Fail-Safe Controller Architectures for Quadcopter with Motor Failures

A fail-safe algorithm in case of motor failure was developed, simulated, and tested. For practical fail-safe flight, the quadcopter may fly with only three or two opposing propellers. Altitude for two-propeller architecture was maintained by a PID controller that is independent from the inner and outer controllers. A PID controller on propeller force deviations from equilibrium was augmented to the inner controller of the three-propeller architecture. Both architectures used LQR for the inner attitude controller and a damped second order outer controller that zeroes the error along the horizontal coordinates. The restrictiveness, stability, robustness, and symmetry of these architectures were investigated with respect to their output limits, initial conditions, and controller frequencies. Although the three-propeller architecture allows for distribution of propeller forces, the two-propeller architecture is more efficient, robust, and stable. The two-propeller architecture is also robust to model uncertainties. It was shown that higher yaw rate leads to greater stability when operating in fail-safe mode.


I. INTRODUCTION
Although stable flight needs at least four propellers, other multicopters employ more for redundancy to achieve safe flight in case of motor failure. Redundant propellers add to the weight and complexity, resulting in greater power consumption and reduction in loop frequency as more propellers are controlled during every iteration.
A solution for quadcopters losing three, two opposing, or one propeller in [1] uses a linear quadratic regulator (LQR) to rotate the quadcopter about a specified axis that is periodically fixed in both inertial and body frame. A 13-camera external motion tracking system is used to continuously provide the quadcopter position and orientation data [2], [3]. Optionally, a pilot sends commands to the quadcopter before and after failure to direct the flight path and land it [4].
This project aims to stabilize and land the quadcopter autonomously after an unexpected motor failure which means that all computations must be performed in flight. The goal is to still achieve fault tolerant return and landing despite limitations in sensor accuracy and computing power.

A. State Variables and Coordinate Frames
A set of quadcopter coordinate frames C is defined in [5]. The " x" superscript in C x indicates the reference frame. A rotation matrix R a b transforms a quantity from C a to C b . Note that characters in boldface are vector or matrix quantities. Table I lists the state variables. The IMU returns ϕ, θ, ψ, p, q, r.

C. Periodic Equilibrium Solutions for Fail-Safe Flight
In this paper, an overbar 0 denotes values that are constant along the periodic equilibrium solution, including reference values. A periodic equilibrium solution, as defined in [1], is a certain set of periodic equilibrium values or simply "equilibrium values" that are achieved when the quadcopter has stabilized its flight after a given amount of time from the last change in the translational reference values. The said equilibrium values depend on the quadcopter model parameters and propeller failure condition which is identified herein as the complete failure of three or two opposing motors.
Moreover, f and τ denote propeller thrust and propeller torque, respectively, with their subscript indices i pertaining to the propeller numbers indicated in Fig. 1.
The strategy adapted in [1] is to control only a single direction of attitude, roll or pitch, once a propeller fails. It is described by primary axis n 1=2n 1 x ,n 1 y ,n 1 z 3 that is stationary in C i and expressed in C b . Without loss of generality, let Motor 4 fail. One possible specification is to force the two opposing propellers to produce equal thrust: A tuning factor may be specified as Double motor failure solution appears when ρ=0. Triple motor failure solution appears as ρ→∞; although possible in theory, this is impractical as one propeller cannot handle the entire quadcopter's weight.

III. METHODOLOGY
A. Hardware DJI FlameWheel 450 was used as skeleton with E600 propulsion system, 4S Lipo (2800 mAh), YOST 3-Space IMU, Ublox NEO-M8N GPS, HC-SR04 ultrasonic sensor, and Raspberry Pi Zero W. Each motor was connected to a wireless relay which may be remotely activated during flight to induce failure. DJI E600 can receive motor signals between 30 Hz and 450 Hz, limiting the achievable effective loop frequencies.
B. Modeling 1) Axial MOIs: To obtain the axial MOIs, the quadcopter was suspended on three different axes and made to swing freely at small angles. The MOI about the axis at the pivot point is where T is the period of oscillation and r is the distance between the center of mass (COM) and pivot point [7]. Using parallel axis theorem, the desired axial MOIs can be obtained. Meanwhile, MOI of propellers were obtained by assuming that the motor is a solid cylinder and the propeller blade a circular disk with evenly distributed masses.
2) Propeller Characterization: The thrust magnitude, torque magnitude, and angular speed of a rotating propeller blade are related by [8] f Note that k f , k τ , and k are model parameters to be experimentally determined. In characterizing the propellers, the microcontroller sends a PWM command to the propeller. As the propeller spins, a weighing scale measures the thrust while a tachometer measures the propeller angular speed. The reaction torque is computed from the voltage and current drawn. At steady state, electrical torque τ e equals mechanical torque τ m [9]. The propeller exerts a torque in a direction opposite its sense of rotation [10]-a part of this is the reaction torque τ ψ exerted by the spinning propeller onto the body frame whereas the remaining is dissipated by aerodynamic drag τ d prop . Thus, at steady state, From (7), where k τ is a positive scalar. It was also shown in [11] that where k d is also a positive scalar. Since τ ψ and τ d prop behave similarly with respect to ω , it is impossible to distinguish between the two. We can set τ d prop =0 so that τ d prop is lumped together with the drag torque τ d on the body frame via experimental modeling. This effectively eliminates whatever excess torque allotment that went into τ ψ . Fig. 2, the quadcopter is attached to a freely rotatable bearing. Commanding two opposing propellers to exert same torque rotates the quadcopter about ẑb. Each torque value corresponds to a steady state angular velocity. Parametrizing the plot of the total torque versus the steady state angular velocity yields the drag coefficient.

C. Motor Failure Detection and Identification
Each combination of failure(s) may be uniquely identified by spikes in state readings. Table II summarizes all possible cases. Note that a propeller exerts a torque opposite its sense of rotation onto the quadcopter.
The state vector is s=2p,q,n x ,n y 3 with state error s=s-s̅ which evolves to first order as s=As+Bu where, based on (2), System input is introduced as a function of propeller force deviations from equilibrium by specifying Three-Propeller: Additional PID controller on propeller force deviations from equilibrium was added so that b) Two-Propeller: With two propellers, altitude PID control can be decoupled from the LQR controller because of symmetry, resulting in a more robust and stable system. The inner controller is described by where u z is the PID output. Taking into account the tilt which reduces lift force, u z is divided by ẑb·ẑi=cos(ϕ)cos(θ).
2) Outer Controller: d H =(x I,y I,z) is the translational deviation of the quadcopter from a desired point in space. As employed in [1], the outer controller zeroes out position error according to damping ratio ζ and natural frequency ω n by introducing a desired translational deviation acceleration d Ḧd es such that where ζ and ω n are diagonal matrices. The instantaneously desired direction of n is given by [ In (20), the component of n along ẑb is shifted such that the total periodic thrust and gravity act on the COM to achieve the desired acceleration. For two-propeller architecture, ζ zz and ω n zz were set to 0 so that the quadcopter's altitude is maintained solely by the PID controller. The implemented frequency of the inner controller was 450 Hz while the outer translational controller (and altitude controller as well for the two-propeller case) interrupted at 45 Hz . However, the achievable effective translational controller frequency was only 10 Hz to match the GPS update rate.

E. Sensor Fusion and Filters
For attitude sensing, accelerometer and magnetometer estimates were fused with gyroscope estimates via complementary filtering. Gyroscope readings were pre-filtered with exponential moving average filter. The tuning of filter time constants was done in powers of 2 of the loop period 1 450 Hz .
IV. RESULTS Table III shows the quadcopter parameters. The high inertia model is used in Section IV-H; it corresponds to a physical quadcopter modeled using the methods presented. In the following figures, blue plots correspond to actual values; red plots to equilibrium or reference values; green plots to updated reference values.

A. Three-Propeller Simulation
With ρ=0.5 , Fig. 3 and 4 show the simulated threepropeller quadcopter response. The tuned nonzero gains are  In this simulation, the quadcopter with only three propellers active is initially at equilibrium when the translational reference values are changed at 10 s to x=-0.3 m, y=0.3 m, z=4 m. It can be seen from Fig. 3 that as the quadcopter moves toward these translational reference values as shown in the first column, the required propeller thrusts shown in the third column steadily approach equilibrium and the desired translational deviation acceleration components shown in the second column approach zero. Meanwhile, Fig. 4 shows the quadcopter's orientation as well as its body frame angular velocities which, as discussed in Section IV-G, form the basis for the primary axis. Notice that although there is no static equilibrium for the roll, pitch, and yaw angles, the angular velocity components approach equilibrium values at steady state. Note that the zigzag pattern of the yaw plot indicates the quadcopter's continuous, rapid spinning motion along the yaw direction. Fig. 5 and 6 show the simulated two-propeller response. To initiate the controller, the quadcopter is initially placed at a small displacement (i.e. at coordinates x=-0.1 m, y=-0.1 m, z=2 m) from initial reference values x=0 m, y=0 m, z=2 m.

B. Two-Propeller Simulation and Implementation
With the rope and bearing setup in Fig. 2, it was possible to safely test the attitude and altitude controller but not the outer translational controller. In the implementation, the quadcopter will be tasked to stabilize about a vertical primary axis that is pointing opposite to gravity. The three-propeller case could not be safely tested with the current setup in the lab due to the circular trajectory [1]. Fig. 7 shows the implemented two-propeller response. Note from Fig. 8 that the quadcopter was able to maintain an altitude close to a reference 0.7 m above ground. Because the propellers were operating very close to limits, maximum PID output had to be capped at 5.0 N to still give a room for attitude controller. Meanwhile, minimum PID output was capped at -0.5 N to prevent quick descent. The strategy employed was to increase the proportional gain while relying on the PID output capping limits so that the PID output becomes similar to a bang-bang controller as seen in Fig. 9. Table IV lists the tuned controller gains. Even though the simulated and implemented optimal gains are far apart due to unmodeled factors, when the implemented gains are simulated, they work to stabilize the system. An accompanying video in [12] demonstrates the controller gains tuning process.   Fig. 7 that the orientation angles and angular velocity measurements in the implementation are noisier and yield wider oscillations than the simulation, as shown in Fig. 6, predicts. This discrepancy is mostly due to sensor noise and a lot of unmodeled non-idealities in the implementation.

Observe in
Nevertheless, the angular velocity components in Fig. 7 are shown to stabilize within boundaries and in the actual implementation, the quadcopter was physically able to stabilize about the vertical primary axis as demonstrated in [12].     8. Implemented two-propeller altitude response while hovering. Using the altitude PID controller, the quadcopter is trying to maintain its altitude (in blue) close to the reference altitude (in red). Fig. 9. Implemented two-propeller altitude PID output and propeller thrusts while hovering. The first column shows the PID output that must be added to the thrust command values of propellers 1 and 3 to maintain reference altitude. The second column shows the actual thrust values commanded to the propellers in order to maintain reference altitude while achieving flight stabilization. Note that the change in PID output values happens in discrete intervals, at a lower frequency than the quadcopter's inner attitude controller.

D. Output Limits
The three-propeller architecture works for any change along x, y if x Ïd es , y Ïd es are capped at 2.1 m s 2 in magnitude. It also works for any change along z if z̃d es is capped at 16.5 m s 2 . Meanwhile, the two-propeller architecture x Ïd es , y Ïd es must be capped at 5.4 m s 2 . Its altitude PID output must be capped at 1.1 N . These simulated limits are greater than the threepropeller, indicating greater stability.

E. Initial Condition Limits
The three-propeller architecture would still work if state variables deviate from equilibrium within the limits in Table V. With Motor 4 failure, symmetry in ϕ and p is lost so the positive and negative limits in θ and q are more symmetric. There is no limit to the initial values of x, y; the system would eventually stabilize but the larger the magnitudes of ẋ and/or y, the longer it would take the system to settle down to near-zero speeds. Moreover, the quadcopter would have to build up angular momentum until r exceeds 43.3930 Meanwhile, two-propeller limits are generally way higher, indicating greater stability. Except for translational variables, positive and negative limits are symmetric. The system can theoretically stabilize even for initial ϕ, θ beyond ±90°. The required initial r is 32.021

F. Frequency Limits
From simulations, frequency of outer three-propeller translational plus altitude controller must be >17 Hz whereas inner attitude controller must be >60 Hz. For the two-propeller architecture, outer controller must be >11 Hz whereas inner controller must be >14 Hz. The lower frequency requirements indicates greater robustness and stability. As the ratio of frequencies approach unity, the minimum frequency for the outer controller becomes slightly more restrictive.

G. Effect of r on Fail-Safe Stability
From periodic solution equations [1], it follows that n y , n z are similarly obtained with q, r in the numerator. When r increases with p , q constant, n z increases and approaches 1 while n x , n y approach 0. With three propellers, either n 1 x or n 1 y is 0; with two propellers, both n 1 x and n 1 y are 0. Increasing r by decreasing τ d or J zz unconditionally lowers n x , n y to their equilibrium values, thereby helping to stabilize the system. Furthermore, (22) and (23) suggest that that there is more average thrust along ẑi if n 1 z is higher so requirements from each propeller are generally lower. Note that the horizontal circular trajectory radius R 0 ps decreases as n 1 z increases, resulting in greater efficiency. These observations were confirmed by simulating and experimentally testing a quadcopter with higher inertia and drag.
where ω 0 is the quadcopter's equilibrium body frame angular velocity.

H. Robustness of Fail-Safe Controller to Model Uncertainty
When flying in fail-safe with two propellers so that p 1=q 1=0, the resulting r̅ and ϵ which depend only on effective drag coefficients are reliable. Drag coefficients will always yield a value for r̅ in accordance with the experimentally extracted model between the assumed propeller torque and observed steady state r . Thus, lumped in the coefficients are all uncertainties in J zz as well as modeling inaccuracies of propellers. This means that although the system's model may be uncertain, the resulting equilibrium values when flying with two propellers are reliable using the modeling methods discussed in this paper.
Simulations show that although the assumed system used to calculate the LQR gains is not the true system, it is possible to find a set of gains that can stabilize the true system, provided that the equilibrium values are accurate enough. A different quadcopter with higher inertia was successfully stabilized in simulations using the low inertia model in Table III

V. CONCLUSIONS
Fail-safe algorithm in case of motor failure for autonomous quadcopter with only onboard sensors and processor was developed, simulated, and tested. This paper also presents a method to detect the failure of a motor or particular combinations of motors. Since system model is vital to the controller, this paper additionally presents methods to model the quadcopter without needing expensive and least available apparatuses such as a reaction torque sensor.
In theory, there can be one-propeller fail-safe architecture but this is impractical as only one cannot handle the quadcopter's weight. Although three-propeller architecture allows for distribution of thrusts thereby lowering propeller requirements, two-propeller architecture is more efficient. Moreover, decoupling of altitude from translational and attitude control makes the two-propeller architecture more robust and stable. Although simulated frequency limits vary depending on quadcopter parameters and controller gains, lower limit for the outer translational controller was usually below 20 Hz. Although the GPS receiver used in this project had an update rate of around 10 Hz only, modern GPS receivers are capable of 5 Hz to 20 Hz, depending on location [13]. Additionally, simulated inner controller frequency limit was usually below 20 Hz for two-propeller architecture and below 100 Hz for three-propeller architecture. Most modern onboard attitude sensors and processors are highly capable of achieving these. It was shown that higher yaw rate leads to improved efficiency and greater stability in fail-safe mode, meaning larger and heavier unmanned aerial vehicles or those with greater air resistance coefficients are harder and more inefficient to stabilize. Finally, the two-propeller architecture is robust to model uncertainties so even if the model used is not true, it is possible to find controller gains that stabilize the system using the uncertain model. The extent of uncertainty allowed and other requirements may be explored in another study.