IEEE TRANSACTIONS ON CONTROL SYSTEMS TECHNOLOGY, VOL. 29, NO.

1, JANUARY 2021 29

Resilient Flight Control: An Architecture for

Human Supervision of Automation
Amir B. Farjadian , Benjamin Thomsen , Anuradha M. Annaswamy , Fellow, IEEE, and David D. Woods

Abstract— We address the problem of flight control in the pres- Any such design, however, has limits—disturbances, failures,
ence of actuator anomalies. A supervisory control architecture and surprising events can occur that fall outside the envelope
that includes the actions of both a human pilot and an autopilot is of robust performance. Systems then can be brittle when events
proposed to ensure resilient tracking performance in the presence
of anomalies. The pilot is tasked with supervisory, higher level challenge its design/performance envelope. Resilience, in part,
decision-making tasks, such as anomaly detection, estimation, refers to mechanisms that allow a system to extend its perfor-
and command regulation. The autopilot is assigned a lower level mance when events challenge boundaries [1]. Given, resilience
task of accurate command following based on an adaptive control is the property of a system that characterizes its ability to han-
design. The main innovations in the proposed architecture are dle extreme and high-impact disturbances that fall outside of
the use of human pilot in utilizing the concepts of capacity for
maneuver (CfM) and graceful command degradation (GCD), the design envelope, and robustness is an ability to withstand
both of which originate in cognitive sciences and a judicious nominal disturbances. This article addresses the question:
combination of the pilot inputs and the autopilot control action. how to design flight controllers that are not only robust but
Together, they provide guidelines for a system to be resilient, also resilient? We propose and test a control architecture to
which corresponds to the system’s readiness to respond to accomplish this through a novel way of utilizing the inputs
unforeseen events. The supervisory control architecture is shown
to be capable of achieving maximum CfM while allowing minimal from human pilots with those of autopilots. Resilient flight
GCD, as well as satisfactory command following postanomaly, control in this architecture uses human cognition to extend the
resulting in resilient flight capabilities. The proposed controller desired tracking performance when the automated controller
is analyzed in a simulation study of a nonlinear F-16 aircraft risks saturation in the face of escalating disturbances.
model under actuator anomalies. It is shown through numerical One way to extend the control envelope is the use of vari-
studies that under suitable inputs from the pilot, the overall
controller is able to deliver resilient flight. ous control architectures where human controllers supplement
flight control automation. As the capability of the automated
Index Terms— Adaptive control, capacity for maneuver (CfM), controller to keep pace with growing disturbances saturates,
cyber–physical systems, flight control, graceful command degra-
dation (GCD), resilience engineering, resilient control, supervi- the human expert may need to intervene and coordinate with
sory control. automation. The exact nature of this coordination may be
in the form of a shared action where both the automation
and the human expert participate at the same time scale
I. I NTRODUCTION [42], the form of supervisory action where the pilot assumes
a high-level role and provides the inputs and setpoints for

F LIGHT anomalies may occur due to a variety of reasons,

such as sensor faults, severe environmental disturbances,
electromechanical damage, or direct failures in the vehicle
the automation to track [43], or the form of trading roles
where humans take over control from automation under emer-
gency conditions [44], or combinations thereof. The current
control surfaces or engines. The goal of a control design is to architectures for combined actions of humans and automation
establish a flight envelope over which performance is robust in generally assume that a partially autonomous machine does
the face of events triggered by these classes of disturbances. all of the work to handle variability and disturbances—
until external demands imposed on the machine exceed the
Manuscript received November 21, 2018; revised May 19, 2019 and Novem-
ber 25, 2019; accepted December 1, 2019. Date of publication January 7, automation’s capabilities to handle the situation—and then
2020; date of current version December 17, 2020. Manuscript received in final control is transferred to people who have to take over when
form December 8, 2019. This work was supported in part by the National the situation is already quite difficult to handle, for exam-
Science Foundation under Grant 1549815, in part by the U.S. Department
of Transportation, in part by the University Transportation Center (UTC) ple, as the control surfaces reach the limit of their control
Program under Grant DTRT13-G-UTC47, and in part by the Boeing Company authority (i.e., as they saturate). Such architectures virtually
through the Strategic University Initiative. Recommended by Associate Editor guarantee bumpy and late transfers of control between machine
S Di Cairano. (Corresponding author: Amir B. Farjadian.)
A. B. Farjadian, B. Thomsen, and A. M. Annaswamy are with the and human, thus increasing the risk of decompensation—
Active Adaptive Control Laboratory, Department of Mechanical Engineering, inability of a joint human–machine control system to keep
Massachusetts Institute of Technology, Cambridge, MA 02139 USA (e-mail: pace with growing or cascading demands [3]. In real cases of
[email protected]; [email protected]; [email protected]).
D. D. Woods is with the Cognitive Systems Engineering Laboratory, human supervision of automation based on such architectures,
Department of Integrated Systems Engineering, The Ohio State University, bumpy/late transfers of control have contributed to actual
Columbus, OH 43210 USA (e-mail: [email protected]). accidents [2], [30]. This article addresses the question: what
Color versions of one or more of the figures in this article are available
online at https://ieeexplore.ieee.org. control architecture for human and automation interaction will
Digital Object Identifier 10.1109/TCST.2019.2959542 lead to joint flight control systems that are more resilient than
1063-6536 © 2020 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission.
See https://www.ieee.org/publications/rights/index.html for more information.

Authorized licensed use limited to: Embry-Riddle Aeronautical University. Downloaded on May 16,2023 at 20:10:59 UTC from IEEE Xplore. Restrictions apply.
30 IEEE TRANSACTIONS ON CONTROL SYSTEMS TECHNOLOGY, VOL. 29, NO. 1, JANUARY 2021

the standard approach? The new architecture proposed in this uncertainties, using an autopilot that is based on an adaptive
article provides a new way for human pilot to shift from mon- control principle is an apt solution and forms an important
itoring to supervisory action so as to “engage bumplessly” as component of our control architecture. The first part of the
operational anomalies threaten to overwhelm the performance supervisory controller we propose consists of an adaptive
of the automated controller alone. controller similar to [6], [8], and [23].
The supervisory control architecture we propose combines The second part of the supervisory controller is a human
an adaptive controller [5] with principles from cognitive engi- pilot action. When abnormalities arise during flights, incident
neering that studies how humans add resilience to complex and full-scope simulator data show that pilots can perceive
systems [2]–[4]. This controller is based on two concepts anomalies and begin to assess the abnormal situation, take
in particular, capacity for maneuver (CfM) and graceful actions, and replan flights [45]. For example, even in accidents,
command degradation (GCD). CfM is the system’s reserved pilots have recognized and attempted to respond to failures,
capacity that is present and will remain after the occurrence of such as losing thrust in both engines due to birds encounter
an anomaly [3]. It is hypothesized that resiliency is rooted in (US Airways 1549), an engine fire followed by losing another
and achieved via monitoring and regulation of the system’s engine (El Al 1862), an engine failure (Delta Air Lines 1141),
CfM [4]. In an engineering context, viewing the actuator and inadvertently stalling the aircraft (Air Florida 90). In the
input as the system’s capacity, and noting that a fundamental proposed architecture, we postulate that pilots can recognize
capacity limit exists in all actuators in the form of magnitude the occurrence of anomalies within a certain reaction time (RT)
saturation, one can define a CfM as the distance between the [13], [46] and have some estimate of the scope of the failures
control input and saturation limits. The need to avoid actuator which they can transmit to the autopilot. Based on these
saturation, and therefore increase CfM, becomes even more judgments, we propose that the pilot can input an estimate
urgent in the face of anomalies, which may push the actuators of allowable GCD that can be tolerated in a given mission
to their limits. With such a definition, we will investigate in while ensuring that some CfM remains for safe performance
this article if a resilient flight control system can be designed in the future.
with the optimization of the CfM in mind. In order to formally analyze flight control anomalies in
The second concept that we utilize is GCD. Since the closed-loop dynamics of a piloted aircraft, mathematical mod-
underlying problem of interest is satisfactory tracking of com- els of a human pilot behavior need to be considered. The
mands, delivering the same command both preanomaly and detailed models of the pilot behavior, especially at frequen-
postanomaly may not be feasible, especially if the anomalies cies where stable feedback action is most urgently needed,
cause a significant loss of actuator effectiveness. GCD is have been developed by McRuer [14] and Hess [15]–[17].
proposed as an inherent metric adopted by humans [2] that will These models have been studied by Hess [16], [17] to under-
allow the underlying system to function so as to retain a target stand a pilot’s actions following significant anomalous events.
CfM. In other words, a human may introduce a certain amount Mulder et al. [41] examined the weaknesses in [14] and
of GCD as a control variable, tuned in a way that permits provided the modifications based on studies of human pilots.
a system to reach its targeted CfM. The control architecture The results of these articles are utilized in determining the
that we propose in this article makes use of such a strategy. pilot’s role in our proposed resilient control architecture.
With resilient control defined for the purposes of this article Additional studies of experienced pilots when it comes to
as the procurement of the optimal CfM with minimal GCD recognizing anomalies and modifying controller response have
while delivering high tracking performance, we will design the been carried out in [34]–[41]. Sarter and Woods [34]–[38]
overall supervisory control architecture so as to have the flight conducted an extensive set of empirical studies with line pilots
control system performing resiliently in the face of anomalies on actual advanced aircraft in full-scope simulation studies.
(that is loss of actuator effectiveness). The results on human interaction with cockpit automation
The supervisory control architecture proposed in this article showed that flight crews are sensitive to anomalies, especially
proceeds in the following manner: When an anomaly occurs, when conditions do not match expectations, such as inter-
the human pilot is tasked with higher level cognitive tasks, nal representations (IRs) of expected aircraft behavior under
such as perception of the anomaly and an estimate of allow- automatic control. These studies also show that flight crews’
able GCD that will ensure maximum CfM. With these two ability to notice anomalies in automation behavior strongly
inputs, the automation, which consists of an adaptive autopilot, depends on the design of cockpit displays, for example, tactile
is tasked with carrying out fast inner loop decisions such displays greatly increase the speed and reliability of anomaly
as adaptive articulation of control surfaces that will ensure recognition without interfering with other pilot tasks [39].
command tracking in a stable manner. In a research review, Mulder et al. [41] pointed out that
Adaptive control systems were created to control dynamic the capability of human controllers to recognize anomalies
processes in the presence of uncertainties [5]. With successes grows with experience “the IR, the quality of which increases
reported in flight control, process control, and automotive with exposure and experience, which is the critical driver
control, adaptive control consists of a self-tuned computational behind human control adaptations.” A recent industry-wide
mechanism that adapts to the uncertainties by allowing the review [40] drawing on diverse data sources from operational
control parameters to be adjusted so as to minimize a suitably experiences supports the results from the earlier full-scope
constructed performance error. Since the problem that is simulator studies. The results from the earlier studies are
addressed in this article is flight control in the presence of suitably integrated into our supervisory control architecture.

Authorized licensed use limited to: Embry-Riddle Aeronautical University. Downloaded on May 16,2023 at 20:10:59 UTC from IEEE Xplore. Restrictions apply.
FARJADIAN et al.: RESILIENT FLIGHT CONTROL: ARCHITECTURE FOR HUMAN SUPERVISION OF AUTOMATION 31

Fig. 2. Overall supervisory controller. Pilot/autopilot contributions to resilient

flight control.
Fig. 1. Resilient flight control architecture composed of pilot and autopilot
actions.

II. S UPERVISORY C ONTROL A RCHITECTURE

The overall schematic of the control architecture proposed
in this article is shown in Fig. 1, which suggests a specific The model of the aircraft to be controlled is assumed as
task distribution between the pilot and the autopilot. This ẋ(t) = Ax(t) + B f u(t)+d +T f (x); y(t) = C x(t) (1)
distribution is decided based on the type of anomaly and
whether it corresponds to an unexpected or an abnormal condi- where x ∈ Rn and u ∈ Rm are deviations around a trim
tion [2], [18]. While abnormal conditions may be addressable condition in aircraft states and control input, respectively,
by including more advanced autopilot action alone, unexpected both of which are measurable at each instant of time. d
conditions require more elaborate diagnostic reasoning to represents uncertainties associated with the trim condition,
explain the associated findings [2]. A combination of pilot– and the last term T f (x) represents higher order effects due
autopilot actions may be needed in such a case, where the to nonlinearities. A is an (n × n) system matrix and B is an
former plays a supervisory role of anomaly recognition plus (n × m) input matrix, both of which are assumed to be known,
estimation and the latter follows by suitably altering the with (A, B) controllable, and  f is a diagonal matrix that
control input. Our focus in this article is on unexpected reflects a possible actuator anomaly with unknown positive
conditions (similar task distributions have been reported in entries λ fi . C is a known matrix of size (k × n) chosen so that
our earlier articles (see [19], [20]). We propose a resilient y corresponds to an output vector of interest. It is assumed that
flight architecture to address these conditions in which the the anomalies occur at time ta so that λ fi = 1 for 0 ≤ t < ta ,
pilot performs supervisory actions, while the autopilot is based and λ fi switches to a value that lies between 0 and 1 for t > ta .
on an adaptive controller that takes actions so as to remove Finally, it is assumed that the higher order effects are such that
discrepancies between the observed and desired states. f (x) is a known vector that can be determined at each instant
The specific adaptive autopilot that we use combines the of time, while  is an unknown vector parameter. Such a
architecture from [8] and [21]–[23]. The advantage of the dynamic model is often used in flight control problems [25].
former is the ability to gracefully degrade the command The goal is to choose the control input u so that the plant
tracking requirement to retain sufficient CfM and prevent state x follows the desired command, which is suitably altered
actuator saturation. The advantage of the latter is to ensure so as to account for the presence of anomalies. The control
a smooth tracking performance even with constraints on the input u is assumed to be position/amplitude limited and as
control effort. By combining suitable elements of these two follows:
 
control solutions, we will show that when anomalies occur, and u ci (t)
following the pilot input, the adaptive controller determines a u i (t) = u maxi sat
u maxi
control solution that not only guarantees bounded solutions 
u ci (t), |u ci (t)| ≤ u maxi
but also minimizes the command tracking error. = (2)
The rest of this article is organized as follows. The problem u maxi (t)sgn(u ci (t)), |u ci (t)| > u maxi
statement is given in Section II. The supervisory control where u maxi for i = 1, . . . , m are the physical amplitude
architecture is described in Section III. Extensive numerical limits of actuator i , and u ci (t) are the control inputs to
studies are carried out using both a high-fidelity nonlinear be determined by the supervisory control architecture. The
model of an F-16 aircraft and a linear model of an F-8 aircraft functions sat(·) and sgn(·) denote the saturation and sign
in Section IV. For the F-16 model, we compare the proposed functions, respectively.
architecture with other nonshared control solutions based on Our proposed supervisory control architecture consists of
only autopilots, which include a standard optimal control the human pilot and adaptive autopilot providing recognition,
approach as in [24] and an adaptive control approach using estimation, and control action in response to actuator anom-
multiple inputs as in [7]. For the F-8 model, we compared the alies (see Figs. 1 and 2). The details of each control unit are
proposed controller with a fault-tolerant controller. The anom- provided in Sections II-A–II-C.
alies considered are successive losses of actuator effectiveness.
Using several performance metrics related to CfM and GCD,
we demonstrate that a supervised controller outperforms all A. Autopilot: μ-Mod Adaptive Control
other controllers. Summary and conclusions are provided in To specify the adaptive controller, we begin with a reference
Section V. model that specifies the commanded behavior from the plant

Authorized licensed use limited to: Embry-Riddle Aeronautical University. Downloaded on May 16,2023 at 20:10:59 UTC from IEEE Xplore. Restrictions apply.
32 IEEE TRANSACTIONS ON CONTROL SYSTEMS TECHNOLOGY, VOL. 29, NO. 1, JANUARY 2021

and is of the form in [5] with x = xT > 0, r = rT > 0 and u = uT > 0.
Lavretsky and Hovakimyan [8] has established the stability
ẋ m (t) = Am x m (t) + Bm r0 (t); ym (t) = C x m (t) (3) of the overall adaptive system specified by (1)–(10) when
where r0 ∈ R k is a reference input, Am (n × n) is a Hurwitz L = 0. Gibson etal. [23] has established the stability of the
matrix, x m ∈ R n is the state of the reference model, ( Am , Bm ) adaptive system when no saturation inputs are present. A very
is controllable, and C is defined as given in (1), that is, ym ∈ straightforward combination of the two proofs can be easily
R k corresponds to a reference model output. The goal of the carried out to prove that when L < 0, the adaptive system
adaptive autopilot is then to choose u ci (t) in (2) so that an considered in this article has globally bounded solutions if
error e is defined as the plant in (1) is open-loop stable and bounded solutions for
an arbitrary plant if all initial conditions of and the control
e(t) = x(t) − x m (t) (4) parameters in (10) lie in a compact set. We skip this proof
due to page limitations.
and all the signals in the adaptive system remain bounded with
The adaptive autopilot in (2) and (4)–(11) provides the
error e(t) tending to zero asymptotically.
required control input in (1) as a solution to the underlying
The design of adaptive controllers in the presence of control
problem. The autopilot includes several free and constant
magnitude constraints was first addressed in [6], with guaran-
parameters, including μ in (5), δ in (7), the reference model
tees of closed-loop stability through modification of the error
parameters Am , Bm , and L in (8), and the control para-
used for the adaptive law. The same problem was addressed in ˙ˆ
[8], using an approach termed “μ-mod adaptive control” where meters K x (0), K r (0), K u (0), ḋ(0), and (0) in (10). The
the effect of input saturation was accommodated through the choice of δ sets the desired CfM and the choice of μ has
addition of another term in the reference model. Yet, another a proportional effect on CfM and GCD, as discussed in
approach based on a closed-loop reference model (CRM) Section II-A1. The choice of the remaining parameters is
was derived in [21]–[23] in order to improve the transient discussed in Section II-A2.
performance of the adaptive controller. The autopilot we 1) Quantification of CfM, GCD, and Tradeoffs: The idea
propose in this article is based on both the μ-mod and CRM behind the choice of control input as in (5) is to introduce
approaches. Compactly, this controller is summarized in the two constant parameters δ and μ, both of which help tune
following equations. The control input is modified from (2) as the control input with respect to its specified magnitude limit
⎧ u maxi . These two parameters will be shown to be useful in
⎪
⎪ u ad (t), |u ad i (t)| ≤ u δmaxi quantifying CfM, GCD, and the tradeoffs between them.
⎨ i
1 a) CfM: We first define a desired target for CfM for the
u ci (t) = (u ad i (t) + μsgn(u ad i (t))u δmaxi ) (5)
⎪
⎪ 1 + μ overall aircraft as
⎩
|u ad i (t)| > u δmaxi CfMd = max u maxi − u δmaxi (12)
i
where
and the actual CfM as
ˆ T (t) f (x)
u ad i (t) = K xT (t)x(t) + K rT (t)r0 (t) + d̂(t) + 
CfM = CfM+ /CfMd (13)
(6)
u δmaxi = (1−δ)u maxi , 0 ≤ δ< 1. (7) where

Equations (5) and (7) imply that there is a buffer region CfM+ = rms(min(ci (t)))|tTa (14.a)
i
[(1 − δ)u maxi , u maxi )] and the choice of μ allows the input ci (t) = u maxi − |u i (t)| (14.b)
to be scaled somewhere in between. The reference model is
also modified as where min and max are the minimum and maximum operators
over the i th index, rms is the root-mean-square operator
ẋ m (t)=Am x m (t) + Bm r0(t)+ K uT (t)u ad (t) − Le(t) (8) defined in (31), and ta and T refer to the time of anomaly and
u ci (t) final time, respectively. From (14), we note that CfM+ has a
u ad i (t) = u maxi sat − u ad i (t) (9)
u maxi maximum value u max for the trivial case when all u i (t) = 0,
a value close to δu max if the control inputs approach the buffer
and L < 0 is a constant or a matrix selected such that (Am +L)
region and zero if u i (t) hits the saturation limit u max . Since
is Hurwitz. Finally, the adaptive parameters are adjusted as
CfMd = δu max , it then follows that CfM, the corresponding
K˙x (t) = −x x(t)e T (t)P B normalized value, is greater than unity when the control inputs
K˙r (t) = −r r0 (t)e T (t)P B are small and far away from saturation, unity as they approach
˙ the buffer region, and zero when fully saturated.
d̂(t) = −d e T (t)P B
˙ b) GCD: As mentioned earlier, the reference model repre-
ˆ
(t) = − f f (x(t))e T (t)P B sents the commanded behavior from the plant being controlled.
K˙u (t) = u u ad e T (t)P Bm (10) In order to reflect the fact that the actual output may be
where P = P T is a solution of the Lyapunov equation (for compromised if the input is constrained, we have added a
Q > 0) term that depends on u ad (t), which can be seen from (9)
to become nonzero whenever the control input saturates, that
T
Am P + P Am = −Q (11) is, when the control input approaches the saturation limit,

Authorized licensed use limited to: Embry-Riddle Aeronautical University. Downloaded on May 16,2023 at 20:10:59 UTC from IEEE Xplore. Restrictions apply.
FARJADIAN et al.: RESILIENT FLIGHT CONTROL: ARCHITECTURE FOR HUMAN SUPERVISION OF AUTOMATION 33

u ad i becomes nonzero, thereby suitably allowing a graceful a similar choice as in (16) can be carried out using the plant
degradation of x m from its nominal choice as in (8). We denote parameters (A, B ˆ f ) and the following relations:
this degradation as
ˆ f K xT (ta )
Am = A + B 
GCD y = rms(ym (t)−r0 (t))/rms(r0 (t)), t ∈ T0 (15) −1
K rT (ta ) = − A−1 ˆ
m B  f (ta )
where T0 denotes the interval of interest and ym (t) is defined ˆ f K r (ta )
T
Bm = B 
as in (3), that is, GCD y is the value associated with the
K uT (ta ) = −A−1 ˆ
m B  f (ta ) (17)
degradation in the corresponding output y in the controlled
system. It should be noted that once μ is specified, the adaptive with the adaptive controller specified using (2) and (4)–(14)
controller automatically scales the input into the reference for all t ≥ ta , L is chosen as in [23], and lower parameters
model through u ad and K u in a way so that e(t) remains ˆ
d̂(0) and (0) are chosen arbitrarily. Similar to μ, we relegate
small and the closed-loop system has bounded solutions. the task of assessing the estimate  ˆ f to the human pilot as
It should be noted that once μ is specified, the adaptive well.
controller automatically scales the input into the reference
model through u ad and K u in a way so that e(t) remains
small and the closed-loop system has bounded solutions. B. Human Pilot: CfM-GCD Tradeoff and Anomaly
c) μ : As can be seen from (5), the purpose of μ is to Estimation
move the control input away from saturation when needed. Upon occurrence of an anomaly, the pilot is the first respon-
For example, if |u ad i (t)| > u δmaxi , the extreme case of μ = 0 der to notice and perceive the malfunction through sensory
will simply set u ci = u ad i , thereby removing the effect of the interaction with the aircraft via pilot control interfaces, such as
virtual limit imposed in (7). As μ increases, the control input stick or a wheel, rudder pedals, as well control indicators/gages
would decrease in magnitude and move toward the virtual in the cockpit displays. Based on this premise, we postulate
saturation limit u δmaxi . Once the buffer δ is determined, μ that the pilot plays a critical supervisory role to take care of
controls u i (t) within the buffer region [(1 − δ)u maxi , u maxi ], unexpected conditions. In particular, we relegate the actions
bringing it closer to the lower limit with increasing μ, that is, of: 1) CfM-GCD tradeoff and and 2) anomaly estimation to
as μ increases, CfM increases as well in the buffer region. the human pilot (see Fig. 2). These actions may be performed
It is easy to see from (8) and (9) that similar to CfM, as μ by the pilot as follows.
increases, GCD increases as well. This is due to the fact that 1) CfM-GCD Tradeoff (tuning μ): As a first step toward
an increase in μ increases u ad i (t), which in turn increases realizing a desired CfM, it is assumed that the pilot monitors
the GCD. While a larger CfM improves the responsiveness the actual CfM, which is defined as in (13). This may be made
of the system to future anomalies, a lower bound on the possible through a display interface in the cockpit through the
reference command is necessary to finish the mission within monitoring of actuator utilization [18]. While (13) may be one
practical constraints, that is, μ needs to be chosen so that GCD measure of CfM, alternate metrics based on the peak value of
remains above a lower limit while maintaining a large CfM. u(t) or an average value over a certain time, or a normalized
As a result, selecting μ is a critical tradeoff in a resilient entity with respect to each actuator may be used as well.
control system design. In this article, we define resiliency When an anomaly occurs, an increased CfM may be obtain-
as the system’s ability to trade off CfM with GCD so as to able only at the expense of a degradation of the trackable
deliver the same tracking performance both before and after command. As was argued in Section II-A1c, μ is a com-
the occurrence of an anomaly, and we relegate the task of pact parameter that directly impacts both CfM and GCD.
selecting the appropriate μ to the human pilot. We assume that the pilot is capable of determining the optimal
2) Choice of the Reference Model Parameters: In addition μ, which corresponds to the maximum CfM that can be
to μ and δ, the adaptive controller in (4)–(14) requires the achieved with a minimum GCD. We, therefore, propose that
reference model parameters Am , Bm , and L and the control with such expertise, the pilot determines the optimal μ and
parameters K x (0), K r (0), and K u (0) at time t = 0. If no enters the parameter for the adaptive autopilot to use.
anomalies are present, then nom =  f = I , which implies 2) Anomaly Estimation ( ˆ f p ): The second task that we
that Am and Bm as well as the control parameters can be assign to the pilot is one of the anomaly estimations. Noting
chosen as that the anomaly, which is assumed to result in a loss of control
effectiveness, is represented by  f in (1), we assume that
Am = A + B K xT (0) ˆ f p (of  f ). In summary, the pilot
−1
pilot provides an estimate 
K rT (0) = − A−1
m B is tasked with providing two pieces of information to the
Bm = B K rT (0) controller, μ and  ˆ f p (see Fig. 2 for a schematic). The former
provides the requisite GCD that allows the overall system to
K uT (0) = −A−1
m B (16)
retain the desired CfM. The latter is a diagnosis of the anomaly
where K x (0) is computed using a linear-quadratic regulator as perceived by the pilot.
(LQR) method and the nominal plant parameters ( A, B) [24], Interface With the Autopilot: Of the two constant parameters
and K r (0) is selected as in (16) to provide unity low-frequency that the pilot provides, μ is directly used in (5), while
dc gain for the closed-loop system. When anomalies  f occur ˆ f p is utilized by the adaptive autopilot in the following
at time t = ta , suppose that an estimate  ˆ f is available, manner. Since, in general, the expertise of the pilot may vary,

Authorized licensed use limited to: Embry-Riddle Aeronautical University. Downloaded on May 16,2023 at 20:10:59 UTC from IEEE Xplore. Restrictions apply.
34 IEEE TRANSACTIONS ON CONTROL SYSTEMS TECHNOLOGY, VOL. 29, NO. 1, JANUARY 2021

A. Adaptive Autopilot
The adaptive controller is adopted from [7], where the f
term, associated with the actuator’s locking, is omitted due
to in-applicability in the problem definition. Assuming the
control input to the plant as in (2), the control input by the
adaptive autopilot can be described as
u ci (t) = K x (t)x(t) + K r (t)r0 (t). (20)
The adaptive parameters K x (t), K r (t), and λ̂(t) are adjusted
as
K˙x (t) = −x B T Peu x T
K˙r (t) = −r B T Peu r0T
˙
λ̂(t) = λ diag(u)B T Peu (21)
where P = P T is a solution of the Lyapunov equation (for
Fig. 3. Different approaches applied to the flight control under anomaly. Top: Q > 0)
proposed supervisory controller. Bottom: optimal/adaptive/μ-mod adaptive
autopilots. T
Am P + P Am = −Q (22)
x = xT> 0, r = rT
> 0, λ = λT > 0, and u(t)
we introduce a new parameter η (0 < η ≤ 1), which is represents the control deficiency signal
calculated based on the pilot’s expertise, as a function of flying u = u i − u ci (23)
hours [26], [32], [33]. One choice of η can be
and eu is the augmented error computed from the auxiliary
η = f (FH) (18) error e as follows:
eu = e − e (24)
where FH stands for flight hours in the past six months and
f (.) normalizes hours to η. With this pilot rating, we assume e˙ = Am e + B diag(λ̂)u. (25)
that an estimate  ˆ f of  f is used in (19) as The parameter λ̂ is a vector, the elements of which are the
current estimates of the diagonal terms of  f in (1).
ˆ f = η
 ˆ f p + (1 − η)nom (19) The adaptation laws in (21) are initialized using a baseline
LQR control law similar to (16). The LQR method is applied
where nom = I. to calculate K x (0) using A and B, and the feedforward gain
(K r ) is initialized to achieve unity dc gain in the closed-loop
system
C. Supervisory Controller
The overall controller is specified by (2), (4)–(14), and Am = A + B K xT (0)
−1
(17)–(19), with the human pilot specifying two parameters K rT (0) = − A−1
m B
μ and  ˆ f p to the autopilot. The pilot is assumed to first
Bm = B K rT (0). (26)
recognize the presence of an anomaly and then provide these
parameters to the adaptive autopilot. The adaptive autopilot The primary goal of the adaptive autopilot is to minimize
then uses these two parameters and automatically determines: the tracking error in the normal and anomaly conditions.
1) the trackable command, in the form of the reference model
state x m , and 2) the control input u that ensures the plant B. Optimal Control
state x tracks x m . It is assumed that both the pilot-supplied The optimal controller is formulated using a conventional
parameters remain constant when the autopilot is adjusting LQR technique [24]. Considering (2), the optimal control input
the control inputs, leading to command tracking. Extensions is generated as
to the case when these parameters vary slowly are relatively
u ci (t) = K x x(t) + K r r0 (t). (27)
straightforward. As will be shown numerically in Section IV,
such a supervisory controller leads to a satisfactory tracking The control gains (K x , K r ) are fixed and chosen similar
performance and a good tradeoff between CfM and GCD. to the initialization in (16) and (26). The LQR method is
applied to calculate (K x (0) = K x L Q R ) using A and B matrices
( f = I ). The feedforward gain (K r ) is initialized to achieve
III. C OMPARISON W ITH OTHER C ONTROLLERS unity dc gain in the closed-loop system as follows:
To evaluate the performance characteristics of the supervi- Am = A + B K xT (0)
sory controller, we compare our proposed method with con- −1
ventional adaptive [7] and optimal controllers [24], as shown K rT (0) = − A−1
m B
in Fig. 3. Bm = B K rT (0). (28)

Authorized licensed use limited to: Embry-Riddle Aeronautical University. Downloaded on May 16,2023 at 20:10:59 UTC from IEEE Xplore. Restrictions apply.
FARJADIAN et al.: RESILIENT FLIGHT CONTROL: ARCHITECTURE FOR HUMAN SUPERVISION OF AUTOMATION 35

TABLE I
O PEN -L OOP S YSTEM M ODEL PARAMETERS

Fig. 4. Timeline of flight scenario used in simulations.

ensure zero steady-state command tracking error, the control

model augments the plant state with the integral of the altitude
The primary goal of the optimal autopilot is to minimize
command tracking error
the tracking error under normal and anomaly conditions.
t
h I (t) = [h(τ ) − h cmd (τ )]dτ (29)
C. Situation Awareness of Pilots 0

Pilots will have disparate levels of cognitive awareness of where h cmd (τ ) is the commanded altitude. The plant state
T
the anomalous situation, where they may be either situation- used in simulation is thus x long = [h I , h, θ, V, α, q] . Two
aware or situation-unaware. We quantify these differences in consecutive faults were introduced at 125 and 215 s, resulting
the following manner based on μ. In addition, we associate a in the postanomaly actuator effectiveness of 30% and 10%,
CfM metric to the human pilot and based on his/her RT. Our respectively, that is, it is assumed that both the elevator
premise is that a situation-unaware pilot (SUP) has a longer RT deflection and thrust inputs were compromised with the corre-
compared to a situation-aware pilot (SAP) and, hence, a lower sponding 2 × 2 matrix  f containing equal diagonal entries
CfM [13]. These models will be included in our numerical λ f with (see Fig. 4)
studies as follows.
1) SAP: The pilot has a high situation awareness and a ⎧
small RT and therefore can compute μ with a delay of RT. ⎪
⎨1 t< 125 s
Moreover, he/she can perceive the anomaly as  ˆ f p , leading to λ f = 0.3 215 > t ≥ 125 s (30)
⎪
⎩
an estimate as in (17). This will be used in (19) to reinitialize 0.1 t ≥ 215 s.
the parameters in the reference model and controller gains in
the adaptive autopilot. In addition, it was assumed that the anomaly causes the deflec-
2) Situation-Unaware Pilot (SUP): In contrast to the SAP, tion of the elevator to be limited. The elevator’s saturation
the SUP is cognitively saturated and slow to respond and limits (u maxi ) were set to 3 deg, and the thrust saturation limit
possesses a large RT. He/she is therefore assumed not be able was set to 1500 lbs above the nominal value associated with
to provide an anomaly estimate  ˆ f p . It is assumed that the the steady-state trim condition. Inspired by [46], we assumed
pilot is capable of providing μ after a large delay of RT. In the an RT of RT = 0.68 s for SAP and RT = 5 s for SUP in the
absence of the pilot’s anomaly estimate, the adaptive autopilot supervisory controller. In addition, we assumed δ = 0.25 to
pursues the anomaly estimation process, which may exhibit specify the desired value for CfM in (12). All LQR designs in
poor performance. (17), (26), and (28) were computed using the state and input
cost matrices (Q and R) given by
IV. N UMERICAL A SSESSMENT
Q = diag(0.01, 0.01, 1, 10, 1, 1)
A. Simulation Example R = diag(1, 1).
The control systems have been simulated in the flight
control problem of the nonlinear longitudinal dynamics of
an F-16 aircraft model. The nonlinear model with two B. Performance Metrics
inputs and two outputs is considered, where the plant state To evaluate the control performance, the root-mean-squared
x long = [h, θ, V, α, q]T contains the altitude, pitch angle, error (RMSE) was used as follows:
airspeed, angle of attack, and pitch rate, respectively. The plant
input is u = [δel δt h ]T that are the elevator deflection and thrust  T  12
1
force relative to trim, respectively. Table I gives the linearized rms(x)|0T = ||x(τ )|| dτ
2
, T >0 (31)
T 0
system matrices at h 0 = 10000 ft and V0 = 500 ft/s. For ease
of exposition, the trim disturbance d and nonlinear parameter where T is the integration period and ||. || denotes the Euclid-
 were set to zeros. The corresponding adaptive laws for d̂ ean norm. With these definitions, we chose four different
and  ˆ in (10) were set to zero as well. metrics to assess the controllers’ performance in the above-
The control objective is to track step-wise commands in mentioned example of command tracking in height (h) and
altitude (h = 80 ft) while regulating airspeed(V = 0). To velocity (V ).

Authorized licensed use limited to: Embry-Riddle Aeronautical University. Downloaded on May 16,2023 at 20:10:59 UTC from IEEE Xplore. Restrictions apply.
36 IEEE TRANSACTIONS ON CONTROL SYSTEMS TECHNOLOGY, VOL. 29, NO. 1, JANUARY 2021

1) Tracking Performance (ρ): The command following

characteristic or change in RMSE before and after the first
anomaly in each output state
ta
RMSE−
i = rms(ei )|0
1
(32)
RMSE+
i = rms(ei )|tTaend
1
ρi = RMSE+ i − RMSE−
i (33)
where i = h, v, eh ft, and eV ft/s are altitude and velocity
tracking errors, RMSE− is the root mean square error before
the first anomaly, and RMSE+ is computed after the first
anomaly to the end of simulation Tend , tai , i = 1, 2 refers
to the first and second anomalies.
2) CfM Metric: Using (12)–(14), the existing CfM with
respect to the desired CfM (CfMd ) is computed, where u maxi
is the actuator saturation limit, with i = el, th.
3) GCD: Using (15), and in this particular example, GCD
is defined as follows:
GCDh = rms(h m (t)−h 0 (t))/rms(h 0 (t)), t ∈ T0
GCDV = rms(Vm (t)−V0 (t))/rms(V0 (t)), t ∈ T0
GCD = (GCDV + GCDh )/2 − 1 (34)
where the rms function is defined in (31), and interval T0
was chosen to cover the last cycle [390, 510] s. The proposed Fig. 5. Supervisory controller with SUP. Left: tracking performance. Right:
control inputs’ status. The vertical dashed lines at t = 125 and 215 s indicate
GCD metric as in (34) presents a normalized scalar indicating two subsequent anomalies. The vertical lines at t = 130 s and t = 220 s are the
the cumulative percentage of command degradation along both pilot inputs to tune the parameter μ, where μ(t = 0) = [1, 1], μ(t = 130) =
output states. Since transients may diminish with time, and (8) [2, 1], and μ(t = 220) = [3, 1]. The instantaneous errors and normalized
CfMs are shown in the last row.
includes a feedback of the state error e(t), a choice of T0 when
TABLE II
e is small ensures that the term in (15) represents a reasonable
S UMMARY C OMPARISON A MONG D IFFERENT C ONTROLLERS
measure of GCD.
4) Parameter Estimation Error: After anomaly, the pilot
may deliver an estimate ( ˆ f p ), which results in a parameter
ˆ
estimate ( f ) as in (19)
ˆ f )
 f = diag( f −  (35)
where diag extracts the diagonal elements of the matrix
argument,  f is the Euclidean norm of parameter estimation
ˆ f is
error,  f is the actual failure repressing the system, and 
the estimate computed from the pilot input in (19). Substituting
TABLE III
(19) into (35), the following can be derived to relate the pilot’s
C OMPREHENSIVE C ONTROLLER C OMPARISON AVERAGED OVER A R ANGE
estimation error to the initial parameter estimation error: OF A NOMALY S EVERITIES

ˆ f p ) + (1 − η)( f − nom )) (36)

 f = diag(η( f − 

where  ˆ f p is the pilot’s input estimate and η is the pilot’s

expertise from (16). The term  f −  ˆ f p can be considered as
pilot’s estimation error ( f p ).

C. Results and Discussion

The plant dynamics and control input were considered as in a range 10% ≤ λ fi ≤ 30%. The supervisory controller
in (1) and (2). The supervisory controller was simulated using as well as the adaptive and optimal controllers described in
(4)–(14), μ-mod adaptive autopilot using (4)–(11), adaptive Sections II and III was assessed using the metrics in (13),
autopilot using (20)–(26), and optimal autopilot using (27) (15), (33), (34), and (36).
and (28). The simulation scenario as in Fig. 4 was used, The illustrative performance of the supervisory controller
where there is a 70% loss of actuator effectiveness followed and adaptive and optimal autopilots is presented in Figs. 5–11.
by a second anomaly. Depending on the metric of interest, Figs. 5 and 6 show the details of the supervisory controller and
the second anomaly was assumed to be fixed at 10% or varied the corresponding analysis. Figs. 7–9 show the performance

Authorized licensed use limited to: Embry-Riddle Aeronautical University. Downloaded on May 16,2023 at 20:10:59 UTC from IEEE Xplore. Restrictions apply.
FARJADIAN et al.: RESILIENT FLIGHT CONTROL: ARCHITECTURE FOR HUMAN SUPERVISION OF AUTOMATION 37

Fig. 6. Supervisory controller with SAP. Left: tracking performance. Right: Fig. 8. Adaptive autopilot. Left: tracking performance. Right: control inputs’
control inputs’ status. The vertical lines correspond to anomalies (t = 125 and status. The vertical dashed lines at t = 125 s and 215 s indicate the two
215 s) and pilot’s perception (t = 125.68 and 215.68 s) when the pilot subsequent anomalies. The instantaneous error/CfM is shown in the last row.
provided the anomaly estimate and also tuned the parameter μ, where
μ(t = 0) = [1, 1], μ(t = 125.68) = [10, 1], and μ(t = 215.68) = [30, 1].
The instantaneous errors and CfMs are shown in the last column.

Fig. 9. μ-mod adaptive autopilot. Left: tracking performance. Right: control

inputs’ status. The vertical dashed lines at t = 125 and 215 s indicate the
two subsequent anomalies. The instantaneous error/CfM are shown in the last
Fig. 7. Optimal autopilot. Left: tracking performance. Right: control inputs’ row.
status. The vertical dashed lines at t = 125 and 215 s indicate the two
subsequent anomalies. The instantaneous error/CfM are shown in the last
row. two columns. The left column corresponds to the tracking
performance and error, and the right column corresponds to
of the optimal, adaptive, and μ-mod autopilots. Table II lists the control inputs and instantaneous CfM. In the left column,
a summary of the overall performance metrics in different the first and second rows show the plant state outputs (h, V ),
controllers. Table III carries out a similar comparison in the reference model states (h ∗ , V ∗ ) when applicable, and desired
case when the second anomaly was varied from 30% to 10%. commands (h 0 , V0 ), while the last row shows the instantaneous
Figs. 5–9 show the system variables in a similar format error (4) about each state output. In the right column, the first
to each other, with each figure consisting of three rows and and second rows show the elevator (δel ) and thrust (δt h )
Authorized licensed use limited to: Embry-Riddle Aeronautical University. Downloaded on May 16,2023 at 20:10:59 UTC from IEEE Xplore. Restrictions apply.
38 IEEE TRANSACTIONS ON CONTROL SYSTEMS TECHNOLOGY, VOL. 29, NO. 1, JANUARY 2021

which he/she will determine μ. The first anomaly occurs at

t = 125 s, and therefore, the pilot is assumed to provide the
first input at t = 130 s, which is a compensatory action by
increasing μ to 2. Yet, notably, the elevator still reaches the
saturation limits, an indication of insufficient CfM. During
this period (130 s ≤ t ≤ 215 s), and as shown in the right
column, the elevator still reaches virtual saturation limits. After
the second anomaly, at t = 220 s, and considering the low
choice of μ, the SUP increases the value of μ to 3, which
shows to be a not-large-enough value in the rest of flight
maneuver, as the CfM reaches the zero limit multiple times
(t > 220). On the other hand, and in this last period, the
μ-mod autopilot starts lowering the desired command (h ∗ )
to restore the CfM and improve tracking error through the
GCD effect as in (15). This is a compensatory action by the
autopilot to account for the small μ as chosen by the SUP. The
SUP controller’s performance preanomaly and postanomaly is
numerically listed in the first row of Table II.
Fig. 6 shows the performance of the controller with an
SAP. In contrast to the SUP, the SAP takes better decisions
about μ and will also provide an anomaly estimate that will
be used in the supervisory controller as in (17), faster after
each anomaly. In this example, it was assumed that the SAP’s
estimation and rating are such that  f  = 0.2. In addition,
the SAP is assumed to have RT = 0.68 s of providing the
parameters. As shown in the right columns, and in contrast
to SUP, the pilot actions keep the control system away from
saturation limits throughout the flight maneuver. At the same
time, it achieves a better tracking error and lower command
degradation. At t = 130.68, the SAP perceives the first
Fig. 10. Pilot’s estimate contribution. Top: parameter estimate based on the anomaly and provides an anomaly estimation ( ˆ f p ) in addition
pilot’s input and expertise. Bottom: mean parameter estimation error based to μ = 10. The higher choice of μ (compared to SUP)
on the pilot’s estimation error and expertise. is only to avoid actuator saturation since SAP has a bet-
ter understanding of the anomaly magnitude and hence the
requirements for lowering ρ. Similarly and upon the second
anomaly (t = 215.68 s), the SAP delivers appropriate  ˆ fp
and μ to avoid actuator saturation and achieve lower ρ. The
responses in Fig. 6 show that the supervisory controller tunes
the reference model outputs (h ∗ , V ∗ ) suitably to minimize the
tracking error. The SAP supervisory controller performance
is numerically encapsulated in the second row of Table II.
The third row is also dedicated to SAP but with a higher
estimation error  f  = 0.4, which seems to have a worse
performance than SUP.
It is important to note that the pilot (SUP/SAP) achieved
stability and low tracking error by compromising the original
command input (r0 ), i.e., the notion of GCD. It is the unique
feature of the supervisory controller to trade off CfM with
Fig. 11. Proposed supervisory controller performance. command degradation. When anomalies cause the control
inputs to exceed the virtual saturation limits, the autopilot has
deflections within the actual (u maxi ) and virtual saturation a built-in mechanism of relaxing the required control input
(u δmaxi ) limits, where applicable. The last row in the right magnitude by lowering the command magnitude. This effect
column shows ci as in (14.b). In each plot, the vertical lines is clearly shown in Figs. 5 and 6, where by tuning μ, the pilot
correspond to the anomalies and where applicable to the pilot has reduced the reference commands to increase the available
input in the case of the supervisory controller. CfM. Yet, the obvious question that can be raised from this
feature is if such a command degradation is acceptable in
D. Supervisory Controller Performance a given mission context. While increasing μ can lead to
Fig. 5 shows the performance of the supervisory controller more CfM, this change can also lead to excessive command
with an SUP. The SUP is assumed to have an RT = 5 s after degradation. Our hypothesis is to defer the decision given by
Authorized licensed use limited to: Embry-Riddle Aeronautical University. Downloaded on May 16,2023 at 20:10:59 UTC from IEEE Xplore. Restrictions apply.
FARJADIAN et al.: RESILIENT FLIGHT CONTROL: ARCHITECTURE FOR HUMAN SUPERVISION OF AUTOMATION 39

the human pilot who has the highest amount of information and optimal autopilots follow these controllers with the worst
at the time. performance and low CfM.

E. Comparison With Other Controllers

F. Pilot’s Contribution
To provide a benchmark comparison, the performance of
optimal, adaptive, and μ-mod adaptive autopilots is shown in A primary component of the supervisory controller is the
Figs. 7–9 using the same simulation scenario as in Figs. 5 and human pilot, whose contribution to estimation error is shown
6. The summary results are also listed in the bottom rows of in Fig. 10. Fig. 10 (top) shows the pilot’s anomaly estimation
Table II. Table III provides a more comprehensive comparison input and Fig. 10 (bottom) shows the pilot’s estimation error,
over the full range of loss of actuator effectiveness at second and both are generated using algebraic simulations of (19)
anomaly ( f = [0.1 : 0.02 : 0.3]). and (36) and by considering scalar λ fi . The top contour is a
The performance of optimal autopilot is shown in Fig. 7, direct demonstration of (19), showing the estimated parameter
where prior and post the first anomaly, the controller shows (λ̂ f ) by varying pilot’s expertise (η) and estimate input (λ̂ f p ).
an acceptable performance. Yet, upon the second anomaly, The range of parameters is selected as η = [0.1 : 0.01 : 1]
the elevator control input (δel ) reaches the saturation limit and and λ̂ f p = [0.1 : 0.01 : 1]. Accordingly, each point on the
the lack of CfM leads to oscillatory behavior and poor tracking plot represents the estimated parameter (λ̂ f ) based on the
performance. As shown in the last row, the errors largely pilot’s input estimate (λ̂ f p ) and expertise (η) using (19). The
increase after the anomalies and the elevator Cel reaches contour lines show a hyperbolic effect, which is due to the
zero. Despite good performance under the normal condition, η ˆ f p product in (19). Moving along the λ̂ f p -axis with (η = 0)
the fixed gain optimal controller is not able to cope with results in high parameter estimate (≈1), due to the dominance
uncertainties and deal well with anomalies. The fourth row of the second term (1 − 0)λnom . It is the characteristic of
in Table II shows the numerical performance of this autopilot, the proposed model to undermine the pilot’s input estimate in
which is the worst among other methods. case of low expertise. Conversely, moving on the top along the
Fig. 9 shows the performance of the μ-mod adaptive λ̂ f p -axis with (η = 1) delivers a parameter estimate exactly
autopilot. This autopilot has the ability to trade CfM with equal to the pilot’s input. The pilot’s input receives the highest
GCD, yet it has a fixed predetermined μ = 100. There weight in case of higher expertise (η).
is no pilot or mechanism to tune μ in face of anomalies The second analysis, in the bottom, is the mean parameter
making the best selection for the CfM-GCD tradeoff. Similar estimation error based on the pilot’s error and expertise. The
to the two autopilots, the μ-mod autopilot shows an acceptable range of parameters is the same as the top, with the addition
performance before the second anomaly, yet it suffers from of actuator effectiveness  f = [0 : 0.01 : 1], whose effect is
actuator saturation afterward. This is due to the very high averaged to produce a 2-D figure. The pilot estimation error
magnitude of μ, which is an initial design to prioritize CfM is assumed to vary  f = [−0.5 : 0.01 : 0.5]. Accordingly,
(over GCD). While the higher choice of μ could be advan- each point on the contour corresponds to a specific pilot error
tageous in less severe anomalies (see Table III), it showed (λ f p = λ f − λ f p ) and expertise (η) averaged over the
a counter-productive effect, given the very high amount of full range of actuator effectiveness ( f = [0 : 0.01 : 1]).
anomaly and plant nonlinearities. The sixth row in Table II Similar to the top contour, higher values of expertise (η)
shows the numerical performance of this autopilot. are associated with less difference between the parameter
Table II shows the summary results for controllers and estimation error (λ f ) and pilot estimation error (λ f p ).
associated performance metrics using a single simulation case, Lower range of η removes the sensitivity to the pilot error
as shown in Figs. 5–9. All controllers show good performance axis, leading to maximum error. While moving to the left of
prior to anomaly, yet their differences emerge in response to λ f -axis increases the final error (λ f ), moving to the right
anomalies. For postanomalies, the controller with SAP has the mostly decreases the error. This is an interesting characteristic
best RMSE+ , resiliency metric, and CfM. SAP’s outstanding of this plot model, where pilot’s underestimation (e.g., λ f =
performance is followed by SUP and adaptive autopilot. This 0.6 and λ f p = 0.4) produces lower error than overestimation
is due to the effect of managing CfM in each controller. (e.g., λ f = 0.4 and λ f p = 0.6). Hence, the pilot should avoid
Table III provides a more comprehensive comparison among overestimating the actuator’s effectiveness.
the controllers by showing the result over a range of actuator It is important to note that the pilot’s input is almost
effectiveness  f = [0.1 : 0.02 : 0.3]. Accordingly, the listed fixed or at a much longer time scale compared to the autopilot.
values are averaged over  f . We also assumed 0.2 parameter
estimation error ( f ) for SAP. Accordingly, the SAP
shows the most resilient performance with postanomaly error G. Resilient Control
lower than preanomaly while also achieving high CfM and As mentioned earlier, resilient control was defined as the
GCD. The SAP is followed by μ-mod adaptive, adaptive, and system’s ability to trade off CfM with GCD so as to deliver
optimal autopilots in terms of ρ, while they show a similar the same tracking performance both before and after the
CfM and GCD. The μ-mod adaptive autopilot uses the GCD- occurrence of anomalies. As mentioned earlier, the choice of
CfM tradeoff mechanism to improve the tracking performance μ directly affects CfM and indirectly affects GCD. For any μ,
but suffers from a fixed gain. The advantageous effect of the adaptive controller guarantees that the state error e goes to
having a high μ (μ = 100) is observable in this result and zero. In summary, the choice of μ directly affects the resilience
in the range of anomalies mostly above 0.1. The adaptive of the overall system.
Authorized licensed use limited to: Embry-Riddle Aeronautical University. Downloaded on May 16,2023 at 20:10:59 UTC from IEEE Xplore. Restrictions apply.
40 IEEE TRANSACTIONS ON CONTROL SYSTEMS TECHNOLOGY, VOL. 29, NO. 1, JANUARY 2021

TABLE IV
O PEN -L OOP S YSTEM PARAMETERS OF THE L INEAR F-8 A IRCRAFT
FOR C OMPARISON W ITH FTC

Given the performance of the supervisory controller,

the question is how one chooses the best μ? Higher μ,
better the CfM, but at the expense of increased GCD.
Greater μ, greater the departure of the command signal
r0 (t)+ K uT (t)u ad (t) from the original command signal r0 (t).
In general, the desired command may not be altered beyond
certain acceptable limits. Too much command degradation, for Fig. 12. FTC performance.
instance, may lead to too long an arrival time or, in extreme
case scenarios, a nonarrival altogether at the destination. These consecutive faults was introduced at 35 and 36 s, with the
limits in turn will, most likely, determine the achievable track- magnitude of 50% and 75% loss of actuator effectiveness,
ing performance and CfM and therefore the overall resilient which was simulated by varying λ f
control performance. We, therefore, propose that the ideal ⎧
selection of μ is delegated to the pilot, as he or she may ⎪
⎨1, t< 35 s
be aware of the allowable GCD and desirable CfM. λ f = 0.5, t = 35 s (37)
⎪
⎩
The earlier discussions highlight the performance of the 0.25, t ≥ 36 s.
proposed supervisory controller relative to alternative autopilot
designs using a numerical simulation based on a nonlinear Figs. 11 and 12 show the performance of the controllers
F-16 aircraft. Primary assessment metrics used were CfM, through the responses of the sideslip angle and bank angle
GCD, tracking performance, and parameter estimation error. as well as the corresponding aileron and rudder deflections.
The proposed controller showed superior performance over As described in (37), two faults were introduced, one at 35 s
optimal, adaptive, and μ-mod adaptive autopilots. and the other at 36 s, through a suitable selection of λ f . The
anomaly occurrence and pilot perception/reconfiguration are
H. Comparison With a Fault-Tolerant Controller shown by the vertical dotted lines in Figs. 11 and 12. As shown
Yet another class of control methods that is applicable in the left columns of Figs. 11 and 12, controllers degraded
when anomalies occur is fault-tolerant control (FTC). In [20], the desired angles to achieve the tracking performance, and
we have provided a complete comparison between our pro- the supervisory controller shows a better tracking response.
posed controller and the FTC which we repeat here for The right column in Figs. 11 and 12 shows the rudder and
completeness. In this section, we compare our approach to that aileron control inputs. The magnitude limits u maxi from (2)
suggested in [47] and [48], where an FTC method is proposed is shown in Figs. 11 and 12, and the virtual magnitude limit
to deal with anomalies that may occur in actuators. This FTC u δmaxi from (7) is shown in Fig. 11. Rudder and aileron are
consists of a diagnosis and a control component, where the suddenly saturated in the case of fixed-gain FTC, while in the
former assumes that the effect of the anomaly is estimated supervisory controller, the rudder is smoothly following the
using an identification method, such as bank of Kalman filters. saturation limits and aileron is distant from saturation.
The control component is composed of fixed-gain feedback, Figs. 11 and 12 show that in comparison to the FTC, our
feedforward, and reference model components. Upon identifi- supervisory controller results in both reduced tracking error
cation of an anomaly, the feedback gains are computed, refer- and reduced command degradation. More details related to
ence model updated, and command inputs degraded into lower this comparison can be found in [20].
magnitudes so as to avoid actuator saturation. The complete
explanation of this method can be found in [47] and [48]. V. C ONCLUSION
As in [20], we design the controller based on a linearized The Resilience Engineering agenda has aspired to develop
fourth-order model of an F-8 aircraft, with two inputs and two mechanisms for resilient control [29]. This article addresses
outputs that were simulated similar to [47] and [48], where that aspiration by providing a resilient control architecture
the state of plant and reference model are x = [ prβϕ]T and based on regulating CfM and GCD. This architecture consists
x m = [ pm rm βm ϕm ]T , and the control input and command of a supervisory control interaction between a pilot and
input are u = [δa δr ]T and r0 = [38]T , respectively, with p autopilot, with specific roles prescribed for both decision-
denoting the roll rate, r the yaw rate, β the sideslip angle, ϕ making entities. In particular, it is proposed that the pilot
the bank angle, δa the aileron deflection, and δr the rudder recognizes the anomaly and specifies a parameter μ, which
deflection. System parameters are shown in Table IV. leads to a maximum CfM with a minimal GCD, which is
The control objective is a setpoint command tracking for then used by the adaptive autopilot to deliver a satisfactory
sideslip and bank angles. The deteriorating scenario of two tracking performance and stability. The autopilot is based
Authorized licensed use limited to: Embry-Riddle Aeronautical University. Downloaded on May 16,2023 at 20:10:59 UTC from IEEE Xplore. Restrictions apply.
FARJADIAN et al.: RESILIENT FLIGHT CONTROL: ARCHITECTURE FOR HUMAN SUPERVISION OF AUTOMATION 41

on a combination of adaptive controllers in [8] and [23] [3] D. D. Woods, and M. Branlat, “Basic patterns in how adaptive systems
and guarantees boundedness. Extensive numerical simulations fail,” in Resilience Engineering in Practice: A guidebook, E. Hollnagel,
ed. Farnham, U.K.: Nov. 2013, pp. 127–144.
were provided, both of a nonlinear model of an F-16 aircraft [4] D. D. Woods, “The theory of graceful extensibility: Basic rules that
and a linear model of an F-8 aircraft, all of which show that govern adaptive systems,” Environ. Syst. Decisions, vol. 38, no. 4,
the supervisory controller results in a satisfactory performance. pp. 433–457, 2018.
[5] K. S. Narendra, A. M. Annaswamy, Stable Adaptive Systems. New York,
The detailed comparisons were carried out with a variety of NY, USA: Dover, 2005.
controllers that are nonadaptive, optimal, and adaptive but uses [6] S. P. Karason and A. M. Annaswamy, “Adaptive control in the
only an autopilot and fault tolerant. In all cases, it was shown presence of input constraints,” in Proc. Amer. Control Conf., 1993,
pp. 1370–1374.
that the proposed controller provides better performance. [7] M. Schwager, A. M. Annaswamy, and E. Lavretsky, “Adaptation-based
This article provides a comparative test of the resilient con- reconfiguration in the presence of actuator failures and saturation,” in
Proc. Amer. Control Conf., 2005.
trol architecture for a specific flight control case and scenario. [8] E. Lavretsky and N. Hovakimyan, “Stable adaptation in the presence
The architecture provides specific performance metrics, and of input constraints,” Syst. Control Lett., vol. 56, no. 11, pp. 722–729,
the test provides the detailed performance measures. The key 2007.
[9] National Transportation Safety Board (USA) Aircraft Accident Report:
finding is that the supervisory controller improved resilient Loss of Thrust in Both Engines After Encountering a Flock of Birds and
performance for handling anomalous conditions. As a result, Subsequent Ditching on the Hudson River, document NTSB/AAR-10/03,
the test provides a potential standard for quantitative analysis Airbus, Weehawken, NJ, USA, 2009.
[10] Netherland Aviation Safety Board (Netherland) Aircraft Accident Report:
of resilient performance. El Al Flight 1862, document Boeing 747-258f 4x-axg, Amsterdam,
This new control architecture addresses the problem of Bijlmermeer, 1994, p. 92.
bumpy transfers of control in current human-automation [11] National Transportation Safety Board (USA) Aircraft Accident Report:
Delta Air Lines, document NTSB/AAR-89/04, Dallas-Fort Worth Inter-
systems. Current forms of human-automation interaction national Airport, Washington, DC, USA, 1989.
virtually guarantee late transfers of control that increases the [12] National Transportation Safety Board (USA) Aircraft Accident Report:
risk of decompensation as the human–machine system tries Air Florida, document NTSB-AAR-82-8, Near Washington National
Airport, Washington, DC, USA, 1982.
to keep pace with growing or cascading demands [3]. This [13] R. Hosman and H. Stassen, “Pilot’s perception in the control of
risk has contributed to actual accidents [2], [30] where loss of aircraft motions,” Control Eng. Pract., vol. 7, no. 11, pp. 1421–1428,
vehicle control resulted from bumpy and late transfers from 1999.
[14] D. T. McRuer, “Human dynamics in man-machine systems,” Automatica,
autopilot to human pilot. The resilient control architecture vol. 16, no. 3, pp. 237–253, May 1980.
developed here demonstrates that there are alternative [15] R. A. Hess, “Simplified approach for modelling pilot pursuit control
architectures, and the simulation studies in this article show behaviour in multi-loop flight control tasks,” Proc. Inst. Mech. Eng., G,
J. Aerosp. Eng., vol. 220, no. 2, pp. 85–102, 2006.
that these alternative architectures can resolve the bumpy [16] R. A. Hess, “Modeling pilot control behavior with sudden changes
transfer of control problem. in vehicle dynamics,” J. Aircr., vol. 46, no. 5, pp. 1584–1592,
This article also provides a demonstration of the value of Sep. 2009.
[17] R. A. Hess, “Modeling human pilot adaptation to flight control anom-
theoretical advances in Resilience Engineering [1]–[4]. The alies and changing task demands,” J. Guid. Control, Dyn., vol. 30, no. 6,
Theory of Graceful Extensibility [4] specifies that adaptive pp. 655–666, Jun. 2015.
[18] D. D. Woods, and N. B. Sarter, “Learning from automation surprises
units and networks (in this case, the combination of human and and going sour accidents,” in Cognitive Engineering In The Aviation
autopilot control) should regulate CfM in order to be resilient Domain, Boca Raton, FL, USA: CRC Press, Aug. 2000, pp. 327–353.
in the face of anomalies that challenge normal function (in this [19] A. B. Farjadian, A. M. Annaswamy, and D. D. Woods, “A resilient
shared control architecture for flight control,” in Proc. Int. Symp. Sustain.
case what an autopilot can handle by itself). The supervisory Syst. Technol., 2016.
control architecture was developed to regulate CfM. Other [20] A. B. Farjadian, A. M. Annaswamy, and D. D. Woods, “Bumpless
research results have shown that adaptive units at different reengagement using shared control between human pilot and adaptive
autopilot,” in Proc. IFAC, Toulouse, France, Jul. 2017.
scales can monitor their CfM and can adapt to compensate [21] T. G. Lee and U. Y. Huh, “An error feedback model based adaptive con-
when the risk of saturation gets too high [31]. This article troller for nonlinear systems,” in Proc. IEEE Int. Symp. Ind. Electron.,
demonstrates that the general concept in the theory can be Jul. 1997, pp. 1095–1100.
[22] E. Lavretsky, “Adaptive output feedback design using asymptotic prop-
defined and used in specific control problems. This article erties of LQG/LTR controllers,” in Proc. AIAA Guid. Navigat. Control
also shows that systems designed to regulate CfM can produce Conf. (AIAA), 2010, pp. 2010–7538.
improved performance in the face of anomalies. The end result [23] T. E. Gibson, A. M. Annaswamy, and E. Lavretsky, “On adaptive
control with closed-loop reference models: Transients, oscillations, and
is a new path forward for the design of combined human and peaking,” IEEE Access, vol. 1, pp. 703–717, Sep. 2013.
machine systems that can reliably produce resilient perfor- [24] A. E. Bryson, “Optimal control-1950 to 1985,” IEEE Control Syst.,
mance in the face of disturbances, anomalies, and cascades vol. 16, no. 3, pp. 26–33, Jun. 1996.
[25] E. Lavretsky, and K. A. Wise, Robust and Adaptive Control. London,
that exceed the machine’s capability alone. U.K.: Springer, 2013, pp. 317–353.
ACKNOWLEDGMENT [26] L. Guohua, “Pilot-related factors in aircraft crashes: A review
of epidemiologic studies,” Aviation Space Environ. Med., vol. 65,
The authors would like to thank Dr. E. Lavretsky of Boeing pp. 944–952, Oct. 1994.
Company for his valuable inputs. [27] D. P. Wiese, A. M. Annaswamy, J. A. Muse, M. A. Bolender, and E.
Lavretksy, “Sequential loop closure based adaptive output feedback,”
R EFERENCES IEEE Access, vol. 12, pp. 23436–23451, 2017.
[28] P. Kapasouris, M. Athans, and G. Stein, “Design of feedback control
[1] D. D. Woods, “Four concepts of resilience and the implications for the systems for unstable plants with saturating actuators,” in Proc. IFAC
future of resilience engineering,” Rel. Eng. Syst. Saf., vol. 141, pp. 5–9, Symp. Nonlinear Control Syst. Design. Oxford, U.K.: Pergamon Press,
Sep. 2015. 1990, pp. 302–307.
[2] D. D. Woods and E. Hollnagel, Joint Cognitive Systems: Patterns [29] C. G. Rieger, “Notional examples and benchmark aspects of a resilient
in Cognitive Systems Engineering. Boca Raton, FL, USA: Taylor & control system,” in Proc. IEEE 3rd Int. Symp. Resilient Control
Francis, 2006. Syst. (ISRCS), 2010, pp. 64–71.
Authorized licensed use limited to: Embry-Riddle Aeronautical University. Downloaded on May 16,2023 at 20:10:59 UTC from IEEE Xplore. Restrictions apply.
42 IEEE TRANSACTIONS ON CONTROL SYSTEMS TECHNOLOGY, VOL. 29, NO. 1, JANUARY 2021

[30] In-Flight Icing Encounter and Loss of Control Simmons Airlines, D.B.A. Benjamin Thomsen received the B.Eng. degree
American Eagle Flight 4184 Avions de Transport Regional (ATR) Model in mechanical engineering from McGill University,
72-212, N401AM, document Aircraft Accident Report NTSB/AAR- Montreal, QC, Canada, in 2015. He is currently pur-
96/01, National Transportation Safety Board, Washington, DC, USA, suing the degree with the Department of Mechanical
1994. Engineering, Massachusetts Institute of Technology,
[31] R. J. Stephens, D. D. Woods, and E. S. Patterson, “Patient boarding in Cambridge, MA, USA.
the emergency department as a symptom of complexity-induced risks,” He is currently a Researcher with the Active Adap-
in Resilient Health Care, vol. 2. Boca Raton, FL, USA: CRC Press, tive Control Laboratory, Massachusetts Institute of
2017, pp. 159–174. Technology. His research interests lie in the areas
[32] T. S. Carretta, D. C. Perry, Jr., and M. J. Ree, “Prediction of situational of motion planning and control for autonomous
awareness in F-15 pilots,” Int. J. Aviation Psychol., vol. 6, no. 1, aerial vehicles, with the goal of ensuring stable and
pp. 21–41, Jan. 1996. consistent UAV behavior in the presence of uncertain vehicle dynamics.
[33] J. L. Taylor, Q. Kennedy, A. Noda, and J. A. Yesavage, “Pilot age
and expertise predict flight simulator performance A 3-year longitudinal
study,” Neurology, vol. 68, no. 9, pp. 648–654, Feb. 2007.
[34] N. B. Sarter and D. D. Woods, “Pilot interaction with cockpit automa-
tion: Operational experiences with the flight management system,” Int.
J. Aviation Psychol., vol. 2, no. 4, pp. 303–321, 1992.
[35] N. B. Sarter and D. D. Woods, “Pilot interaction with cockpit automation Anuradha M. Annaswamy (F’02) is currently the
II: An experimental study of pilots’ model and awareness of the flight Founder and the Director of the Active Adaptive
management system,” Int. J. Aviation Psychol., vol. 4, no. 1, pp. 1–28, Control Laboratory and a Senior Research Scien-
1994. tist with the Department of Mechanical Engineer-
[36] N. B. Sarter and D. D. Woods, “How in the world did we ever get into ing, Massachusetts Institute of Technology, Cam-
that mode? Mode error and awareness in supervisory control,” Hum. bridge, MA, USA. She is the author of 100 journal
Factors, vol. 37, pp. 5–19, Mar. 1995. publications and numerous conference publications,
[37] N. B. Sarter and D. D. Woods, “Team play with a powerful and a coauthor of a graduate textbook on adaptive
independent agent: Operational experiences and automation surprises control (2004), and a coeditor of several reports,
on the Airbus A-320,” Hum. Factors, vol. 39, pp. 553–569, Dec. 1997. including Systems & Control for the Future of
[38] N. B. Sarter and D. D. Woods, “Team play with a powerful and Humanity, Research Agenda: Current and Future
independent agent: A full-mission simulation study,” Hum. Factors, Roles, Impact and Grand Challenges (Elsevier), the IEEE Vision for Smart
vol. 42, pp. 390–402, Sep. 2000. Grid Control: 2030 and Beyond (IEEE Xplore), and Impact of Control
[39] A. E. Sklar and N. B. Sarter, “Good vibrations: Tactile feedback in Technology. Her research interests pertain to adaptive control theory and
support of attention allocation and human-automation coordination in applications to aerospace, automotive, and propulsion systems, cyber–physical
event-driven domains,” Hum. Factors, vol. 41, pp. 543–552, Dec. 1999. systems science, and CPS applications to smart grids, smart cities, and
[40] K. Abbott, D. McKenney, and P. Railsback, Operational Use of Flight smart infrastructures.
Path Management Systems. Palo Alto, CA, USA: PARC, 2013. Dr. Annaswamy is also a fellow of the International Federation of Automatic
[41] M. Mulder et al., “Manual control cybernetics: State-of-the-art and Control (IFAC). She received several awards, including the George Axelby
current trends,” IEEE Trans. Human-Mach. Syst., vol. 48, no. 5, and Control Systems Magazine Best Paper Awards from the IEEE Control
pp. 468–485, Oct. 2018. Systems Society (CSS), the Presidential Young Investigator Award from NSF,
[42] D. A. Abbink et al., “A topology of shared control systems—Finding the Hans Fisher Senior Fellowship from the Institute for Advanced Study,
common ground in diversity,” IEEE Trans. Human-Mach. Syst., vol. 48, Technische Universität München, the Donald Groen Julius Prize from the
no. 5, pp. 509–525, Oct. 2018. Institute of Mechanical Engineers, a Distinguished Member Award, and a
[43] T. B. Sheridan and G. Johannsen, Monitoring Behavior and Supervisory Distinguished Lecturer Award from the IEEE CSS. She is also the President-
Control. New York, NY, USA: Plenum Press, 1976. Elect of the IEEE CSS. She has been the Deputy Editor of Annual Reviews
[44] M. Mulder, D. A. Abbink, and E. R. Boer, “Sharing control with haptics:
in Control (Elsevier) since 2016.
Seamless driver support from manual to automatic control,” Hum.
Factors J. Hum. Factors Ergonom. Soc., vol. 54, no. 5, pp. 786–798,
May 2012.
[45] A. Rankin, R. Woltjer, and J. Field, “Sensemaking following surprise in
the cockpit—A re-framing problem,” Cognition, Technol. Work, vol. 18,
pp. 623–642, Sep. 2016.
[46] A. Jain, R. Bansal, A. Kumar, and K. D. Singh, “A comparative study of
David D. Woods received the Ph.D. degree from
visual and auditory reaction times on the basis of gender and physical
Purdue University, West Lafayette, IN, USA, in
activity levels of medical first year students,” Int. J. Appl. Basic Med.
1979.
Res., vol. 5, no. 2, pp. 124–127, 2015.
[47] Y. Zhang and J. Jiang, “Fault tolerant control system design with He is currently a Professor of integrated systems
explicit consideration of performance degradation,” IEEE Trans. Aerosp. engineering with The Ohio State University, Colum-
Electron. Syst., vol. 39, no. 3, pp. 838–848, Jul. 2003. bus OH, USA. His work on safety in high risk,
[48] Y. Zhang, J. Jiang, and D. Theilliol, “Incorporating performance degra- complex settings is found in the books: Behind
dation in fault tolerant control system design with multiple actuator Human Error (1994; second edition, 2010), Joint
failures,” Int. J. Control Autom. Syst., vol. 6, pp. 327–338, Jun. 2008. Cognitive Systems (Foundations, 2005; Patterns,
2006), Resilience Engineering: Concepts and Pre-
cepts (2006), and Resilience Engineering in Practice
(2011). He studies human coordination with automated and intelligent systems
and accident investigations in aviation, nuclear power, critical care medicine,
Amir B. Farjadian received the B.S. degree in bio- crisis response, military operations, outages of critical digital services, and
medical engineering from Azad University, Tehran, space operations. He began developing resilience engineering from 2000 to
Iran, in 2003, the M.S. degree in biomedical engi- 2003 as a part of the response to several NASA accidents.
neering from the Iran University of Science and Dr. Woods received many awards, such as the Laurels Award from Aviation
Technology (IUST), Tehran, in 2006, and the Ph.D. Week and Space Technology in 1995 and the Jimmy Doolittle Fellow Award
degree in bioengineering from Northeastern Univer- from the Air Force Association. He has served on many national advisory
sity, Boston, MA, USA, in 2015. committees, such as the National Research Council committees on Dependable
At the time of writing this article, he was with Software in 2006, the Autonomy in Civil Aviation in 2014, the FAA Human
the Active Adaptive Control Lab, Department of Factors and Cockpit Automation Team (in 1996 and its reprise in 2013), and
Mechanical Engineering, Massachusetts Institute of the Defense Science Board Task Force on Autonomy in 2012. He was an
Technology (MIT), Cambridge, MA, USA, pursuing Advisor to the Columbia Accident Investigation Board. He is also the Past-
research in human-machine cognitive interaction, trying to introduce the next President of the Resilience Engineering Association and the Human Factors
generation of resilient control systems. and Ergonomics Society.

Authorized licensed use limited to: Embry-Riddle Aeronautical University. Downloaded on May 16,2023 at 20:10:59 UTC from IEEE Xplore. Restrictions apply.