IMMUNE : Control reallocation after

surface failures using model predictive

control
L. Lafourcade ∗,∗∗ Ch. Cumer ∗ C. Döll ∗
∗
ONERA, The French Aerospace Lab, Systems Control and Flight
Dynamics Department DCSD, 2, av. Ed. Belin, B.P. 4025, 31055
Toulouse Cedex 4, France, (e-mail:[email protected], Tel.: +33
(0)5.62.25.29.20, Fax: +33 (0)5.62.25.25.64)
∗∗
Institut Supérieur de l’Aéronautique et de l’Espace (ISAE),
SUPAERO, 10 av. Ed. Belin - B.P. 54032 - 31055 Toulouse Cedex 4,
France

Abstract: This paper describes how to exploit the linear model predictive control with
quadratic programming to the well-known control surface reallocation problem once an actuator
failure has been detected and isolated. Theoretical developments assume here an overactuated
aircraft model, only submitted to input constraints. Implementation improvements are added
to allow real on-board applications. Simulations prove the efficiency of the algorithm for various
failure cases.

Keywords: Control reallocation, linear model predictive control, quadratic programming,

optimization.

1. INTRODUCTION 2. PROBLEM STATEMENT

This paper deals more particularly with the so-called

control surface reallocation problem once a surface failure
has been detected and isolated. It is indeed possible Dynamics
Actuator

Actuator

to exploit the control surface redundancy or the ability

Control

Sensors
u y
split

A/C
law

of asymmetric control surface action. The aircraft A/C

nominal behavior can be recovered on-line in spite of a
failure by splitting the commanded control inputs into new
physical actuator deflections. This is typically the case
of the lateral motion : several spoilers, inner and outer Fig. 1. Actuator split in the closed loop.
ailerons on the left and the right wings can be used to
obtain the same turn rate, even if one or more fail.
During these last decades significant research has been
Fig. 1 shows the closed loop system of the considered
focused on the control allocation problem for overactu-
ated aircraft under control input constraints. All solutions aircraft A/C. It was developed during the common ON-
use basically either weighting pseudo-inverse approach or ERA/DLR IMMUNE project. IMMUNE stands for Intelli-
linear/quadratic optimizations (Enns, 1998; Beck, 2002). gent Monitoring and Managing of UNexpected Events. For
Improvements can be reached through multiple alloca- more details on the IMMUNE project and the A/C model
tion step schemes like Daisy Chaining (Buffington and see (Döll et al., 2010). The 11 A/C states are controlled
Enn, 1996) or through combinations with other techniques by 20 first order control actuators. The control inputs u
(sliding modes control...) (Alwi and Edwards, 2008). In are the deflections δ of the inner (I) and outer (O) right
(Gaulocher et al., 2007) Model Predictive Control ad- (R) and left (L) ailerons (A), of the 12 spoilers (SP) and
dresses a specific case of the control allocation problem the rudder (R) for the lateral control as well as of the
under input and output constraints : the goal is to limit a left and right elevators (EL) for the longitudinal control
structural load output to an admissible level while keeping and the stabilizer (STAB) for trim. They are all expressed
the flight behavior as close as possible to the initial one. in o . The A/C states represent the main flight dynamics
This idea is re-used here in the context of actuator failures. characteristics and are measured by sensors. These outputs
y represent the angle of attack α, the sideslip angle β, the
The paper is organized as follows. Section 2 gives an pitch angle θ and the roll angle ϕ, all given in o , the roll
overview of the A/C closed-loop architecture and intro- rate p, the pitch rate q and the yaw rate r, all given in
o
duces the main notations. Section 3 presents the theoreti- /s, the altitude ZCG given in m, the lateral acceleration
cal developments. And finally numerical simulation results Ny,CG and the vertical acceleration Nz,CG given in g as
illustrate the validity of this approach in Section 4. well as the vertical speed Vz given in m/s :
 The deflections uk are physically limited both in amplitude
 
  δAOR
α  δAIR  and rate. These limitations are taken into account in the
β   δSP1 
  following way :
p
   δSP2 
q

 
.
 umin ≤ uk ≤ umax and |∆uk | ≤ Tech .u̇max ∀k ≥ 0(2)
 ..
  
r  
3. PROPOSED APPROACH
 
   δSP12 
y=
 θ  u= 
ϕ

  δAIL 
 ZCG 
  
 δAOL 
 Linear Model Predictive Control with quadratic program-
 δELR 
  ming is used after one or several actuator failures have
 N yCG 
 
 Nz   δSTAB 
  been detected and isolated (see for example (Hardier and
CG
Vz
 δELL  Bucharles, 2010))
δRR • at each time step
The control deflections u are computed by the nominal • by optimizing only nuM P C control surface deflections
control law in terms of equivalent control deflections in • in order to recover the nominal performances within
roll, pitch and yaw deflections. These equivalent control a prediction horizon Np .Tech .
deflections are then allocated to the physical control actu- Using the recursive expression (1), the following matrix
ators within the actuator split block. expression allows us to compute the outputs yk from the
present time step (denoted by the index 1) to Np .Tech
When no actuator failure occurs, the control law and the seconds later (index Np ) in function of the present value
actuator split block are both tuned a priori to perform x1 of state vector and the control inputs to be applied
excellent reference flight qualities. A contrario, the control (u1 , . . . , uNp ) :
law and the actuator split block are not designed to
counter an actuator failure. In this case, the closed loop  y1
  C

will deliver degraded outputs.  y2   CA 
.. ..
It is proposed here to modify the split block after one
   
 .  
= . 
 x1
or several actuator failures in order to recover the nomi-
 (3)
 ..   .. 
nal A/C behavior. Linear Model Predictive Control with .   N. p−1
   
 
quadratic programming will be used as a control realloca- yN p−1 CA
tion algorithm for the on-line change of the split block. For yN p CAN p
| {z } | {z }
illustration, the proposed approach is applied to ensure the Ŷ V
nominal turn behavior even after several failures.
u1
  
0 ... ... ... 0
In normal flight, the ailerons are sufficient to provide the CB 0 ... ... 0   u2 
roll moment (the rudder is used for yaw). For such a ma-

 CAB CB 0 ... 0 
 .
..


noeuvre, the lateral and longitudinal motions are coupled, +
 
.. .. .. .. ..   
.
 N.p−2 . . . . 
  ..
 
the deflections of the elevators and the stabilizer are hence 
N p−3

justified. In the case of an aileron failure, dissymetric use CA B CA B . . . CB 0 uN p−1

CAN p−1 B CAN p−2 B . . . CAB CB
of spoilers can replace the failed actuator(s) to obtain | {z }| uNp
the same roll moment. This is the redundancy which is M
{z }
exploited here. Û

Consider a complete linear aircraft model The objective is now to compute the inputs Û in order
to minimize the difference between the obtained outputs
(Asys , Bsys , Csys , 0)
Ŷ and the reference outputs YREF , for instance the turn
which includes the A/C states at a given flight condition behavior of the nominal aircraft without failure :
 
as well as the actuator and sensor dynamics. For on-board min J = kŶ − YREF k2 = k MÛ + Vx1 − YREF k2
computation, the linearization is realized every 10 s. This U
model is then discretized with a sampling time Tech using
which reduces to a quadratic programming problem for
the well known Tustin equations :
the inputs Û as follows :
A = eAsys Tech
B = A−1 Asys Tech min J = Û T MT MÛ + aT Û + d


sys e − I Bsys
aT = 2xT1 V T M − 2YREF
T

C = Csys M
avec T
d = (Vx1 − YREF ) (Vx1 − YREF )
leading to the following discrete time state space represen-
tation or recursive expression : The limititations of uk in both positions and rates given

xk+1 = Axk + Buk in the inequalities (2) are transformed into the following
sys : (1) expressions :
yk = Cxk

1
U ≤ Umax
The sampling frequency fech = is here 16 Hz.

U ≥ Umin

Tech

 
Afterwards we will denote uk (resp. yk ) the vector of the ∆Umax + U0 (4)
MVL . U ≤
20 deflections (resp. of the 11 outputs) values reached at


 ∆Umax − U0

the time step k.Tech .
 | {z }
VVL
where Umax , Umin , U0 and ∆Umax are vectors of dimen- There is a compromise between the accuracy in following
sions (nuM P C Np × 1) : the reference signal YREF and the computation time.
umax umin u0
     
 umax   umin   0  4. APPLICATION
Umax =  ...  Umin =  ...  U0 =  ... 
    
The proposed algorithm is applied to several failure cases
umax umin 0 at various flight conditions (speed, mass and altitude) in

u̇max
 the presence of uncertainties and external perturbations
 u̇max  like the wind for the IMMUNE model, see (Döll et al.,
∆Umax = Tech . 
 ... 
 2010). It is first applied to cases where the nominal flight
control law works well in order to determine the best
u̇max compromise between the prediction horizon Np and the
interpolation horizon Ni as well as the number of control
It can be easily proven that the square matrix MVL of surfaces nuM P C which should be optimized. These cases
dimension (2 nuM P C Np × 2 nuM P C Np ) is equal to : are :
 
I 0 ... ... 0 • reconfiguration without failure using the spoilers in
.
 −I I . . . . . . ..  addition to the ailerons


VL
   • reconfiguration after an aileron jammed at 0o using
MVL = with VL =  0 −I I . . . ... 
 
−VL the remaining ailerons and spoilers
• reconfiguration after an aileron jammed at 40o using
 
 . . . .
 .. . . . . . . 0 

the remaining ailerons and spoilers
0 . . . 0 −I I • reconfiguration after loss of efficiency of an aileron

Structural limitations for this aircraft are not known and The best compromise for the A/C real time application
were therefore not included into the cost function, but this is a prediction horizon Np of 50.Tech = 3.125s with an
approach accepts their potential inclusion as additional optimization every Ni = 0.625s. For accuracy reasons, all
output constraints (Gaulocher et al., 2007). 17 lateral control inputs are reallocated :
• the rudder,
Once Û is obtained, just the optimized control surface
• the 4 inner and outer left and right ailerons,
deflections u1 at k = 1 is then applied to the aircraft.
• and the 12 spoilers
For real time on-board application, the time-consuming
The reference signal Yref is here the nominal lateral
optimization is not realized at each time step, but only at
behavior without failure:
m = (Np − 1)/(Ni − 1) time steps (Ni is the interpolation  
horizon.). More precisely, instead of computing Û directly, βref
 pref 
we search for
Yref =  rref 
 
u1
 
 ϕ 
ref
 um+1  Ny,ref
Ûdownsampled =   ... 


uN p The reallocation by MPC is implemented in the actuator

split block as shown in Fig. 2.
Between these points, the remaining values are linearly The control deflections computed by the nominal law
interpolated (with κ = m 1): and those ones optimized by MPC are combined except
the rudder deflection. The MPC control inputs act hence
I 0 ... ... 0
 
as a feedforward for the desired control deflections. The
 (1 − κ) I κI 0 ... 0
nominal control law ensures robustness to internal uncer-
 (1 − 2κ) I 2κI 0 ... 0
  tainties like model errors and external perturbations like
 .
.. .
.. .. .. .. 

 . . .  turbulences.

 0 I 0 ... 0  Once, the MPC control scheme is tuned, a very hard, but
 .. 
also very unlikely failure case is simulated in order to illus-
Û = 
 . (1 − κ) I κI 0 0  Ûdownsampled

. trate the interest of such a control reallocation approach.
..
 

 (1 − 2κ) I 2κI 0 0   The reconfiguration is initialized after the simultaneous
 .. .. .. .. ..  jam of the outer and inner left aileron at −40o and −30o

 . . . . .  respectively for a turn to the right with a heading change
 .
..

of ∆Ψ = +90o at low altitude (about 700 f t) and at low
 0 I 0 0
speed (about 150 kts). The nominal law was not at all
 
.. .. ..
. . 0 . I designed for such a case as the failure occurence is less
| {z } than the demanded one Φcoupledf ailure < 109 ).
C
In the following plots, the signals in the nominal case
then the whole procedure starts again. The interpolation without failure are plotted in red, the signals resulting
also smoothes the optimized control inputs. from the reallocation are plotted in blue lines.
 17
[alloc.lateral]'

17
aileron outer right
dp 17
LATER
Demux
17 17 aileron inner right
17
0 17 12

Constant2 Switch spoiler 1

Lateral
dq spoiler 2
Terminator1

spoiler 3

spoiler 4
12
U(E)
U
12
dr spoiler 5
Selector

6 12 spoiler 6
1 Demux
12 12 Demux
12
spoiler 7

engine 1
spoiler 8

spoiler 9
22
1
spoiler 10
[0,1]->[0,45]
engine 2
spoiler 11

45 spoiler 12

aileron inner left

speedbrakes

3 aileron outer left

[alloc.longi]'

elevator right
LONGI 3

3 stabilizer
Demux

3
elevator left
Switch1
longitudinal rudder

engine 1 (left)

engine 2 (right)

Fig. 2. Implementation of the MPC in the nonlinear simulation environment

are deflected upwards. This would mean a negative lift on

the left wing and hence a turn to the left. The nominal
law immediately counters the induced roll moment by a
symmetric deflection on the right ailerons. They are now
saturated, but the aircraft continues a straight flight. In
order to induce the turn to the right, the MPC orders the
deflection of the spoilers 1-3 on the right wing. After the
desired heading change, the MPC reduces the deflection of
the right ailerons in order to less counter the effect of the
jammed left ailerons. The aicraft comes back to a straight
flight. In order to reduce the induced yawing moment of
the jammed ailerons, the MPC orders a slight deflection of
the spoilers 1-3 on the right wing. The optimized control
input signals are a little bit too noisy. This is due to the
optimization at each time step. The rudder is used almost
in the same way as by the nominal law.

Fig. 3. Control inputs after optimization at each time step

In Fig. 3, the MPC reallocated control inputs without in-

terpolation (blue) after the simultaneous jam of the outer
and inner left aileron are plotted. The jammed ailerons
Fig. 4. Smoothed control inputs after optimization using Fig. 6. Lateral and longitudinal outputs compared to the
interpolation nominal case
In Fig. 6, the resulting lateral and longitudinal outputs
y (blue) after the simultaneous jam are compared to
the nominal signals without failure (red). Here the full
nonlinear simulator is used. It can be seen that the A/C
after failure behaves almost as the nominal A/C. The
angle of attack α and the pitch angle θ differ from the
nominal values which is due to the fact that the A/C has
to compensate the additional drag due to the deflection
of the jammed ailerons. Otherwise, the behavior is more
or less the same than in the linear case. The sideslip
angle β and the yaw rate r are slightly less damped than
for the linearized model. This is due to small differences
between the linear and the nonlinear model. But globally,
the proposed linear MPC scheme works very well even with
the nonlinear model. The combination of the MPC with
the nominal control law ensures the robustness to internal
uncertainties (model errors) and external perturbations.
In Fig. 7, the pitch angle θ, the roll angle ϕ and the
yaw angle ψ generated by MPC (blue) or smoothed MPC
(black) are compared to those generated by the nominal
law (red) in the case of the simultaneous jammed ailerons
Fig. 5. The resulting lateral outputs compared to the using the nonlinear simulator. It can clearly be seen that
reference signals the nominal control law was not designed for this very
hard and unlikely failure case. Especially, the roll angle
In Fig. 4, the MPC reallocated control inputs with inter- oscillates by almost 10o around its desired value of 30o .
polation (blue) after the simultaneous jam of the outer The MPC reconfiguration with or without interpolation
and inner left aileron are plotted. Mainly, the system be- reassures an almost nominal behavior. The blue and the
havior is as before, but the control inputs are considerably black lines are superposed. It improves significantly the
smoothed. By the way, the computing time is considerably A/C behavior with respect to the pure nominal law in
reduced during optimization. this failure case.

In Fig. 5, the resulting outputs Ŷ (blue) due to opti-

mization after the simultaneous jam are compared to the
reference signals Yr ef without failure (red). Here a linear
model is used. It can be seen that the A/C after failure
behaves almost as the nominal A/C, especially in terms of
sideslip angle β and roll angle ϕ. There is a slight difference
in roll rate p during the initiation of the turn to the right.
It can be stated that the minimization of the optimization
criterion works well.
 Gaulocher, S., Roos, C., and Cumer, C. (2007). Aircraft
load alleviation during maneuvers using optimal control
surface combinations. Journal of Guidance, Control and
Dynamics, 30(2).
Hardier, G. and Bucharles, A. (2010). In-flight aircraft
monitoring using a frequency domain parameter identi-
fication. In 18th IFAC Symposium on Automatic Control
in Aerospace. Nara, Japan.

Fig. 7. θ, ϕ and ψ generated by the nominal law and the

MPC reconfigured law after the simultaneous aileron
jam
5. CONCLUSIONS AND PERSPECTIVES

MPC works as a feedforward, the nominal law in closed

loop ensures robustness and rejects external perturbations.
The proposed MPC algorithm permits to treat all failure
cases in various flight conditions with uncertainties and
external perturbations. The reconfiguration improves sig-
nificantly the A/C behaviour in hard and very unlikely
failure cases with respect to the pure nominal law.
However, the proposed MPC must still be extended to an
integrated closed loop law in order to replace completely
the nominal law after reconfiguration in order to ensure
itself robustness and perturbation rejection. The compu-
tation time should still be reduced for implementation on
on-board computers.
For the moment being, the reference signal was the nom-
inal aircraft behavior without failure. It can be adapted
to restricted achievable A/C performances after failure,
especially after multiple failures.

REFERENCES
Alwi, H. and Edwards, C. (2008). Fault tolerant control
using sliding modes with on-line control allocation.
Automatica, 44, 1859–1866.
Beck, R. (2002). Application of Control Allocation Methods
to Linear Systems with Four or More Objectives. Ph.D.
thesis, Faculty of the Virginia Polytechnic Institute and
State University.
Buffington, J. and Enn, D. (1996). Lyapunov stability
analysis of Daisy Chain control allocation. Journal of
Guidance, Control and Dynamics, 19(6), 1226–1230.
Döll, C., Hardier, G., Varga, A., and Kappenberger, C.
(2010). IMMUNE project : An overview. In 18th IFAC
Symposium on Automatic Control in Aerospace. Nara,
Japan.
Enns, D. (1998). Control allocation approaches. In Proc.
AIAA guidance, navigation, control conference, 98–108.