Proceedings of the 2007 American Control Conference

Marriott Marquis Hotel at Times Square

New York City, USA, July 11-13, 2007

FrC07.3

Stable Adaptive Reconfigurable Flight Control with Self-Diagnostics

Jovan D. Boskovic, Joshua Redding and Raman K. Mehra
Scientific Systems Company, Inc.
500 West Cummings Park, Suite 3000
Woburn, MA 01801
Email: jovan@ssci.com, joshua@ssci.com, rkm@ssci.com
Abstract In this paper a new approach to adaptive faulttolerant control with self-diagnostics is presented. The approach
is based on generating high-frequency signals for actuators with
suspected failures, and minimizing the effect of those signals on
the system state using the remaining healthy control surfaces.
It is shown that the adjustment of parameters using a signal
composed of the nominal control input, self-diagnostic signal
and compensation signal, and the use of the corresponding
parameter estimates in the control law results in a stable system
in which the asymptotic convergence to zero is guaranteed for
both the tracking and parameter errors. The properties of the
proposed system are evaluated through simulations of a highperformance aircraft under multiple flight-critical failures.

I. I NTRODUCTION
One of the problems encountered in the available techniques for on-line Failure Detection, Identification and Reconfiguration (FDIR) [1], [2], [4], [14], [13], [16] is the
difficulty in estimating failure-related parameters accurately.
This can be attributed to the fact that common flight control
commands result in insufficient persistent excitation in a
high-dimensional failure parameter space.
Some previous work in this area was focused on injecting
persistently exciting signals in the kernel of the control
derivative matrix B in over-actuated aircraft [15]. However,
it is not clear how this technique will affect the closed-loop
system stability. Since the stability has not been explicitely
proved, the ratonale is that signals in the kernel of B will
not affect the closed-loop stability. However, this may not be
true in the presence of parametric uncertainty or unmodeled
dynamics. It is also not clear how this approach would
extend to the lock-in place failures. In addition, derivatives
of all state variables need to be available, which may not
be realistic since state variable measurements are commonly
fairly noisy.
In this paper we propose a stable approach to selfdiagnostics in reconfigurable control systems. The advantage
of the approach is that the closed-loop stability can be
guaranteed, and the effect of the self-diagnostics signal on
the state of the system is minimized.
The motivation comes from the problem of using the information generated by a Health Monitoring (HM) system to
This research was supported by the NASA Langley Research Center
under contract No. NNL06AA26P to Scientific Systems Company.

1-4244-0989-6/07/$25.00 2007 IEEE.

COMPENSATOR
Commands

Self Diagnostics

HMS
ACTUATORS

CONTROLLER

AIRFRAME

FDI

Fig. 1. Structure of the proposed Fault-Tolerant Control System with SelfDiagnostics

achieve effective control reconfiguration. Assuming the HM

system only declares that a particular actuator (or actuators)
has failed, without providing any additional information, the
main idea is to run self-diagnostics on that actuator (or
actuators) and identify the failure. This is important not
only for increasing the robustness of the system, but also
for obtaining better diagnostics information, and running
prognostics algorithms to predict the effect of the failure in
the future.
Figure 1 illustrates the approach proposed in this report.
It is seen that the HM system declares actuators healthy
or failed, and that information is used to activate the SelfDiagnostics module. In order to minimize the effect of
the self-diagnostics signals on the system states, the Compensator module generates an appropriate signal, without
affecting the closed-loop stability. This system is described
in detail in the following sections.
II. A DAPTIVE R ECONFIGURABLE C ONTROL
S ELF -D IAGNOSTICS

WITH

In this paper our focus is on a class of nonlinear models

of aircraft dynamics, and first-order actuator dynamics. The
overall model is of the form:
x 1
x 2

= x2 ,
= f (x) + g(x)u,

(1)
(2)

u a

= (ua uc ),

(3)

where x IRn and u IRm denote respectively the state and

control input vectors, uc IRm is the signal generated by
the controller, ua is a vector of internal actuator states, f (x)
and g(x) are sufficiently smooth, = diag([1 2 ... m ]),
i > 0, and min(i ) >> 1.
The above model corresponds to the case when the
components of the vector x1 are Euler angles, while their

5765

FrC07.3
derivatives, rather than the angular rates, are a part of vector
x2 . Remaining components of x2 are the angle-of-attack,
side-slip angle and total velocity. The transformation from
the standard aircraft model to the above form is given
previously [6].
The aircraft model is characterized by the following assumption:
Assumption 1:
(a) m > n;
(b) g(x)g(x)T is invertible on a domain D;
(c) Elements of g(x) are bounded for all x on the same
domain D.
In this paper the focus will be on a class of failure
scenarios that satisfy the following assumption:
Assumption 2:
(a) Up to m n effectors can undergo total LOE failure
(b) All effectors can undergo partial LOE failure.
Reference Model: The reference model is chosen in the
form:
(4)

x 1

= x2 ,

x 2

= Am x + Bm r,

u = uc +
u,

where x is the state of the reference model, the reference

model is asymptotically stable, and r is a vector of bounded
piece-wise continuous reference inputs (commands).
Control Objective: The objective is to design a control
law uc (t) such that the error x(t) x (t) tends to zero
asymptotically even in the presence of different flight control
actuator failures.
A. Failure Modeling and Parameterization
Flight control actuator failures can be broadly divided
into two categories: (i) Failures that result in a total loss
of effectiveness of the control effector; and (ii) Failures
that cause partial loss of effectiveness. The former includes
Lock-In-Place (LIP), float, and Hard-Over Failure (HOF),
while the latter is referred to as the Loss-Of-Effectiveness
(LOE) type of failure. Uncertainty associated with each of
the actuator models is due to: (i) Unknown time of failure
tF i ; (ii) Unknown LOE coefficient ki ; and (iii) Unknown
value at which the control effector locks.
In this section failure parameterization will be reviewed
for the case of first-order actuator dynamics.
In [11], the following model was proposed for the case of
zeroth-order actuator dynamics:
(6)

where u
is a vector of values where the actuators have locked,
K = diag([k1 k2 ... km ]), = diag([1 2 ... m ]) ki
[k , 1], k << 1, i = 1, 2, ..., m, and

1, if t < tF
=
0, if t tF

(7)

where = diag( 1+ 2+ m+ ), 0 < << 1,

and = diag([1 2 ... m ]). It is seen that, when i = 0,
ui = u
i . When i = i < 1, ui
= i uci since
= 0. Hence
the above model has the desired properties of covering both
the LIP and LOE cases for a sufficiently small .
First-Order Actuator Dynamics: The actuator equation is
given by (3), where = diag([1 2 ... m ]), and i > 0.
Failure Model: In this case the failure model is of the form:
u = (u Kuc ).

(8)

Hence in the case of failure at tF i , one has that u i (t) = 0

for t tF i , and ui (t) = ui (tF i ) for all t tF i . In the case
of LIP, ui (tF i ) has the value of u(t
F i ), while in the case of
HOF, it jumps to the upper or lower position limit.
It is now noted that the model (8) can be rewritten as:

(5)

u = Kuc + (I )
u,

Hence, when = I and K = I, one has that u = uc . When

K = I and i = 0, ui = u
i , and when = I and ki < 1,
ui = ki uci .
The new failure parameterization from [3] is of the form,

u = u + [Kuc + (I )u].
Based on the model (7), the failure model in the case of
first-order actuator dynamics is now of the form:
u = u + (uc + u).

(9)

B. Parameter Estimation Algorithms

First-order actuator dynamics with failures can be written
in the form:
ui
u i = i ui + i (i uci +
), i = 1, 2, ..., m, (10)
i +
where i >> 1.
Observer: In this case the observer is of the form:
ui
) i (
ui ui ),
u
i = i ui + i (i uci +

i +

(11)

where i > 0 is the observer gain.

Error Model: Upon subtracting (10) from (11) one obtains:
e i = i ei + i i i ,
where i = i i ,
i = uci

ui
,
(i + )2

and where the term ui 2i /(i + )2 /(i + ) has been

neglected.
Theorem II.1: Adaptive algorithms:

i = Proj[0,1] {i i i ei }, i (0) = 1,
where i > 0 denote adaptive gains, assure that ei L
L2 .

5766

(12)

FrC07.3
In the above adaptive law, the Projection Algorithm is
used to project the estimates i (t) to the interval [0, 1] at
every instant. Properties of such algorithms are discussed
elsewhere[8].
Proof: Let a tentative Lyapunov function be of the form:
1 2 2i
[
e +
].
2 i
i
The following property of the adaptive algorithms with
projection is used next (see the Appendix): if the adaptive
law is of the form = Proj[,
]
{e}, then e.
Since it is assumed that i is constant for t tF i , it follows

that i = i , which implies that i i i ei i i .

With these facts the first derivative of V along the solutions
of the system is:
i i
V = i e2i + i i i +
i
i e2i 0.
V (
ei , i ) =

Hence each ei is bounded (i is bounded due to the use of

the projection algorithm). Upon integrating V from 0 to ,
one obtains:
Z
e2i ( )d.
V (0) V () i
0

Since the term on the left hand side is bounded, it follows

that ei L L2 .

Remark: It is important to note that the above proof holds
for any uci , i.e. also for a uci that is composed of some
nominal control input, an input that adds a high-frequency
self-diagnostics (SD) signal, and an input that assures that
the effect of the SD signal on the states is nullified.
C. Reconfigurable Control with Self-Diagnostics
The reconfigurable control design is carried out in two
steps. First, an ideal reconfigurable controller is designed
assuming that i are known accurately. In the second step,
true values of i are replaced by their estimates.
1) Ideal Reconfigurable Controller: Since i in (10)
satisfies i >> 1, from (10) one has:
ui
1
u i = ui + i uc +
= 0, i = 1, 2, ..., m, (13)
i
i +
resulting in u
u. Upon substituting this expression
= uc +
into (2) one obtains:
x 1

= x2 ,

(14)

x 2

= f (x) + g(x)[uc +
u].

(15)

Now the following assertion is considered:

0.
u i ui ) =
Assertion 1: If i [0, 1], then i+ (
Proof: When i (0, 1], i+
0.
When

=
0, which
=
i
happens at tF i , one has that ui (tF i ) = u
i .

Based on Assertion 1, the plant equation is rewritten as:
x 1

= x2 ,

(16)

x 2

= f (x) + g(x)[uc + u].

(17)

The ideal reconfigurable controller is now chosen as:

(18)

uc = ucn + SvSD + (I S)w,

where, as in the first-order case, w denotes a vector of highfrequency self-diagnostics signals, S = diag([s1 s2 ... sm ]),
where up to m/2 elements can be zero,

1, if ith actuator is declared healthy
si =
0, if ith actuator is declared failed
and
vSD = (g(x)S)T (g(x)S2 SB T )1 g(x)(S I)w. (19)
In Equation (18), ucn is defined as:
ucn = (g(x))T (g(x)2 g(x)T )1 ( g(x)u),

(20)

where
(21)

= f (x) + Am x + Bm r.
Since
g(x)SvSD + g(x)(I S)w = 0,

substituting (18) into (2) yields the equation of the reference

model. Hence the ideal reconfigurable controller achieves the
control objective.
2) Adaptive Reconfigurable Controller: Now the adaptive
reconfigurable controller is chosen in the form (18), where:
T (g(x)
2 g(x)T )1 (
ucn = (g(x))

m
X

gi (x)

i=1

ui
), (22)
i +

and
T (g(x)S
2 SB T )1 g(x)(S
I)w. (23)
vSD = (g(x)S )
A question that arises is if this control law assures the
stability of the overall closed-loop system. This is discussed
in the following section.
3) Proof of Stability: In this section the stability of the
overall system will be demonstrated.
Theorem II.2: If i is of the same order of magnitude as
i , then the control law (22) for the plant (1)-(3), in which
the parameter estimates are generated using (11) and (12)
assures that all the signals in the system are bounded and,
in addition, that limt [x(t) x (t)] = 0.
Proof: Since i and i are of the same order of magnitude,
the error model (12) can be written as:
i
ui
1
ei = ei + (uci
)i
= 0,

i
i
(i + )(i + )
from where one obtains:
ui
i
)i ].
ei
= [(uci

i
(i + )(i + )

5767

The plant equation (17) is now expressed as:

x 2

= f (x) + g(x)[uc + u]
m
X
ui
i i ],
= f (x) +
gi (x)[i uci +
i +
i=1

(24)

FrC07.3
where the term ui 2i /(i +)2 /(i +) has been neglected.
Upon substituting the control law (22), using the fact that
SD + g(x)(I
S)w = 0,
g(x)Sv
and using (24), one obtains:
x 2 = Am x + Bm r +

m
X

gi (x)

i=1

i
ei .
i

(25)

Let x = [xT1 xT2 ]T , ei = xi xi , e= [eT1 eT2 ]T, and

0
I
e = [
e1 e2 ... em ]T . Now, using Am = , the
Am
overall closed-loop system can be expressed as:


0

e.
e = Am e +
g(x)
Since each ei has been shown previously to satisfy ei
L L2 , and since Am is asymptotically stable, using the
assumption 1(c) and BIBO stability arguments, it follows
that e L L2 . Since e = x x is bounded, and x
is a bounded signal, it follows that x is bounded as well.
Bounded x implies that uc is bounded as well, which in turn
implies that u is bounded. It now follows that each e i is
bounded, and, from Barbalats lemma, limt ei (t) = 0. It
can now be concluded that limt e(t) = 0.

III. S IMULATIONS
The proposed approach was implemented in Matlab and
tested on a medium-fidelity simulation of an F/A-18. The
simulation consists of linear stability and control derivatives,
nonlinear kinematics, second-order flight control actuator
dynamics with non-measurable rates, and position and rate
limits on the control effectors.
The states of the model are: Total velocity V , pitch rate
q, pitch angle , angle-of-attack , altitude h, side-slip angle
, roll rate p, yaw rate r, roll angle , and yaw angle . The
control surfaces include: Left and right Leading-Edge Flaps
(LEF); Left and right Trailing-Edge Flaps (TEF); Left and
right Ailerons (AIL); Left and right Stabilators (STAB); and
Left and right Rudders (RUD). Control inputs also include
left and right engine (PLA).
Figures 2 through 4 show different failure scenarios that
test the robustness of the approach to adaptive fault-tolerant
control with self-diagnostics described in this paper. Each
figure shows the resulting aircraft states, actuator positions
and failure parameter estimates during a 30 degree lateral
doublet under specific failure conditions. We consider the
following cases: Multiple false alarms, Figure 2; False failure
information, Figure 3; and Severe missed detection, Figure 4.
In Case 1, the HM system points to several healthy actuators (right TEF and left STAB) as having failed, prompting
the system to run a self-diagnostics check and assess the
suspected failures. The self-diagnostics and accompanying
compensation signals designed to accomplish this appear in

Figure 2(b) at about 9 seconds, but show no adverse effects

on the systems lateral states shown in Figure 2(a). As seen
in Figure 2(c), the proposed system accurately characterizes
all actuators as healthy, i.e. no failures are present.
In Case 2, the HM system again indicates that failures have
occurred in the right TEF and left STAB, which prompts a
self-diagnostics check that again designs and adds frequency
content to the actuator inputs. These inputs (self-diagnostics
and compensation signals) can be seen in Figure 3(b),
beginning at about t = 9 seconds. From Figure 3(c) it can
be seen that the proposed system accurately characterizes the
TEF failure before the self-diagnostics signals are introduced.
However, the addition of the self-diagnostics signals allows
enough excitation for the proposed system to quickly and
accurately characterize the rudder failure parameter as well.
Figure 3(a) shows that the lateral states and stability of the
system again were not affected.
Case 3 tests the robustness of the self-diagnostics method
in the presence of severe missed detections. In this case, at
t = 4 seconds all left control surfaces as well as both engines
experience some degree of loss of effectiveness and all right
surfaces experience a lock-in-place. Since the HM system
does not recognize these failures, a self-diagnostics check
is not prompted and the proposed system is left to attempt
to characterize all failures without the persistent excitation
offered through the self-diagnostics signals. Although many
of the failure parameters in Figure 4(c) converge to their true
values, a lack of frequency content leaves several parameters
at incorrect values (LEF, AIL).
It can be concluded that the proposed technique for adaptive reconfigurable fault-tolerant control with self-diagnostics
has the following properties: (i) Is robust to false alarms,
false failure information and missed detections; and (ii)
Assures the convergence of the failure parameter estimates
to their true values.
IV. C ONCLUSIONS
In this report a new approach to adaptive fault-tolerant
control with self-diagnostics is presented. The approach is
based on generating high-frequency signals for actuators
with suspected failures, and compensating for the effect
of those signals on the system state using the remaining
healthy control surfaces. It is shown that the adjustment of
parameters using a signal composed of the nominal control
input, self-diagnostic signal and compensation signal, and
the use of the corresponding parameter estimates in the
control law results in a stable system in which the asymptotic
convergence to zero is guaranteed for both the tracking and
parameter errors. The properties of the proposed system are
evaluated through simulation of a high-performance aircraft.
Future work in this area includes extensive testing of the
proposed technique through high-fidelity piloted simulations
and flight tests on F/A-18 aircraft, as well as testing on other
civilian and military aircraft.

5768

FrC07.3

Lateral States

[deg]

Actual
Model

0
5

10

15

20

25

30

35

40

10

15

20

25

30

35

40

10

15

20

25

30

35

40

10

15

20

25

30

35

40

10

15

20
Time [sec]

25

30

35

40

p [deg/s]

20
0
20

r [deg/s]

1
0
1

[deg]

50
0
50
4
[deg]

2
0
2

(a) Lateral state response

Actuator Response

LEF [deg]

Left

Right

3
2

10

15

20

25

30

35

40

10

15

20

25

30

35

40

10

15

20

25

30

35

40

10

15

20

25

30

35

40

10

15

20

25

30

35

40

10

15

20
Time [sec]

25

30

35

40

TEF [deg]

20
10
0
10

AIL [deg]

20
10
0

STAB [deg]

10
5
0
5

RUD [deg]

5
0
5
10

PLA [deg]

80
70
60
50

(b) Actuator inputs

Left

Right

LEF

TEF

0.5
0

HMS
0

10

15

20

25

30

35

40

AIL

0.5

0.5

10

15

20

25

30

35

40

10

15

20

25

30

35

40

0
1

0.5

0.5

10

15

20

25

30

35

40

15

20

25

30

35

40

10

15

20

25

30

35

40

10

15

20

25

30

35

40

10

15

20

25

30

35

40

10

15

20

25

30

35

40

10

15

20
25
Time [sec]

30

35

40

0.5

10

15

20

25

30

35

40

0.5

0.5

10

0.5
0

0.5

0.5
0

STAB

0.5

RUD

PLA

R EFERENCES
[1] M. Bodson and J. Groszkiewicz, Multivariable Adaptive Algorithms
for Reconfigurable Flight Control, IEEE Transactions on Control
Systems Technology, Vol. 5, No. 2, pp. 217-229, March 1997.
[2] Boeing Phantom Works, Reconfigurable Systems for Tailless Fighter
Aircraft - RESTORE, Contract No. F33615-96-C-3612, Scientific
and Technical Reports No. A007, St. Louis, Mo, May 1998.
[3] J. D. Boskovic, J. Redding and R. K. Mehra, Integrated Health
Monitoring and Fast on-Line Actuator Reconfiguration Enhancement
(IHM-FLARE) System, Final Report for NASA Langley Phase I
SBIR, Contract No. NNL06AA26P, July 2006.
[4] J. D. Boskovic and R. K. Mehra, A Multiple Model-based Decentralized System for Accommodation of Failures in Second-Order Flight
Control Actuators, to be presented at the 2006 American Control
Conf., Minneapolis, MN, June 14-16, 2006.
[5] J. D. Boskovic, S. E. Bergstrom, R. K. Mehra, James Urnes, Sr.,
Mark Hood, and Yohan Lin, Fast on-Line Actuator Reconfiguration
Enabling (FLARE) System, in Proc. of the 2005 AIAA Guidance,
Navigation and Control Conf., San Francisco, CA, August 2005.
[6] J. D. Boskovic and R. K. Mehra, Robust Integrated Flight Control
Design Under Failures, Damage and State-Dependent Disturbances,
AIAA Journal of Guidance, Control & Dynamics, Vol. 28, No. 5, pp.
902-917, September-October 2005.
[7] J. D. Boskovic, S. E. Bergstrom and R. K. Mehra, Adaptive Accommodation of Failures in Second-Order Flight Control Actuators with
Measurable Rates, in Proc. of the 2005 American Control Conf.,
Portland, OR, June 8-10, 2005.
[8] J. D. Boskovic and R. K. Mehra, A Multiple Model Adaptive Flight
Control Scheme for Accommodation of Actuator Failures, AIAA J.
of Guidance, Control & Dynamics, Vol 25, No. 4, pp. 712-724, 2002.
[9] J. D. Boskovic and R. K. Mehra, Aircraft Prognostics and Health
Management (PHM) and Adaptive Reconfigurable Control (ARC)
System, NASA DFRC Phase II SBIR Final Report, Contract No:
NAS4-02017, March 2004.
[10] J. D. Boskovic and R. K. Mehra, Failure Detection, Identification
and Reconfiguration in Flight Control, in Fault Diagnosis and
Fault Tolerance for Mechatronic Systems, Recent Advances Series:
Springer Tracts in Advanced Robotics, Vol. 1, F. Caccavale and L.
Villani (Eds), Springer Verlag, NY, 2002.
[11] J. D. Boskovic, S.-H. Yu, and R. K. Mehra, A Stable Scheme
for Automatic Control Reconfiguration in the Presence of Actuator
Failures, in Proc. of the 1998 American Control Conf., Vol. 4, pp.
2455-2459, Philadelphia, PA, June 24-26, 1998.
[12] J. Brinker and K. Wise, Reconfigurable Flight Control of a Tailless
Advanced Fighter Aircraft, Proc. AIAA Guidance, Navigation and
Control Conf., Vol. 1, pp. 75-87, Boston, MA, August 1998.
[13] A. Calise, S. Lee and M. Sharma, Direct Adaptive Reconfigurable
Control of a Tailless Fighter Aircraft, in Proc. of the AIAA Guidance,
Navigation and Control Conf., Vol. 1, pp. 88-97, Boston, MA, August
1998.
[14] P. Chandler, M. Pachter and M. Mears, System Identification for
Adaptive and Reconfigurable Control, Journal of Guidance, Control
& Dynamics, Vol. 18, No. 3, pp. 516-524, May-June 1995.
[15] M. Elgersma, D. Enns, S. Shald and P. Voulgaris, Parameter Identification for Systems with Redundant Actuators, in Proc. of the AIAA
Guidance, Navigation and Control Conf., Boston, MA, August 1998.
[16] J. D. Monaco et al, Implementation and Flight Test Assessment of
an Adaptive , Reconfigurable Flight Control System, Proc. AIAA
GNC Conf., New Orleans, LA, August 1997.
[17] K. S. Narendra and A. M. Annaswamy, Stable Adaptive Systems,
Prentice Hall Inc., Englewood Cliffs, New Jersey, 1988.
[18] NASA
Ames
Research
Center,
Integrated
Vehicle
Health
Management,
Research
projects
description
http://www.nasa.gov/centers/ames/research/humaninspace/
humansinspace-ivhm.html
[19] NASA
Glenn
Research
Center,
Vehicle
Health
Management,
Research
projects
description
at
http://www.grc.nasa.gov/WWW/cdtb/projects/vehiclehealth
[20] A. Patterson-Hine, et al., A Model-based Health Monitoring and
Diagnostic System for the UH-60 Helicopter, in Proc. of the
American Helicopter Society 57th Annual Forum, AHS, Washington,
2001.

10

15

20
25
Time [sec]

30

35

40

(c) Failure parameter estimates

Fig. 2. Case 1 False alarms - The HM system indicates failures in non5769failed actuators

FrC07.3

Lateral States

Model

0
2

10

15

20

25

30

35

p [deg/s]

p [deg/s]
0

10

15

20

25

30

35

40

r [deg/s]

r [deg/s]
0

10

15

20

25

30

35

40

[deg]

[deg]

20

25

30

35

40

10

15

20

25

30

35

40

10

15

20

25

30

35

40

10

15

20

25

30

35

40

10

15

20
Time [sec]

25

30

35

40

50

10

15

20

25

30

35

0
50

40

[deg]

[deg]

15

0
2

50

0
2

10

50

0
20

20

0
20

Model

0
2

40

20

Actual

[deg]

[deg]

Lateral States

Actual

10

15

20
Time [sec]

25

30

35

0
2

40

(a) Lateral state response

Actuator Response

Right

3
2

10

15

20

25

30

35

40
TEF [deg]

TEF [deg]

0
0

10

15

20

25

30

35

AIL [deg]

AIL [deg]

10

15

20

25

30

35

20

25

30

35

40

10

15

20

25

30

35

40

10

15

20

25

30

35

40

10

15

20

25

30

35

10

15

20

25

30

35

40

10

15

20

25

30

35

40

10

15

20
Time [sec]

25

30

35

40

40

0
0.5
5

RUD [deg]

RUD [deg]

15

0.5

10
0
10
0

10

15

20

25

30

35

0
5
10

40

70
PLA [deg]

80
PLA [deg]

10

40
STAB [deg]

STAB [deg]

70
60
50

20

40

10

Right

10

10

Left

3
2

20

10

Actuator Response

Left

LEF [deg]

LEF [deg]

(a) Lateral state response

10

15

20
Time [sec]

25

30

35

65
60
55

40

(b) Actuator inputs

(b) Actuator inputs

Left

Right

10

15

20

25

30

35

40

0.5

0.5

10

15

20

25

30

35

40

10

15

20

25

30

35

10

15

20

25

30

35

10

15

20

25

30

35

40

0.5

0.5

10

15

20

25

30

35

40

AIL
0

10

15

20

25

30

35

10

15

20

25

30

35

40

10

15

20

25

30

35

40

0.5

0.5

10

15

20
25
Time [sec]

30

35

40

20

25

30

35

40

10

15

20

25

30

35

10

15

20

25

30

35

40

10

15

20
25
Time [sec]

30

35

40

0.5
0

10

15

20

25

30

35

40

10

15

20

25

30

35

40

10

15

20

25

30

35

40

10

15

20

25

30

35

40

10

15

20

25

30

35

40

10

15

20
25
Time [sec]

30

35

40

0.5

10

15

20

25

30

35

40

0.5

0.5

10

15

20

25

30

35

40

0
1

0.5

0.5

10

15

20

25

30

35

40

0.5

0.5

0.5

40

0.5

0.5

15

0.5

0.5

10

40

STAB

0.5

HMS
0

40

0.5
0

40

0.5

RUD

AIL
STAB

0
1

RUD

0.5

PLA

Right

1
LEF

HMS
0

Left

PLA

LEF

0.5
0

TEF

TEF

10

15

20
25
Time [sec]

30

35

40

(c) Failure parameter estimates

(c) Failure parameter estimates
Fig. 3. Case 2 False failures - The HM system gives incorrect failure
Fig. 4. Case 3 Missed detection - The HM system does not detect actual
5770failures
information