Analysis of Control Strategies for Aircraft Flight Upset Recovery

Analysis of Control Strategies for Aircraft

Flight Upset Recovery

∗ Luis G. Crespo National Institute of Aerospace † Sean P. Kenny and David E. Cox Dynamic Systems and Control Branch, NASA Langley Research Center ‡ Daniel G. Murri NASA Engineering and Safety Center, NASA Langley Research Center This paper proposes a framework for studying the ability of a control strategy, consisting of a control law and a command law, to recover an aircraft from flight conditions that may extend beyond the normal flight envelope. This study was carried out (i) by evaluating time responses of particular flight upsets, (ii) by evaluating local stability over an equilibrium manifold that included stall, and (iii) by bounding the set in the state space from where the vehicle can be safely flown to wings-level flight. These states comprise what will be called the safely recoverable flight envelope (SRFE), which is a set containing the aircraft states from where a control strategy can safely stabilize the aircraft. By safe recovery it is implied that the tran- sient response stays between prescribed limits before converging to a steady horizontal flight. The calculation of the SRFE bounds yields the worst-case initial state corresponding to each control strategy. This information is used to compare alternative recovery strategies, determine their strengths and limitations, and identify the most effective strategy. In regard to the control law, the authors developed feedback feedforward laws based on the gain scheduling of multivariable controllers. In regard to the command law, which is the mechanism governing the exogenous signals driving the feed- forward component of the controller, we developed laws with a feedback structure that combines local stability and transient response considera- tions. The upset recovery of the Generic Transport Model, a sub-scale twin-engine jet vehicle developed by NASA Langley Research Center, is used as a case study.

Keywords: loss of control, flight control, upsets, homothetic deformations.

∗ Associate Research Fellow, 100 Exploration Way, Hampton VA 23666 USA. AIAA Senior Member.

† Senior Research Engineer, Mail Stop 308, NASA LaRC, Hampton VA 23681 USA.

‡ NASA Technical Fellow, Mail Stop 308, NASA LaRC, Hampton VA 23681 USA. AIAA Senior Member.

1 of 31 American Institute of Aeronautics and Astronautics I. Introduction In-flight loss of control (LOC) was the largest fatal accident category for commercial jet airplane accidents worldwide in the last decade [1]. Aircraft LOC can be described as motion that is: outside the normal operating flight envelope; not predictably altered by pilot control inputs; driven by nonlinear effects and coupling; and characterized by disproportionately large responses to small changes in the vehicle’s state; or oscillatory/divergent behavior [1].

The uncommanded angular rates and displacements characterizing these responses seriously compromise the ability to maintain heading, altitude, and wings-level flight. The primary drivers of LOC are entry into a vehicle upset condition, loss of control effectiveness, and severe degradations of the aircraft’s handling/flying qualities. This paper studies the first of these three causes.

Transport simulations and flight control systems have traditionally been developed for normal flying conditions. It is therefore vital to use enhanced transport simulation tech- nologies for evaluation of off-nominal conditions where the effects of nonlinear dynamics and uncertainties are dominant. Since the aircraft dynamics during upsets are dominated by strong nonlinearities, analyses based on linear time-invariant (LTI) models are of limited value. Unfortunately, most of the mathematical tools for control analysis are based on such models.

This paper studies upset recovery by using a high fidelity aircraft model. A model of the Generic Transport Model (GTM), a subscale twin-engine jet vehicle developed by the National Aeronautics and Space Administration (NASA) Langley Research Center, is used as a case study. The closed-loop dynamics are given by a nonlinear dynamic model and a flight control system. This control system consists of (i) a longitudinal controller having the elevators deflection as control input, (ii) an auto-throttle having the throttle-input to both engines as control input, and (iii) a lateral/directional multivariable controller having the ailerons and rudders as inputs. These controllers, which assume a full-state feedback feedforward structure, comprise the control law. The feedforward component of the controller is driven by commands generated by the pilot. These commands, which are exogenous signals to the system, are created by the pilot based on the current aircraft’s state and the desired steady-state flight condition. This paper assumes that there is a feedback-based law, called the command law , governing the commands driving the feedforward component of the controller. Command laws based on local stability arguments, dynamic arguments for attitude and altitude stabilization, and piloted simulations are derived and analysed.

The efficacy of a control strategy depends upon both the control and command laws.

This paper derives a few control strategies, where a control law and a command law were paired, and explores their ability to safely recover the aircraft from flight upsets. Three analyses were applied to each control strategy. In the first analysis the authors evaluated the aircraft’s time response to seven flight upsets: nose-up, nose-down, inverted-flight, stall, deep-stall, spin, and high-sideslip. These simulations, which were set according to piloted simulations under realistic flight conditions, provided local figures of merit for the recovery.

In the second analysis, the authors evaluated local stability about the equilibrium manifold corresponding to angles of attack varying from cruise to post stall conditions. This analysis yielded ranges of the angle of attack where the system become unstable. In the third analysis, the authors calculated inner bounds to the safely recoverable flight envelope (SRFE) and the corresponding worst-case flight conditions. Since the SRFE is a subset of the state space 2 of 31 American Institute of Aeronautics and Astronautics from where the recovery is effective, its inner bound is a global figure of merit for upset recovery.

The above analysis sequence was used to assess flight upset recoverability for various control strategies. This enabled the authors to (i) determine if the role played by the con- troller at the onset of the upset, where the vehicle state might be far away from the trim point used for control design, is beneficial; (ii) identify the strengths and limitations of the control strategy, (iii) determine which command law offers a superior upset recovery, and (iv) generate command laws that can be used for pilot queueing and automatic recoveries.

This paper is organized as follows: section II presents details of the aircraft model and the controller’s architecture; this is followed by section III, where the background of the analysis tools mentioned above and their application to the GTM is summarized; these tools are applied to several control strategies in sections IV–VIII; the results are discussed in section IX; and finally, a few concluding remarks close the paper.

II. Plant and Controller Architecture A. The Generic Transport Model The GTM is a model of a transport aircraft for which both a dynamically scaled flight test article and a high fidelity simulation were developed. Figure 1 shows the flight test article and its concept of operations. References [2, 3, 4] provide details on the vehicle’s configuration and characteristics and the flight experiments. The aircraft is piloted from a ground station via radio frequency links by using onboard cameras and synthetic vision technology. The Figure 1. NASA GTM test article and its concept of operations.

high fidelity simulation uses nonlinear aerodynamic models extracted from wind tunnel data and system identification for conditions that include high angles of attack, and considers actuator dynamics with rate and range limits, engine dynamics, sensor dynamics along with analog-digital-analog latencies and quantization, sensor noise and biases, telemetry uplink and downlink time delays, turbulence, atmospheric conditions, etc. The open-loop system model has 278 state variables.

During stall, which occurs between angles of attack of 12 and 14 degrees, the vehicle 3 of 31 American Institute of Aeronautics and Astronautics experiences a drop in altitude and an uncommanded roll departure. These effects, which are captured by the aerodynamic model of the high fidelity simulation, mimic the behavior of the test article observed in the flight experiments.

B. Control Design The system dynamics can be represented as ˙ X = F ( X, U, ˆ p ) , (1) where F is a nonlinear function of the state vector X , the control input U , and the vector of uncertain parameters , ˆ p . The vector of uncertainties, ˆ p , may contain parameters that affect the vehicle dynamics such as aerodynamic coefficients, initial conditions, time-delays, CG coordinates, etc. For control design purposes, this nonlinear plant is linearized about a ∗ ∗ ∗ ∗ trim point ( X (ˆ p ) , U (ˆ p )) satisfying F ( X , U , ˆ p ) = 0 for the force and moment equations.

∗ ∗ Deviations from the trim values X and U are written as lower-case letters hereafter, e.g., ∗ ∗ X = X + x and U = U + u . Linearization of Eq. (1) about the trim point leads to the p system ˙ x = A x + B u + ν ( x , u, ˆ p ) , (2) p p p p p where ∣ ∣ ∣ ∣ ∂F ∂F ∣ ∣ A = B = (3) p p ∣ ∣ ∂X ∂U ∗ ∗ ∗ ∗ X ( ˆ p ), U ( ˆ p ) X ( ˆ p ), U ( ˆ p ) and ν contains higher-order terms. In a sufficiently small neighbourhood of the trim point, the effect of the higher-order terms is negligible. The LTI representation of the plant, which results from dropping the higher-order terms from Eq. (2), is given by ˙ x = A (ˆ p ) x + B (ˆ p )( R ( u ) + d ) + B ˆ r, (4) p p p p s 2 where A and B , the system and control input matrices, have unknown components that p p depend on ˆ p ; d ( t ) is an exogenous disturbance; ˆ r ( t ) is the reference command generated by the pilot; R ( u ) is a saturation function that enforces range saturation limits in the control s inputs, and B is the command input matrix. The vector ˆ p takes on the value ¯ p when the aircraft flies under nominal operating conditions.

The state, x , consists of angle of attack, α ; sideslip angle, β ; speed, V ; roll rate, p ; pitch p rate, q ; yaw rate, r ; longitude, x ; latitude, y ; altitude, z ; and the Euler angles, ψ , θ , and φ . The control input u consists of the elevator deflection, δ ; the aileron deflection, δ ; the e a rudder deflection, δ ; and the throttle input to the engines, δ . The reference command ˆ r r th consists of angle of attack-, sideslip-, speed- and roll rate-commands. These four commands, denoted hereafter as α , β , V , and p , respectively, are generated by the pilot to cmd cmd cmd cmd attain the desired flight maneuver.

The flight controller consists of independent controllers for the longitudinal and the lat- eral/directional dynamics. While the longitudinal controller consists of an auto-throttle and a multiple-input-single-output controller for pitch, the lateral/directional controller assumes a multiple-input-multiple-output structure. The controllers operating the control surfaces 4 of 31 American Institute of Aeronautics and Astronautics have a linear quadratic regulator structure with proportional and integral (LQR-PI) terms having integral error states for each of the components of the reference command ˆ r . Further- more, strategies for preventing integrator windup caused by input saturation were applied.

A fixed control allocation matrix that correlates inputs of the same class prescribes the 10 main plant inputs: 4 elevators, 2 ailerons, 2 rudders and 2 throttles. As a result, out of these 10 inputs only 4 are independent.

1. Auto-throttle The throttle input to the engines was prescribed by a simple proportional-derivative con- troller with the form δ = K e + K ˙ e , (5) th 1 V 2 V where e = V − V . (6) V cmd The regulation of airspeed and pitch control were done separately because of a large time scale separation between the corresponding actuators. In a previous work [5], a multivariable controller for both airspeed and pitch was developed.

2. Longitudinal Controller The linearized plant for pitch control takes the form ˙ x = A x + B u , (7) lon lon lon lon lon 3 × 3 3 × 1 > where A ∈ R is the system matrix, B ∈ R is the input matrix, x = [ α q V ] is lon lon lon the state, and u = δ is the input. To enable tracking commands in angle of attack, the lon e integral error state ∫ e = ( α − α ) dt, (8) α cmd was added. This led to the augmented plant [ ] [ ] [ ] [ ] [ ] ˙ x A 0 x B 0 lon lon lon lon = + δ + α , (9) e cmd ˙ e 0 − 1 H 0 e α 1 α where H = [1 , 0 , 0]. A constant gain LQR controller that minimizes ∫ ∞ T 2 J = ( x Qx + δ R ) dt, (10) lon lon e > where Q = Q ≥ 0, R > 0 are weighting matrices, was designed. This led to [ ] [ ] x lon δ = K K . (11) e lon eα e α 5 of 31 American Institute of Aeronautics and Astronautics This controller must attain ample stability margins so the low-pass- and anti-aliasing-filters from sensors and the delay caused by telemetry do not compromise stability. In particular, all controllers designed herein attained more than 6 dB of gain margin and 60 deg of phase margin.

The plant’s input is given by    u if u < u < u , min max  R ( u ) = (12) u if u ≥ u , s max max    u otherwise , min where u is the controller’s output, and u and u are the saturation limits of the actuator.

max min The control deficiency caused by this saturation function is given by u = R ( u ) − u. (13) ∆ s The integrator anti-windup strategy proposed in [5] was applied to the 〈 e , δ 〉 pair. The α e aim of anti-windup compensation is to modify the dynamics of a control loop during con- trol saturation so that an improved transient behavior is attained after desaturation. This practice mitigates the chance of having limit cycle oscillations and successive saturation.

Because there is a high chance of control input saturation during the upset recovery, the proper management of integrators is of paramount importance.

3. Lateral/Directional Controller An LTI model of the corresponding plant is ˙ x = A x + B u , (14) lat lat lat lat lat 3 × 3 3 × 2 > where A ∈ R is the system matrix, B ∈ R is the input matrix, x = [ β p r ] is the lat lat lat > state, and u = [ δ δ ] is the input. To enable satisfactory command following, integral lat a r error states for sideslip and roll rate, given by ∫ e = ( β − β ) dt, (15) β cmd ∫ e = ( p − p ) dt, (16) p cmd were added. The integral error in sideslip was chosen over that of the yaw rate to facilitate the generation of commands for coordinated turns with non-zero bank angles and cross-wind landing. The augmented plant is given by     [ ] [ ] [ ] [ ] ˙ x x lat lat A 0 B 0 β     lat lat cmd ˙ e = + u + , (17)    e  lat β β H 0 0 − I p cmd ˙ e e p p [ ] > > > where H = [1 , 0] [0 , 1] [0 , 0] . A LQR control structure for the lateral controller was adopted. This led to   [ ] x lat [ ] δ   a = . (18) K K K  e  lat e e β β p δ r e p 6 of 31 American Institute of Aeronautics and Astronautics As before, this controller attains ample stability margins to accommodate for filters and time delays. The anti-windup technique in [5] was applied to the 〈 e , δ 〉 and 〈 e , δ 〉 pairs.

β r p a 4. Control Allocation Equations (11) and (18) along with the three realizations of the anti-windup technique > mentioned above, prescribe the preallocated input u = [ δ δ δ δ ] , where n e a r th > u = K [ x e e ˙ e x e e ] , (19) n n lon α V V lat β p 4 × 11 and K ∈ R is the feedback gain. This input, along with a control allocation scheme, n fully determines the 10 control inputs of the aircraft. This relationship can be written as u = G u , (20) nom nom n 10 × 4 where G ∈ R is the control allocation matrix. The allocation of u enforced by G nom n nom makes the four elevators deflect the same, both ailerons deflect in opposite directions, the thrust of both engines equal, and the deflection of both rudders equal.

C. Competing Control Alternatives This section presents details of the development and configuration of three flight control systems. Each of these systems will constitute one of the control strategies to be evaluated.

Figure 2 shows projections of the equilibrium manifold corresponding to the open-loop a plant for wings-level horizontal flight with angles of attack varying between 2 and 30 degrees .

Trim points that are locally stable are colored in green while those that are locally unstable are shown in red. Note that the longitudinal dynamics are unstable in the [11 . 9 , 12 . 8] deg range while the lateral/directional dynamics are unstable in the [10 . 4 , 14 . 25] and [23 . 85 , 28 . 4] deg ranges. The corresponding locus of open-loop poles are shown in Figure 3, where the lateral poles are shown in blue and the longitudinal ones are in red. The large variation in the location of the poles indicates that the aircraft pre-stall, stall, and post-stall dynamics vary significantly.

∗ ∗ A single-trim-point flight controller for X and U corresponding to horizontal, wings- level flight with a zero path-angle, and 80 knots was designed first. This controller consists of the auto-throttle, the longitudinal and the lateral/directional controllers introduced above.

This controller will be denoted as C . The controller gains were tuned according to classical control metrics, which included stability margins, shaping of the input- and output-loop transfer-functions, and time responses to representative pilot commands. The control objec- tive was to obtain a controller that provides satisfactory pilot command tracking given the intrinsic time delays of the system.

Figure 4 shows the states and commands corresponding to a typical maneuver within the normal flight envelope. The aircraft starts off from the trim point used for control design and then it is subjected to commands in angle of attack, side-slip, and roll rate. It can be seen that the controller tracked the doublets well while reaching the commanded airspeed after a short transient without significant changes in altitude. Figure 5 shows the same a The equilibrium manifolds displayed in this manuscript are based on the family of LTI models of the plant corresponding to varying values of angle of attack and, when applicable, to the corresponding linear controllers. Since the parameterizing variable of the gain scheduled controller is a state, the linearization of the corresponding nonlinear closed-loop system may yield LTI models that differ from the ones used herein.

7 of 31 American Institute of Aeronautics and Astronautics Figure 2. Projections of the equilibrium manifold for varying levels of angle of attack. Points in green are locally stable while those in red are locally unstable.

maneuver but for a sequence of commands centered about a trimmed point with a higher angle of attack. A substantial degradation in tracking performance occurred because this ∗ flight condition is far from X . Note that uncommanded oscillations in pitch appeared and the aircraft became unstable in both roll and yaw.

Figure 6 shows the closed-loop poles corresponding to C . Note that even though this controller attains good command tracking in the normal flight envelope, it fails to locally stabilize the aircraft over the entire equilibrium manifold. Providing there is enough control authority, the aircraft might be kept near a locally unstable equilibrium point by a judicious and persistent set of commands ˆ r .

To improve the command tracking performance outside the normal flight envelope, two gain-scheduled controllers were designed [6]. In regard to tracking performance the first controller, to be denoted as C , can be regarded as aggressive; while the second controller, to be denoted as C , can be regarded as moderately aggressive. These controllers schedule three fixed-point controllers on the longitudinal and lateral axes with angle of attack. Since the scheduling variable is a state, the resulting controllers are quasi-linear parameter varying.

The trim points used for control design correspond to angles of attack of 4.2, 13, and 22 degrees. These values correspond to cruise, stall, and post-stall flight conditions, respectively.

Each of the fixed-point controllers comprising the gain scheduled controller attains good tracking performance near the corresponding linearization point. Furthermore, they make the equilibrium manifold shown above locally stable at each point in the [2 , 30] angle of attack degree range. The controller designed for 4.2 degrees used by both gain scheduled controllers is the very same C .

8 of 31 American Institute of Aeronautics and Astronautics Figure 3. Locus of the open-loop poles for varying values of angle of attack at trim in the [2 , 30] degree range. Longitudinal poles are shown in red while the lateral/directional are shown in blue.

Controller C provides improved tracking command near stall at the expense of a reduced time delay margin in the lateral/directional axes. Figure 7 shows the corresponding closed- loop poles in the range of interest. As intended, this controller makes all the equilibrium points locally stable. The time responses corresponding to the same pilot commands of Figure 5 are shown in Figure 8. In contrast to the fixed-point controller, C ; the gain- scheduled controller, C ; attains good command tracking in all axes. A similar tracking performance was observed throughout the [2 , 28] degree range of angle of attack. For larger angles of attack, good V command tracking is not possible due to the reduced control authority resulting from a saturated throttle input.

Controller C exhibits a degraded command tracking and larger time delay margins when compared to C but still offers satisfactory command tracking in all axes. Figures with the corresponding locus of its closed-loop poles and the time response to commands outside the normal flight envelop are omitted.

D. Command Law The commands ˆ r used in figures 4 and 5 were prescribed a priori based on standard flight maneuvers. In practice, however, they are generated by the pilot according to the existing flight condition and the desired aircraft state. Recall that the pilot commands are exogenous signals entering the controller via the feedforward terms defined by the integral error states e , e , e , and e .

α V β p 9 of 31 American Institute of Aeronautics and Astronautics Figure 4. Aircraft states and commands corresponding to maneuvers within the standard flight envelope for C .

Figure 5. Aircraft states and commands corresponding to maneuvers outside the standard flight envelope for C .

10 of 31 American Institute of Aeronautics and Astronautics Figure 6. Locus of the closed-loop poles of C for varying values of angle of attack in the [2 , 30] degrees range. Longitudinal poles are shown in red while the lateral/directional are shown in blue.

This paper investigates command laws assuming a feedback structure where ˆ r is a func- tion of the current and the targeted aircraft states, i.e., ˆ r ( X ( t ) , X ). These command target laws are vehicle and control-law dependent and will only address the need for reaching the target state X from arbitrary initial conditions. This structure enables the generation target of command laws that change at the same time scale as the aircraft’s state. Furthermore, these command laws are easy to implement, for example, to execute an automated upset recovery; while enabling the application of control analysis tools. There are many command laws, having a feedback structure or not, that would perform satisfactorily. It is of interest to determine if the actions taken by a pilot under realistic conditions can be effectively and accurately represented by a feedback structure, what the functional form of that structure would be, and what the features characterizing effective command laws would be. While these issues motivate some of the developments in this paper, they are out of the scope of this work.

Given the control architecture above, we adopted command laws with the form α = α + f ( X, X ) , (21) cmd target α target β = β + f ( X, X ) , (22) cmd target β target V = V + f ( X, X ) , (23) cmd target V target p = p + f ( X, X ) , (24) cmd target p target > where f = [ f , f , f , f ] is comprised of functions that approach zero when X approaches α β V p X . For a stabilizing controller, i.e., a controller that drives α , β , V , and p from an initial target 11 of 31 American Institute of Aeronautics and Astronautics Figure 7. Locus of the closed-loop poles of C for varying values of angle of attack in the [2 , 30] degrees range. Longitudinal poles are shown in red while the lateral/directional are shown in blue.

Figure 8. States and commands corresponding to maneuvers outside the normal flight envelope for C .

12 of 31 American Institute of Aeronautics and Astronautics state to α , β , V , and p , the above functional forms ensure that the commands cmd cmd cmd cmd will approach the target state, thus, that the aircraft state will approach the target state.

In this study, the target state X is given by α = 4 . 28 deg, V = 80 knots, target target target β = p = q = r = 0 degrees/second, and θ = φ = 0 degrees.

target target target target target target This flight condition corresponds to a locally open-loop and closed-loop stable, zero path- angle, wings-level flight. The functional forms of the components of f , which are yet to be determined, are responsible for driving the states that are not commanded directly to their target values, e.g., for making the yaw rate, r , converge to zero by prescribing suitable transients for β and p . Note that all the 7 variables γ , β , V , p , q , r , and φ must cmd cmd reach fixed target values by manipulating the 4 commands, α , β , V , and p .Thus, cmd cmd cmd cmd f is responsible for driving the states, directly commanded or not, to the desired state.

For instance, the command law α = α − kγ will drive the angle of attack from a cmd target suitable initial condition to its targeted value while reaching a zero path angle in steady state. Particular command laws are proposed below.

III. Analysis Framework This section briefly introduces the framework used to evaluate control strategies for upset recovery. Two evaluations are carried out. In the first analysis the authors evaluate the time response of the closed-loop system to seven flight upsets. The aircraft states at which the upsets occur were generated using piloted simulations. This evaluation only provides a local notion of effectiveness. In the second analysis, the authors calculate inner bounding sets of the SRFE centered about X . This evaluation provides a global notion of recovery target effectiveness.

A. Local Analysis: Point Simulations Piloted, real-time simulations were used to identify initial aircraft states leading to flight upsets. These upsets, which are characterized by the occurrence of uncommanded aircraft responses, are well outside the normal flight envelope. A brief description of each of them is given next.

1) Nose-up : This condition is characterized by a post-stall angle of attack, low airspeed, and a large and positive path angle. The roll asymmetry present in the stall range, excites the lateral and directional dynamics during the recovery.

2) Nose-down : This upset is characterized by a small angle of attack, a large airspeed, and a steep descent. During the recovery the aircraft reaches speeds outside the normal flight envelope.

3) Inverted flight : This flight condition is characterized by a bank angle of 180 degrees and a steep descent. A successful recovery requires a large roll rate to bring the vehicle back to a non-inverted flight. The recovery can yield speeds outside the normal flight envelope.

4) Stall : This upset is characterized by a large angle of attack, a negative path angle, and a low airspeed. The roll departure at stall preceding the upset creates moderate roll and yaw rates.

13 of 31 American Institute of Aeronautics and Astronautics 5) Deep stall : This is like the stall condition above, but it attains a larger angle of attack and steeper descent.

6) Spin : This upset is characterized by a very large angle of attack, a low airspeed, a large and negative path angle, large pitch, roll, and yaw rates, and a moderate sideslip angle. During the recovery the aircraft experiences large airspeeds.

7) High sideslip/roll rates : This condition is characterized by a large sideslip angle and large roll and yaw rates. The aerodynamics of the aircraft in this flight regime has a stabilizing effect.

Several control strategies were evaluated by simulating these flight upsets. The corresponding time-responses will be qualified according to several figures of merit. These figures of merit, which take into account several stability and performance considerations, are introduced in the following section.

B. Global Analysis: Homothetic Deformations To make this paper self-contained, a brief introduction to the control analysis methodology proposed in [7] is presented next. Consider the dynamic system in (1) and the control law U = U ( X, ˆ r ) , (25) where U refers to a particular control structure, and ˆ r are the pilot commands feeding into the feedforward part of the controller. Assuming that the pilot commands have the feedback structure ˆ r ( f ( X ) , X ), the expression target ˙ X = F ( X, U ( X, f ( X ) , X ) , ˆ p ) , (26) target fully describes the closed-loop system response.

In this paper ˆ p represents the aircraft state at which the recovery is initiated, i.e., ˆ p = X (0). In contrast, the analysis in [5] considered uncertain parameters representing actuator failures, unknown time-delays and unknown aerodynamic coefficients. The aircraft response to the commands ˆ r is deemed safe when a set of requirements is satisfied. These requirements are represented by a set of inequality constraints on selected output metrics. Specifically, satisfaction of the vector inequality g (ˆ p ) < 0 , (27) implies the satisfaction of all the requirements. These constraints partition the state space into two sets, the failure domain F = { ˆ p : g (ˆ p ) ≥ 0 for some i } where at least one require- i ment is violated, and the safe domain S = { ˆ p : g (ˆ p ) < 0 for all i } where all requirements i are satisfied. Note that S is the SRFE defined earlier. The term “safe recovery”, which is to be captured in g , is broad in scope and refers to acceptable ranges of variation in metrics of interest. These metrics may correspond to specific performance and stability specifications as well as to typical notions of goodness.

Let ¯ p , called the nominal parameter point, be equal to X . The objective of this target analysis is to determine the largest deviation from ¯ p for which all the requirements are met, i.e., the family of initial conditions centered about the target state from which the aircraft can 14 of 31 American Institute of Aeronautics and Astronautics be safely stabilized. In this paper, such a deviation will be prescribed as a hyper-rectangular set of fixed proportions. The notions required to calculate this deviation are introduced next.

A homothetic deformation results from a uniform, radial expansion or contraction of the space about a fixed point. The distance from any point in the space to the fixed point changes by a factor  after the deformation. This factor is called the similitude ratio of the deformation. Note that if  is greater than 1, the deformation is an expansion, while if  is less than 1, the deformation is a contraction. A hyper-rectangular reference set , dim(ˆ p ) denoted as Ω ⊂ R , will be deformed with respect to its geometric center ¯ p . Intuitively, one can imagine that Ω is being deformed homothetically with respect to ¯ p ∈ S until the deformed set touches the failure domain boundary. This deformation will be called the Maximal Deformation . The set resulting from this deformation is the maximal set . A critical parameter value (CPV) is (one of) the point(s) where the maximal set touches F . In the context of this paper, the CPV is the worst-case initial state . The critical similitude ratio (CSR) is the similitude ratio of that deformation and is a nondimensional metric proportional to the separation between the point ¯ p and the failure domain. The parametric safety margin (PSM), ρ ∈ R , is its dimensional equivalent.

The values taken on by the CSR and the PSM are proportional to the size of the maximal set and measure the separation between ¯ p and F . The PSM is assigned a negative value if the control strategy does not even satisfy the requirements at ¯ p . If the PSM is zero, the control strategy exhibits no robustness because there is an arbitrarily small deviation from ¯ p leading to a requirement violation. If the PSM is positive, the requirements are satisfied at ¯ p and its vicinity. The larger the PSM, the larger the Ω-shaped vicinity of ¯ p where the requirements are satisfied. The formulation used to calculate maximal deformation can be found in [5, 7].

The requirements used to prescribe a safe upset recovery for the GTM are as follows: 1) Structural loading : the requirement g < 0 ensures that the loading factor caused by the vehicle’s acceleration does not exceed 2 g s. This acceleration is below the loading limit for the fuselage.

2) Admissible range of roll rate : the requirement g < 0 ensures that the absolute value of the roll rate does not exceed 200 deg/s throughout the recovery.

3) Admissible range of pitch rate : the requirement g < 0 ensures that the absolute value of the pitch rate does not exceed 80 deg/s throughout the recovery.

4) Admissible range of yaw rate : the requirement g < 0 ensures that the absolute value of the yaw rate does not exceed 90 deg/s throughout the recovery.

5) Admissible range of angle of attack : the requirement g < 0 ensures that the angle of attack remains in the [ − 5 , 50] deg range throughout the recovery.

6) Admissible range of sideslip : the requirement g < 0 ensures that the sideslip angle stays in the [ − 30 , 30] deg range throughout the recovery.

7) Admissible range of airspeed : the requirement g < 0 ensures that the true aero- dynamic speed stays in the [40 , 200] knot range throughout the recovery.

15 of 31 American Institute of Aeronautics and Astronautics 8) Admissible altitude range : the requirement g < 0 ensures that the altitude stays in the [300 , 1500] ft range throughout the recovery. This requirement prescribes the maximum loss in altitude that is acceptable.

9) Translational stability : the requirement g < 0 ensures that the magnitude of the translational acceleration is bounded by a small constant for the last 5 seconds of the simulation.

10) Rotational stability : the requirement g < 0 ensures that the magnitude of the rotational acceleration is bounded by a small constant for the last 5 seconds of the simulation.

11) Orientation of the z -axis : the requirement g < 0 ensures that the angle between the z -axis in the body frame and the z axis in the flat-earth frame is less than 90 deg after a short transient.

12) Stable steady-state : the requirement g < 0 ensures that the aircraft state is within a small box centered about X during the last 5 s of the simulation.

target 13) High-frequency oscillations in pitch : the requirement g < 0 ensures that the amount of power in pitch exceeding 5 Hz is bounded by a small constant. This, and the following two requirements, are violated when limit cycle oscillations occur.

14) High-frequency oscillations in roll : the requirement g < 0 ensures that the amount of power in roll exceeding 5 Hz is bounded by a small constant.

15) High-frequency oscillations in yaw : the requirement g < 0 ensures that the amount of power in yaw exceeding 5 Hz is bounded by a small constant.

Note that the controller’s ability to satisfy the requirements depends on the aircraft’s tran- sient response, whose analytical representation is mathematically intractable due to nonlin- earities. Further notice that the dependency of g on ˆ p assumes an unknown and implicit functional form. Evaluating g for a particular realization of ˆ p requires simulating the closed- loop response for a fixed integration time and using the corresponding closed-loop signals to evaluate the 15 constraints. The functional form of the requirement functions, which relate the value of g with the aircraft state, are omitted from this paper. While the notions of recovery effectiveness supporting the requirement functions are fairly universal, their par- ticular functional form is not. It is up to the analyst to construct functions that properly describe his/her notion of acceptable/safe recovery.

Because of the feedback structure of the command law, the SRFE is a subset of the domain of attraction of the equilibrium point X of the dynamic system in (26) having target a requirement–compliant transient response.

In the following sections the authors apply the local and global analyses above to assess a few control strategies. The local analyses, which are based on the point simulations of section III-A, will be assessed using the same performance functions of the global analysis.

However, the authors will consider the requirements g < 0, g < 0, g < 0, g < 0, g < 0 1 8 9 10 12 b mission-critical or ”hard”, since they may indicate instability or loss of the mission , while b While positive values of g indicate an excessive loss in altitude, only those where g > 2 . 28 indicate a 8 8 crash. Therefore, the numerical value of g determines if the violation is critical or not.

16 of 31 American Institute of Aeronautics and Astronautics the other ones will be regarded as ”soft”. This distinction allows the analyst to better qualify the efficacy and performance of the control strategy.

The five control strategies evaluated next are: (i) fixed control surface deflections and fixed velocity command, (ii) fixed-gain controller C with fixed commands, (iii) fixed-gain controller C with a state-varying command law, (iv) an aggressive gain scheduled controller C with a state-varying command law, and (v) a moderately aggressive gain scheduled con- troller C with a state-varying command law.

IV. Strategy 1: Fixed Control Surface Deflections & Fixed V cmd ∗ ∗ This control strategy uses the control surface deflections in U corresponding to X = X for attitude control and a fixed-trimmed point auto-throttle for speed regulation.

target Figure 2 indicates that the point X , located at α = 4 . 2 degrees, is locally open-loop target stable, so all aircraft states within the corresponding domain of attraction will converge to the target state. It remains to be determined if the domain of attraction is large enough to make this strategy useful. Because the corresponding time response will be driven by the uncontrolled modes, the resulting transient response may exhibit undesired characteristics.

This is the rationale supporting the usage of the auto-throttle, which aims at regulating the phugoid mode of the longitudinal response.

A. Strategy 1: Local Analysis via Point Simulations The constraint functions defined in section III-B were used to qualify the ability of this strategy to recover from the seven flight upsets described in section III-A. Table 1 shows the value of g corresponding to each upset. Recall that negative values indicate the satisfaction of a requirement while positive values indicate a violation. Also remember that requirements g < 0, g < 0, g < 0, g < 0, and g < 0 are mission critical while the other ones are 1 8 9 10 12 not, i.e., the aircraft can be stabilized when requirements other than these are violated. The rows corresponding to the hard requirements indicate that this strategy can overcome the nose-up, nose-down, and stall upsets but not the others. In regard to the nose-up upset, only the airspeed requirement is violated, while for both nose-down and stall conditions, all requirements are satisfied. While rotational equilibrium is achieved in all cases, the upsets for which the vehicle could not be recovered are characterized by extreme airspeeds and large losses in altitude. This can be seen in Figure 9, where the aircraft states corresponding to the spin condition are shown. The throttle input, which is not shown, saturates at 0% and 100% a few times throughout the maneuver.

B. Strategy 1: Global Analysis via SRFE Bounding The maximal deformation defined in section III-B corresponding to strategy 1 was calculated and the results are presented next. Note that the maximal set is a 8-dimensional hyper- rectangle in the state space centered at the target flight condition X = [4 . 2 , 80 , 0 , 0 , 0 , target 0 , 0 , 0], which corresponds to a horizontal flight at cruise speed. Recall that the maximal set, which is an inner bound to the SRFE whose size is proportional to the value of the PSM, touches the requirement violation point X at its boundary. This point is the worst-case worst-case initial state for the particular upset recovery strategy.

17 of 31 American Institute of Aeronautics and Astronautics Table 1. Figures of merit of upset recovery for strategy 1.

Nose-up Nose-down Inverted Stall Deep Stall Spin High β Structural loading: g -0.78 -0.86 -0.64 -0.80 -0.67 -0.68 -0.76 Roll rate: g -0.89 -0.97 -0.66 -0.91 -0.65 0.01 -0.01 Pitch rate: g -0.73 -0.76 -0.61 -0.76 -0.62 -0.22 -0.41 Yaw rate: g -0.75 -0.96 -0.35 -0.80 -0.21 -0.09 -0.46 Angle of attack: g -0.32 -0.22 -0.28 -0.32 -0.25 -0.04 -0.11 Sideslip angle: g -0.88 -0.99 -0.24 -0.94 -0.33 -0.66 -0.53 Airspeed: g 0.05 -0.13 1.13 -0.21 0.72 0.74 1.13 Altitude: g -0.06 -0.42 1.59 -0.11 0.97 1.04 1.40 Translation: g -0.68 -0.97 10.91 -0.88 0.3 0.41 0.86 Rotation: g -0.99 -0.99 -0.96 -0.99 -0.99 -0.99 -0.99 Orientation: g -0.38 -0.71 0.28 -0.52 0.10 0.04 0.39 Steady state: g -0.68 -0.97 2.47 -0.91 -0.13 0.07 0.09 Pitch oscillations: g -0.99 -0.99 -0.99 -0.99 -0.98 -0.96 -0.97 Roll oscillations: g -0.98 -0.99 -0.94 -0.99 -0.78 -0.73 -0.72 Yaw oscillations: g -0.99 -0.99 -0.99 -0.99 -0.93 -0.97 -0.88 Figure 9. States corresponding to the spin upset for strategy 1.

18 of 31 American Institute of Aeronautics and Astronautics The PSM and the CPV corresponding to the control strategy number 1 are 42 . 1 and X = [11 . 24 , − 7 . 61 , 82 . 88 , 25 . 41 , 12 . 7 , 12 . 7 , − 6 . 5 , 22 . 8] respectively. The components worst-case of X , which have the same units of X , are [ α, β, V, p, q, r, θ, φ ]. The critical worst-case target requirement, which is the one taking the value of zero at the CPV(s), is the altitude loss requirement. Figure 10 shows the aircraft states corresponding to the worst-case initial condition associated with this control strategy. Recall that this condition results from a search in the continuum of the state space and may not be an upset, i.e., may not be produced by or yield an uncommanded aircraft response.

We have used a logarithmic scale for the time axis in order to better show the first few seconds of the simulation. The requirement violation, which occurs at the final integration time, t = 45s, is caused by a sluggish auto-throttle response to airspeed variations.

Figure 10. States corresponding to the worst-case initial state for strategy 1.

V. Strategy 2: Controller C with Constant Commands Here the authors consider the single-trimmed point controller C combined with the command law in Equations (21–24) for f = 0 . This combination guarantees that, given a suitable initial condition (i.e., one at which the LTI model used for control design is an accurate representation of the dynamics), α , β , V , and p will converge to the commanded values, which, due to the command law in Eq. (21–24), are the very same targeted states.

This control strategy cannot guarantee that the uncommanded states will converge to the desired values, e.g., the altitude may keep dropping while the yaw rate may not converge to zero.

19 of 31 American Institute of Aeronautics and Astronautics A. Strategy 2: Local Analysis via Point Simulations Table 2 shows the constraint functions corresponding to this control strategy for the seven upsets. As before, this strategy was unable to recover the aircraft from the inverted, deep stall, spin and high- β upsets. While the performance of this strategy was similar to that of strategy number 1 in most cases, the inverted condition is much worse. Note that the vehicle hits the ground since g = 3 . 63 > 2 . 28. Further notice that the values taken by the pitch and yaw rate constraint functions, as well as those describing high frequency oscillations, are larger. This should be expected since, in contrast to strategy 1, the control surface deflections now vary with time. Figures 11 and 12 show the states, control inputs, and Table 2. Figures of merit of upset recovery for control strategy 2.

Nose-up Nose-down Inverted Stall Deep Stall Spin High β Structural loading: g -0.74 -0.86 -0.58 -0.79 -0.70 -0.66 -0.87 Roll rate: g -0.93 -0.98 2.00 -0.91 -0.71 -0.14 -0.01 Pitch rate: g -0.51 -0.68 6.50 -0.56 -0.54 0.37 -0.41 Yaw rate: g -0.89 -0.98 5.66 -0.81 -0.16 -0.16 -0.25 Angle of attack: g -0.24 -0.22 2.41 -0.20 0.06 0.41 -0.20 Sideslip angle: g -0.94 -0.99 1.54 -0.94 -0.33 -0.58 -0.53 Airspeed: g 0.04 -0.23 0.71 -0.21 0.19 0.33 0.05 Altitude: g -0.24 -0.52 3.62 -0.03 0.43 0.57 0.70 Translation: g -0.06 -0.30 5.31 -0.15 2.26 2.98 1.96 Rotation: g -0.99 -0.99 8.60 -0.99 -0.99 -0.99 -0.99 Orientation: g -0.67 -0.69 0.59 -0.58 -0.18 -0.14 -0.13 Steady state: g -0.39 -0.84 36.50 0.14 1.44 0.82 1.43 Pitch oscillations: g -0.99 -0.99 196.7 -0.99 -0.95 -0.86 -0.96 Roll oscillations: g -0.99 -0.99 2.52 -0.99 -0.93 -0.61 -0.51 Yaw oscillations: g -0.99 -0.99 893.4 -0.99 -0.96 -0.89 -0.82 commands corresponding to the spin upset. The comparison with Figure 9 illustrates the difference made by the control law. Note that all inputs except the rudder saturate.

B. Strategy 2: Global Analysis via SRFE Bounding The PSM and the CPV corresponding to strategy 2 are 35 . 9 and X = [ − 0 . 50 , − 6 . 45 , worst-case 86 . 5 , 21 . 6 , 10 . 8 , 10 . 8 , 14 . 63 , − 19 . 5] respectively. The critical requirement is the bounded mag- nitude of the steady state. Figure 13 shows the aircraft states and commands corresponding to this worst-case initial condition. As before, the steady-state requirement is violated at the terminal time of t = 45 s. This violation is caused by an unsettled pitch dynamics and a persistent loss in altitude.

20 of 31 American Institute of Aeronautics and Astronautics VI. Strategy 3: Controller C with a Feedback Command Law This control strategy pairs controller C with a state-varying command law. This law is given by Equations (21–24) and the feedback functions f = − k γ, (28) α 1 f = 0 , (29) β f = 0 , (30) V f = ( k − 1) r − k k | φ | sign( φ ) , (31) p 2 2 3 where k > 0; k is equal to zero when | φ | < 85 deg, it is equal to one when | φ | > 90, and it 1 2 is equal to | φ | / 5 − 13 otherwise; and k > 0. The structure of α in (21) ensures that the 3 cmd Figure 11. States corresponding to the spin upset for strategy 2.

path angle is driven to zero in steady state, thus, a constant altitude is ultimately reached.

The structure of f yields a large roll rate when the absolute value of the bank angle exceeds p 90 degrees. This command will drive the vehicle to its Earth-down orientation. At this orientation, p makes the yaw rate go to zero in steady state. While the functional form cmd of f was inspired by the actions taken by a pilot in the real time simulation, the value of the constants k , k , and k was set according to simulations. This simple command law is 1 2 3 an oversimplification of the pilot commands used in engineering applications. However, for the scope of this paper, this command law proved to be effective. Better and more realistic command laws will be investigated in the future.

21 of 31 American Institute of Aeronautics and Astronautics Figure 12. Control inputs corresponding to the spin upset for strategy 2.

A. Strategy 3: Local Analysis via Point Simulations Table 3 shows the value of g corresponding to control strategy number 3 for each flight upset.

In contrast to strategies 1 and 2, strategy 3 can recover the aircraft from all upsets. Note that the few requirements violated are not only soft but also take moderate values. Figures 14 and 15 show the states, commands and control inputs corresponding to the spin upset.

Note that in contrast to strategy 2, the commands are now time-varying. Further notice that both the aileron and throttle inputs saturate initially. The large disparity in the entries of Tables 2 and 3 indicate the high sensitivity of the recovery to the command law.

B. Strategy 3: Global Analysis via SRFE Bounding The PSM and the CPV corresponding to strategy number 3 are 75 . 79 and X = worst-case [ − 2 , − 13 . 7 , 93 . 7 , 45 . 6 , − 22 . 8 , 22 . 8 , − 15 . 6 , − 41 . 0] respectively. The critical requirement is the bounded yaw rate. Figure 16 shows the aircraft states and commands corresponding to this worst-case initial condition. The requirement violation occurs at t = 0 . 18 s. Note than in spite of the soft violation, the command law makes all the states, directly and indirectly commanded, converge to the target values.

22 of 31 American Institute of Aeronautics and Astronautics Figure 13. States and commands corresponding to the worst-case initial state for strategy 2.

Figure 14. States and commands corresponding to the spin upset for strategy 3.

VII. Strategy 4: Controller C with a Feedback Command Law This control strategy uses the gain scheduled controller C and the same command law used in strategy 3. Recall that, as compared to C , this controller provided improved com- 23 of 31 American Institute of Aeronautics and Astronautics Table 3. Figures of merit of upset recovery for control strategy 3.

Nose-up Nose-down Inverted Stall Deep Stall Spin High β Structural loading: g -0.81 -0.85 -0.81 -0.86 -0.73 -0.70 -0.91 Roll rate: g -0.86 -0.61 -0.73 -0.79 -0.71 -0.14 -0.01 Pitch rate: g -0.59 -0.50 -0.27 -0.64 -0.47 0.09 -0.41 Yaw rate: g -0.90 -0.86 -0.91 -0.81 -0.14 -0.16 -0.27 Angle of attack: g -0.25 -0.22 -0.27 -0.30 -0.14 -0.04 -0.23 Sideslip angle: g -0.94 -0.92 -0.93 -0.93 -0.33 -0.68 -0.53 Airspeed: g 0.04 -0.36 -0.57 -0.21 -0.03 -0.16 -0.76 Altitude: g -0.70 -0.67 0.08 -0.64 -0.21 -0.24 -0.32 Translation: g -0.99 -0.99 -0.99 -0.99 -0.99 -0.99 -0.99 Rotation: g -0.99 -1.00 -0.99 -0.99 -1.00 -0.99 -0.99 Orientation: g -0.85 -0.83 -0.18 -0.84 -0.33 -0.51 -0.19 Steady state: g -0.99 -0.99 -0.98 -0.99 -0.98 -0.98 -0.98 Pitch oscillations: g -0.99 -0.98 -0.98 -0.98 -0.96 -0.92 -0.96 Roll oscillations: g -0.97 -0.79 -0.93 -0.93 -0.88 -0.87 -0.62 Yaw oscillations: g -0.99 -0.99 -0.99 -0.99 -0.95 -0.94 -0.83 mand tracking performance throughout the equilibrium manifold in Figure 2.

A. Strategy 4: Local Analysis via Point Simulations Table 4 shows the value taken by the constraint functions for the flight upsets. As with strategy 3, strategy 4 was able to recover the aircraft from all upset conditions. Note that even though the values of g attained by both strategies are comparable, strategy 4 yielded responses that tended to have larger angular rates and more high-frequency pitch, roll and yaw oscillations. The tight command tracking attained by the controller near the equilibrium manifold degraded rapidly with the separation from the equilibrium condition. This can be seen in Figures 17 and 18 where the states, commands, and control inputs corresponding to the spin upset are shown. As before, a logarithmic scale for the time axis was used to better show the actions leading to the recovery. Note the large, high frequency oscillations in the three axes started occurring near t = 1 seconds. Since the command law is a function of the yaw rate, high-frequency oscillations in r yield high frequency oscillations in p . This will be the equivalent to pilot-induced oscillations (PIO). Undesirable oscillations may be the result of a faulty control law, a faulty command law, or a faulty interaction between them. These oscillations might occur at higher frequencies than conventional PIOs because the feedback laws prescribed by f yields commands varying as fast as the aircraft states.

The precursor of this oscillations however, is the command law. The very same behavior was observed in piloted- real time-simulations under various flight conditions.

24 of 31 American Institute of Aeronautics and Astronautics Figure 15. Control inputs corresponding to the spin upset for strategy 3.

Figure 16. States and commands corresponding to the worst-case initial state for strategy 3.

B. Strategy 4: Global Analysis via SRFE Bounding The PSM and the CPV corresponding to strategy number 4 are 51 . 52 and X = worst-case [12 . 66 , 9 . 31 , 89 . 3 , 31 . 0 , 15 . 5 , 15 . 5 , − 9 . 0 , 27 . 9] respectively. As expected by the point simula- 25 of 31 American Institute of Aeronautics and Astronautics Table 4. Figures of merit of upset recovery for control strategy 4.

Nose-up Nose-down Inverted Stall Deep Stall Spin High β Structural loading: g -0.77 -0.85 -0.81 -0.85 -0.74 -0.70 -0.90 Roll rate: g -0.90 -0.61 -0.64 -0.90 -0.73 -0.15 -0.01 Pitch rate: g -0.36 -0.50 -0.04 -0.50 -0.41 0.55 -0.41 Yaw rate: g -0.90 -0.88 -0.34 -0.81 -0.19 -0.16 -0.22 Angle of attack: g -0.25 -0.22 -0.24 -0.30 -0.17 -0.04 -0.23 Sideslip angle: g -0.93 -0.92 -0.81 -0.89 -0.33 -0.79 -0.53 Airspeed: g 0.02 -0.36 -0.54 -0.21 -0.03 -0.16 -0.78 Altitude: g -0.63 -0.67 0.02 -0.65 -0.34 -0.21 -0.38 Translation: g -0.99 -0.99 -0.99 -0.99 -0.99 -0.99 -0.99 Rotation: g -0.99 -1.00 -0.99 -0.99 -1.00 -0.99 -0.99 Orientation: g -0.75 -0.83 -0.18 -0.79 -0.39 -0.44 -0.18 Steady state: g -0.99 -0.99 -0.98 -0.99 -0.99 -0.99 -0.99 Pitch oscillations: g -0.96 -0.98 -0.33 -0.98 -0.91 2.13 -0.92 Roll oscillations: g -0.98 -0.76 -0.04 -0.99 -0.82 -0.36 -0.42 Yaw oscillations: g -0.99 -0.99 -0.45 -0.99 -0.95 -0.76 -0.74 Figure 17. States and commands corresponding to the spin upset for strategy 4.

26 of 31 American Institute of Aeronautics and Astronautics Figure 18. Control inputs corresponding to the spin upset for strategy 4.

tions, the critical requirement was the high frequency roll oscillation. Figure 19 shows the aircraft states and commands corresponding to this worst-case initial condition. The viola- tion occurred at the final time. During the maneuver, large and uncommanded oscillations in the rotational rates occurred. This oscillation, not the peak value of the states or the steady-state, was what prevented a larger expansion of the maximal set.

VIII. Strategy 5: Controller C with a Feedback Command Law This control strategy uses the gain scheduled controller C and the same state-varying command law used above. Recall that, as compared to C , this controller provides improved command tracking performance near the equilibrium manifold, but as compared to C , this controller exhibited a less aggressive command tracking.

A. Strategy 5: Local Analysis via Point Simulations Table 5 shows the value of g corresponding to each flight upset. There is less high-frequency oscillation than in strategy 4, and as much as in strategy 3. In some of the upsets, the performance of strategies 3 and 5 were practically the same since C did mostly scheduled C throughout the manouver. Note, however, that the flight conditions going through stall made the constraint functions for roll and yaw rates take larger values. This is a consequence of the faster response of the lateral/directional controller. Figures 20 and 21 show the states, commands, and control inputs for the spin upset. As compared to C , the high-frequency oscillations disappeared while the elevators and rudders are less active.

27 of 31 American Institute of Aeronautics and Astronautics Figure 19. States and commands corresponding to the worst-case initial state for strategy 4.

Figure 20. States and commands corresponding to the spin upset for strategy 5.

B. Strategy 5: Global Analysis via SRFE Bounding The PSM and the CPV corresponding to this strategy are 75 . 82 and X = [ − 2 . 0 , − 13 . 6 , worst-case 93 . 6 , 45 . 4 , − 22 . 7 , 22 . 7 , − 7 . 0 , − 40 . 9] respectively. As with strategy 3, the critical requirement 28 of 31 American Institute of Aeronautics and Astronautics Table 5. Figures of merit of upset recovery for strategy 5.

Nose-up Nose-down Inverted Stall Deep Stall Spin High β Structural loading: g -0.80 -0.85 -0.81 -0.86 -0.73 -0.70 -0.91 Roll rate: g -0.85 -0.61 -0.73 -0.83 -0.56 -0.14 -0.01 Pitch rate: g -0.59 -0.50 -0.27 -0.63 -0.42 0.06 -0.41 Yaw rate: g -0.92 -0.87 -0.94 -0.81 0.11 -0.11 -0.27 Angle of attack: g -0.26 -0.22 -0.27 -0.31 -0.13 -0.04 -0.23 Sideslip angle: g -0.94 -0.92 -0.95 -0.93 -0.33 -0.56 -0.53 Airspeed: g 0.04 -0.36 -0.56 -0.21 -0.03 -0.16 -0.77 Altitude: g -0.70 -0.67 0.08 -0.64 -0.28 -0.24 -0.33 Translation: g -0.99 -0.99 -0.99 -0.99 -0.99 -0.99 -0.99 Rotation: g -0.99 -1.00 -0.99 -0.99 -0.99 -1.00 -0.99 Orientation: g -0.85 -0.83 -0.18 -0.83 -0.38 -0.51 -0.20 Steady state: g -0.99 -0.99 -0.98 -0.99 -0.98 -0.98 -0.99 Pitch oscillations: g -0.99 -0.98 -0.98 -0.98 -0.97 -0.92 -0.96 Roll oscillations: g -0.96 -0.78 -0.94 -0.94 -0.83 -0.76 -0.62 Yaw oscillations: g -0.99 -0.99 -0.99 -0.99 -0.89 -0.64 -0.83 was the bounded yaw rate. Figure 22 shows the states and commands corresponding to X . There are slight differences in the worst-case condition and time responses of worst-case strategies 3 and 5. This is somewhat expected since the fixed-point controller C constitutes the gain scheduled controller C , and the worst-case state occurs where controllers based on C are dominant. As before, the requirement violation occurs near t = 0 . 1 seconds.

IX. Discussion The analyses above indicate that upset recovery strategies 3 and 5 are the most effective since they not only overcome the seven flight upsets but also attain the largest maximal sets (the PSMs of the five strategies are 42.1, 35.9, 75.79, 51.52 and 75.82 respectively).

However, recall that C , the controller used in strategy 5, provided a much better command tracking performance than C , the controller used in strategy 3, at high angles of attack.

This improvement, however, does not yield considerable advantages when X is at the target cruise condition. Note that other X s, e.g., stabilization at an angle of attack in the target stall range, will render different assessments. The results coming out of the above analyses can be used to identify shortcomings of the control and command laws, as well as of the interaction between them, and to generate criteria for their tuning and redesign. Notice that the analysis above was able to identify command law-induced oscillations in C . Ideally, the command law should be designed to complement the control law to avoid limit cycle oscillations resulting from unintended excitations.

29 of 31 American Institute of Aeronautics and Astronautics Figure 21. Control inputs corresponding to the spin upset for strategy 5.

Figure 22. States and commands corresponding to the worst-case initial state for strategy 5.

X. Concluding Remarks This paper presents a framework for the systematic analysis of in-flight loss of control due to flight upsets. The framework carries out local and global analyses of recovery strategies 30 of 31 American Institute of Aeronautics and Astronautics that combine control and command laws based on high fidelity simulations of the aircraft response. Since the flight upsets occur well outside the nominal flight envelope, the devel- opment of accurate mathematical models at off-nominal flying conditions is of paramount importance. This framework enables a fair comparison of alternative upset recover strategies admitting arbitrary control structures and feedback-based command laws. While control laws are mostly set according to nominal flying conditions, command laws for upset recovery will only be used outside the normal flight envelope. They can be used to execute an automatic recovery or for pilot queuing. While equally effective command laws with various structures and functional forms can be designed and analysed, those that closely follow pilot’s actions will be preferred since they yield lower rotational rates. In the future, the authors will study pilot-generated commands during successful upset recoveries and determine if they can be well approximated by feedback-based structures. If this is the case, the above framework will enable quantifying the limits of the flight envelope from w a safe recovery is still possible.

Furthermore, we will consider the design of command laws leading to large SRFEs following the same trends of those generated by a pilot.

References Belcastro, C. M., “Aircraft loss of control: Analysis and requirements for future safety-critical systems and their validation,” 2011 8th Asian Control Conference , May 15–18 2011.

Cunningham, K., Cox, D. E., Murri, D. G., and Riddick, S. E., “A Piloted Evaluation of Damage Accommodating Flight Control Using a Remotely Piloted Vehicle,” AIAA Guidance Navigation and Control Conference, Portland, Oregon, USA , August 2011, AIAA–2011–6451.

Jordan, T. L., Foster, J. V., Bailey, R. M., and Belcastro, C. M., “AirSTAR: A UAV Platform for Flight Dynamics and Control System Testing,” AIAA Guidance Navigation and Control Conference, Keystone, Colorado, USA , August 2006, AIAA–2006–3307.

Murch, A. M., “A Flight Control System Architecture for the NASA AirSTAR Flight Test Facility,” AIAA Guidance Navigation and Control Conference, Honolulu, Hawaii, USA , August 2008, AIAA–2008– 6990.

Crespo, L. G., Matsutani, M., and Annaswamy, A., “Design of an adaptive controller for a remotely operated air-vehicle,” AIAA Journal of Guidance, Control and Dynamics , Vol. 35, No. 2, 2012, pp. 406–422.

Rugh, W. J. and Shamma, J. S., “Research on Gain Scheduling,” Automatica , Vol. 36, No. 10, 2000, pp. 1401–1425.

Crespo, L. G., Kenny, S. P., and Giesy, D. P., “A Computational Framework to Control Verification and Robustness Analysis,” NASA TP 2010–216189, NASA Langley Research Center, Hampton, VA, USA, 2010, pp. 1–38.

31 of 31 American Institute of Aeronautics and Astronautics