A Survey of Intelligent Control and Health Management Technologies for Aircraft Propulsion Systems <s> Control System Integrity Assurance <s> In the paper, the results of a full-scale engine demonstration of a sensor failure detection algorithm are presented. The algorithm detects, isolates, and accommodates sensor failures using analytical redundancy. The experimental hardware, including the F100 engine, is described. Demonstration results were obtained over a large portion of a typical flight envelope for the F100 engine. They include both subsonic and supersonic conditions at hoth medium and full, nonafter burning, power. Estimated accuracy, minimum detectable levels of sensor failures, and failure accommodation performance for an F100 turbofan engine control system are discussed. HE objective of the advanced detection, isolation, and accommodation (ADIA) program was to improve demonstrated reliability of digital electronic control systems for turbine engines by detecting, isolating, and accommodat- ing sensor failures using analytical redundancy methods. This paper discusses the results of an engine demonstration of an analytical-redundancy-based algorithm developed as part of the ADIA program. Over the past 45 years, hydromechanical implementations of turbine engine control systems have ma- tured into highly reliable units. However, there is a trend toward increased engine complexity. Engine control has be- come increasingly complex and has evolved from a hydrome- chanical to a full authority digital electronic (FADEC) imple- mentation. These FADEC-type controls have to demonstrate the same or improved levels of reliability as their hydrome- chanical predecessors. Various redundancy management techniques have been ap- plied to both the total control system and to individual compo- nents. Studies1 have shown that the least reliable of the control system components are the engine sensors. Sensor redundancy will be required to achieve adequate control system reliability. One important type of sensor redundancy is analytical redun- dancy2 (AR), which uses a model to generate redundant infor- mation that can be compared to measured information to detect failures. AR-based systems can have cost and weight savings over hardware redundancy. Considerable progress has been made in the application of analytical redundancy to improve turbine engine control sys- tem reliability. However, little has been done to demonstrate AR-based techniques on real engine systems. One exception was a flightiest program3 where selected out-of-range (hard) sensor faults were induced and the resulting actions of the control evaluated. The test program included a ground-thrust stand evaluation and a flight test. The sensors that failed during the flight test included the compressor inlet variable geometry sensor, inlet static pressure, burner pressure, and fan turbine inlet temperature. Most failures were detected and accommodated. However, a recreation of a broken line (hard) burner pressure went undetected. Pilot response to aircraft performance after accommodation was favorable. <s> BIB001 </s> A Survey of Intelligent Control and Health Management Technologies for Aircraft Propulsion Systems <s> Control System Integrity Assurance <s> This paper presents the results of applying two different types of neural networks in two different approaches to the sensor validation problem. The first approach uses a functional approximation neural network as part of a nonlinear observer in a model-based approach to analytical redundancy. The second approach uses an auto-associative neural network to perform nonlinear principal component analysis on a set of redundant sensors to provide an estimate for a single failed sensor. The approaches are demonstrated using a nonlinear simulation of a turbofan engine. The fault detection and sensor estimation results are presented and the training of the auto-associative neural network to provide sensor estimates is discussed. <s> BIB002 </s> A Survey of Intelligent Control and Health Management Technologies for Aircraft Propulsion Systems <s> Control System Integrity Assurance <s> Abstract : Sensor failure detection, isolation, and accommodation using a neural network approach is described. An autoassociative neural network is configured to perform dimensionality reduction on the sensor measurement vector and provide estimated sensor values. The sensor validation scheme is applied in a simulation of the T700 turboshaft engine in closed loop operation. Performance is evaluated based on the ability to detect faults correctly and maintain stable and responsive engine operation. The set of sensor outputs used for engine control forms the network input vector. Analytical redundancy is verified by training networks of successively smaller bottleneck layer sizes. Training data generation and strategy are discussed. The engine maintained stable behavior in the presence of sensor hard failures. With proper selection of fault determination thresholds, stability was maintained in the presence of sensor soft failures. <s> BIB003 </s> A Survey of Intelligent Control and Health Management Technologies for Aircraft Propulsion Systems <s> Control System Integrity Assurance <s> ABSTRACT In this paper, a bank of Kalman filters is applied to aircraft gas turbine engine sensor and actuator fault detection and isolation (FDI) in conjunction with the detection of component faults. This approach uses multiple Kalman filters, each of which is designed for detecting a specific sensor or actuator fault. In the event that a fault does occur, all filters except the one using the correct hypothesis will produce large estimation errors, thereby isolating the specific fault. In the meantime, a set of parameters that indicate engine component performance is estimated for the detection of abrupt degradation. The proposed FDI approach is applied to a nonlinear engine simulation at nominal and aged conditions, and the evaluation results for various engine faults at cruise operating conditions are given. The ability of the proposed approach to reliably detect and isolate sensor and actuator faults is demonstrated. NOMENCLATURE A16 Variable bypass duct area A8 Nozzle area BST Booster CLM Component Level Model FAN Fan FDI Fault detection and isolation FOD Foreign object damage HPC High-pressure compressor HPT High-pressure turbine LPT Low-pressure turbine P27 HPC inlet pressure PS15 Bypass duct static pressure PS3 Combustor inlet static pressure PS56 LPT exit static pressure T27D Booster inlet temperature T56 LPT exit temperature TMPC Burner exit heat soak WF36 Fuel flow XN2 Low-pressure spool speed, measured XN25 High-pressure spool speed, measured XNH High-pressure spool speed, state variable XNL Low-pressure spool speed, state variable <s> BIB004 </s> A Survey of Intelligent Control and Health Management Technologies for Aircraft Propulsion Systems <s> Control System Integrity Assurance <s> In this paper, an approach for in-flight fault detection and isolation (FDI) of aircraft engine sensors based on a bank of Kalman filters is developed. This approach utilizes multiple Kalman filters, each of which is designed based on a specific fault hypothesis. When the propulsion system experiences a fault, only one Kalman filter with the correct hypothesis is able to maintain the nominal estimation performance. Based on this knowledge, the isolation of faults is achieved. Since the propulsion system may experience component and actuator faults as well, a sensor FDI system must be robust in terms of avoiding misclassifications of any anomalies. The proposed approach utilizes a bank of (m+1) Kalman filters where m is the number of sensors being monitored. One Kalman filter is used for the detection of component and actuator faults while each of the other m filters detects a fault in a specific sensor. With this setup, the overall robustness of the sensor FDI system to anomalies is enhanced. Moreover, numerous component fault events can be accounted for by the FDI system. The sensor FDI system is applied to a commercial aircraft engine simulation, and its performance is evaluated at multiple power settings at a cruise operating point using various fault scenarios.Copyright © 2004 by ASME <s> BIB005
A large component of propulsion diagnostics is the critical function of control system fault detection and isolation. Some of this is based on basic control system sensors, and primarily position feedbacks (continuous and switch position). With the advent of FADEC's, dedicated self-test circuitry is required to ensure the integrity of the control system itself while providing necessary levels of fault isolation to line replaceable units (LRUs). While implementation has improved over the past two decades, poor control system diagnostics and fault isolation continue to bedevil flight operations with unacceptable "no fault found" control component removals. Selectively applying the methods being developed for engine health management, including a systems engineering approach, dedicated sensors and prognostics to control system integrity may be cost effective. Complex fuel pumps, fuel metering units, actuators, electrical power systems and oil system components can be monitored for performance degradation by using existing or added sensors to sense and trend temperature, differential pressure, slew rates, valve position, etc. Blade tip clearance sensors being considered for active control have the potential to detect and isolate a major cause of performance degradation. Microwave and optical sensors proposed for tip clearance measurement can provide high frequency tip timing data permitting detection of deflection and vibration of individual blades, and isolation of blade damage. The signal and data processing burdens are disincentives that may be overcome by the benefits to specific engines. A specialized and well-developed area of control system integrity assurance is sensor validation ( fig.10 ). Sensor validation schemes tend to be model-based in that the residuals (the differences between sensor measurements and model-synthesized estimates) are checked, and a large residual indicates that a fault has occurred. The engine model can be built in various ways that directly relate to the validation scheme to be used. For instance, least-squares-type parameter estimation schemes can provide estimates of sensor gain and bias faults by incorporating these parameters into the plant model.  Another method of sensor validation relies on a bank of Kalman filters ( fig. 11) . BIB001 BIB004 A Kalman filter takes in sensor readings and produces state variable estimates that are used with a built-in plant model to generate sensor estimates. The bank of Kalman filters consists of multiple filters, each of which utilizes a different sensor suite. The first filter uses all but the first sensor as input, the second filter uses all but the second sensor as input, and so on. Thus, each filter tests the hypothesis that the sensor it does not include is faulty. When a sensor fault occurs, the output of all filters but one will be corrupted by the faulty information. Therefore, the fault causes the residuals associated with all filters but the one that does not use the bad information to grow large, revealing the defective sensor. This method has been extended from sensor fault detection and isolation to include actuator and component fault detection as well. BIB005 This is accomplished by adding an additional Kalman filter that utilizes all sensors, and estimates several tuning parameters in addition to the state variables to account for model mismatch due to component or actuator faults. If the tuning parameter estimates become large while the residuals in the sensor fault hypothesis filters remain small, it indicates that the fault is probably in a component or actuator. Yet another method for performing sensor validation, using an artificial neural network (ANN), was demonstrated in simulation in NASA's High Reliability Engine Control program, BIB002 and was subsequently applied to a helicopter turboshaft engine as well ( fig. 12) . BIB003 The ANN consists of an input and output layer with the number of nodes equal to the number of sensors. There are three hidden layers: mapping, bottleneck, and demapping. The mapping and demapping layers are both large compared to the input and output layers. The bottleneck layer is small, and is trained to represent only the essential information contained in the system outputs. This ANN formulation can be robust enough to reproduce accurate sensor estimates (outputs) even with a faulty input. Sensor outputs are fed into the input layer of the ANN and compared to its output. If they are similar the sensors are considered to be operating properly. If an input and output diverge, the sensor is declared faulty and the ANN's estimate can be used to replace the bad sensor, thus providing sensor fault isolation and accommodation.