], which is experimentally-validated with reference to normal and/or regime faulty conditions. Oppositely to the data-driven case, this method generally provides less accurate predictions, but it is cost-effective, it allows to verify FDI functionalities in extreme conditions and (above all) permits to generalise the FDI algorithms validity to similar equipments (i.e., governed by similar equations).

The development of a high-fidelity dynamic model of an EMA and its consequent experimental validation are thus, of paramount importance for the design of a deterministic model-based condition-monitoring, especially for the failure transients characterisation (with particular reference to the ones related to jamming faults, literature information is scarce). The basic objective of this work is thus to design and validate a deterministic model-based monitoring system of a fault-tolerant EMA for primary flight controls developed by Umbragroup (Italy), aiming at demonstrating the potential applicability of the actuator for safety-critical aerospace applications. In previous works by the authors [44,45], a preliminary performance verification of the monitoring system was obtained, but the experimental validation of the model was limited to the normal condition and the accuracy in terms of motor currents response was poor. This paper substantiates the effectiveness of the condition-monitoring design, by enhancing the EMA model accuracy and extending its experimental validation in both time and frequency domains to all the system operative modes.

2. Materials and Methods

2.1. System Architecture

The reference actuator is a fault-tolerant EMA (Figure 1a), basically composed of

• dual redundant three-phase Permanent Magnets Synchronous Machines (PMSMs) with surface-mounted magnets and sinusoidal back-electromotive forces, driven via Field-Oriented Control (FOC) technique;
• dual Electronic Control Units (ECUs), implementing the condition-monitoring algorithms and the closed-loop control functions, based on three nested loops on motors currents, motors speeds and output shaft position;
• Umgragroup-patented jamming-tolerant mechanical transmission with differential ball-screws (Figure 1b).

2.2. Mechanical Transmission

The mechanical transmission of the EMA is based on differential ball-screws couplings. The two motors engage, via rotor-integrated ball-nuts, an intermediate screwshaft having three threaded portions: two external ones for the motors and an internal one for the output shaft, Figure 1b. The kinematics thus implements a speed-summing paradigm and the relationships between the motors rotational speeds (${\dot{\theta }}_1$ and ${\dot{\theta }}_2$), the output translational speed (${\dot{x}}_o$) and the screwshaft translational and rotational speeds (${\dot{x}}_{ss}$ and ${\dot{\theta }}_{ss}$) are given by Equations (1)–(3),

$${\dot{\theta }}_{ss} = \frac{p_{s1}{\dot{\theta }}_1-p_{s2}{\dot{\theta }}_2}{p_{s1}-p_{s2}},$$

(1)

$${\dot{x}}_{ss} = \frac{p_{s1}{p}_{s2}}{2\pi \left(p_{s1}-p_{s2}\right)}\left({\dot{\theta }}_1-{\dot{\theta }}_2\right),$$

(2)

$${\dot{x}}_o = b_1{\dot{\theta }}_1 + b_2{\dot{\theta }}_2 = \frac{p_{s1}\left(p_{s2}-p_{s3}\right)}{2\pi \left(p_{s1}-p_{s2}\right)}{\dot{\theta }}_1 - \frac{p_{s2}\left(p_{s1}-p_{s3}\right)}{2\pi \left(p_{s1}-p_{s2}\right)}{\dot{\theta }}_2,$$

(3)

in which p_s1 and p_s2 are the leads of the motor screw-nut couplings and p_s3 is the lead of the output shaft screw.

Theoretically, there are infinite combinations of motors motions generating the same output translation, Equation (3). However, a set of relevant combinations of motors speeds has been selected to define the EMA operative modes,

Table 1. Fault-tolerant EMA operative modes.

Mode	Motor 1 State	Motor 2 State	Screwshaft Motion	Motors Speeds Constraint	Output Speed
ASB (fail-operative)	Active	Braked & De-energized	Roto-translation	${\dot{\theta }}_2 = 0$	$b_1{\dot{\theta }}_1$
SBA (fail-operative)	Braked & De-energized	Active	Roto-translation	${\dot{\theta }}_1 = 0$	$b_2{\dot{\theta }}_2$
AAPT (fail-operative)	Active	Active	Translation	${\dot{\theta }}_1 = p_{s2}/p_{s1}{\dot{\theta }}_2$	$\left(b_1{p}_{s2}/p_{s1}+b_2\right){\dot{\theta }}_2$
AAPR (fail-operative)	Active	Active	Rotation	${\dot{\theta }}_1 = {\dot{\theta }}_2$	$\left(b_1+b_2\right){\dot{\theta }}_2$
AAEP (normal operation)	Active	Active	Roto-translation	${\dot{\theta }}_1 = {\alpha }_{EP}{\dot{\theta }}_2$	$\left(b_1{\alpha }_{EP}+b_2\right){\dot{\theta }}_2$

.

In active/stand-by modes (ASB and SBA in Table 1), one motor rotates and the other is de-energized and held by the related brake, so that the screwshaft has a roto-translating motion, Equations (1) and (2). In active/active modes, both motors rotate and, depending on their speeds, the motion of the screwshaft can range from roto-translation to pure translation or pure rotation (AAPT and AAPR in Table 1). Among all possible active/active modes generating the screwshaft roto-translation, one implies a balanced power split among the motors in quasi-dynamic regime (i.e., at constant motors speeds). This speeds combination, given by Equation (4), is imposed by the EMA control laws if no jamming or motor faults are detected, obtaining the so-called “active-active equal power” mode (AAEP in Table 1).

$${\dot{\theta }}_1 = {\alpha }_{EP}{\dot{\theta }}_2 = \frac{p_{s2}\left(p_{s1}-p_{s3}\right)}{p_{s1}\left(p_{s1}+p_{s3}\right)}{\dot{\theta }}_2,$$

(4)

2.3. Electronic Control Unit and Sensors

The electronic section of the EMA includes dual ECUs (whose architectural block diagram is depicted in Figure 2) for the independent drive of the motors, and each ECU is composed of two boards: one dedicated to the closed-loop control (CON board) and the other to the condition-monitoring (MON board).

The CONi board (with i = 1, 2) is connected with the inverter of the i-th motor, which is controlled by a TMS320F28335 Texas Instruments Microcontroller (C2000 real-time series) [46].

The sensing system includes:

• n. 12 current sensors (CSx, with x = a, b, c), two ones per each phase of the motors;
• n. 4 resolvers (RES), two ones per each motor;
• n. 2 Linear Variable Differential Transformers (LVDT), measuring the output shaft position;
• n. 2 cone-type proximity sensors (CTP), monitoring the screwshaft translation;
• n. 4 temperature sensors, monitoring the heating of motors (MTS) and the heating of the inverters (ITS).

Concerning data exchange among the ECU boards, the MONi board (with i = 1, 2) is interfaced with:

• the i-th Flight Control Computer (FCC), via RS422 communication;
• the CONi board, via Serial Peripheral Interface (SPI) bus;
• the other monitor board, via dual redundant CAN bus;
• one of the two resolvers of the i-th motor, via SPI bus;
• one of the two LVDTs, via SPI bus;
• one of the two set of current sensors of the i-th motor;
• the brake of the i-th motor, via General Purpose Input/Output interface;
• one of the two cone-type proximity sensor;
• one of the two motor temperature sensors;
• one of the two inverter temperature sensors.

while the CONi board is interfaced with:

• the MONi board, via SPI bus;
• the other control board, via CAN bus;
• one of the two resolvers of the i-th motor, via SPI bus;
• one of the two set of current sensors of the i-th motor.

Table 2. EMA control sensors data [47,48,49,50].

Component	Model	Range	Accuracy
Current sensor	Allegro ACS714	±30 A	0.3 A
Resolver	Tamagawa TS2651N141E78	±π rad	0.0029 rad
Resolver analog-to-digital converter	Analog Devices AD2S1210	±π rad	0.0014 rad
LVDT	Meggitt DJD100759C0	±0.037 m	5 × 10−5 m

reports the main characteristics of the sensors used for the closed-loop control and condition-monitoring functions.

2.4. Condition-Monitoring System

The condition-monitoring system developed for each MON_i board essentially includes (together with signal-based threshold checks on overheating, communication bus consistency and hardware components functionality) the following model-based algorithms:

• Motion Monitor;
• Currents Monitor;
• Jamming Monitor.

2.4.1. Motion Monitor

The Motion Monitor calculates voted position values for the two motors, and the output shaft, by using triple redundant signals. This is obtained analytically, by combining the measurements of the dual sensors with model-based reconstructions derived from kinematic relationships. In fact, by reformulating Equation (3) in terms of displacements, once that two out of the three quantities ${\theta }_1$, ${\theta }_2$ and $x_o$ are known, the resting one can be estimated. Taking into account that the LVDTs provide two linear feedback signals (LF1 and LF2) and that two consolidated angle feedbacks (CAF1 and CAF2, each one obtained by the resolvers related to the i-th motor) are available, five position estimates can be calculated, Equations (5)–(9)

EAF11 = (LF1 − b₂ CAF2)/b₁,

(5)

EAF12 = (LF2 − b₂ CAF2)/b₁,

(6)

EAF21 = (LF1 − b₁ CAF1)/b₂,

(7)

EAF22 = (LF2 − b₁ CAF1)/b₂,

(8)

ELF = b₁ CAF1 + b₂ CAF2,

(9)

The system can thus apply a triple redundancy on each position signal, up to obtain voted output position feedback (VLF) as well as voted angle feedbacks (VAF1 and VAF2), and it is capable of tolerating up to two position sensors faults, except the fault of two resolvers located on different motors,

Table 3. Motion Monitor: EMA operative states resulting from position sensors faults.

n. of Sensor Faults	CAF1	CAF2	LF1	LF2	VAF1	VAF2	VLF	EMA State
0	OK	OK	OK	OK	CAF1	CAF2	LF1	OK
					EAF11	EAF21	LF2
					EAF12	EAF22	ELF
1	Fail	OK	OK	OK	EAF11	CAF2	LF1	OK
					EAF12		LF2
	OK	Fail	OK	OK	CAF1	CAF2	LF1
						EAF22	LF2
	OK	OK	Fail	OK	CAF1	CAF2	LF2
					EAF12	EAF22	ELF
	OK	OK	OK	Fail	CAF1	CAF2	LF1
					EAF11	EAF21	ELF
2	Fail	OK	Fail	OK	EAF12	CAF2	LF2	OK
	Fail	OK	OK	Fail	EAF11	CAF2	LF1	OK
	OK	Fail	Fail	OK	CAF1	EAF22	LF2	OK
	OK	Fail	OK	Fail	CAF1	EAF21	LF1	OK
	OK	OK	Fail	Fail	CAF1	CAF2	ELF	OK
	Fail	Fail	OK	OK	No signal	No signal	LF1	Fail
							LF2

.

2.4.2. Currents Monitor

The Currents Monitor aims to detect and isolate current sensors faults and motor phases faults, as well as to calculate voted values of phase currents. Also in this case, a model-based technique is used: when a three-phase PMSM correctly operates, the sum of its phase currents is constant (near to zero). From the six current measurements related to the i-th motor (I_{x i Y}, where x = a, b, c is the motor phase; Y = C, M is the CON or MON sensors set), eight sums of currents can be obtained, Equation (10).

$${\Sigma }_i = \left[\begin{array}{cccccc}1& 1& 1& 0& 0& 0\\ 1& 1& 0& 0& 0& 1\\ 1& 0& 0& 0& 1& 1\\ 1& 0& 1& 0& 1& 0\\ 0& 1& 0& 1& 0& 1\\ 0& 1& 1& 1& 0& 0\\ 0& 0& 1& 1& 1& 0\\ 0& 0& 0& 1& 1& 1\end{array}\right]\left[\begin{array}{l}{I}_{ia\mathrm{C}}^{}\hfill \\ I_{ib\mathrm{C}}^{}\hfill \\ I_{icC}^{}\hfill \\ I_{iaM}^{}\hfill \\ I_{ibM}^{}\hfill \\ I_{icM}^{}\hfill \end{array}\right],$$

(10)

As reported in

Table 4. Currents Monitor: groups and classes for FDI of sensors and coil faults to the i-th motor.

Group	Sums of Currents	Common Measurement	Class
GaC	Σi1, Σi2, Σi3, Σi4	Ii a C	Ca
GaM	Σi5, Σi6, Σi7, Σi8	Ii a M
GbC	Σi1, Σi2, Σi5, Σi6	Ii b C	Cb
GbM	Σi3, Σi4, Σi7, Σi8	Ii b M
GcC	Σi1, Σi4, Σi6, Σi7	Ii c C	Cc
GcM	Σi2, Σi3, Σi5, Σi8	Ii c M

, by selecting the sums of currents (Σ_{i h}, with h = 1, …, 8) that contain the same measurement, it is possible to construct six groups (G_aC, G_bC, G_cC, G_aM, G_bM and G_cM). Then, by selecting the groups of sums of currents that also contain the same current data, three classes are obtained (C_a, C_b, C_c).

The algorithm generates the following diagnostic outputs:

• if all sums of currents do not exceed a predefined threshold, no fault is detected;
• if the threshold is exceeded by all the sums of currents belonging to a group, a fault of the sensor providing the common measurement is detected;
• if the threshold is exceeded by all the sums of currents included in a class, a fault of the common coil included in the class is detected.

2.4.3. Jamming Monitor

The Jamming Monitor algorithm is composed of two sections executed in series, dedicated to the fault detection on the motors and the screwshaft, respectively.

In particular, for each k-th monitoring sample (k = 1, 2, …), the algorithm defines a fault flag vector F_mon, in which four Boolean variables identify the occurrence of the four possible jamming events (F_mon|1 and F_mon|2 for the motors jamming, F_mon|ssRJ and F_mon|ssTJ for the screwshaft rotational and translational jamming respectively), Equation (11)

$$F_{mon}^{(\mathrm{k})} = {\left[\begin{array}{cccc}{\mathrm{F}}_{\mathrm{mon}|1}^{(\mathrm{k})}& {\mathrm{F}}_{\mathrm{mon}|2}^{(\mathrm{k})}& {\mathrm{F}}_{\mathrm{mon}|\mathrm{ssRJ}}^{(\mathrm{k})}& {\mathrm{F}}_{\mathrm{mon}|\mathrm{ssTJ}}^{(\mathrm{k})}\end{array}\right]}^T,$$

(11)

If no jamming is detected, all the fault flag vector components are 0 (i.e., false Boolean values). Otherwise, if a jamming is detected, at least one fault flag vector component is 1 (i.e., true Boolean value). The jamming is also isolated if only one vector component is 1.

Each algorithm section uses a generalized Jamming-Detection Logic (JDL), whose flow chart is reported in Figure 3: the fault flag (F_mon) is generated by elaborating a monitor signal (ε_mon) sampled at the monitoring frequency (f_mon). If the monitor signal is lower than a pre-defined threshold (ε_th), a fault counter (c_mon) is increased by 2; if the threshold is exceeded, the fault counter is decreased by 1 if it is positive at the previous step, otherwise it is held at 0. The jamming is detected, when the fault counter exceeds a pre-defined value (c_mon max, which basically defines the FDI latency).

In the first section of the algorithm, the jamming related to the i-th motor (i = 1, 2) is targeted. The monitor signal (ε_mon|i) is defined as the variation of the motor rotation (θ_i) between two samples, Equation (12),

$${\epsilon }_{\mathrm{mon}|i}^{(\mathrm{k})} = \left|{\theta }_i^{(\mathrm{k})}-{\theta }_i^{(\mathrm{k}-1)}\right|,$$

(12)

$$\{\begin{array}{ll}{\mathrm{F}}_{\mathrm{mon}|i}^{(\mathrm{k})} = JDL\left({\epsilon }_{\mathrm{mon}|i}^{(\mathrm{k})}\right)\hfill & \mathrm{if}\hspace{1em}\left|{\theta }_{id}^{(\mathrm{k})}-{\theta }_{id}^{(\mathrm{k}-1)}\right| \ge {\epsilon }_{di}\hfill \\ F_{mon}^{(\mathrm{k})} = 0\hfill & \mathrm{if}\hspace{1em}\left|{\theta }_{id}^{(\mathrm{k})}-{\theta }_{id}^{(\mathrm{k}-1)}\right| < {\epsilon }_{di}\hfill \end{array},$$

(13)

and the algorithm operates as follows, Equation (13): if the i-th motor rotation demand (θ_{i d}) between two samples varies for more than a pre-defined threshold (ε_{d i}), the JDL is executed to define the related fault flag (F_mon|i); otherwise, all fault flags are set to 0 and the system operates normally (AAEP mode). If a motor jamming is detected by the JDL, the related fault flag becomes true and the control laws are reconfigured to engage the appropriate active/stand-by mode (ASB or SBA).

The second section of the algorithm is instead dedicated to the screwshaft jamming FDI, which can result in a rotational or in a translational stuck, due to the jamming of the internal or external screw-nut couplings respectively. A model-based approach is again applied. In normal conditions (AAEP mode), the motors speeds are correlated via Equation (4), while, if there is a screwshaft rotation jamming, the mechanical train imposes that ${\dot{\theta }}_1 = p_{s2}/p_{s1}{\dot{\theta }}_2$ (given by ${\dot{\theta }}_{ss} = 0$ in Equation (1)). Otherwise, if the jamming causes a translation stuck, the transmission imposes ${\dot{\theta }}_1 = {\dot{\theta }}_2$ (given by ${\dot{x}}_{ss} = 0$ in Equation (2)).

Starting from these considerations, the screwshaft jamming is detected by:

• reconstructing, via Equation (3), an output speed estimate (${\dot{x}}_{oe}$) from the motor angle feedbacks, and an output speed demand (${\dot{x}}_{od}$) from the motors speed demands;
• performing a threshold check on an output speed residual (${\delta }_{sr}$), calculated via Equation (14).

$${\delta }_{sr}^{(\mathrm{k})} = \left|{\dot{x}}_{od}^{(\mathrm{k})}-{\dot{x}}_{oe}^{(\mathrm{k})}\right| = \left|b_1\left({\dot{\theta }}_{1d}^{(\mathrm{k})}-{\dot{\theta }}_1^{(\mathrm{k})}\right)+b_2\left({\dot{\theta }}_{2d}^{(\mathrm{k})}-{\dot{\theta }}_2^{(\mathrm{k})}\right)\right|,$$

(14)

It is worth noting that, if no jamming is occurred, δ_sr is very small, due to the speed tracking of the EMA control laws, while it is large if there is a jamming. In fact, if we impose the kinematic relationships with or without a screwshaft jamming, the output speed estimate can be approximated via Equation (15) and δ_sr is given by Equation (16).

$${\dot{x}}_{oe}^{(\mathrm{k})}\approx \{\begin{array}{ll}\left(b_1{\alpha }_{EP}+b_2\right){\dot{\theta }}_2^{(\mathrm{k})}\hfill & \mathrm{No} \mathrm{jam}\hfill \\ \left(b_1{p}_{s2}/p_{s1}+b_2\right){\dot{\theta }}_2^{(\mathrm{k})}\hfill & \mathrm{if} {\dot{\theta }}_{ss} = 0\hfill \\ \left(b_1+b_2\right){\dot{\theta }}_2^{(\mathrm{k})}\hfill & \mathrm{if} {\dot{x}}_{ss} = 0\hfill \end{array},$$

(15)

$${\delta }_{sr}^{(\mathrm{k})}\approx \{\begin{array}{ll}0\hfill & \mathrm{No} \mathrm{jam}\hfill \\ \left|b_1\left({\alpha }_{EP}-p_{s2}/p_{s1}\right){\dot{\theta }}_2^{(\mathrm{k})}+\left(b_1{\alpha }_{EP}+b_2\right)\left({\dot{\theta }}_{2d}^{(\mathrm{k})}-{\dot{\theta }}_2^{(\mathrm{k})}\right)\right|\hfill & \mathrm{if} {\dot{\theta }}_{ss} = 0\hfill \\ \left|b_1\left({\alpha }_{EP}-1\right){\dot{\theta }}_2^{(\mathrm{k})}+\left(b_1{\alpha }_{EP}+b_2\right)\left({\dot{\theta }}_{2d}^{(\mathrm{k})}-{\dot{\theta }}_2^{(\mathrm{k})}\right)\right|\hfill & \mathrm{if} {\dot{x}}_{ss} = 0\hfill \end{array},$$

(16)

In case of jamming faults, the first contributions at second hands in Equation (16) have large amplitudes (while the second ones are minor, due to motors speed tracking), i.e., any screwshaft jamming implies that δ_sr is large.

The screwshaft jamming isolation (i.e., rotational or translational stuck) is finally obtained by executing two JDL algorithms in parallel, as summarized by Equations (17) and (18).

$$\{\begin{array}{l}{\epsilon }_{\mathrm{mon}|\mathrm{ssRJ}}^{(\mathrm{k})} = \left|{\dot{\theta }}_1^{(\mathrm{k})}-p_{s2}/p_{s1}{\dot{\theta }}_2^{(\mathrm{k})}\right|\\ {\epsilon }_{\mathrm{mon}|\mathrm{ssTJ}}^{(\mathrm{k})} = \left|{\dot{\theta }}_1^{(\mathrm{k})}-{\dot{\theta }}_2^{(\mathrm{k})}\right|\end{array},$$

(17)

$$F_{mon}^{(k)}=\{\begin{array}{cc}0& \mathrm{if} {\delta }_{sr}^{(\mathrm{k})} < {\epsilon }_s\\ {\left[\begin{array}{cccc}0& 0& JDL\left({\epsilon }_{\mathrm{mon}|\mathrm{ssRJ}}^{(\mathrm{k})}\right)& JDL\left({\epsilon }_{\mathrm{mon}|\mathrm{ssTJ}}^{(\mathrm{k})}\right)\end{array}\right]}^T& \mathrm{if} {\delta }_{sr}^{(\mathrm{k})} \ge {\epsilon }_s\end{array},$$

(18)

Concerning the parameters of the Jamming Monitor algorithm, they have been defined (

Table 5. Parameters of the Jamming Monitor algorithm.

Parameter	Value	Unit	Definition Criterion
fmon	2000	Hz	ECU limitation
εd 1 = εd 2	2.5 × 10−3	rad	FDI latency < 20 ms
εth|1 = εth|2	0.05	rad	FDI latency < 20 ms
cmonmax|1 = cmon max|2	16	--	FDI latency < 20 ms
εs	0.12 × 10−3	m/s	FDI latency < 100 ms
εth|ssRJ	2	rad/s	FDI latency < 100 ms
εth|ssTJ	1	rad/s	FDI latency < 100 ms
cmon max|ssRJ = cmon max|ssTJ	20	--	FDI latency < 100 ms

), by taking into account the available computational resources of the ECUs, which have limited the monitoring sampling rate to 2 kHz, and by imposing that the following maxima FDI latencies:

• 100 ms for the screwshaft jamming faults;
• 20 ms for the motors jamming, to account for additional delays due to the brake activation and engagement.

2.5. Nonlinear Dynamic Modelling

As described in Section 2.4, the condition-monitoring algorithms are designed via deterministic model-based approach, by performing threshold checks on monitor signals generated by theoretical predictions of the system behaviour. In practical terms, these predictions can significantly deviate from the actual dynamics (e.g., the sums of the phase currents are not constant, the mechanical train compliance alters the validity of the “rigid” kinematic relationships, the closed-loop bandwidth limitations imply that the motors speed tracking is not ideal), so the FDI effectiveness is generally questionable and it must be verified well before the EMA manufacturing.

The development of a high-fidelity dynamic model and its consequent experimental validation are thus of paramount importance for a deterministic model-based condition-monitoring, especially for the failure transient characterisation. In previous works by the authors [44,45], a preliminary verification of performances were obtained, but the accuracy in terms of motors currents response was poor and the experimental validation was limited to the normal operative condition. Here, an enhanced model of the EMA dynamics is proposed, which has been experimentally validated with reference to all the five operative modes of the EMA (Table 1). The model is composed of:

• an electromechanical section, simulating

  ○

  FOC current dynamics (differently from [44,45], both quadrature and direct currents are simulated);

  ○

  5-degree-of-freedom mechanical transmission, with equations of motions related to motors rotation, output translation and screwshaft rotation and translation;

  ○

  sliding friction on motors and output shaft described via combined “Coulomb–tanh” model [51,52], with optimized parameters with respect to [44,45];

  ○

  mechanical endstrokes (no model was included in [44,45]);

  ○

  jamming faults, implying the sudden block of motors rotation, screwshaft rotation or screwshaft translation;

• an electronic section, including

  ○

  sensors errors and nonlinearities (bias, noise, resolution);

  ○

  commands nonlinearities (saturation, rate limiting);

  ○

  digital signal processing at 2 kHz sampling rate for both monitoring (Table 5) and closed-loop control functions.

As far as the normal operation is concerned (i.e., no faults), the electro-mechanical section of the model, schematically represented by Figure 4, is governed by Equations (19)–(24),

$$L_q{\dot{I}}_{q i} = V_{q i} - R{I}_{q i} - \left(k_t + L_d{n}_d{I}_{d i}\right){\dot{\theta }}_i\hspace{1em}\hspace{1em}\mathrm{with}\hspace{1em}i = 1, 2,$$

(19)

$$L_d{\dot{I}}_{d i} = V_{d i} - R{I}_{d i} + L_q{n}_d{I}_{q i}{\dot{\theta }}_i\hspace{1em}\hspace{1em}\mathrm{with}\hspace{1em}i = 1, 2,$$

(20)

$$J_i{\ddot{\theta }}_i = k_t{I}_{q i} - T_{fr i}\tanh \left(\frac{{\dot{\theta }}_i}{{\omega }_{fr i}}\right) - d_i\left({\dot{\theta }}_i-{\dot{\theta }}_{ss}-\frac{2\pi {\dot{x}}_{ss}}{p_{s i}}\right) - k_i\left({\theta }_i-{\theta }_{ss}-\frac{2\pi x_{ss}}{p_{s i}}\right) \mathrm{with} i = 1, 2,$$

(21)

$$\begin{array}{l}{J}_{ss}{\ddot{\theta }}_{ss} = d_1\left({\dot{\theta }}_1-{\dot{\theta }}_{ss}-\frac{2\pi {\dot{x}}_{ss}}{p_{s1}}\right) + k_1\left({\theta }_1-{\theta }_{ss}-\frac{2\pi x_{ss}}{p_{s1}}\right)+d_2\left({\dot{\theta }}_2-{\dot{\theta }}_{ss}-\frac{2\pi {\dot{x}}_{ss}}{p_{s2}}\right) +\dots \\ \dots + k_2\left({\theta }_2-{\theta }_{ss}-\frac{2\pi x_{ss}}{p_{s2}}\right) - d_3\left[{\dot{\theta }}_{ss}+\frac{2\pi \left({\dot{x}}_{ss}-{\dot{x}}_o\right)}{p_{s3}}\right] - k_3\left[{\theta }_{ss}+\frac{2\pi \left(x_{ss}-x_o\right)}{p_{s3}}\right]\end{array},$$

(22)

$$\begin{array}{l}{m}_{ss}{\ddot{x}}_{ss} = \frac{2\pi d_1}{p_{s1}}\left({\dot{\theta }}_1-{\dot{\theta }}_{ss}-\frac{2\pi {\dot{x}}_{ss}}{p_{s1}}\right) + \frac{2\pi k_1}{p_{s1}}\left({\theta }_1-{\theta }_{ss}-\frac{2\pi x_{ss}}{p_{s1}}\right) + \frac{2\pi d_2}{p_{s2}}\left({\dot{\theta }}_2-{\dot{\theta }}_{ss}-\frac{2\pi {\dot{x}}_{ss}}{p_{s2}}\right) +\dots \\ \dots + \frac{2\pi k_2}{p_{s2}}\left({\theta }_2-{\theta }_{ss}-\frac{2\pi x_{ss}}{p_{s2}}\right) - \frac{2\pi d_3}{p_{s3}}\left[{\dot{\theta }}_{ss}+\frac{2\pi \left({\dot{x}}_{ss}-{\dot{x}}_o\right)}{p_{s3}}\right] - \frac{2\pi k_3}{p_{s3}}\left[{\theta }_{ss}+\frac{2\pi \left(x_{ss}-x_o\right)}{p_{s3}}\right]\end{array},$$

(23)

$$m_o{\ddot{x}}_o = F_e - F_{fr o}\tanh \left(\frac{{\dot{x}}_o}{v_{fr o}}\right) + \frac{2\pi d_3}{p_{s3}}\left[{\dot{\theta }}_{ss}+\frac{2\pi \left({\dot{x}}_{ss}-{\dot{x}}_o\right)}{p_{s3}}\right] + \frac{2\pi k_3}{p_{s3}}\left[{\theta }_{ss}+\frac{2\pi \left(x_{ss}-x_o\right)}{p_{s3}}\right],$$

(24)

where V_{q i}, V_{d i}, i_{q i} and i_{d i} are the quadrature and direct voltages and currents of the i-th motor, J_i and J_ss are the motors and the screwshaft inertias, m_ss and m_o are the screwshaft and output shaft masses, R is the motors phase resistance, L_d and L_q are the motors inductances in the rotor frame (which are identical in the reference EMA, because the PMSMs have surface-mounted magnets), k_t is the motors torque constant, n_d is the number of motors pole pairs, F_e is the external load, k_m and d_m are the stiffness and damping referred to the roto-translating motion deformation of the m-th screw-nut coupling (with m = 1, 2, 3), while T_{fr i}, ω_{fr i}, F_{fr o} and v_{fr o} are the parameters of the “Coulomb–tanh” friction models related to the i-th motor and the output shaft, respectively.

Concerning the jamming faults, they are simulated as instantaneous stops of the moving element, as described by Equation (25),

$$\dot{z} =\{\begin{array}{ll}{\dot{z}}_0 + {\displaystyle {\int }_0^t\ddot{z}dt}\hfill & 0 \le t < t_f\hfill \\ 0\hfill & t \ge t_f\hfill \end{array}\hspace{1em};\hspace{1em}z =\{\begin{array}{ll}{z}_0 + {\displaystyle {\int }_0^t\dot{z}dt}\hfill & 0 \le t < t_f\hfill \\ z\left(t_f\right)\hfill & t\ge t_f\hfill \end{array},$$

(25)

in which z is the position of the element interested by the jamming fault (i.e., z = θ₁ or z = θ₂ for motors jamming and z = θ_ss or z = x_ss for screwshaft rotational or translational jamming), t_f is the time at which the fault is injected, while z₀ and ${\dot{z}}_0$ are the initial position and speed.

It is worth noting that the proposed model represents a balance between prediction accuracy, objectives of the study and complexity of the model itself. More accurate simulations could include mechanical freeplay [30], sophisticated friction models [51,52] and iron losses in the motor [53,54], but the inclusion of these model features would entail minor effects for the examined application. In particular, the mechanical freeplay, due to the screw-nut couplings preload, was extremely small in the reference EMA and its contribution in the model would have been poor. Similarly, the motor iron losses have been neglected because they depend on electrical frequency, which is relatively small for the reference EMA (<60 Hz,

Table 6. Parameters of the electro-mechanical section of the model.

Parameter	Meaning	Value	Unit
ps1	Lead of the motor 1 ball-nut	−15 × 10−3	m
ps2	Lead of the motor 2 ball-nut	15 × 10−3	m
ps3	Lead of the output shaft ball-nut	−3.175 × 10−3	m
J1 = J2	Motors inertia	6.5 × 10−3	kg∙m2
Jss	Screwshaft inertia	6.5 × 10−3	kg∙m2
mss	Screwshaft mass	0.9	kg
mo	Output shaft mass	1.3	kg
R	Motors phase resistance	0.41	ohm
Ld	Motors inductance on direct axis	2 × 10−3	H
Lq	Motors inductance on quadrant axis	2 × 10−3	H
kt	Motors torque constant	0.97	N∙m/A
nd	Motors pole pairs	15	--
Vsupply	DC voltage supply	28	V
Iq max	Maximum quadrature current	25	A
ωm max	Maximum motors speed	25	rad/s
xo max	Midstroke displacement	25 × 10−3	m
k1 = k2	Stiffness of the motors ball-nuts	3.67 × 105	N∙m/rad
k3	Stiffness of the output shaft ball-nut	9.8 × 103	N∙m/rad
d1 = d2	Damping of the motors ball-nuts	9.73	N∙m∙s/rad
d3	Damping of the output shaft ball-nut	0.39	N∙m∙s/rad
Tfr 1	Coulomb friction on motor 1	5.73	N∙m
ωfr 1	Coulomb velocity on motor 1	0.15	rad/s
Tfr 2	Coulomb friction on motor 2	2.68	N∙m
ωfr 2	Coulomb velocity on motor 2	0.15	rad/s
Ffr o	Coulomb friction on output shaft	15	N
vfr o	Coulomb velocity on output shaft	0.001	m/s

) and their impact on actuator dynamics in the positiontracking frequency range (<20 Hz) is expected to be minor. On the other hand, more accurate friction models (including load and temperature dependence) could significantly enhance the simulation, but a simplified approach has been preferred for both the lack of detailed information and to limit the number of model parameters.

The EMA model has been developed in the Matlab–Simulink–Stateflow environment and the numerical simulation is solved by the Runge–Kutta method, with 10⁻⁵ s integration step. It is worth noting that the choice of a fixed-step solver is not strictly related to the objectives of this work, in which the model (once experimentally validated) is used for “off-line” simulations testing the FDI algorithms, but it has been selected for the next steps of the project, when the FDI system will be implemented in the ECU boards via automatic Matlab compiler and executed in “real-time”.

The parameters of the electro-mechanical section of the model are given in Table 6.

2.6. ECU Prototype for Experimental Tests

Since one of the main objectives of the research was to assess the FDI capabilities of the condition-monitoring system in case of mechanical jamming or motors faults before the final design of the dual CON-MON ECUs, an intermediate step has been made, by developing a prototype simplex ECU.

In the prototype ECU (whose block diagram is reported in Figure 5), the condition-monitoring algorithms and the redundancy management functions are not implemented, but the fault-tolerant closed-loop control is the same of the final design.

Considering that, as outlined in Table 1, the relationship between the output shaft speed and the motors speeds varies with the operative mode, some kind of reconfiguration technique must be implemented to assure the system stability and the dynamic performances in all modes. In the proposed design, based on three nested loops, on motors currents, motors speeds and output shaft position,

• all the regulators implement proportional/integral actions on tracking error signals, plus anti-windup function with back-calculation algorithm [55] to compensate for commands saturation;
• the innermost loops on motors currents and motors speeds are processed at 2 kHz and use fixed parameters (i.e., they don’t vary with EMA mode). They provide tracking bandwidths of 420 Hz and 58 Hz, on currents and speeds, respectively;
• the reconfiguration strategy is applied to the outermost loop only, which is processed at 1 kHz (due to a prototype ECU limitation) and it can be reconfigured through a dedicated mode switching signal.

In the dual CON-MON ECUs, the mode switch comes from the condition-monitoring algorithms, while in the prototype ECU it is imposed by the operator via the test rig, together with the EMA position demand (Figure 5).

Thanks to this prototype ECU, the system dynamic performances have been characterized in both frequency and time domains for each operative mode, aiming to validate the simulation results provided by the EMA model and to permit the design of the condition-monitoring algorithms via model-based approach.

3. Results and Discussion

3.1. Experimental Validation of the Model

Excerpts of the model validation results are reported from Figure 6, Figure 7, Figure 8, Figure 9, Figure 10 and Figure 11.

The most relevant time-domain responses are reported from Figure 6, Figure 7 and Figure 8, with reference to both active/stand-by modes and the normal operation (AAEP mode), by focusing the attention on position and currents dynamics. All the time-domain responses are referred to position tracking tests in which the EMA is commanded to follow a large-amplitude rate-limited square-wave signal under 100 kN/m spring-type load, which is roughly representative of the worst-case flight conditions. More precisely, by referring to Equation (24), the test have been carried out by imposing

$$F_e = -k_e\left(x_o + \frac{x_{o \max }}{4}\right),$$

(26)

where k_e = 10⁵ N/m and x_o max = 0.025 m. Thus, from Figure 6, Figure 7 and Figure 8, the external load is opposite to (aiding) the EMA motion when the output speed is positive (negative).

Satisfactory results are generally obtained, with concrete enhancement of the motor currents predictions with respect to [44,45]. In SBA mode, the currents prediction is accurate in both steady-state and transient phases, with overall accuracy of 2 A, Figure 6b. The predictions in terms of position response are more accurate (it is expected since the signal is characterised by a low-frequency content), with errors lower than 0.15 mm (0.3% of the EMA full stroke), Figure 6a. In ASB mode, the errors on currents simulation during steady-state conditions are limited to 2 A (i.e., 8% of the maximum current), but the errors tend to increase at the abrupt transients derived from command signal variations and when the EMA performs a dynamic position tracking with aiding load, Figure 7b. This behaviour essentially depends on the simplified friction model used for the EMA simulation: a load-dependant model could probably enhance the results and further developments of the research will take into account this point. Concerning the position response, it anyway exhibits a good accuracy, with errors lower than 0.25 mm (0.5% of the EMA full stroke). It is also worth noting that both simulation and experiment point out that the position response is characterised by a slight overshoot (0.75 mm), related to a too moderate anti-windup action in the position regulator, Figure 7a. Similar results characterise the simulation in AAEP mode (Figure 8), even if the prediction errors on position response increase during the overshoot phase, by reaching 0.8 mm (1.6% of the EMA full stroke).

Excerpts of results of the frequency-domain validation of the model are then reported from Figure 9, Figure 10 and Figure 11, in which the position tracking responses to sinusoidal demand waves of 0.5 mm (i.e., 1% of the EMA full stroke) under a 2 kN compressive load are proposed in terms of amplitude and phase of the first harmonic signal component. The plots also report the speed and acceleration limits of the EMA and it can be verified that, in the examined frequency range and for all operative modes, the system works without encountering saturation phenomena.

The frequency responses highlight that the model is very accurate for small-displacement dynamics (relevant for flight control applications): for input frequencies up to 10 Hz, the prediction errors are actually comparable to sensors accuracy (i.e., 0.1% of the EMA full stroke).

3.2. Jamming Failure Transient Characterisation

The validated model is then used to verify the condition-monitoring performances, by injecting the jamming faults in different points of the mechanical train and by evaluating the FDI latency to implement the correct operative mode switching and the control laws reconfiguration. The most relevant results are reported from Figure 12, Figure 13 and Figure 14 and are related to the motor 2 jamming and to the screwshaft jamming respectively. To evaluate the effectiveness of the Jamming Monitor (JM), the responses in terms of output position and motors speeds are reported with and without the JM execution.

All the simulations are carried out by commanding the EMA, under 2.4 kN compressive load, to track a large-displacement demand (±18 mm, i.e., 75% of the EMA full stroke) at maximum speed and by simulating a jamming when the actuator reaches its midstroke (i.e., at 2.03 s).

The simulation points out that in case of motor 2 jamming, causing the operation to switch from AAEP to ASB mode (Figure 12), the FDI latency is extremely small (10 ms, similar to the one obtained in [44,45]), but immediately after the fault compensation the EMA tends to diverge from the correct position tracking, Figure 12a. This behaviour results from an imperfect reconfiguration of the position regulator (related to integral operator initialization), which implies a reverse speed demand to the active motor, Figure 12b.

The failure transient related to the screwshaft translational jamming, causing the operation to switch from AAEP to AAPR mode (Figure 13), is effectively minimized by the JM (FDI latency is 15 ms, larger than the one obtained in [44,45]), even if the EMA dynamic performances after the fault are significantly reduced (as also confirmed by Figure 10a). The faulty dynamics without JM is dramatically negative, since the EMA reacts to the jamming by oppositely diverging with respect to the position demand and it rapidly reaches the endstroke, Figure 13a. It is worth noting that the model enhancement has permitted to correctly reproduce this critical behaviour, by including the simulation of the impact on mechanical endstrokes.

Finally, the results related to the screwshaft rotational jamming, causing the operation to switch from AAEP to AAPT mode (Figure 14), point out that the FDI latency is more concrete (90 ms, again larger than the one obtained in [44,45]), but no relevant variation in tracking performances is observable after the fault (Figure 14a), because the reconfiguration of motors speeds demands generated by the fault-tolerant control laws are very close to the ones before the fault, Figure 14b.

4. Conclusions

A condition-monitoring system for the detection and isolation of faults in a fault-tolerant EMA for flight control applications is developed via deterministic model-based approach. The monitoring algorithms are designed and verified by using a detailed nonlinear model of the EMA, which simulates, by physical first-principles, the most relevant phenomena involved in the system dynamics (structural compliance of the mechanical train, field-oriented control of the motors currents, sliding friction, digital signal processing, sensors errors, major faults). The model is experimentally validated in both time and frequency domains for normal operative conditions and with jamming faults. The results demonstrate that the EMA is capable of operating after a mechanical jamming. A particular attention is paid to the failure transient characterisation (strongly relevant for aircraft applications), pointing out that the monitoring algorithms, composed of two sections dedicated to the blocks of motors and differential screws, respectively, succeed in detecting and isolating the fault at different locations of the mechanical transmission, with fault latency lower than 90 ms.