Amy K. Chicatelli

Towards Run-time Assurance of Advanced Propulsion Algorithms

This paper covers the motivation and rationale for investigating the application of run-time assurance methods as a potential means of providing safety assurance for advanced propulsion control systems. Certification is becoming increasingly infeasible for such systems using current verification practices. Run-time assurance systems hold the promise of certifying these advanced systems by continuously monitoring the state of the feedback system during operation and reverting to a simpler, certified system if anomalous behavior is detected. The discussion will also cover initial efforts underway to apply a run-time assurance framework to NASAs model-based engine control approach. Preliminary experimental results are presented and discussed.

Application of Diagnostic Analysis Tools to the Ares I Thrust Vector Control System

The NASA Ares I Crew Launch Vehicle is being designed to send astronauts into Earth orbit in support of missions to the International Space Station, to the moon, and beyond. The launch vehicle is an in-line two-stage rocket with the crew vehicle, Orion, on top of the stack. The Ares I is undergoing design and development utilizing commercial-off-the-shelf tools and hardware when applicable, along with cutting edge launch technologies and state-of-theart design and development techniques to ensure a safe, reliable, cost-effective space transportation system. In support of the vehicle’s design and development, the Ares Functional Fault Analysis group was tasked to develop an Ares Vehicle Diagnostic Model (AVDM) and to demonstrate the capability of that model to support failure-related analyses and design integration. The AVDM is a directed graph model of failure effect propagation paths within the vehicle architecture and is a comprehensive representation of the system’s failure space behavior. The AVDM is intended to support system engineering activities during the design process, and to provide diagnostic support throughout the development and deployment of the Ares I Launch Vehicle. During the Ares I design phase, the AVDM has been demonstrated to be valuable in the systems engineering process for assessing the completeness of schematics, and improving quality of various system design documents and analyses. The AVDM, along with supporting tools, has provided detection and fault isolation information to determine which components meet the diagnostic requirements for launch pad replacement and to assess system response to off-nominal conditions. One important component of the AVDM is the Upper Stage (US) Thrust Vector Control (TVC) diagnostic model—a representation of the failure space of the US TVC subsystem. This paper first presents an overview of the AVDM, its development approach, and the software used to implement the model and conduct diagnostic analysis. It then uses the US TVC diagnostic model to illustrate details of the development, implementation, analysis, and verification processes. Finally, the paper describes how the AVDM model can impact both design and

Interdisciplinary modeling using computational fluid dynamics and control theory

For the modeling of high speed propulsion systems, there are at least two major categories of models, with several subdivisions in each category. One major category is characterized by computational fluid dynamics (CFD) and is highly accurate. CFD models can have millions of states, give a very complete view of the internal flow field, and run much slower than real-time on most computers. The other major category of models is used by control engineers for design and analysis of control systems. These models typically have on the order of ten to one hundred states, run near real-time, and capture the fundamental dynamics required for controller design. To provide improved control models particularly for these high speed systems, methods are needed that use the CFD techniques but yield models that are appropriate for both control analysis and design. The goal of this paper is to present/discuss some of the tools being developed to create an interdisciplinary technology bridge between the CFD and control disciplines.

Pilot-in-the-Loop Evaluation of a Yaw Rate to Throttle Feedback Control with Enhanced Engine Response

This paper describes the implementation and evaluation of a yaw rate to throttle feedback system designed to replace a damaged rudder. It can act as a Dutch roll damper and as a means to facilitate pilot input for crosswind landings. Enhanced propulsion control modes were implemented to increase responsiveness and thrust level of the engine, which impact flight dynamics and performance. Piloted evaluations were performed to determine the capability of the engines to substitute for the rudder function under emergency conditions. The results showed that this type of implementation is beneficial, but the engines’ capability to replace the rudder is limited.

Investigation of Asymmetric Thrust Detection with Demonstration in a Real-Time Simulation Testbed

The purpose of this effort is to develop, demonstrate, and evaluate three asymmetric thrust detection approaches to aid in the reduction of asymmetric thrust-induced aviation accidents. This paper presents the results from that effort and their evaluation in simulation studies, including those from a real-time flight simulation testbed. Asymmetric thrust is recognized as a contributing factor in several Propulsion System Malfunction plus Inappropriate Crew Response (PSM+ICR) aviation accidents. As an improvement over the state-of-the-art, providing annunciation of asymmetric thrust to alert the crew may hold safety benefits. For this, the reliable detection and confirmation of asymmetric thrust conditions is required. For this work, three asymmetric thrust detection methods are presented along with their results obtained through simulation studies. Representative asymmetric thrust conditions are modeled in simulation based on failure scenarios similar to those reported in aviation incident and accident descriptions. These simulated asymmetric thrust scenarios, combined with actual aircraft operational flight data, are then used to conduct a sensitivity study regarding the detection capabilities of the three methods. Additional evaluation results are presented based on pilot-in-the-loop simulation studies conducted in the NASA Glenn Research Center (GRC) flight simulation testbed. Data obtained from this flight simulation facility are used to further evaluate the effectiveness and accuracy of the asymmetric thrust detection approaches. Generally, the asymmetric thrust conditions are correctly detected and confirmed.

Modeling and Control Design for a Turboelectric Single Aisle Aircraft Propulsion System [STUB]

A nonlinear dynamic model with full flight envelope controller is developed for the propulsion system of a partially turboelectric single-aisle aircraft. The propulsion system model consists of two turbofan engines with a large percentage of power extraction, feeding an electric tail fan for boundary layer ingestion. The dynamic model is compared against an existing steady state design model. An electrical system model using a simple power flow approach is integrated into existing modeling tools used for dynamic simulation of the turbomachinery of the vehicle. In addition to the simple power flow model of the electrical system, a more detailed model is used for comparison at a key vehicle transient flight condition. The controller is a gain scheduled proportional-integral type that is examined throughout the flight envelope for performance metrics such as rise time and operability margins. Potential improvements in efficiency for the vehicle are explored by adjusting the power split between the energy used for thrust by the turbofans and that extracted to supply power to the tail fan. Finally, an operability study of the vehicle is conducted using a 900 nautical mile mission profile for a nominal vehicle configuration, a deteriorated propulsion system at the end of its operating life, and an optimized power schedule with improved efficiency.

Runtime Assurance Protection for Advanced Turbofan Engine Control [STUB]

This paper describes technical progress made in the application of run time assurance (RTA) methods to turbofan engines with advanced propulsion control algorithms that are employed to improve engine performance. It is assumed that the advanced algorithms cannot be fully certified using current verification and validation approaches and therefore need to be continually monitored by an RTA system that ensures safe operation. However, current turbofan engine control systems utilize engine protection logic for safe combustion dynamics and stable airflow through the engine. It was determined that the engine protection logic should continue to be used to provide system safety and should be considered as a part of the overall RTA system. The additional function that an RTA system provides is to perform diagnostics on anomalous conditions to determine if these conditions are being caused by errors in the advanced controller. If this is the case, the RTA system switches operation to a trusted reversionary controller. Initial studies were performed to demonstrate this benefit. The other focus was to improve the performance of the engine protection logic, which was deemed too conservative and reduced engine performance during transient operations. It was determined that the conservative response was due to poor tuning of one of the controller channels within the protection logic. An automatic tuning algorithm was implemented to optimize the protection logic control gains based on minimizing tracking error. Improved tracking responses were observed with no change to the existing protection logic control architecture.

An Intelligent Propulsion Control Architecture to Enable More Autonomous Vehicle Operation

This paper describes an intelligent propulsion control architecture that coordinates with the flight control to reduce the amount of pilot intervention required to operate the vehicle. Objectives of the architecture include the ability to: automatically recognize the aircraft operating state and flight phase; configure engine control to optimize performance with knowledge of engine condition and capability; enhance aircraft performance by coordinating propulsion control with flight control; and recognize off-nominal propulsion situations and to respond to them autonomously. The hierarchical intelligent propulsion system control can be decomposed into a propulsion system level and an individual engine level. The architecture is designed to be flexible to accommodate evolving requirements, adapt to technology improvements, and maintain safety.