Minimisation of Failure Transients in a Fail-Safe Electro-Mechanical Actuator Employed for the Flap Movables of a High-Speed Helicopter-Plane

Abstract

The work deals with the model-based characterization of the failure transients of a fail-safe rotary EMA developed by Umbragroup (Italy) for the flap movables of the RACER helicopter-plane by Airbus Helicopters (France). Since the reference application requires quasi-static position-tracking with high disturbance-rejection capability, the attention is focused on control hardover faults which determine an actuator runaway from the commanded setpoint. To perform the study, a high-fidelity nonlinear model of the EMA is developed from physical first principles and the main features of health-monitoring and closed-loop control functions (integrating the conventional nested loops architecture with a deformation feedback loop enhancing the actuator stiffness) are presented. The EMA model is then validated with experiments by identifying its parameters by ad-hoc tests. Simulation results are finally proposed to characterize the failure transients in worst case scenarios by highlighting the importance of using a specifically designed back-electromotive damper circuitry into the EMA power electronics to limit the position deviation after the fault detection.

1. Introduction

The aircraft electrification is surely one of the most important and strategic initiatives currently supporting the innovation of the aviation industry [1,2]. In particular, the more-electric aircraft concept entails the gradual replacement of onboard systems based on mechanical, hydraulic, or pneumatic power sources with electrically powered ones, aiming to reduce weight and costs, to optimize energy and to increase the eco-compatibility of future aircrafts [3,4,5,6]. Electro-mechanical actuation clearly plays a key role for pursuing these challenging objectives. The applicability of Electro-Mechanical Actuators (EMAs) in aerospace is proven in terms of load and speed performances [7,8,9,10,11,12], but several reliability concerns still remain open [13,14,15,16,17]. The use of EMAs for safety-critical functions can be thus obtained only by fault-tolerant architectures, which apply hardware redundancies on electrical, electronic, or mechanical parts.

In general terms, depending on how the redundancy is applied, a fault-tolerant function can be maintained after a fault, or it can be lost while avoiding the extension of the fault effects to other functions, so that fail-operative or fail-safe functions are respectively obtained. With reference to flight control functions, this concept can be applied to both movables and actuators. To obtain a fail-operative flight control, different architectures can be used by applying load-level redundancy (splitting the movable into sub-movables and using a fail-safe EMA on each part), actuator-level redundancy (using multiple fail-safe EMAs on a single movable), or subsystem-level redundancy (using a single fail-operative EMA on a single movable). Any fault-tolerant system necessitates effective health-monitoring algorithms aiming to anticipate (i.e., avoid) or detect/isolate the fault, so that prognostic and diagnostic approaches are respectively defined. The prognostic solution, though potentially overwhelming [18,19,20,21], is nowadays far from being applicable to airworthy systems, and diagnostic approaches are typically preferred [22,23,24]. The diagnostic monitoring requires that the Fault Detection and Isolation (FDI) is implemented and executed in real time by onboard control electronics [25,26,27,28], so that, in case of fault, the redundant components or the isolation devices can be engaged [29,30].

The design and the validation of health-monitoring systems play a key role in this context. In a flight control EMA, the FDI output, including the consequent accommodation/compensation of the fault, must be provided with very small latency, and the failure transients must be adequately limited. The development of high-fidelity experimentally validated models of EMAs is of paramount importance for the validation of monitoring functions. Since nonlinearities, disturbances, environment, and loads can significantly affect the actuator response, an in-depth knowledge of both normal and faulty behaviours is required. The crucial problem entails the knowledge of faulty dynamics, especially in complex systems with a huge number of fault modes [31,32,33]. In the so-called data-driven techniques, this knowledge is achieved via experiments, by artificially injecting the major faults in the EMA and measuring its response [20,34,35,36]. This method provides accurate predictions, but rigging costs are often prohibitive. In addition, the FDI validation strongly depends on test conditions. As a relevant example, in [20], the mechanical degradation of the ball-screw elements of an aircraft EMA is investigated via a data-driven approach: the lifecycle of a rudder control actuator, including periodical maintenance checks, is simulated by testing a prototype EMA in laboratory environment with alternate endurance and monitoring trials. To accelerate the mechanical degradation, the prototype is intentionally modified with respect to the nominal design, by using a reduced number of recirculating paths in the ball-screw, by removing the anti-rotation device on the output shaft, by applying relevant radial loads, and by progressively removing the lubricant. Discrete-time and continuous-time fault symptoms are then computed by leveraging the EMA outputs via multivariate statistical methods (such as Hotelling’s T² and Q techniques). The health monitoring demonstrates to be very effective, but the entire experimental activity required a specifically dedicated rig and took seven months. In addition, the experimental campaign did not take into account temperature effects.

In model-based techniques, the knowledge of the faulty dynamics is to a great extent obtained from mathematical models, capable of simulating the fault by physical first principles, and are experimentally validated with reference to normal and/or regime faulty conditions [26,27,28,37,38]. Oppositely to the data-driven case, this method generally provides less accurate predictions, but it is cost-effective, allows to verify the FDI functionalities in extreme conditions, and (above all) permits to generalize the validity of algorithms to similar equipment (i.e., governed by similar equations). As a relevant example, in [28], the major faults of a primary flight control movable driven by active-active EMAs are addressed via model-based approach: a set of monitoring algorithms are designed using a detailed nonlinear model of the system capable of fault simulation. Robust detection thresholds are determined taking into account parametric and input uncertainties, and the health-monitoring is verified through simulation, by injecting faults in an experimentally validated model of the system.

The basic objective of this work is to validate the monitoring algorithms of the fail-safe EMA developed by UmbraGroup (Italy) for the flap movables of the RACER (Rapid And Cost-Efficient Rotorcraft) helicopter-plane by Airbus Helicopters with reference to the model-based analysis of the failure transients related to the hardover of the control electronics (major EMA fault mode). The paper is articulated as follows: the first part is dedicated to the system description and to the EMA modelling; successively, the main features of the closed-loop control and health-monitoring functions are presented. Finally, an excerpt of simulation results is proposed by characterizing the EMA failure transients in selected worst-case scenarios. The results are finally discussed by highlighting the effectiveness and the most relevant criticalities of the proposed approach with suggestions of possible enhancements.

2. Materials and Methods

2.1. System Description

The reference EMA is used to control the six flap movables of the RACER helicopter-plane, an innovative, high-speed, more-electric air vehicle developed by Airbus Helicopters, Figure 1. The RACER helicopter-plane is designed to reach maximum cruise speed 50% faster than a conventional helicopter (the Velocity Never Exceed, VNE, is 115 m/s) and to consume 15% less fuel per distance at reference cruise speed (90 m/s) [39]. The aerodynamic concept essentially merges a conventional helicopter with a low aspect-ratio box-wing airplane; at cruise speed, the two wing propellers generate thrust and the box-wing contributes to lift, generating low induced drag and minimized interactions with the main rotor flow [40,41], so that the rotor can be slowed by up to 15%, preventing the blades from working with transonic local flow (which reduces performances). The electrical system is based on high-voltage direct current power generation, assuring a consistent weight reduction [42].

The RACER flaps placed on both box-wing (four) and vertical stabilizers (two) are used to adapt the vehicle attitude, to enhance stability, to optimize the trim configuration, and to abate noise [43,44,45]. Depending on the vehicle weight, the airspeed, the altitude, and the rotors speed, the wing flaps are deflected to optimize the mean lift coefficient of the main rotor. On the other hand, the flaps on the vertical fins are used to eliminate the residual yawing torque generated by the propellers, by assuring that they only contribute to propulsion during cruise [43]. Given these basic flight control functions, the design of the closed-loop position control of the flap movables is mainly driven by disturbance rejection requirements (i.e., the capability to minimize the position deviation from the commanded setpoint under external disturbances).

It is worth noting that in the RACER helicopter-plane, the flaps are not used for manoeuvrability (trajectory control is managed through the cyclic stick, as for conventional helicopters), so that they are classified as secondary flight controls. The flap EMAs are thus designed to be fail-safe systems in such a way that, after a major fault, the actuator is still capable of maintaining the flap movable at a fixed deflection (last or neutral position, depending on the fault mode), providing an adequate torsional stiffness to avoid flutter concerns.

Each flap EMA is composed of two parts, Figure 2: an electromechanical rotary actuator (FLap Actuator, FLA) and a control electronic box (Actuator Control Electronics, ACE). The equipment locations on the RACER helicopter-plane are shown in Figure 3 (note that the reported layout also depicts flaps on the horizontal tail since they have been initially included in the flight control system [41,43], but then eliminated from the final design).

The ACE includes three electronic boards, Figure 4 and Figure 5:

• COMmand (COM) board, implementing the EMA closed-loop control functions and the control of one of the two motor brakes (BC_COM in Figure 4);
• MONitor (MON) board, implementing the EMA health-monitoring algorithms and the control of one of the two motor brakes (BC_MON in Figure 4);
• PoWeR (PWR) board, including the power supply regulation for all electrical components, the MOSFET bridge, the six currents sensors (three ones for the COM board and three ones for the MON board, CF_{x COM} and CF_{x MON} in Figure 4) and a BEMF (Back Electro-Motive Force) damper circuitry, Figure 5.

The activation of the BEMF damper circuitry in the PWR board is obtained by a logic signal named system validity (SV in Figure 4 and Figure 5), which derives from an “AND” operator applied to the local validity signals provided by the two boards (LV_COM and LV_MON in Figure 4 and Figure 5). When SV is true, the power bridge thyristors are opened, and the damper thyristor is closed (Figure 5), so that the motor phases are shorted to the ground, and an electromagnetic damping torque is developed and transmitted to the EMA output shaft. This strategy permits significantly limiting the failure transients related to major faults (e.g., the control electronics hardover) since the unavoidable delays needed to achieve the full engagement of the motor brakes can determine an excessive deviation from the commanded setpoint with potentially dangerous concerns due to the impact on mechanical stops.

Both COM and MON boards are controlled by Texas Instruments TMS570LC4357-EP ARM-based microcontrollers [46] using a 10 kHz sample rate for the digital signal processing.

The FLA basically includes, Figure 6:

• a three-phase Permanent Magnet Synchronous Machine (PMSM) with surface-mounted magnets and sinusoidal back-electromotive forces, driven via Field-Oriented Control (FOC) technique;
• two motor rotation sensors: a resolver interfaced with the COM board and a magnetic encoder interfaced with the MON board (RF_COM and RF_MON in Figure 4);
• a dual magnetic encoder for the output shaft rotation sensing, interfaced to both COM and MON boards (PF_COM and PF_MON in Figure 4);
• two temperature sensors (TF_COM and TF_MON in Figure 4);
• two power-off electromagnetic brakes used to block in position the EMA after a major fault detection;
• an innovative Umbragroup-patented differential ball-screw mechanism implementing the mechanical power conversion from motor to output shaft, which, if compared with conventional gearboxes, assures a high gear ratio (more than 500) with minimum backlash (less than 0.05 deg) and superior efficiency (about 95%).

Table 1. EMA control sensors data.

Component	Model	Range	Accuracy
Current sensor	Allegro ACS723LLCTR-10AB-T	±10 A	0.1 A
Resolver	Tamagawa TS2610N171E64	±π rad	4 × 10−4 rad
Resolver analog-to-digital converter	Analog Devices AD2S1210	±π rad	2 × 10−4 rad
Magnetic encoder (motor)	Analog Devices ADA4571	±π rad	4 × 10−4 rad
Duplex magnetic encoder (output)	RLS AksIM-2	±0.157 rad	1.7 × 10−3 rad

reports the main characteristics of the sensors used for the closed-loop control and health-monitoring functions of the actuator [47,48,49,50,51].

2.2. Nonlinear Dynamic Modelling

The EMA health-monitoring algorithms have been designed with the essential support of the dynamic simulation by artificially injecting major system faults in a detailed nonlinear model of the actuator, developed via physical first principles and validated through experiments. This approach is of paramount importance, especially for the failure transient characterisation which is often unfeasible (or problematic) via testing.

The model of the RACER flaps EMA is essentially composed of:

• an electromechanical section, simulating

  ○

  FOC current dynamics;

  ○

  multi-harmonic modelling of PMSM torque disturbances (due to cogging effects [52,53,54,55] and/or BEMF waveform distortions);

  ○

  2-degree-of-freedom mechanical transmission with equations of motions related to motor and output rotations;

  ○

  sliding friction on motors and output shaft, described via combined “Coulomb–tanh” model [56,57];

  ○

  mechanical freeplay [21];

  ○

  internal stiffness dependence on output shaft position;

• an electronic section simulating the control and health-monitoring algorithms implemented by the COM and MON boards, including

  ○

  Clarke-Park transforms for the FOC technique implementation;

  ○

  sensor errors and nonlinearities (bias, noise, resolution);

  ○

  command nonlinearities (saturation, rate limiting);

  ○

  digital signal processing at 10 kHz sampling rate;

  ○

  control hardover fault simulation, implying that the voltage demands on both quadrature and direct axes suddenly assume and maintain random values, so that the EMA motion is out of control (as a worst case scenario, the quadrature voltage is set to saturation value, while the direct voltage is set to zero).

2.2.1. Electro-Mechanical Section of the Model

The electro-mechanical section of the model, schematically represented in Figure 6, is governed by Equations (1)–(10),

$$V_{abc}=R{I}_{abc}+L{\dot{I}}_{abc}+e_{abc},$$

(1)

$$e_{abc}={\lambda }_m{n}_d{\dot{\theta }}_m{\left[\begin{array}{ccc}\sin \left(n_d{\theta }_m\right)& \sin \left(n_d{\theta }_m-\frac{2}{3}\pi \right)& \sin \left(n_d{\theta }_m+\frac{2}{3}\pi \right)\end{array}\right]}^T,$$

(2)

$$J_m{\ddot{\theta }}_m=T_m+T_b-T_{sfm}\tanh \left(\frac{{\dot{\theta }}_m}{{\omega }_{sfm}}\right)-d_{vfm}{\dot{\theta }}_m-\frac{d_s{\dot{\theta }}_s+k_s{\theta }_s}{{\tau }_g},$$

(3)

$$J_o{\ddot{\theta }}_o=T_{aer}-T_{sfo}\tanh \left(\frac{{\dot{\theta }}_o}{{\omega }_{sfo}}\right)-d_{vfo}{\dot{\theta }}_o+d_s{\dot{\theta }}_s+k_s{\theta }_s,$$

(4)

$$T_m={\lambda }_m{n}_d\left[I_a\sin \left(n_d{\theta }_m\right)+I_b\sin \left(n_d{\theta }_m-\frac{2}{3}\pi \right)+I_c\sin \left(n_d{\theta }_m+\frac{2}{3}\pi \right)\right]+{\displaystyle \sum _{j=1}^M{T}_{hdj}\sin \left(n_{hdj}{\theta }_m\right)},$$

(5)

$$k_s=k_{s\min }+{\gamma }_k{\left({\theta }_o-{\theta }_{o\max }\right)}^2,$$

(6)

$$T_b=\{\begin{array}{ll}0\hfill & \hspace{1em}t<t_{FC}\hfill \\ -k_b\left[{\theta }_m-{\theta }_m\left(t_{FC}\right)\right]-d_b\left[{\dot{\theta }}_m-{\dot{\theta }}_m\left(t_{FC}\right)\right]\hfill & \hspace{1em}t\ge t_{FC}\hfill \end{array},$$

(7)

$${\dot{\theta }}_s=\{\begin{array}{cc}-\frac{k_s}{d_s}{\theta }_s& \hspace{1em}\left|{\theta }_g-{\theta }_o\right|<{\epsilon }_p\\ {\dot{\theta }}_g-{\dot{\theta }}_o& \hspace{1em}\left|{\theta }_g-{\theta }_o\right|\ge {\epsilon }_p\end{array},$$

(8)

$${\theta }_s=\{\begin{array}{cc}{\displaystyle \int {\dot{\theta }}_{s}dt}& \hspace{1em}\left|{\theta }_g-{\theta }_o\right|<{\epsilon }_p\\ {\theta }_g-{\theta }_o-{\epsilon }_p\mathrm{sgn}\left({\theta }_g-{\theta }_o\right)& \hspace{1em}\left|{\theta }_g-{\theta }_o\right|\ge {\epsilon }_p\end{array},$$

(9)

$${\dot{\theta }}_g=\frac{{\dot{\theta }}_m}{{\tau }_g},$$

(10)

where V_abc = [V_a, V_b, V_c]^T is the applied voltages vector, I_abc = [I_a, I_b, I_c]^T is the phase currents vector, e_abc is the back-electromotive forces vector (sinusoidal BEMF waveforms are assumed), λ_m is the magnet flux linkage, R and L are the resistance and the inductance of motor phases, respectively, n_d is the number of rotor pole pairs, θ_m is the motor rotation, θ_g is the theoretical rotation imposed by a rigid ball-screw drivetrain, θ_s is the torsional deformation referred to the first structural mode of the EMA, θ_o is the output rotation, J_m and J_o are the motor and output inertias, respectively, τ_g is the gear ratio of the differential ball-screw mechanism, ε_p is the internal freeplay, T_m is the motor torque, T_{hd j} and n_{hd j} are the amplitude and mechanical period indices, respectively, related to the j-th (j = 1, …, M where M is an integer number) harmonic torque disturbance contribution, T_aer is the aerodynamic hinge moment, T_b is the brakes torque, k_b and d_b are the torsional stiffness and damping of the brakes, respectively, t_FC is the time at which the fault compensation occurs, k_s and d_s are the torsional stiffness and damping, respectively, referred to the first structural mode of the EMA, k_smin is the minimum internal stiffness, γ_k is the parameter defining the stiffness variation with respect to output position, d_vfm and d_vfo are the viscous friction coefficients related to the motor and output shafts, respectively, while T_sfm, ω_sfm, T_sfo, and ω_sfo are the parameters of the “Coulomb–tanh” models simulating the sliding friction on motor and output shaft, respectively.

Concerning the aerodynamic hinge moment applied on the EMA (T_aer, in Equation (4)), the requirements indicate that, apart from static loadings, two contributions of dynamic loads must be taken into account for the performance analysis: a deterministic one (related to the helicopter-plane motion, main rotor speed and angle, wing propeller speeds), in which harmonic loads of specific amplitudes and frequencies are superimposed, and a non-deterministic one, including gust loads and harmonic loads of constant amplitudes randomly applied along the the position-tracking frequency range. In this work, the study is focused on the vertical stabilizer flaps, since it represents the worst-case scenario for the EMAs employed in the RACER helicopter-plane,

Table 2. Loads on vertical stabilizer FLA at VNE (derived from CFD analyses by Airbus Helicopters, worst-case scenario, all positions).

Static [Nm]	Harmonic Amplitude [Nm]	Harmonic Frequency [Hz]	Dynamic Load Definition
±100	2	15	Deterministic
	3	20
	15	23
	2	30
	2	46
	1.5	From 1 to 100	Non-deterministic

.

It is worth noting that the proposed model represents a balance between prediction accuracy, objectives of the study, and complexity of the model itself. More accurate simulations could include sophisticated friction models [56,57] and iron losses in the motor [58,59], but the inclusion of these features would entail minor effects for the examined application. In particular, the motor iron losses have been neglected because they depend on electrical frequency, which is relatively small in the position-tracking frequency range (<50 Hz, Table 2). On the other hand, more accurate friction models (including load and temperature dependence) could enhance the simulation, but a simplified approach has been preferred both for the lack of detailed information and to limit the number of model parameters.

The EMA model has been entirely developed in the Matlab–Simulink–Stateflow environment, and the numerical solution is obtained by a Runge–Kutta method with 10⁻⁶ s integration step. The choice of a fixed-step solver is not strictly related to the objectives of this work in which the model (once experimentally validated) is used for “off-line” simulations characterising the EMA failure transients, but it has been selected for the next steps of the project, when the algorithms for the closed-loop control and the health-monitoring will be implemented in the ACE boards via the automatic Matlab compiler and executed in “real-time”.

The parameters of the electro-mechanical section of the model are given in

Table 3. Parameters of the electro-mechanical section of the model.

Parameter	Meaning	Value	Unit	Identification Method (See Section 2.3)
L	Motor phase inductance	15 × 10−3	H	Test 1, Test 2
R	Motor phase resistance	1.53	ohm	Test 1, Test 2
λm	Magnet flux linkage	0.014	N∙m/A	Test 3
nd	Motor pole pairs	10	--	Design
Jm	Motor inertia	4 × 10−5	kg∙m2	Design, Test 5
Tsfm	Coulomb friction on motor shaft	0.015	N∙m	Test 5
ωsfm	Coulomb velocity on motor shaft	0.1	rad/s	Test 5
dvfm	Viscous friction coefficient on motor shaft	10−4	N∙m s/rad	Test 5
τg	Differential ball-screw gear ratio	500	--	Design
θomax	Mechanical endstroke, from centred	0.14	rad	Design
ksmin	Drivetrain torsional stiffness at θo = θo max	1.15 × 104	N∙m/rad	FEM analysis
γk	Parameter of the stiffness curve	1.3 × 105	N∙m/rad3	FEM analysis
ds	Drivetrain damping (1st vibration mode)	2.6	N∙m s/rad	FEM analysis
Jo	Output inertia, including flap movable	0.06	kg∙m2	Design, Test 5
Tsfo	Coulomb friction on output shaft	0.5	N∙m	Test 5
ωsfo	Coulomb velocity on output shaft	10−3	rad/s	Test 5
dvfm	Viscous friction coefficient on output shaft	0.1	N∙m s/rad	Test 5
kb	Brakes stiffness	150	N∙m/rad	Test 4
db	Brakes damping	0.02	N∙m s/rad	Test 4
εp	End-life internal freeplay	1.3 × 10−3	rad	Design
M	Number of cogging torque harmonics	3	--	Test 5
Thd1	Torque disturbance amplitude, 1st harmonic	0.001	N∙m	Test 5
nhd1	Torque disturbance period index, 1st harmonic	10	--	Test 5
Thd2	Torque disturbance amplitude, 2nd harmonic	0.007	N∙m	Test 5
nhd2	Torque disturbance period index, 2nd harmonic	20	--	Test 5
Thd3	Torque disturbance amplitude, 3rd harmonic	0.002	N∙m	Test 5
nhd3	Torque disturbance period index, 3rd harmonic	24	--	Test 5
Vmax	DC voltage supply	28	V	Design
Iqmax	Maximum quadrature current	4	A	Design
ωm max	Maximum motor speed	100	rad/s	Design

.

2.2.2. Electronic Section of the Model

The closed-loop control of the RACER flap EMAs is schematically represented in Figure 7. The position-tracking architecture integrates the conventional three nested loops on motor currents, motor speed, and output position [8,9] with a deformation feedback loop (“Stiffness Enhancement System, SES” block in Figure 7) and a model-based correction of voltage commands, aiming to decouple the currents dynamics from the motor motion (“electro-mechanical decoupler” block in Figure 7).

The FOC technique implemented in the COM board applies the direct and inverse Clark–Park transforms [60] via Equations (11)–(13),

$$x_{\alpha \beta \gamma }=T_C{x}_{abc}=\sqrt{\frac{2}{3}}\left[\begin{array}{ccc}1& -1/2& -1/2\\ 0& \sqrt{3}/2& -\sqrt{3}/2\\ \sqrt{2}/2& \sqrt{2}/2& \sqrt{2}/2\end{array}\right]x_{abc},$$

(11)

$$x_{dqz}=T_P{x}_{\alpha \beta \gamma }=\left[\begin{array}{ccc}\cos \left(n_d{\theta }_m\right)& \sin \left(n_d{\theta }_m\right)& 0\\ -\sin \left(n_d{\theta }_m\right)& \cos \left(n_d{\theta }_m\right)& 0\\ 0& 0& 1\end{array}\right]x_{\alpha \beta \gamma },$$

(12)

$$x_{dqz}=T_P{T}_C{x}_{abc}\hspace{1em}\iff \hspace{1em}{x}_{abc}={\left(T_P{T}_C\right)}^T{x}_{dqz},$$

(13)

where x_αβγ = [x_α, x_β, x_γ]^T, x_abc = [x_a, x_b, x_c]^T, and x_dqz = [x_d, x_q, x_z]^T are generic three-phase vectors in the Clarke, Park, and stator reference frames, respectively, while T_C and T_P are the Clarke and Park transforms.

The digital regulators on position, speed, and currents implement proportional/integral actions on tracking error signals, plus anti-windup functions with back-calculation technique [61] to compensate for commands saturation. Each j-th (with j = θ, ω, and I indicating the position, speed, and currents loops, respectively) digital regulator is governed by Equations (14) and (15):

$$y_{PI}^{\left(j\right)}=k_P^{\left(j\right)}{\epsilon }^{\left(j\right)}+\frac{k_I^{\left(j\right)}{T}_s}{z-1}\left[{\epsilon }^{\left(j\right)}+k_{AW}^{\left(j\right)}\left(y_{}^{\left(j\right)}-y_{PI}^{\left(j\right)}\right)\right]$$

(14)

$$y_{}^{\left(j\right)}=\{\begin{array}{ll}{y}_{PI}^{\left(j\right)}\hfill & \hspace{1em}\left|y_{PI}^{\left(j\right)}\right|<y_{sat}^{\left(j\right)}\hfill \\ y_{sat}^{\left(j\right)}\mathrm{sgn}\left(y_{PI}^{\left(j\right)}\right)\hfill & \hspace{1em}\left|y_{PI}^{\left(j\right)}\right|\ge y_{sat}^{\left(j\right)}\hfill \end{array}$$

(15)

where $z$ is the discrete-time operator, ${\epsilon }^{\left(j\right)}$ is the regulator input (tracking error), $y^{\left(j\right)}$ is the regulator output, $y_{PI}^{\left(j\right)}$ is the saturator block input (proportional–integral with respect to error, if no saturation is present), while $k_P^{\left(j\right)}$ and $k_I^{\left(j\right)}$ are the proportional and integral gains, $k_{AW}^{\left(j\right)}$ is the back-calculation anti-windup gain, $y_{sat}^{\left(j\right)}$ is the saturation limit, and T_s is the sampling time.

Concerning the SES loop, its basic objective is to enhance the loads disturbance rejection in the frequency range where the first resonant pulsation of the ball-screw mechanism is located (according to FEM analyses performed by Umbragroup, from 70 to 90 Hz, depending on output shaft position, Equation (6)). The control task is achieved by superimposing to the current demand generated by the speed regulator (I_qc, in Figure 7) an additional one (I_qSES, in Figure 7) that depends on the torsional deformation (δ_f) reconstructed by the motion feedbacks (θ_mf and θ_of in Figure 7), Equations (16)–(18).

$$I_{qd}=I_{qc}+I_{qSES},$$

(16)

$${\ddot{I}}_{qSES}=-a_{SES}{\dot{I}}_{qSES}-b_{SES}{I}_{qSES}-k_{SES}{\dot{\delta }}_f,$$

(17)

$${\delta }_f=\frac{{\theta }_{mf}}{{\tau }_g}-{\theta }_{of},$$

(18)

The structure of the current demand regulator (a second-order system responding to deformation rate input, Equations (17) and (18)) is defined by pursuing the following requirements:

• the loop shall not affect the EMA low-frequency behaviour (maxima loads, position tracking, etc.);
• the loop shall generate demands only in the frequency range where the first resonant pulsation of the ball-screw mechanism is located, and the compensation shall imply an increase of EMA stiffness, enhancing the disturbance rejection capabilities related to external loads.

To fulfill these objectives, the positive-defined parameters, k_SES, a_SES, and b_SES in Equation (17) are set in such a way that

• by tuning a_SES and b_SES, the phase response of the SES current demand (I_qSES) with respect to torsional deformation is about −180° from 70 to 90 Hz;
• by tuning k_SES, the SES current demand (I_qSES) implies an effective compensation without affecting the control stability.

Figure 8 shows the Bode diagram of the transfer function defined in Equation (19), which relates in the Laplace domain (i.e., s represents the complex variable) the SES current demand with the reconstructed deformation feedback,

$$\frac{I_{qSES}\left(s\right)}{{\delta }_f\left(s\right)}=-\frac{k_{SES}s}{s^2+a_{SES}s+b_{SES}},$$

(19)

It can be noted that the design implies that from 70 to 90 Hz the phase response ranges from −175° to −190°, and the regulator gain achieves its maximum, while it tends to be negligible at both low and high frequencies.

Regarding the currents-motion decoupling, it is obtained via Equations (20) and (21):

$$V_d=V_{dc}-L_q{n}_d{I}_{qf}{\dot{\theta }}_{mf},$$

(20)

$$V_q=V_{qc}+\left(\sqrt{\frac{3}{2}}{\lambda }_m+L_d{I}_{df}\right)n_d{\dot{\theta }}_{mf},$$

(21)

where V_dc and V_qc are the direct and quadrature voltage demands generated by the current regulators, and L_d and L_q are the inductances on the direct and quadrature axes (in the reference PMSM, having surface-mounted magnets, L_d = L_q = L). The currents dynamics imposed by the FOC technique implies that in the PMSM rotor frame (Equation (13)),

$$L{\dot{I}}_d=V_d-R{I}_d+L{n}_d{I}_q{\dot{\theta }}_m,$$

(22)

$$L{\dot{I}}_q=V_q-R{I}_q-\left(\sqrt{\frac{3}{2}}{\lambda }_m+L{I}_d\right)n_d{\dot{\theta }}_m,$$

(23)

Thus, by substituting Equations (20) and (21) into Equations (22) and (23), we have

$$L{\dot{I}}_d=V_{dc}-R{I}_d+L{n}_d\left(I_q{\dot{\theta }}_m-I_{qf}{\dot{\theta }}_{mf}\right),$$

(24)

$$L{\dot{I}}_q=V_{qc}-R{I}_q-\sqrt{\frac{3}{2}}{\lambda }_m{n}_d\left({\dot{\theta }}_m-{\dot{\theta }}_{mf}\right)-L{n}_d\left(I_d{\dot{\theta }}_m-I_{df}{\dot{\theta }}_{mf}\right),$$

(25)

Now, if the sensor dynamics imply minor phase delays and/or attenuations (θ_mf ≈ θ_m, I_qf ≈ I_q, I_df ≈ I_d), the residuals terms at second hands in Equations (24) and (25) can be neglected, so that the currents dynamics on both direct and quadrature axes behave independently and are decoupled from the rotor motion.

To protect the system from major faults and to permit its reversion into a fail-safe configuration (EMA with engaged brakes, maintaining the flap at fixed deflection), the following set of health-monitoring algorithms are executed by the MON board:

• over-temperature monitor, checking that the motor stator temperature does not exceed a pre-defined threshold;
• over-current monitor, checking that the quadrature current does not exceed a pre-defined threshold;
• Over-Speed Monitor (OSM), checking that the motor speed does not exceed a pre-defined threshold;
• currents consistency monitor, checking that the sum of the phase currents is lower than a pre-defined threshold;
• mechanical consistency monitor, checking that the EMA torsional deformation is lower than a pre-defined threshold;
• position deviation monitor, checking that the deviation of the output position feedback from the commanded setpoint is lower than a pre-defined threshold.

For the examined application, the most feared EMA failure is the control hardover, i.e., an electronic fault for which the COM board applies and maintains random voltage demands on both quadrature and direct axes, so that the actuator motion is out of control. The coverage of this failure is here provided by the OSM, whose working flow chart is reported in Figure 9. The OSM fault flag (F_mon) is generated by elaborating as fault symptom the amplitude of the speed feedback signal (ω_mon) at the k-th monitoring sample (processed at 10 kHz rate): if the fault symptom is greater than a pre-defined threshold (ω_th), a fault counter (c_mon) is increased by 2; if the threshold is not exceeded, the fault counter is decreased by 1 if it is positive at the previous step, otherwise it is held at 0. The fault is thus detected when the fault counter exceeds a pre-defined value (c_mon max, which basically defines the OSM FDI latency).

The parameters of the electronic section of the model are given in

Table 4. Parameters of the electronic section of the model.

Parameter	Meaning	Value	Unit
Ts	Digital control sample time (all regulators)	10−4	s
$k_P^{\left(\theta \right)}$	Proportional gain of the position regulator	1.58 × 104	1/s
$k_I^{\left(\theta \right)}$	Integral gain of the position regulator	1.1 × 105	1/s2
$k_{AW}^{\left(\theta \right)}$	Anti-windup gain of the position regulator	0.69	s
$y_{sat}^{\left(\theta \right)}$	Saturation limit of the position regulator	100	rad/s
$k_P^{\left(\omega \right)}$	Proportional gain of the speed regulator	0.07	A s/rad
$k_I^{\left(\omega \right)}$	Integral gain of the speed regulator	2	A/rad
$k_{AW}^{\left(\omega \right)}$	Anti-windup gain of the speed regulator	0.28	rad/(A s)
$y_{sat}^{\left(\omega \right)}$	Saturation limit of the speed regulator	4	A
$k_P^{\left(I\right)}$	Proportional gain of the current regulators	2.78	V/A
$k_I^{\left(I\right)}$	Integral gain of the current regulators	4.1 × 103	V/(A s)
$k_{AW}^{\left(I\right)}$	Anti-windup gain of the current regulators	150	A/V
$y_{sat}^{\left(I\right)}$	Saturation limit of the current regulators	28	V
aSES	SES regulator parameter 1	1.02 × 103	rad/s
bSES	SES regulator parameter 2	2.37 × 105	rad2/s2
kSES	SES regulator gain	103	A/(m s)
ωth	OSM fault symptom threshold	0.0175	rad/s
cmonmax	OSM fault counter threshold	250	--

.

2.2.3. Fault Simulation

As previously mentioned, the basic objective of the work is to validate the EMA health-monitoring algorithms with reference to the control hardover fault (worst-case failure), by particularly focusing on the failure transient characterisation. The model has been developed as a finite-state machine by using Matlab-Simulink-Stateflow charts and logics so that the simulations of both hardover fault and the subsequent activation of the back-electromotive circuitry are integrated in the EMA simulator.

The hardover fault is simulated by Equation (26), so that when the fault is injected (t = t_FI), the direct and quadrature voltages are switched from the values demanded by the EMA control laws (Equations (20) and (21)) to zero and saturation values, respectively:

$$V_d=\{\begin{array}{ll}{V}_{dc}-L{n}_d{I}_{qf}{\dot{\theta }}_{mf}\hfill & t<t_{FI}\hfill \\ 0\hfill & t\ge t_{FI}\hfill \end{array}\hspace{1em};\hspace{1em}{V}_q=\{\begin{array}{ll}{V}_{qc}+\left(\sqrt{\frac{3}{2}}{\lambda }_m+L{I}_{df}\right)n_d{\dot{\theta }}_{mf}\hfill & t<t_{FI}\hfill \\ V_{\max }\hfill & t\ge t_{FI}\hfill \end{array},$$

(26)

As described in Section 2.1, the PWR board of the EMA includes a BEMF damper circuitry, which, in case of a detected fault, imposes that the motor phases are shorted to the ground (so that an electromagnetic damping torque is developed and transmitted to the EMA output shaft). In the model, the BEMF damper activation is simulated via Equation (27), where t_FD is the time at which the fault is detected by the OSM.

$$V_{abc}=\{\begin{array}{ll}{\left(T_P{T}_C\right)}^T{V}_{dqz}\hfill & t<t_{FD}\hfill \\ 0\hfill & t\ge t_{FD}\hfill \end{array},$$

(27)

2.3. Experimental Test Campaign for the Model Validation

To substantiate the failure transient analysis presented and discussed in Section 3, the EMA model has been experimentally validated through a specific test campaign carried out at the Umbragroup facilities. In particular, the following tests have been performed, aiming to identify the model parameters reported in Table 3:

• Unloaded, open-loop tests

  ○

  Test 1 (blocked motor with engaged brakes): chirp wave inputs are given as direct voltage demand, while the quadrature voltage is set to zero, aiming to identify motor phase resistance and inductance (R and L). The test is repeated at a different position of the PMSM rotor to verify that the phase inductance does not significantly depend on motor angle (assumption of the model);

  ○

  Test 2 (blocked motor with engaged brakes): step inputs of different amplitudes are given to the quadrature voltage demand, while the direct voltage is set to zero, aiming to confirm the values of motor phase resistance and inductance. The test is repeated at different position of the PMSM rotor;

  ○

  Test 3 (free-wheeling motor with disengaged brakes and open phases): the PMSM rotor is dragged by an external motor at different speed amplitudes and the phase-to-phase BEMF is measured, aiming to identify the motor flux linkage (λ_m) and to eventually highlight higher harmonic components in the BEMF waveform;

• Unloaded, closed-loop tests

  ○

  Test 4 (blocked motor with engaged brakes): current loop tracking is tested by providing square-wave inputs of different amplitudes as quadrature current demand, while the direct current is set to zero, aiming to identify the damping and stiffness of the brakes (d_b and k_b);

  ○

  Test 5 (disengaged brakes): speed loop tracking is tested, by providing square-wave inputs of different amplitudes as speed demand, aiming to identify the torque disturbance parameters (M, T_hd1, n_hd1, T_hd2, n_hd2, T_hd3 and n_hd3), the viscous damping coefficients (d_vfm and d_vfo), the parameters of the sliding friction models (T_sfm, T_sfo ω_sfm and ω_sfo), and the actuator inertias (J_m and J_o).

At the current stage of the campaign, loaded tests and position-loop tests have not been carried out, but they have been planned for the future steps of the research, mainly to confirm the predictions of the resonant frequency of the ball-screw drivetrain, currently estimated through FEM analyses.

3. Results

3.1. Experimental Validation of the Model

An excerpt of the results obtained during the model validation campaign is reported from Figure 10, Figure 11, Figure 12 and Figure 13.

Figure 10 and Figure 11 are devoted to the identification of the electrical parameters of the motor phases (i.e., resistance and inductance), and it can be noted that the model succeeds in predicting the hardware response in both steady-state and dynamic operations. The repetition of tests at different positions of the PMSM rotor provided essentially identical results, thus confirming that the position-dependence of electrical parameters is negligible (basic assumption of the model).

Figure 12 is instead relevant for the identification of the magnet flux linkage as well as for the characterisation of the BEMF waveform with respect to the motor angle. Again, the model succeeds in predicting the hardware response in terms of both magnet flux linkage and BEMF waveform, which is essentially sinusoidal for the reference PMSM (basic assumption of the model).

Figure 13 finally reports a closed-loop speed-tracking response, which is essentially relevant for the identification of system inertias (lower left plot in Figure 13), torque disturbance parameters (upper and lower right plots in Figure 13), and friction parameters. It is interesting to note that the FFT analysis performed on quadrature current signal clearly highlights the presence of three harmonic disturbances. The first two harmonic components are multiples of the fundamental electrical frequency, being 10 and 20 times the mechanical frequency (n_d = 10, Table 3), and they derive from small deviations of the BEMF from the sinusoidal waveform. The resting harmonic component is instead located at 24 times the mechanical frequency, and the disturbance can be interpreted as an effect of cogging torque, due to assembly tolerances and/or magnet imperfections. As discussed in [52,53,54,55], these irregularities generate torque harmonics at frequencies that are multiple of the stator slots, which in the reference PMSM is 12.

3.2. Loads Disturbance Rejection Capability

Before performing the failure transient analysis (Section 3.3), the control system performances have been verified using the experimentally validated model of the EMA by characterizing the disturbance rejection capability against external loads.

The performance specification actually requires that under any of the load conditions reported in Table 2, the EMA position deviation shall be lower than the position sensor accuracy (0.1 deg). To demonstrate the effectiveness of the developed control system with special reference to the application of the SES deformation loop, an extensive simulation campaign has been carried out, and a summary of the results is given in Figure 14.

The results clearly highlight that the use of the SES deformation loop implies a relevant enhancement of performances. The compliance response under deterministic loading profiles is marginal without using the SES loop, while it significantly diminishes if the SES loop is present. Further, the compliance under non-deterministic loads exceeds the requirement limit in the resonant pulsation region (70 Hz) if the SES loop is not used, while it becomes adequate if the SES loop is applied.

3.3. Failure Transient Analysis

The experimentally validated model of the EMA has been finally used to characterise the failure transients related to a control hardover fault, as simulated in Equation (26). The following worst-case scenario has been simulated:

• the maximum static load plus the deterministic dynamic loads defined in Table 2 are applied to the output shaft;
• the EMA is demanded to move to the maximum positive deflection (minimum stiffness);
• the control hardover fault occurs immediately after the EMA reaches the position setpoint (t = t_FI = 0 s);
• the brakes activation occurs with a predefined delay from the fault detection (t_FC − t_FD = 51 ms, Umbragroup information).

To evaluate the effectiveness of the BEMF damper circuitry, the simulation is performed by activating or not the system, obtaining the results in Figure 15 and Figure 16.

It is interesting to note that, though the fault detection latency is extremely small (in both simulations, t_FD = 13.4 ms), the position deviation without BEMF damper is excessive and the EMA reaches the mechanical endstroke at high speed, possibly implying permanent damages (Figure 15). On the other hand, the use of the BEMF damper permits to strongly limit the position deviation during the failure transient, and the EMA can be blocked by the brakes in safety.

4. Discussion

As highlighted by the results in Section 3.3, the control hardover fault can determine EMA damages and potentially unsafe operation for the FLA movables. The failure transient analysis conducted using the experimentally validated model of the EMA highlights that, in some special operating conditions, even if the fault is detected with extremely small latency (less than 15 ms), the actuator can reach the mechanical endstroke impacting at high speed, thus causing permanent damages. To counteract this adverse situation, essentially caused by unavoidable delays in the activation of EMA brakes, the PWR board of the RACER flaps EMAs includes a specifically designed BEMF damper circuitry, which, immediately after the fault detection, opens the power bridge thyristors and connects all the motor phases to the ground, thus generating an electromagnetic damping torque.

5. Conclusions

The failure transients related to control hardover fault in the EMA employed for the flap movables of the RACER helicopter-plane are characterised using an experimentally validated model of the system, which includes multi-harmonic torque disturbance simulation, “Coulomb–tanh” friction, mechanical freeplay, and position-dependant stiffness of the ball-screw drivetrain. The failure transient characterization performed in a worst-case scenario in terms of external loads and position setpoint demonstrates that, though the fault detection is executed with extremely small latency (less than 15 ms), a potentially dangerous actuator runaway can occur, causing high-speed impacts on the EMA mechanical endstroke, caused by the activation delay of the EMA brakes (about 50 ms). Simulation is thus used to point out that an effective solution can be obtained by including a BEMF damper circuitry in the EMA power electronics, which, immediately after the fault detection, opens the power bridge thyristors and connects all the motor phases to the ground, thus generating an electromagnetic damping torque.

The future developments of the research will be focused on:

• extension of the model validation with loaded position-loop tests, aiming to:

  ○

  verify the actual location of the resonant pulsation of the ball-screw drivetrain (currently estimated via FEM analyses);

  ○

  characterise the actual disturbance rejection of external loads;

• model enhancement, by including a friction model that takes into account dependence on applied loads and temperature;
• robustness analysis of the health-monitoring performances against model parameters uncertainties.