Design and Analysis of Robust Fault Diagnosis Schemes for a Simulated Aircraft Model

Several procedures for sensor fault detection and isolation (FDI) applied to a simulated model of a commercial aircraft are presented. The main contributions of the paper are related to the design and the optimisation of two FDI schemes based on a linear polynomial method (PM) and the nonlinear geometric approach (NLGA). The FDI strategies are applied to the aircraft model, characterised by tight-coupled longitudinal and lateral dynamics. The robustness and the reliability properties of the residual generators related to the considered FDI techniques are investigated and verified by simulating a general aircraft reference trajectory. Extensive simulations exploiting the Monte Carlo analysis tool are also used for assessing the overall performance capabilities of the developed FDI schemes, in the presence of turbulence, measurement, and model errors. Comparisons with other disturbancedecoupling methods for FDI based on neural networks (NNs) and unknown input kalman filter (UIKF) are finally reported.


INTRODUCTION
Increasing demands on reliability for safety critical systems such as aircraft or spacecraft require robust control and fault diagnosis capabilities as these systems are potentially subjected to unexpected anomalies and faults in actuators, input-output sensors, components, or subsystems.Consequently, fault diagnosis capabilities and requirements for aerospace applications have recently been receiving a great deal of attention in the research community [1,2].A fault diagnosis system needs to detect and isolate the presence and location of the faults, on the basis also of the control system architectures.Development of appropriate techniques and solutions for these tasks are known as the fault detection and isolation (FDI) problem.There are, broadly speaking, two main approaches for addressing the FDI problem, namely, hardware-based and model-based techniques [3,4].A common and important approach in model-based techniques is known as the residual-based method.A number of researchers have developed residual-based methods for dynamic systems such as the parity space [5], state estimation [6], unknown input observer (UIO), Kalman filters (KFs) [3], and parameter identification [6].Intelligent techniques [7] can be also exploited.Furthermore, the Massoumnia's geometric method [8] was successfully extended to nonlinear systems [9,10].A crucial issue with any FDI scheme is its robustness properties and a viable procedure for practical application of FDI techniques is really necessary.Moreover, robust FDI for the case of aircraft systems and applications is still an open problem for further research.
The first part of this work deals with the residual generator design for the FDI of input-output sensors of a general aviation aircraft subject to turbulence, wind gust disturbances, and measurement noises.The developed PM scheme belongs to the parity space approach [5] and it is based on an input-output polynomial description of the system under diagnosis.In particular, the use of input-output forms allows to easily obtain the analytical description for the disturbancedecoupled residual generators.These dynamic filters, organised into bank structures, are able to achieve fault isolation properties.An appropriate choice of their parameters allows to maximise robustness with respect to both measurement noise and modelling errors, while optimising fault sensitivity characteristics.The development of NLGA methodology is based on the works by De Persis and Isidori [10].It was shown that the problem of the FDI for nonlinear systems is solvable if and only if there is an unobservability distribution that leads to a quotient subsystem which is unaffected by all faults but one.If such a distribution exists, an appropriate coordinate transformations in the state space can be exploited for designing a residual generator only for the observable subsystem.This technique was applied for the first time to a vertical takeoff and landing (VTOL) aircraft with reference to a reduced-order model [11].The NLGA residual generators have been designed in order to be analytically decoupled from the vertical and lateral components of the wind (gusts and turbulence).Moreover, a new full analytical developed mixed H − /H ∞ optimisation is proposed in order to design the NLGA residual generators so that a good tradeoff between the fault sensitivity and the robustness with respect to measurements and model errors is achieved.The designed residual generators have been tested on a PIPER PA-30 aircraft flight simulator that was implemented in Matlab-Simulink environments.With respect to the related works by the same authors [12,13], the main contribution of this paper regards the enhancement in the designs of the proposed FDI schemes.Moreover, the final performances have been evaluated by adopting a typical aircraft reference trajectory embedding several steady-state flight conditions, such as straight flight phases and coordinated turns.Comparisons with different disturbance-decoupling methods for FDI based on neural networks (NNs) and unknown input Kalman filter (UIKF) have been also provided.Finally, extensive experiments exploiting Monte Carlo analysis are used for assessing the overall capabilities of the developed FDI methods, in the presence of uncertainty, measurement, and modelling errors.

AIRCRAFT MODEL OVERVIEW
This section recalls briefly the description of the monitored aircraft whose main parameters and variables are reported in Table 1.
The considered aircraft simulation model consists of a PIPER PA-30, based on the classical nonlinear 6 degrees of freedom (DoF) rigid body formulation [14] whose motion occurs as a consequence of applied forces and moments (aerodynamic, propulsive, and gravitational).A set of local approximations for these forces has been computed and scheduled depending on the values assumed by true airspeed (TAS), curvature radius, flight path angle, altitude, and flap deflection.In this way, it is possible to obtain a mathematical model for each flight condition.This model is suitable for a state-space representation, as it can be made explicit.The parameters in the analytic representation of the aerodynamic actions have been obtained from wind tunnel experimental data, and the aerodynamic actions are expressed along the axes of the wind reference system.It should be observed that aerodynamic forces and moments are not implemented by the classical linearised expressions (stability derivatives) but by means of cubic splines approximating the nonlinear experimental curves.The nonlinear 6 DoF model has been completed by means of the PIPER PA-30 propulsion system consisting of two 4-pistons aspirated engines, with the throttle valve aperture δ th as input and the overall thrust intensity as output.The overall simulation model, used to perform all the following tests, consists of the aircraft 6 DoF flight dynamics and the engine model completed with the model of input-output sensors, the servo actuators, the atmosphere turbulence Dryden description, the wind gust disturbances, and a classical autopilot.Moreover, the sensor models embed all the possible sources of disturbance (calibration and alignment errors, scale factor, white and coloured noises, limited bandwidth, g-sensitivity, gyro drift, etc.).The linear model used by the proposed PM FDI approach described in Section 3 embeds the linearisation both of the 6 DoF model and of the propulsion system as follows: with where Δ denotes the variations of the considered variables while c(t) and d(t) are the control inputs and the disturbances, respectively.The disturbance contribution of the wind gusts as air velocity components, w u , w v , and w w , along body axes was also considered.The output equation associated with the model ( 1) is of the type y(t) = Cx(t), where the rows of C correspond to rows of the identity matrix, depending on the measured variables.On the other hand, regarding the NLGA FDI scheme described in Section 4, it requires a nonlinear input affine system [10], but the adopted simulation model of the aircraft does not fulfil this requirement.For this reason, the following simplified aircraft model is used: where C (•) are the aerodynamic coefficients; t (•) are the engine parameters; and w v , w l are the vertical and lateral wind disturbance components.In particular, the model of (3) has been obtained on the basis of some assumptions.In particular, the expressions of aerodynamic forces and moments have been represented by means of series expansions in the neighbourhood of the steady-state flight condition, then only the main terms are considered.The engine model has been simplified by linearising the power with respect to the angular rate behaviour in the neighbourhood of the trim point.The second-order coupling between the longitudinal and lateraldirectional dynamics have been neglected.The x-body axis component of the wind has been neglected.In fact, the aircraft behaviour is much more sensitive to the y-body and z-body axis wind components.Finally, the rudder effect in the equation describing the β dynamics has been neglected.It is worth noting that Section 5 has shown that the designs and the simulations of the NLGA residual generators are robust with respect to the last approximation.In fact, the model of the β dynamics will never be used.

PM RESIDUAL GENERATORS
Let us consider the input-output representation of a continuous-time, time-invariant linear dynamic system affected by faults and disturbances in the form where y(t) ∈ R m is the output vector, c(t) ∈ R lc is the input vector, d(t) ∈ R ld is the disturbance vector, and f (t) ∈ R l f is the fault vector; P(s), Q c (s), Q d (s), and Q f (s) are known polynomial matrices of proper dimensions.Models of type ( 4) can be frequently found in practice by applying well-known physical laws to describe the input-output dynamical links of various systems.Algorithms to transform multivariable state-space models to equivalent multiple-input-multiple-output (MIMO) polynomial representations and vice versa are available [15].Suitable software routines for multivariable system transformations have been implemented by the authors in the Matlab environment.In fact, the Matlab software for state-space and transfer function conversions is not able to manage directly MIMO models, since they are considered as concatenations of singleinput-single-output (SISO) systems.
An important aspect of the residual generator design concerns the decoupling properties of the disturbance d(t).The decoupling can be obtained premultiplying all the terms of (4) by the matrix L(s) ∈ N l (Q d (s)), that is, the left nullspace of the matrix Q d (s): Hence, the residual generator for the system of ( 4) is represented by where it is assumed that r(t) ∈ R and L(s) is a polynomial row vector.The polynomial R(s) can be arbitrarily selected among the polynomials with degree greater than or equal to n * r , where n * r is the maximum row-degree of the pair {L(s)P(s), L(s)Q c (s)}.Moreover, if all the roots of R(s) lie in the open left-half s-plane, it assures the stability of the filter of (6).Without loss of generality, it is assumed that R(0 Therefore, a polynomial matrix B(s), whose rows represents a minimal polynomial basis of N l (Q d (s)), has m − l d rows and m columns.
This work is focused on the problem of detecting and isolating additive faults acting on the input and output sensors of the monitored system.If the input-output measurements are modelled by the relations of (7): the system of (4) becomes under the assumptions that T .Thus, the residual generator of ( 6) is written as Remark 2. The residual generator described by ( 7) and ( 9) can be seen as an errors-in-variables (EIV) model [16] with respect the input and output variables, as the measurements that feed the residual function are affected by additive faults.This description highlights the importance of the residual generator in the form of (9).
Remark 3. The diagnostic capabilities of the residual generator of (6) strongly depend on the choice of the terms L(s) and R(s).This paper proposes a method for the design of these polynomials, under the assumption that f (t) is a scalar and, consequently, Q f (s) is a vector.The rationale of this assumption is commented in Section 3.2 where the fault isolation method is proposed.
In the following, the freedom design in the selection of the rows of the polynomial matrix L(s) is investigated when q = m − l d ≥ 2. These degrees of freedom are used to optimise the sensitivity properties of r(t) with respect to the fault f (t), for example, by maximising the steady-state gain of the transfer function If b i (s) (i = 1, . . ., q) are the row vectors of the basis B(s), L(s) can be expressed as linear combination of these vectors: where k i are real constants maximising: with the constraint Under these assumptions, when the fault f (t) is a stepfunction of magnitude F,the steady-state residual value is If the following real vectors are defined as the problem of the maximisation of the residual fault sensitivity can be recast as follows.
Proposition 1.Given the vector a, the vector k that maximises the steady-state fault sensitivity, that is, the function W given by the expression under the constraint of (12), can be found by solving The solution to the problem described by Proposition 1 can be derived as follows.The constraint of (12) describes a hypersphere, whilst the expression of the function of ( 15) is a hyperplane.The unknown coefficients k must belong to both the hyperplane and the hypersphere.Therefore, the points of tangency between the hypersphere and the hyperplane represents the solutions that maximise or minimise W. As shown below, the solution of the problem described by Proposition 1 exists and is unique.
an expression in the form of Ax = b is obtained, where The unknown vector x, under the constraint of ( 12), can be expressed as follows: where (A −1 b) i is the ith element of the vector A −1 b.The vector x represents the squares of the solution of the problem of Proposition 1.
Let us indicate Ω the set of the vectors k whose elements are the square roots of the elements of x.As every element can be taken both with signs "+" and "−", such vectors are 2 q .Therefore, the solution k of Proposition 1 can be reformulated as Remark 4. The matrix A can be expressed as , where E is a matrix with equal columns.If a 1 / = 0, this assumption guarantees the existence of A −1 , and consequently the existence and the uniqueness of the solution A −1 b.Obviously, if a 1 = 0 and a j / = 0, it is sufficient to express k j as function of the remaining variables and to reapply the same procedure.
Remark 5.The same solution can be found by maximising the function |W |.Due to the symmetry properties, the maximisation of |W | admits two solutions corresponding to the maximum and the minimum of the function W.Moreover, the choice of the quadratic constraint of ( 12) guarantees the unicity of the solution to the problem of Proposition 1. Remark 6.The problem described by Proposition 1 could have been solved also in a numerical way, that is, by searching k that maximises W on the surface of the q-dimensional hypersphere.However, the computational cost of this numerical solution can be a drawback when q is big.

PM residual design
Section 3 has shown how to maximise the steady-state gain of the continuous-time transfer function G f (s) = L(s)Q f (s)/R(s) trough a suitable choice of the real vector k (i.e., k = k).The design of the filter of ( 6) has been completed here by introducing a method for assigning both the zeros and the poles of the continuous-time transfer function G f (s).The zeros and poles location influences the transient characteristics (maximum overshoot, delay time, rise time, settling time, etc.) of the filter of (6).In many applications, these characteristics must be kept within tolerable or prescribed limits in order to guarantee good performances of the filter in terms, for example, of fault detection times and false-alarm probabilities.
is fixed and no freedom degree is left to arbitrarily assign the zeros.In order to solve this problem, a polynomial vector k(s) can be considered.Under this assumption, L(s) still belongs to the subspace N l (Q d (s)), where the terms k i are polynomial coefficients.
The previous consideration leads to introduce the polynomial where k(s) is a q-dimensional polynomial vector whose ith element has the form The degree n k and the q × n k coefficients k j i are freedom design ( j / = 0) that are exploited for obtaining the desired roots of the polynomial E(s).However, in order to maximise the steady-state gain, as shown in Section 3, the following condition must hold: Definition 1. H(s) is the reference polynomial whose roots are the zeros to be assigned: Since the constraint of (24) must hold, H(0 Obviously, this assumption does not provide any restriction on the roots assignable.Under the previous considerations, the zero assignment and pole placement problem is formulated as follows. Proposition 2. The degree n k and the coefficients k j i have to be determined under the constraint of (24) in order to obtain E(s) = H(s).
Proof.In Section 3, the polynomial vector a(s) = B(s)Q f (s) was defined.Its ith element is a known polynomial of a certain degree, n ai .If n a is defined as follows: the ith element of a(s) can be always written as a polynomial of degree n a : by imposing that a j i = 0 when j > n ai .As E(s) = k T (s)a(s), by multiplying ( 23) and ( 27), it results where Equations ( 28) and (29) assume that k α i = 0 when α > n k and a β i = 0 when β > n a .Note that the coefficients e 1 , . . ., e nk+na depend on the freedom design k 1 i , . . ., k nk i .On the other hand, e 0 is fixed as the coefficients k 0 i are assigned by (24).Let us suppose that n h ≤ n k + n a .By imposing E(s) = H(s), from (29) and (25), the following expressions are computed: (30) Equations ( 24) and (30) represent a linear system with n k +n a equations and q × n k unknowns, which can be expressed in the classical form Ax = b, where The degree n k of the polynomials k i (s) has to be chosen in order to obtain a solvable system (i.e., rank In order to understand the proposed solution, the following points should be considered. (i) The choice of n k must guarantee that the relations n h ≤ n k + n a are satisfied.(ii) When q ≥ 2, the difference between the number of unknown terms and the number of equations, that is, (q − 1) × n k − n a , is greater than zero if n k is selected sufficiently high.(iii) Even if the system admits solutions, the inverse of the matrix A may not exist; in such case there are infinite solutions and the one associated to the pseudoinverse of A, that is, A + b can be computed.
Remark 8.The use of a polynomial vector k(s) instead of a real vector k has the drawback of increasing the complexity of the residual generator.Many FDI applications require that where F(s) is an arbitrary polynomial.These cases do not require a k(s) such that where E 0 (s) = kB(s)Q f (s).However, there is a restriction on the choice of F(s).In fact, due to the realisability condition, deg{F(s)} > n * r − deg{E 0 (s)}.Moreover, the method cannot be applied if E 0 (s) admits one or more roots with positive real part, as the residual generator would become unstable.These cases require an approximate solution.
Remark 9.This section is focused on the design of residual generators on the basis of a given reference function with disturbance-decoupling and fault sensitivity maximisation properties.The pole location influences the transient dynamics of the designed residual filters, while the steady-state properties depend on the PM residual design, as it maximises the residual steady-state values with respect to step faults affecting input and output sensors.The poles of the residual functions could be optimised with respect to both fault and disturbance terms, as shown, for example, in a work by the same authors [17].

PM fault isolation
This section addresses the design problem of residual generator banks for the isolation of faults affecting the input and the output sensors.This design is performed by using the disturbance-decoupling method suggested in Section 3.
To univocally isolate a fault concerning one of the output sensors, under the hypotheses that the input sensors and the remaining output sensors are fault-free, a bank of residual generator filters is used.The number of these generators is equal to the number m of the system outputs, and the ith device (i = 1, . . ., m) is driven by all but the ith output and all the inputs of the system.In this case, a fault on the ith output sensor affects all but the ith residual generator.
In presence of a fault on the jth output sensor, the measured output y * (t) can be expressed as follows: with where h oj (t) represents the jth output fault function.
In these conditions, the system of (4) becomes where p j (s) is the jth column of the matrix P(s).
Let us indicate L oi (s) a polynomial row vector belonging to the basis of the left null space of the matrix The expression of the ith filter when a fault is acting on the jth output sensor is obtained by multiplying (36) by L oi (s): where P i (s) is the matrix obtained by deleting from P(s) the ith column, and y * i (t) represents the (m − 1)-dimensional vector obtained by deleting from y * (t) its ith component.
From the comparison between (37) and (6) with the methods shown in Sections 3 and 3.1 can be exploited for the design of the ith filter.In particular, the parameters of this filter can be properly chosen in order to optimise its performances when a fault is acting on the jth output sensor.
In more detail, as shown in Section 3, L oi (s) is chosen to maximise the steady-state gain in the presence of the fault f oj (t).Moreover, as shown in Section 3.1, R oi (s) is chosen to obtain a fixed behaviour of the transfer function due to the fault f oj (t).
It is worth noting that the similar design technique can be used for input sensor fault isolation.
The problem requirements determine the selection of the specific fault with respect to which the design depends.Most often in practice, it is important to obtain good performance with respect to all possible faults rather than optimal behaviour with respect to one specific fault.In this situation, a different design of the filter behaviour for each fault situation is needed.

NLGA RESIDUAL GENERATORS
The considered NLGA to the FDI problem is suggested in [18] and formally developed in [10].It consists in finding, by means of a coordinate change in the state space and in the output space, an observable subsystem which, if possible, is affected by the fault and not affected by disturbance.In this way, necessary and sufficient conditions for the FDI problem to be solvable are given.Finally, a residual generator can be designed on the basis of the model of the observable subsystem.
More precisely, the approach considers a nonlinear system model in the form in which the state vector x ∈ X (an open subset of R n ), c(t) ∈ R c is the control input vector, f (t) ∈ R is the fault, d(t) ∈ R d the disturbance vector (embedding also the faults which have to be decoupled), and y ∈ R m the output vector; whilst n(x), (x), the columns of g(x) and p(x) are smooth vector fields; and h(x) is a smooth map.Therefore, if P represents the distribution spanned by the column of p(x), the NLGA method can be devised as it follows: first, determine the largest observability codistribution contained in P ⊥ , denoted with Ω * [10].
If (x) / ∈ Ω * , the design procedure can continue, otherwise, the fault is not detectable; whenever the previous condition is satisfied, it can be found a surjection Ψ 1 and a function Φ 1 fulfilling Ω * ∩ span{dh} = span{d(Ψ 1 • h)} and Ω * = span{d(Φ 1 )}, respectively.The functions Ψ(y) and Φ(x) defined as are (local) diffeomorphisms, where H 2 is a selection matrix (i.e., a matrix in which any row has all 0 entries but one, which is equal to 1), Φ 1 (x) represents the measured part of the state which is affected by f and not affected by d, and Φ 3 (x) represents the not measured part of the state which is affected by f and by d.
In the new (local) coordinate defined previously, the system of (38) is described by the relations in the form with 1 (x 1 , x 2 , x 3 ) not identically zero.Denoting x 2 with y 2 and considering it as an independent input, it can be singled out the x 1 -subsystem: which is affected by the single fault f and decoupled from the disturbance vector.This subsystem has been exploited for the design of the residual generator for the FDI of the fault f .As already described in Section 2, the proposed NLGA FDI scheme is designed on the basis of a model structure of the input affine type as described in [10].For this reason, the aircraft simulation model has been simplified and the nonlinear model of (3) has been considered for the NLGA design.
Under these assumptions, by means of computations detailed in [19], the residual generators for detecting the faults affecting the aircraft input sensors are obtained.In particular, the residual generator for the elevator r δe (t), with k δe > 0, is described by the relation The aileron residual generator r δa (t), with k δa > 0, has the form (43) The rudder residual generator r δr (t), with k δr > 0, is written in the form The throttle residual generator r δth (t), with k δth > 0, has the form Remark 10.It is worth observing that each residual generator is affected by a single input sensor fault and is decoupled from the wind components and the faults affecting the remaining input sensors.This feature can be obtained by defining a different p(x) for each residual generator design [19].
In this way, the tuning of the residual generator gains k δe , k δa , k δr , and k δth can be carried out independently.Finally, by a straightforward analysis, the positive sign of each gain is a necessary and sufficient condition for the asymptotic stability of the dynamics (42)-(45).
A procedure optimising the tradeoff between the fault sensitivity and the robustness to the modelling errors and disturbances of the generic residual generator is proposed in the next section.

NLGA robustness improvement
The proposed NLGA-based scheme consists of two design steps: (1) the structural decoupling of critical disturbances (wind gust and turbulence) and critical modelling errors can be obtained as described in Section 4; (2) the nonlinear residual generators robustness is improved by minimising the effects of both noncritical disturbances and modelling errors, whilst maximising the fault effects on the residual signals.
In order to apply the robustness improvement procedure presented in this section, the considered framework is restricted to suitable scalar components of the x 1 -subsystem (41).In particular, the vectors x 1 and y 1 are decomposed as follows: where x 11 ∈ R, y 11 ∈ R, and, correspondingly, it follows that Let us consider the following conditions: ( As can be seen in [19], the conditions (48) are satisfied for the considered aircraft application, hence, from now on, the scalar x 11 -subsystem (49) is referred to in place of the x 1subsystem (41).
It can be noted that the tuning of the residual generator gains, in the framework of the x 11 -subsystem (49), cannot be properly carried out.In fact, the critical disturbances are structurally decoupled but the noncritical ones are not considered.For this reason, to achieve robustness of the residual generators, the tuning of the gains is performed by embedding the description of the noncritical disturbances in the x 11 -subsystem as follows: where, to simplify the treatment without loss of generality (accordingly to the considered aircraft application), the state variable x 11 is supposed to be directly measured.Moreover, the variable ν ∈ R is the measurement noise on x 11 .Finally, the variable ζ ∈ R and the related scalar field e(•) represent the noncritical effects which have not been considered in the simplified aircraft model (3) used for the NLGA scheme.
The following system, which is referred to as filter form, represents a generic scalar residual generator (based on the subsystem (50)) to which (42)-(45) belong as a particular case ξ f = n 11 y 11 , y 1c , y 2 + g 11 y 11 , y 1c , where the gain k f has to be tuned in order to minimise the effects of the disturbances ζ and ν whilst maximise the effects of the fault f on the residual r f .The quantification both of the disturbances and of the fault effects on the residual can be obtained by defining the estimation error In order to apply the effective mixed H − /H ∞ approach [3,20] to tune k f , the system (53) has to be linearised in the neighbourhood of a stationary flight condition, as suggested in [2] with reference to the H ∞ optimisation of nonlinear unknown input observers.It is worth observing that the considered aircraft application is characterised by small excursions of the state, input, and output variables with respect to their trim values x 10 , x 30 , c 0 , y 10 , and y 20 , hence the robustness of the nonlinear residual generator is achieved.The linearisation of (53) is the following: where Now, it is important to note that in place of the residual generators in the filter form (51), the following observer form of the residual generators can be used: For the same reasons previously described, the estimation error x o is introduced: The linearisation of (58) is Both the linearised models (54) and (59) of the residual generators in the filter form and observer form, respectively, can be represented by the following general form: with E 1 = [cce11 0] as well as the following positions: On the basis of ( 60) and ( 61), the mixed H − /H ∞ [3,20] procedure is developed for the robustness improvement of the residual generators both in the filter and observer form.
Since the considered NLGA residual generators are scalar, the H − /H ∞ procedure leads to a new analytical solution.
The following definition will be used throughout the section.
Definition 2. The norms H ∞ and H − of a stable transfer function G are defined as where σ represents the maximum singular value, whilst σ the minimum singular value.The problem of the tradeoff between disturbances robustness and fault sensitivity is stated as follows.
Problem 1 (Mixed H − /H ∞ residual robustness improvement).Given two scalars β > 0 and γ > 0, find the set K defined as: where In order to obtain the analytical solution of Problem 1, the following propositions are given.
Proof.From the definition (64) hence it is possible to write From the last expression, it is straightforward to obtain (66) and ( 67).

Proposition 4. The set
Proof.By means of Proposition 3, it is possible to write which holds for Proof.From the definition (65), it results G r f (s) = m/(s − a + k) and assuming, without loss of generality, that m > 0, it follows G r f − = m/(k − a).By imposing G r f − > β with β > 0, the constraint k < a + (m/β) has to hold.Then, by recalling the result of Proposition 4, the maximum feasible value of β fulfilling the constraint G rε ∞ < γ is given by hence Theorem 1.Given γ > 1 and β ∈]0, β max (γ)[, the set K fulfilling the constraints of Problem 1 is given by Proof.The proof of the theorem is not reported, as it is straightforward from Propositions 3, 4, and 5.
Remark 11.Let us consider the following performance index to maximise From (66), it follows (81) From (81), it can be observed that In this way, the maximum value of the performance index J is The method proposed in this paper guarantees the maximum value of the performance index J as well as the constraints G rε ∞ < γ and G r f − > β if β ≥ m/ e 2 11 + a 2 .In fact, from β ≥ m/ e 2  11 + a 2 it follows hence k < (a + e 2 11 + a 2 ).Finally, from (75) it is always possible to find a β such that m e 2  11 + a 2 On the basis of Theorem 1, k can be designed by means of the following procedure.
(2) Compute β max (γ) and choose β ∈]0, β max (γ)[ to obtain a desired level of fault sensitivity. ( (4) Apply the chosen gain k to the k f of (51) or to the k o of (56) if the NLGA residual generator is in the filter form or in the observer form, respectively.

FDI PERFORMANCE ESTIMATION
To show the diagnostic characteristics brought by the application of the proposed FDI schemes to general aviation aircrafts, some numerical results obtained in the Matlab and Simulink environments are reported.The final performances that are achieved with the developed FDI schemes are finally reported.These performances are evaluated by means of extensive simulations applied to the aircraft simulation model.This section presents also some comparisons of the developed PM and NLGA FDI strategies with NN and UIKF FDI schemes.
The designed PM residual generator filters are fed by the 4 component input vector c(t) and the 9 component output vector y(t) acquired from the simulation aircraft model previously described.In particular, a bank of 4 residual generator filters has been used to detect input sensor faults regarding the 4 input control variables.Moreover, in order to obtain the fault isolation properties, each residual generator function of the considered bank is fed by all but one of the 4 control input signals and by the 9 output variables.Obviously, the residual generator bank has been designed to be decoupled from the 3 component wind disturbance vector d(t) = [w u (t), w v (t), w w (t)] T .As to the NLGA residual generator filters, the aircraft synthesis model of (3), adopted for the design, is simplified with respect to the simulation model.Analogously to the PM, the approximations of the NLGA synthesis nonlinear model are related to a particular steadystate flight condition.For this reason, the switching for the NLGA FDI scheme is also required when a generic reference trajectory is followed.Hence, it is important to evaluate the robustness characteristic of a single design of NLGA residual generators when a large set of flight conditions is dealt with.
It is worth noting that the aircraft reference trajectories are typically made up of a sequence of steady-state flight conditions, each one described by the associated input state output set point and the linearised model of (1).As a consequence, all the FDI linear techniques are usually implemented by switching among the residual generators related to the different steady-state flight conditions.The target of this work is to reduce the switching by adopting robust PM residual generators.In particular, the robustness is achieved by using the same residual generators for a large set of flight conditions.The chosen single steady-state flight condition for designing both of the PM and of the NLGA residual generators is a coordinated turn characterised as follows: (i) the true airspeed is 50 m/s; (ii) the curvature radius is 1000 m; (iii) the flight-path angle is 0 • ; (iv) the altitude is 330 m; (v) the flap deflection is 0 • .This represents one of most general flight condition due to the coupling of the longitudinal and lateral dynamics.Moreover, it is used in simulation to highlight the performances of the proposed methods in the nominal flight condition.
Regarding the PM, the detection properties of the filters in terms of fault sensitivity and disturbance rejection can be achieved according to Section 3. The synthesis of the dynamic filters for FDI has been performed by choosing a suitable linear combination of residual generator functions.This choice has to maximise the steady-state gain of the transfer functions between input sensor fault signals.The roots of the R(s) polynomial matrix have been optimised for maximising the fault detection promptness, as well as to minimise the occurrence of false alarms.In order to assess the PM diagnosis technique, different fault sizes have been simulated on each sensor.Single faults in the input sensors have been generated by producing abrupt (step) and ramp (slowly developing) faults in the input signals c(t).The residual signals indicate fault occurrence according to whether their values are lower or higher than the thresholds fixed in fault-free conditions.The residual processing methods can be based on simple residual geometrical analysis or comparison with fixed thresholds [3].More complex residual evaluation can rely on statistical properties of the residuals and hypothesis testing [6], or based on adaptive thresholds, that is, the socalled threshold selector [21].
In this paper, the threshold test for FDI is performed with the logic described by (86): that is, the comparison of r(t) with respect its statistical normal characteristics.r and σ 2 r are the normal values for the mean and variance of the fault-free residual, respectively.In order to separate normal from faulty behaviour, the tolerance parameter ν (normally ν ≥ 3) is selected and properly tuned.Hence, by a proper choice of the parameter ν, a good tradeoff can be achieved between the maximisation of fault detection probability and the minimisation of false-alarm probability.In practice, the threshold values depend on the residual error amount due to measurement errors, linearised model approximations, and disturbance signals that are not completely decoupled.
Thus, in this case, a suitable value of ν = 4 for the computation of the positive and negative thresholds in (86) has been considered.To summarise the performances of the PM FDI scheme, the minimal detectable step faults on the various input sensors are collected in Table 2.
On the other hand, the minimal detectable ramp faults are reported in Table 3. Concerning the NLGA, the synthesis of the residual generators has been performed by using filter gains that optimise the fault sensitivity and reduce as much as possible the occurrence of false alarms due to model uncertainties and to disturbances not completely decoupled.This robustness requirement has been fulfilled by designing the residual gains according to the Procedure 1.For example, with reference to the fourth residual generator, Procedure 1 has led to K δth = 1 which satisfies the norm bounds γ = 1.2 and β = 400.This guarantees a good separation of the residual signal with f L2 ≥ 0.05 and d L2 ≤ 10, where L 2 -norm is considered.
In order to assess the NLGA diagnosis technique, single step and ramp faults have been used.Moreover, also in this case the threshold values have been chosen in simulation according to (86).A suitable value of ν = 8 for the computation of the positive and negative thresholds in (86) has been considered.For what concern NLGA FDI scheme, the minimal detectable step faults on the various input sensors are summarised in Table 4.
On the other hand, the minimal detectable input sensor ramp faults are reported in Table 5.
The minimal detectable step fault values in Tables 2, 3 case in which the occurrence of a fault is detected and isolated as soon as possible.The detection delay times represent the worst case results, as they are evaluated on the basis of the time taken by the slowest residual function to cross the settled threshold.These experiments represent a further validation of the residual generator robustness with respect to the fault type, as the the residual function sensitivity was optimised only with respect to step faults.
As an example, Figure 1 shows the 4 PM residual functions generated for the complete trajectory.On the basis of the fault-free and faulty conditions, this bank provides the correct isolation of the considered input sensor ramp fault.
The horizontal lines represent the levels of the fault-free thresholds that are settled according to test (86) with ν = 4.The first residual function depicted in Figure 1, provides also the isolation of the fault f c (t) regarding the 1st input sensor.
The second example of Figure 2 shows the 4 residual functions generated by the NLGA filter bank applied to the complete aircraft trajectory.The horizontal lines represent the thresholds with ν = 12.Note that, due to the NLGA de-sign technique, only the 1st residual related to the δ e signal of the filter bank is sensitive to a ramp fault affecting the 1st input sensor.

Reliability and robustness evaluation
In this section, the robustness characteristics of the proposed PM and NLGA FDI schemes have been evaluated and compared also with respect to the UIKF scheme [3] and the NN technique [7].In particular, a bank of UIKF has been exploited for diagnosing faults of the monitored process.This technique seems to be robust with respect to the modelling uncertainties, the system parameter variations, and the measurement noise, which can obscure the performance of an FDI system by acting as a source of false faults.The procedure recalled here requires the design of a UIKF bank and the basic scheme is the standard one: a set of measured variables of the system is compared with the corresponding signals estimated by filters to generate residual functions.The diagnosis has been performed by detecting the changes of UIKF residuals caused by a fault.The FDI input sensor scheme exploits a number of KF equal to the number of input variables.Each filter is designed to be insensitive to a different input sensor of the process and its disturbances (the so-called unknown inputs).Moreover, the considered UIKF bank was obtained by following the design technique described in [3, Section 3.5, pages 99-105], whilst the noise covariance matrices were estimated as described in [22, Section 3.3, pages 70-74 and Section 4.6, pages 130-131].Each of the 4 UIKF of the bank was decoupled from both one input sensor fault and the wind gust disturbance component, thus providing the optimal filtering of the input-output measurement noise sequences.On the other hand, a dynamic NN bank has been exploited in order to find the dynamic connection from a particular fault regarding the input sensors to a particular residual.In this case, the learning capability of NN is used for identifying the nonlinear dynamics of the monitored plant.The dynamic NN provides the prediction of the process output with an arbitrary degree of accuracy, depending on the NN structure, its parameters, and a sufficient number of neurons.Once the NN has been properly trained, the residuals have been computed as the difference between predicted and measured pro-cess outputs.The FDI is therefore achieved by monitoring residual changes.The NN learning is typically an offline procedure.Normal operation data are acquired from the monitored plant and are exploited for the NN training.Regarding the NN FDI method and according to a generalised observer scheme (GOS) [3], a bank of 4 time-delayed threelayers multilayer perceptron (MLP) NN with 15 neurons in the input layer, 25 neurons in the hidden layer, and 1 neuron in the output layer is implemented.Each NN was designed to be insensitive to each input sensor fault, and the NN were trained in order to provide the optimal output prediction on the basis of the training pattern and target sequences [7].
In the following of this section, the performances of the different FDI schemes have been evaluated by considering a more complex aircraft trajectory.This has been obtained by means of the guidance and control functions of a standard autopilot which stabilises the aircraft motion towards the reference trajectory as depicted in Figure 3.The reference trajectory is made up of 4 branches (2 straight flights and 2 turn flights) so that a closed path is obtained.It is worth observing that only 2 steady-state flight conditions are used to follow   The reference turn flight condition is used to design the PM and the NLGA filters.The achieved results are reported in Tables 2 and 4, respectively.The performed tests represent a also a possible reliability evaluation of the considered FDI techniques.In fact, in this case the diagnosis requires that the residual generators are robust with respect to the flight conditions that do not match the nominal trajectory used for the design.
As an example, the fault-free and faulty residuals generated by the designed NN and UIKF banks are shown in Table 6 summarises the results obtained by considering the observers and filters (corresponding to the PM, NLGA, UIKF,and NN) for the input sensor FDI whose parameters have been designed and optimised for the steady-state coordinated turn represented by the 2nd reference flight condition of the complete trajectory.Table 6 reports the performances of the considered FDI techniques in terms of the minimal detectable step faults on the various input sensors, as well as the corresponding parameters ν for the residual evaluation of (86).The mean detection delay is also reported in Table 6 in order to compare the effectiveness of the different FDI schemes.
The choice of ν has been performed with reference to the particular flight conditions involved in the complete trajectory following.In particular, the selected value of ν for each FDI observer or filter represents a tradeoff between two objectives, that is, for increasing the residual fault sensitivity and promptness, as well as for minimising the occurrence of false alarms due to the switching among the reference flight conditions needed to stabilise the aircraft motion towards the reference trajectory.Table 6 shows how the proper design of the parameter ν allows to obtain good performances with all the considered FDI schemes, hence the robustness with respect to the proposed complete trajectory is always achieved.
It is worth noting that the NLGA has a theoretical advantage by taking into account the nonlinear dynamics of the aircraft.However, the behaviour of the related nonlinear residual generators is quite sensitive to the model uncertainties due to variation of the flight condition.In fact, the NLGA FDI scheme requires high values of ν which have to be increased (from 8 to 12 in this work) when the aircraft motion regarding the complete trajectory is considered in place of the nominal flight condition.In particular, even though the analysis was restricted just to the aircraft turn phase of the complete trajectory, a performance worsening would happen, since the steady-state condition (nominal flight condition) is quite far to be reached.However, the filter design based on the NLGA lead to a satisfactory fault detection, above all in terms of promptness.On the other hand, regarding the PM, it is rather simple to note the good FDI performances, even if optimisation stages can be required.The ν values selected for the PM are lower, but the related residual fault sensitivities are even smaller.Similar comments can be made for the UIKF and NN techniques.
The simulation model applied to the complete trajectory is an effective way to test the performances of the proposed FDI methods with respect to modelling mismatch and measurement errors.The obtained results demonstrate the reliability of the PM-, NLGA-, UIKF-, and NN-based FDI schemes as long as proper design procedures are adopted.

Monte Carlo analysis
In this section, further experiment results have been reported.They regard the performance evaluation of the developed FDI scheme with respect to uncertainty acting on the system.Hence, the simulation of different fault-free and faulty data sequences was performed by exploiting the aircraft Matlab-Simulink simulator and a Monte Carlo analysis implemented in the Matlab environment.The Monte Carlo tool is useful at this stage as the FDI performances depend on the residual error magnitude due to the system uncertainty, as well as the signal c(t) and y(t) measurement errors.It is worth noting how the Monte Carlo simulations have been achieved by perturbing the parameters of the PM filter residuals by additive white Gaussian noises with standard deviation values equal to a fixed percentage p of the element values.The same experiments have been performed by statistically varying the main parameters of the NLGA filters.In these conditions, the Monte Carlo analysis represents a further method for estimating the reliability and the robustness of the developed FDI schemes, when applied to the considered aircraft.
For robustness and reliability experimental analysis of the FDI schemes, some performance indices have been used.The performances of the FDI method are then evaluated on a number of Monte Carlo runs equal to 1000.This number of simulations is carried out to determine the indices listed below with a given degree of accuracy.
False-Alarm Probability (r fa ): the number of wrongly detected divided by total fault cases.
Missed-Fault Probability(r mf ): for each fault, the total number of undetected faults, divided by the total number of times that the fault case occurs.
True Detection/Isolation Probability (r td , r ti ): for a particular fault case, the number of times it is correctly detected/isolated, divided by total number of times that the fault case occurs.
Mean Detection/Isolation Delay (τ md , τ mi ): for a particular fault case, the average detection/isolation delay time.
These indices are hence computed for the number of Monte Carlo simulations and for each fault case.Table 7summarises the results obtained by considering the PM dynamic filters for the input sensor FDI for a complete aircraft trajectory and with p = 10%.
The same analysis can be applied again to the residual generated by means of the NLGA, NN, and UIKF FDI schemes.The results are summarised in Tables 8, 9, and 10.
Tables 7, 8, 9, and 10 show how the proper design of the dynamic filters with a proper choice of the FDI thresholds allow to achieve false-alarm and missed-fault probabilities less than 0.6%, detection and isolation probabilities bigger than 99.4%, with minimal detection and isolation delay times.The results demonstrate also that Monte Carlo simulation is an effective tool for testing and comparing the design robustness of the proposed FDI methods with respect to modelling

CONCLUSION
The paper provided the development and application of two FDI techniques based on a PM scheme and on an NLGA method, respectively.The PM procedure led to residual generators optimising the tradeoff between disturbancedecoupling and fault sensitivity.Moreover, the application of the PM FDI scheme resulted robust with respect to model uncertainties.On the other hand, the NLGA relies on a novel design scheme based on the structural decoupling of disturbances and modelling errors, Thus, the mixed H − /H ∞ optimisation of the tradeoff between fault sensitivity, disturbances, and modelling errors has been proposed.The PM and NLGA residual generators were tested by considering a nonlinear aircraft simulator model that takes into account also the wind gusts, the Dryden turbulence, the input-output sensors measurement errors, as well as the engine and the servo actuators.Moreover, in order to verify the robustness characteristics and the achievable performances of the approaches, the simulation results considered a typical aircraft reference trajectory consisting of several steady-state flight conditions.The effectiveness of the developed PM and NLGA FDI schemes was shown by simulations and a comparison with widely used data-driven and model-based disturbancedecoupling FDI schemes, such as NN and UIKF diagnosis methods, was provided.The reliability and the robustness properties of the proposed residual generators to model uncertainty and disturbances and measurement noise for the aircraft nonlinear model were investigated via Monte Carlo simulations.Further works extensive comparative studies for robustness of the FDI algorithms when applied to real data.

Table 6 :
Performances of the FDI schemes for a complete aircraft trajectory.