Force Fight and Its Elimination in a Prototype of a Redundant Direct-Drive Avionic Actuator

Featured Application

Redundancy is essential in avionic applications but force fight can appear in redundant actuators. In this paper, this phenomenon is highlighted and eliminated in a redundant direct-drive actuator. The used approach can be implemented for a wide range of applications.

Abstract

Nowadays, in aeronautical applications, rigorous reliability requirements are high constraints for embedded systems. Therefore, material redundancy is adopted to ensure safety whatever operation conditions may be. In the design of a direct-drive actuator for a specific application, redundancy is taken into account using a compound of four three-phase permanent magnet synchronous machines (PMSM). Each two electric machines are mounted in series sharing the same rotor with a common through shaft. The stators of each two electric machines are designed and manufactured as a six-phase machine. For each machine, power supply, sensors, and control loops are independent. In the characterization of the designed actuator and in the validation of its specific control in healthy operation mode and in faulty operation mode, taking into account the force fight phenomenon between the motor lanes, a specific test bench is developed. The aim of this paper is to highlight this phenomenon in faulty operation mode and to develop an easily implementable monitoring architecture, in order to eliminate it. Finally, with the proposed approach of monitoring, the force fight phenomenon is eliminated in faulty operation mode keeping the same performance as in healthy operation mode.

1. Introduction

Nowadays industries require electrical rotating machines to be more and more efficient. Their use in embedded systems also needs mass optimization according to specifications. Among electrical machines, permanent magnet synchronous machines (PMSM) with inner magnets were selected as good technology candidates [1] for this type of application. The advantage of this technology is related to the high and constant torque in the operation range at low velocity. Besides, performance, robustness, and efficiency are higher in comparison to other technologies [2].

In critical systems such as aircraft, satellites, robots, and special space vehicles, simplex structured actuators are unable to satisfy the reliability requirements. Therefore, an actuator with redundant motor architecture has been developed to deal with this problem [3,4]. The redundancy can have several forms that depend on the safety requirements. In our case, redundancy in the designed direct-drive actuator is realized using permanent magnet synchronous machines (PMSM) as a main component, called Brushless Alternative Current (BLAC) motor. According to the application specifications, a compound of four PMSM was designed [4]. Finally, for normal operation with any fault, each machine provides a quarter of the total motor torque of the designed actuator to compensate the load torque.

The major problem of material redundancy resides in the force fight phenomenon between the active electric machines. In this case, electric machines may enter in conflict during their operation [5,6]. Instead of all being in motor mode to provide a quarter of the total torque in normal operation, some of them can provide a resistive torque to the others. The position control loops associated with each machine provide the requested motor torque. This phenomenon creates abnormal operation of the direct drive actuator involving current consumption with thermal rise and possibly instability and/or decrease in performance.

To eliminate this abnormal behavior, some faults are identified as responsible for this phenomenon and some monitoring approaches are suggested to create a communication protocol between information feedback and active lanes.

In this paper, the first part is devoted to the designed direct-drive actuator and its specific control strategy. In the second part, two operation modes are presented; one in healthy operation mode and the second in faulty operation mode where the force fight phenomenon between lanes is described. In the third section, a monitoring mode with some approaches is suggested to eliminate this phenomenon. Finally, an experimental validation is carried out on a specific test bench to show the force fight phenomenon between the lanes and how to eliminate it in order to keep the same performance as in healthy operation mode.

2. The Designed Redundancy Actuator

In Fly Control, new Fly-By-Wire actuator technologies are developed to ensure greater safety and comfort for the pilot and to reduce the weight on board. The redundancy actuator to be designed is based on the same technology. The objective of this project is to develop a new prototype in order to improve the safety function of the specific application, to reduce the effort required of the pilot during the flight and to add other autopilot functions. In the design of this actuator, some constraints are considered; namely embedded mass, power, size, and performance in healthy and faulty modes. An optimization algorithm is developed taking all these constraints into account to design the BLAC machine as the main compound of the actuator.

Besides, for security, the actuator to be designed should respect the catastrophic criticality function where the failure occurrence rate should be less than 1 × 10⁻⁹/Flight Hour (FH). Likewise, each actuating chain of the designed actuator, composed of a BLAC motor, a power stage, and a position sensor should respect the failure occurrence rate imposed by the safety norms (

Table 1. Failure occurrence rate of one actuating chain.

Brushless Alternative Current (BLAC) Motor	Position Sensor	Power Stage
1 × 10−6/Flight Hour (FH)	2 × 10−6/FH	1.5 × 10−4/FH

) for Fly Control.

In avionics, safety norms require redundancy using at least three compounds. In our case, four BLAC motors and architecture to design the actuator are chosen to ensure material redundancy. In the literature, different approaches are presented and suggested. The first approach of redundancy is to use several sets of windings in the same stator called electrical redundancy [3,7]. The second approach sets several stators associated with their rotors on the same transversal shaft, which is known as mechanical redundancy, or serial redundancy. In the design of our actuator, a combination of mechanical and electrical redundancies is chosen.

Table 2. Approaches of redundancy.

Approach	Type of Redundancy	Architecture	Advantages	Drawbacks
Approach 1	Electrical redundancy	• 1 stator • 1 shaft • 1 rotor	• High torque	• 1 system • Big size
Approach 2	Mechanical redundancy	• 4 stators • 4 rotors • 1 transversal shaft	• High torque • 4 series subsystems	• Big size
Approach 3	Electrical and mechanical redundancies	• 2 stators • 2 rotors • 1 transversal shaft	• High torque • 2 configurations • Small size • 2 series subsystems	• Magnetic dependency of the motors

summarizes the advantages and drawbacks of each approach and the combination of both.

Finally, the architecture of the designed actuator is based on Approach 3 with two structures mounted on a common yoke through a transversal shaft. Figure 1 gives a view of the full prototype with the mechanical redundancy using two structures of two six-phase stators and two rotors. For each structure, two temperature sensors; PT100 (Appendix) are fixed in the extremity of each stator. Both measure the ambient temperature of stators during the operation of the actuator. In addition, four position sensors; ECN413 of high precision (Appendix) are mounted separately on the same shaft. Each position sensor provides data to each control loop. Moreover, two supply wires of 6 phases are added for each structure.

In addition, as shown in Figure 2, each structure shows the electrical redundancy using two stators on the same yoke with one rotor and one shaft. Each stator has its own power supply and its own control.

The stator and the rotor of each BLAC motor are designed based on a developed pre-sizing analytical model where constraints are taken into account. Figure 3 shows the designed stators on the yoke. Figure 4 and Figure 5 give a view of the designed rotor of one structure.

For the stator, the design is based on the magnetic symmetrical axes, which lead to two three phase systems in the same stator as shown in Figure 3. In addition, the mass of the stators and the mutual inductances (on the same three phase systems and between the three phases of the same system) has been minimized. However, each stator is designed and manufactured using a set of laminates as shown in Figure 6.

For the rotor of each structure, rotor pole parts (Figure 7) are designed and manufactured maintaining inserted NdFeB permanent magnets. To increase the air gap induction, a rotor with magnetic flux concentration is chosen. The rotor tooth shape has been designed to induce sinusoidal flux linkages [1,2] and to reduce cogging torque. Concentrated coils in the stator reduce the mass and volume of the whole actuator. To avoid short-circuit between two phases, each slot is filled with one coil.

The chosen architecture for the designed actuator matches the requested specification according to the application and avoids occurrence of any fault propagation thanks to electrical and mechanical redundancies.

3. Control Strategy

For the designed actuator, a position control is developed using four independent control strategies for the four BLAC motors. Figure 8 shows the control strategy of one BLAC motor (motor lane) with an inverter (Inv) to supply one three-phase stator and a power supply stage (PS) to supply the inverter (DC link).

In the electronic control unit (ECU), control loops of the four BLAC motors are implemented to ensure actuator operation in healthy and faulty modes. Each control loop has its own position and current sensors as shown in Figure 8. In addition, a monitoring block is used to obtain and process the sensor data sent by the ECU to inform the supervisor about the operation mode. For a healthy operating mode, the monitoring block informs the supervisor to continue sending the position command for all the position control loops of all the motor lanes. Moreover, in case of a detected faulty operating mode from the data sensors, the monitoring block informs the supervisor to stop sending the position command to the control loop of the faulty motor lane. This is, for example, the case of the force fight phenomenon, which is detected from the appearance of a current peak as soon as the fault appears.

Position Control

Position control is based on multiloop control design and the autopilot current control of PMSM in dq plan deduced from the analytical model of each BLAC motor [8,9]. In this strategy, ${\mathrm{V}}_{\mathrm{d}}^{*}$ and ${\mathrm{V}}_{\mathrm{q}}^{*}$, given by Equations (1) and (2), are the voltages to use for the generation of Pulse Width Modulation (PWM) signals:

$${\mathrm{V}}_{\mathrm{d}}^{*}{=\mathrm{V}}_{\mathrm{sd}1}-{\mathrm{e}}_{\mathrm{sd}}$$

(1)

$${\mathrm{V}}_{\mathrm{q}}^{*}{=\mathrm{V}}_{\mathrm{sq}1}-{\mathrm{e}}_{\mathrm{sq}}$$

(2)

In these equations, V_sd1 and V_sq1 are considered to be the control signals provided by the current controllers while e_sd and e_sq are considered to be the link terms. These terms are deduced by identification using electrical equations of the BLAC motor model [10,11]:

$${\mathrm{V}}_{\mathrm{sd}1}{=\mathrm{R}}_{\mathrm{a}}{\mathrm{I}}_{\mathrm{d}}{+\mathrm{L}}_{\mathrm{d}}\frac{{\mathrm{dI}}_{\mathrm{d}}}{\mathrm{dt}}$$

(3)

$${\mathrm{V}}_{\mathrm{sq}1}{=\mathrm{R}}_{\mathrm{a}}{\mathrm{I}}_{\mathrm{q}}{+\mathrm{L}}_{\mathrm{q}}\frac{{\mathrm{dI}}_{\mathrm{q}}}{\mathrm{dt}}$$

(4)

$${\mathrm{e}}_{\mathrm{sd}}=\mathrm{p}\Omega {\mathrm{L}}_{\mathrm{q}}{\mathrm{I}}_{\mathrm{q}}$$

(5)

$${\mathrm{e}}_{\mathrm{sq}}=-(\mathrm{p}\Omega {\mathrm{L}}_{\mathrm{d}}{\mathrm{I}}_{\mathrm{d}}{+\mathrm{pk}}_{\mathrm{m}}\Omega )$$

(6)

where:

R_a: winding resistor (Ohms);

L_d: d axis inductance (H);

L_q: q axis inductance (H);

p: number of poles pair;

k_m: torque constant (Nm/A);

i_q, i_d: currents in dq plan (A);

Ω: velocity (rad/s);

Figure 9 gives the position control of each motor lane. The current control is carried out in dq plan where two PI controllers are designed to provide V_sd1 and V_sq1. The signal controls V_sd and V_sq used for the generation of PWM signals are deduced taking into account the link terms e_s1 and e_s2 given by Equations (5) and (6). With this strategy, the link terms allow to get a torque, which depends only on Iq and a flux which depends only on I_d.

Using placement pole method, two PI current controllers are designed from Equations (3) and (4). For these loops, two set points are chosen; Id* is equal to zero while Iq* is provided by the velocity controllers. This choice is due to the operation range of the designed actuator characterized by a constant torque at low velocity range. For the velocity control, a PI controller is designed taking into account the mechanical time constant of each motor lane. The velocity set point ɷ* of this loop is provided by a position proportional controller designed according to performance criteria of the designed actuator. For this controller, a set point Θ* is provided by the supervisor for each motor lane.

4. Operation Modes

The designed actuator can operate in healthy and faulty operation modes. Indeed, in faulty operation mode, the monitoring block can detect any abnormal operation on the designed actuator from data sensors provided by the ECU. Figure 5 presents the architecture of data exchange between the ECU, the monitoring block, and the supervisor.

4.1. Healthy Operation Mode

Based on the control strategy of Figure 6, a control position is carried out on the designed actuator associated with a load. In this application, a redundant BLAC motor on direct-drive actuator coupled to a common shaft uses typically one of two configurations; an active-standby configuration or an active-active configuration [2]:

• In the active-standby configuration, two BLAC motors (one stator) are actively powered while the others are in a standby mode. In this case, each motor lane provides half of the total motor torque of the designed actuator without any dialog between them.
• In the active-active configuration, all the motor lanes are powered to operate simultaneously. Indeed, this configuration presents some advantages in comparison to the active-standby configuration. This is, for example, the case when sizing each BLAC motor. In this configuration, the power size of the BLAC motors is smaller in comparison to the same BLAC motors used in the active-standby configuration. Each motor lane provides a quarter of the motor torque of the designed actuator without any dialog between them.

4.2. Faulty Operation Mode

In the designed actuator, some faults can create an abnormal operation where BLAC motors are in conflict. Some of them provide a motor torque and others provide a resistive torque. This phenomenon, called force fight, is due mainly to three types of faults as shown in Figure 10.

These cases affect the behavior of the actuator particularly in active-active configuration. This is due to the operation of all the BLAC motors and consequently can potentially create a force fight between all the active BLAC motors [8].

The force-fight results from the fact that the BLAC motor position sensors, control electronics, and mechanical components are similar and have independent and unique tolerances. These differences can result in one lane attempting to position the shaft to a different position than the other lane(s). Instead of creating a resultant motor torque on the common shaft to reach the same rotor position, each motor lane is challenging the others in order to reach and to keep its desired position. This torque induces current consumption and thermal elevation without any significant load increase. In our case, abnormal operation due to force fight phenomena is detected by the rapid rise of the current Iq at its maximum value with high temperature on the stators. Designing an actuator to withstand the worst-case force fight events could induce additional weight, and extra costs. Hence, there is a need for a system and method of preventing, or at least mitigating, the resultant force fight that can occur between BLAC motors when actuator system channels are configured in an active-active configuration.

To avoid force fight, a monitoring function is proposed for each BLAC motor of the designed actuator.

5. Monitoring Mode

The monitoring function is an important part of safety for the designed actuator. This function validates all the information coming in and out from and to the ECU, namely supervisor commands, current and position sensors data, and ECU commands. Using this information, a comparison is carried out by MON1 and MON2 to detect any abnormal function in the signal transmission or in the computing. If a fault is detected, the monitoring blocks (Figure 11) will notify the supervisor and deactivate the faulty motor lane with the drive stop action. In addition, Monitor 1 (MON1) and Monitor 2 (MON2) associated with two motor lanes exchange online information to validate computer commands.

6. Proposed Approaches

In order to avoid or minimize this behavior, a monitoring function and lane communication has to be implemented. The multiple position information feedbacks or position commands need to be merged and methods be applied.

• In the first example of offset on position feedback information of one lane, the following methods can be suggested:
  • Use of a democracy and voter approach [12,13] to choose the position information feedback use by the different control lane. This method requires time and resources to be implemented.
  • Use of neural feedforward controller as presented in [14] where the behavior of the actuator is deduced from errors in measurement, positioning, and various test cases. With a good training of the neural network, expected results have been achieved.
  • Use the mean of the different position information feedbacks [15,16]. This method is simple to implement but monitoring of the sensors is necessary to avoid false information.
  • Use of a master position information feedback and slave for the other one. This method is easy to implement but a monitoring is necessary to validate the information of the master and to compare it to the different slaves.
  • Limit the current of the motor in an active/standby operating mode [17]. The torques developed by each motor are evaluated and some actuators can be disconnected if necessary. The anti-force fight system is quite complex to implement.
  • Like the previous approach, electrical and mechanical energies can be evaluated and compared to a healthy model [18]. Force fight can be then detected but the required sensors could be a source of failure.
  • Use of dedicated control laws and observers to mitigate the force fight. Performant computation units are then necessary [19].
• In the second example of offset on position command information of one lane, the monitoring function of each lane has to communicate and validate the integrity of the position command information.
• In the third example of offset on the torque, current, or command of one lane, the use of an inverted model will be able to locate the fault. Therefore, with the monitoring function, the lane is deactivated.

In all cases, using the monitoring function to detect the force fight and to deactivate the fault lane is necessary. In our application, the use of a master sensor is recommended because of its simplicity in implementation.

For the designed actuator, a position control is developed using four independent control strategies for the four BLAC motors. Figure 12 shows the control strategy of one BLAC motor (motor lane) with an inverter (Inv) to supply one three-phase stator and a power supply stage (PS) to supply the inverter (DC link).

In avionics until now, only master/slave control with PID controllers is certified. Although it is simple, this type of controller has many advantages. It is easy to implement, to understand, and to adjust their PID parameters. In addition, they are robust but not optimal, that is why in avionics, performance is defined with a tolerance error related to response time (bandwidth) and overshoot in healthy and faulty operating modes. For the designed direct-drive actuator, the designed control takes into account some specifications related to response time (bandwidth) and overshoot to optimize PID parameters for healthy and faulty operation modes [2].

In the electronic control unit (ECU), control loops of the four BLAC motors are implemented to ensure actuator operation in healthy and faulty modes. Each control loop has its own position and current sensors as shown in Figure 5. In addition, a monitoring block is used to obtain and process the sensor data sent by the ECU in order to inform the supervisor about the operation mode. For a healthy operating mode, the monitoring block informs the supervisor to continue sending the position command for all the position control loops of all the motor lanes. Moreover, in case of a detected faulty operating mode from the data sensors, the monitoring block informs the supervisor to stop sending the position command to the control loop of the faulty motor lane. This is, for example, the case of the force fight phenomenon, which is detected from the appearance of a current peak as soon as the fault appears.

7. Experimental Validation

For the experimental validation, a test bench is set up (Figure 13) to validate the operation of the designed actuator (prototype) associated with an active load in order to reproduce the real operation of the designed actuator in healthy and faulty operation modes. Two control laws are implemented using DS1106 and DS5202 to simultaneously provide PWM signals of each electronic power stage (4). A position control associated with the proposed control strategy for the prototype (2) and a torque control for the torque motor (3) which is coupled to the shaft of the designed actuator (active load). In addition, the position sensor (6), current sensors (5) of each BLAC motor of the designed actuator are connected by A/D inputs of DS2002 to the control loops. Furthermore, a torque sensor (7) and temperature sensor (8) of each BLAC motor are used to record real-time measurements.

For the two control laws, a position setpoint is chosen based on Figure 14 and a torque law based on an AMESim model of the hydromechanical part of the application. This model is implemented in the same platform for a real-time co-simulation using Simulink/AMESim in order to reproduce the dynamic behavior of the actuator according to the specification of the application. For this paper, only the faulty operation mode is considered because of the force fight phenomenon between motor lanes.

7.1. Faulty Operation Mode and Force Fight Phenomenon

The force fight phenomenon can occur for any configuration of operation. According to the application, active-active configuration is selected to study and to analyze this phenomenon. Indeed, this phenomenon is more significant when four BLAC motors are operating simultaneously.

Using a multicore dSPACE platform where four control loops are implemented, all the BLAC motors of the designed actuator are active. In addition, a deviation of offset (+) is created manually on motor lane 4 in order to observe this phenomenon in real time.

Based on the position command given by Figure 14, a real-time co-simulation is carried out between Simulink and AMESim in faulty operation mode for 80 s. Among the faults listed above, a variable fault offset on position feedback information is created at t = 3 s on motor lane 4. Figure 14 shows that the desired position of the designed actuator is achieved with good performance, namely response time, minimum overshoot, and steady-state error of zero. Even though a fault appeared on one or two motor lanes, the desired position was achieved with the same performance listed in the specifications of the application.

In addition, it can be noticed that when the offset is changing between positive and negative values (%), the current command (Iq_command) of the faulty motor lane (Motor Lane 4) given by Figure 15 is changing too. Indeed, as shown in Figure 9, the multiloop control generates the velocity command from the position error, while the velocity controller generates the Iq command from the measured velocity and the velocity command. Its value depends indirectly on the angular position error, which is computed from the measured position associated with the created offset and the angular position command. If the position offset is positive, the position error is negative; Iq current will be also negative. Similarly, if the offset is negative, the position error is positive; Iq current will be positive. However, the change of Iq has a direct effect on the torque. This is due to the direct relationship between both [9]. For the other motor lanes, the offset does not affect Iq current responses of the other motor lanes. This is due to the independent control loops of all the motor lanes and their optimized PID parameters.

As the torques are images of Iq currents, Figure 16 shows that the torque response of the faulty motor lane is not following the same response as the other motor lanes. Indeed, this motor lane challenges the other lanes to move the shaft to a different position even though the other motor lanes are following the same angular position command. The sign of the motor torque of the faulted motor lane (cyan on Figure 16) depends on the sign of the offset (+) as shown in Figure 14. However, the other motor lanes handle this problem by creating more torques in order to maintain the position shaft to the position command whatever the motor torque of the faulted motor. This behavior induces more heat losses by a factor of three for the healthy lanes and a factor of six for the faulted lane [2].

In order to eliminate the force fight phenomenon between the lanes of the designed actuator and to keep good performance, three methods were suggested previously. Among them, the master/slave approach is selected here because of its easy implementation compared to the others.

7.2. Validation of the Monitoring Mode and Master/Slave Method

This method uses one position information feedback for the different motor lanes as shown in Figure 17. In this case, if an offset appears on the master sensor or slave sensors, no force fight will be created between the motor lanes. This is because of the monitoring block, which detects the fault on the position sensor of the motor lane 4 and isolates it. In this case, the position sensor of motor lane 4 is provided using the master/slave method, which is based on a voting algorithm implemented in the flight control computer.

In this method, the measured position to provide to the ECU of each motor lane is computed from the measured position of the three motor lanes. As they are similar, one among the three provides the same measured position to all the control loops as a master while the others, considered as slaves, are used to compare the master position with the slave positions.

By implementing this method on the test bench and estimating the position feedback of the faulty motor lane from the other sensors, we notice that the position response (Figure 18) of the designed actuator is reached with better performance compared to the same response given in Figure 14. The absolute error is given between the two curves. Due to the type of the corrector (PI), the error is important during transient period. In addition, as shown in Figure 19, the force fight phenomenon between the motor lanes is eliminated. Indeed, all the motor lanes operate in motor mode to provide a quarter of the total motor torque and to compensate the load torque.

Finally, for the other faults creating the force fight phenomenon, the master/slave method can be also used to provide the same Iq command or the same position command to all the motor lanes. In this case, a new voting algorithm will be developed to deal with each fault in order to isolate the false current or position command, providing a master value to the other motor lanes.

In addition, other faults were created on the same test bench in order to validate the robustness of the designed control in faulty operation mode:

• Loss of one machine (BLAC lane),
• Short circuit to the ground of a machine phase of a six-phase stator,
• Loss of an inverter arm of an electronic power converter,
• Loss of power (DC bus voltage) of an electronic power converter.

These faults were selected according to their rate of occurrence. The experimental results show, for each fault, that the position and torque responses match the required specification in faulty mode and confirmed that the designed control is robust.

8. Conclusions

In this paper, the design and the manufacturing of a prototype achieve the new concept of the direct-drive actuator with four BLAC motors. Indeed, the combination of electrical and mechanical redundancies in its design allows on the one hand to ensure high reliability in healthy and faulty operating modes and on the other hand to have a reduced size for its integration as a new subsystem in Fly Control. In addition, with each motor lane having its own control loops with its own position and current sensors, a drawback is highlighted in faulty operating mode creating a conflict between all the motor lanes. This phenomenon, called force fight, is due to faults in position feedback, position command, or torque command. Even when the position command is reached; the force fight induces higher torque for all motors, current consumption, thermal elevation and performance reduction. However, some methods are suggested in order to avoid force fight, using monitoring and communication between lanes in order to merge the different position or command information. Among the proposed methods, the master/slave method has been selected according to the application, to be implemented in the test bench. The experimental results confirm the validity of this method to eliminate force fight between motor lanes and to ensure good performance of the direct-drive actuator during operation.

In addition, other faults created on the test bench confirmed the robustness of the designed control even in faulty operation mode. However, the designed control confirms the reliability of the system in healthy and faulty operation modes.

Finally, for the next generation of helicopters, the designed actuator will be able to meet the demand for the electrification of the actual flight control with high reliability. In addition, this new concept will be used for other functions such as flight assistance, automatic pilot, or unmanned flight.