Optimal aircraft control upset recovery with and without component failures

Recovery of safe flight for a particular aircraft, in a specific initial adverse condition is examined, with and without a specific control failure. It is shown that under optimal circumstances, the adverse vehicle state could be corrected with little altitude loss. In addition, a control failure which proved fatal in practice was corrected, assuming independently acting spoilers. Generalizing these results to a comprehensive set of upset scenari will be time consuming, but could offer valuable heuristic piloting insights.


Introduction 2 Vehicle Model
This paper treats the problem of recovering sustainable nondescending (safe) flight in a transport aircraft after one or more of its control effectors fail. Such recovery can be a challenging goal for many transport aircraft currently in the operational fleet for two reasons. First, they have very little redundancy in their means of generating control forces and moments. These aircraft have, as primary control surfaces, a single rudder and pairwise elevators and aileron/spoiler units that provide yaw, pitch, and roll moments with sufficient bandwidth to be used in stabilizing and maneuvering the airframe. Beyond this, throttling the engines can provide additional moments, but on a much slower time scale.
Other aerodynamic surfaces, such as leading and trailing edge flaps, are only intended to be placed in a position and left, and are, hence, very slow-moving. Because of this, loss of a primary control surface strongly degrades the controllability of the vehicle, particularly when the failed effector becomes stuck in a non-neutral position where it exerts a disturbance moment that must be countered by the remaining operating effectors.
The second challenge in recovering safe flight is that these vehicles are not agile, nor can they tolerate large accelerations. This is of special importance when, at the outset of the recovery maneuver, the aircraft is flying toward the ground, as is frequently the case when there are major control hardware failures.
Recovery of safe flight is examined in this paper in the context of trajectory optimization.
For a particular transport aircraft, and a failure scenario inspired by an historical air disaster, recovery scenari are calculated with and without control surface failures, to bring the aircraft to safe flight from the adverse flight condition that it had assumed, apparently as a result of contact with a vortex from a larger aircraft's wake. An effort has been made to represent relevant airframe dynamics, acceleration limits, and actuator limits faithfully, since these contribute to the lack of agility and control power that plays an important role in defining what can be achieved with the vehicle when it is in extremis. where ec is the commanded value of e.
Thus far, the ailerons and spoilers have been referred to as a single unit. This is because, on the study aircraft, hardware linkages couple their motion. In particular, the right spoiler deflection is related to aileron deflection 8A by where 8A and 8xR are expressed in degrees. The left spoiler mirrors this, deflecting when the aileron deflection is negative. This relationship is not differentiable and, so, should confidently be expected to cause difficulty in optimization computations which require a guarantee of adequate smoothness for convergence. The aileron/spoiler linkage is modelled smoothly by driving the spoiler deflections from the aileron rate command CYA, modified by a squashing function on 8A. Again, for the right spoiler, 32 1 (5) gxR = T_cYA1 + exp{25 -208A} It should be noted that the vehicle model from [ 1,2] included a number of logical branches in which calculated quantities changed discretely as vehicle states passed thresholds. These were carried into the optimization model, but smoothed using appropriately defined squashing functions.

Trajectory Optimization Formulation
In September 1994, a Boeing 737-300 aircraft, USAir Flight 427, crashed on approach to Pittsburgh after encountering the vortex wake field of a passing 727 aircraft. Results from a simulation study of this 737, reconstructed from the recovered flight data, indicated that the crash may have been due to adverse yaw moments caused by a stuck rudder [5].
This specific aircraft incident was selected as the testcase for the work reported in this paper. It should be noted that the USAir 427 aircraft was a 737-300, rather then the uniquely short-bodied Langley 737-100 used in this study. The "300" is larger all around, with more powerful engines. Because we are studying the Flight 427 scenario, but applying it to a different transport aircraft, the results are of qualitative applicability to the Flight 427 situation. These quantities were imposed as initial conditions on the trajectories discussed in the next section. Not shown are control surface initial conditions that were defined as a result of the acceleration terms in Table 1.
The trajectory optimization results in the following section were obtained by approximating the solution of the plant equations by collocation, using a midpoint Euler discretization formula that provides 2hal-order accuracy, with equally spaced integration intervals. The optimization computations were carried out using the SNOPT 5.3 [7] nonlinear programming code. Gradients of dynamics and constraints were supplied to SNOPT analytically, and were obtained by applying the ADIFOR 2. The key performance issue in recovery of safe flight is to recover while losing as little altitude as possible in order to avoid ground contact and without violating airframe and crew safety acceleration placards. This certainly makes selection ofthecost function simple; i.e.maximize terminal altitude. Since theaircraft isinitially traveling downward, a nonpositive altitude rate h_<O (6) is imposed throughout the trajectory, in order to assure a meaningful solution.
After the solution is obtained, it is verified that (6) is never an active constraint on the solution. The acceleration placards constraining the recovery trajectories are given in Table 2. where % 0, and 0 are the euler angles. In other words, the aircraft has stopped descending, and has a non-negative energy rate. If the airframe is rotating, it is rotating back to a centered position. This appears to ensure that the aircraft can be flown from the terminal point of the recovery maneuver without losing more altitude.

Upset Recovery
In this section, two main scenari are considered.
First, recovery from the initial conditions of Table 1 with minimum altitude loss is calculated with a healthy set of control effectors, to serve as an ideal baseline against which to consider the case of the rudder hardover suggested by [5]. In analyzing the "healthy" case we, in fact, consider two subscenari recovery with the ailerons and spoilers linked using (5), and again, allowing the spoilers to operate independently of the ailerons. This was done because, at the time of writing, the authors are still wrestling with the problem of obtaining a solution for the stuck rudder case in which the ailerons and spoilers are linked, and which satisfies the placards in Table 2. This difficulty highlights the importance of losing a control effector in an aircraft with negligible control redundancy. Figures 1-9 display features of the recovery trajectories for the no-failure cases, computed using 40 integration intervals. The solid lines correspond to independent spoilers and the dash-dotted lines to coupled aileron/spoilers. The dashed lines, on the control surface histories, are their position limits. The maneuver is short in duration, lasting less than 5 seconds, and loses roughly 400 feet in altitude. It is also somewhat extreme, as can be seen from the accelration and euler angle plots. Unsurprisingly, allowing the spoilers to move independently enhances the performance; in this case, by roughly 6%. Note that, the flaps are aggressively used, decreasing 12and enhancing lift. This turns out to be very important to recovering the vehicle. We have not been successful in computing a no-failure recovery maneuver that satisfied acceleration placards with realistically coupled aileron/spoiler, without using flaps. Interestingly, it looks as though the pilot could simply turn them on, then off at the outset of the maneuver, freeing his or her hands to wrestle with the yoke and throttles. This may, on examination of further upset scenari, generalize to a trainable pilot action for recovering control.
Figures 10-19 display corresponding data for recovery (with independent spoilers) for the same initial conditions, but including a rudder hardover failure. Two trajectories are presented. The optimized trajectory for maximizing altitude resulted in undesirable responses in the accelerations (Figures 14 and 15). In order to determine the importance of these extraneous-looking temporal features, the trajectory was recalculated, adding a integral penalty on the sum of the squared control surface rates, scaled by 10 2. This was seen to have a fairly negligible effect on performance. In the Figures, the dash-dotted lines depict response without the control rate penalty and the solid lines are the response with it. Additionally, obeying the trajectory optimization rule of thumb that it is easier to solve a problem where the plant can meet the constraints easily than one where it can not, the object of the optimization problem was inverted from maximizing final altitude for a fixed rudder deflection to maximizing constant rudder deflection for a fixed final altitude. This permitted variation of the rudder setting during the iterations, and dramatically eased the solution process. For an altitude loss of 4190 It, the maximized rudder deflection without the control rate penalty was 17.61 deg., and with it was 17.54 deg.; both of which correspond well to 17.6 deg at which the data in Table 1 were drawn.
The Figures show a trajectory that is startlingly different from the no-fail case on several counts. First, the trajectory duration is an order of magnitude larger. As can be seen from Figure 10, after the initial altitude loss, there is a leg where altitude is almost unchanged for the rest of the trajectory.
This occurs shortly after 20 sec, and the change can be seen in the euler angle histories, as the aircraft labo-    Figure  19: Stuck Rudder Flaps.