Julien Marzat

Hélène Piet-Lahanier

Frédéric Damongeot

Eric Walter

Control-based

Keywords: aircraft, closed-loop system, fault detection and isolation, fault diagnosis, guidance and control

Introduction

To check the ability of an aircraft to complete its mission, there is an absolute necessity to identify early unexpected changes in the system (referred to as faults) before they lead to a complete breakdown. Procedures of fault detection and isolation (FDI) address such a problem. The application considered here is an autonomous aircraft equipped with a fixed set of sensors and actuators, controlled by classical guidance, navigation and control (GNC) algorithms. Faults affecting propulsion, flight control surfaces or sensors of this type of vehicle should be carefully addressed, as they cause 80% of flight incidents according to a reliability study from the Office of the U.S. Secretary of Defense [START_REF] Schaefer | Unmanned aerial vehicle reliability study[END_REF]. A classical way to tackle the problem is hardware redundancy, i.e., several devices performing the same function with a voting scheme to detect and isolate faults. However, this approach implies higher costs, lower autonomy and reduced payload, because of the additional weight, volume and power required. The large majority of modern FDI methods thus rely on analytical redundancy, which exploits the relations between measured or estimated variables to detect possible system dysfunctions [START_REF] Steinberg | Historical overview of research in reconfigurable flight control[END_REF][START_REF] Chow | Analytical redundancy and the design of robust failure detection systems[END_REF][START_REF] Frank | Fault diagnosis in dynamic systems using analytical and knowledge-based redundancy: A survey and some new results[END_REF]. These methods most often generate residuals to quantify the distance between the measured and expected behaviors. These signals should remain small as long as there is no fault, and become sufficiently large to be noticeable whenever a fault occurs [START_REF] Isermann | Supervision, fault-detection and fault-diagnosis methods: An introduction[END_REF][START_REF] Ding | Model-based fault diagnosis techniques: design schemes, algorithms, and tools[END_REF]. Such an analytical redundancy strategy should be defined to tackle the difficult problem of detection and isolation of faults that can occur on any sensor or actuator of the aircraft, with a reduced computational cost to respect embedding constraints.

Numerous FDI strategies have been applied to aeronautical systems. The main model-based methods, such as parity space, parameter estimation or observer-based FDI, have been developed initially for linear systems [START_REF] Patton | Review of parity space approaches to fault diagnosis for aerospace systems[END_REF]. In aerospace, though, nonlinear models provide a more accurate representation of the vehicle complex behavior. Most of the methods have thus been extended via linearization [START_REF] Williamson | Fault detection for deep space satellites[END_REF]. There is also a emerging trend toward fully-nonlinear FDI methods [START_REF] Meskin | Nonlinear geometric approach to fault detection and isolation in an aircraft nonlinear longitudinal model[END_REF][START_REF] Marzat | Nonlinear FDI based on state derivatives, as provided by inertial measurement units[END_REF].

Using these methods, some authors have considered sensor faults only [START_REF] Patton | Review of parity space approaches to fault diagnosis for aerospace systems[END_REF][START_REF] Jayakumar | Isolating incipient sensor faults and system reconfiguration in a flight control actuation system[END_REF][START_REF] Liu | Fault diagnosis of inertia sensor in missile control systems[END_REF][START_REF] Bo | A method for fault detection and isolation in the integrated navigation system for UAV[END_REF][START_REF] Castaldi | Design of residual generators and adaptive filters for the FDI of aircraft model sensors[END_REF][START_REF] Cork | Sensor fault detection for UAVs using a nonlinear dynamic model and the IMM-UKF algorithm[END_REF], actuator faults only [START_REF] Meskin | Nonlinear geometric approach to fault detection and isolation in an aircraft nonlinear longitudinal model[END_REF][START_REF] Marzat | Nonlinear FDI based on state derivatives, as provided by inertial measurement units[END_REF][START_REF] Bateman | Actuators fault diagnosis and tolerant control for an unmanned aerial vehicle[END_REF][START_REF] Ducard | Efficient nonlinear actuator fault detection and isolation system for unmanned aerial vehicles[END_REF][START_REF] Henry | Fault diagnosis of Microscope satellite thrusters using H ∞ /Hfilters[END_REF][START_REF] Patton | Robust FDI applied to thruster faults of a satellite system[END_REF][START_REF] Kladis | Fault diagnosis with matrix analysis for electrically actuated unmanned aerial vehicles[END_REF], or non-simultaneous sensor and actuator faults [START_REF] Williamson | Fault detection for deep space satellites[END_REF][START_REF] Tan | Sliding mode observers for robust detection and reconstruction of actuator and sensor faults[END_REF][START_REF] Marcos | An application of H ∞ fault detection and isolation to a transport aircraft[END_REF].

The applicability of these methods rely heavily on the modeled dynamics of the system to design dynamical filters. This involves a very significant computational cost, given the limited resources available on-board. In most of these studies, the closed-loop control of the aircraft is ignored when building the FDI procedure. This seems unfortunate, as control information may provide additional insight on the system behavior and thus help detect and isolate faults.

An interesting idea in this context is active fault diagnosis, which injects an auxiliary input into the system in an attempt to facilitate distinction between faulty and normal behaviors [START_REF] Campbell | Auxiliary Signal Design for Failure Detection[END_REF]. This technique has been applied in two recent studies concerning small UAVs [START_REF] Bateman | Actuators fault diagnosis and tolerant control for an unmanned aerial vehicle[END_REF][START_REF] Ducard | Efficient nonlinear actuator fault detection and isolation system for unmanned aerial vehicles[END_REF], with the addition of a small sinusoidal component to the control signal of actuators suspected of faults. Even if this strategy may accelerate decision, there is no systematic approach to designing such signals and guaranteeing that the additional input will not deteriorate performance in normal operating condition or even destabilize the system [START_REF] Niemann | Active fault diagnosis by temporary destabilization[END_REF]. A different route is pursued here, and FDI methods that use control information without interfering with the control loop are considered.

The effect of feedback on fault diagnosis methods has been analyzed in [START_REF] Niemann | Robust fault detection in open loop vs. closed loop[END_REF] and more recently in [START_REF] Baïkeche | On parametric and nonparametric fault detection in linear closed-loop systems[END_REF]. They show that model uncertainty or multiplicative faults make the residuals depend on the control signal. More generally, the control input holds relevant information concerning faults in a feedback-controlled system. As there is a trade-off to achieve between fault detection and performance of the closed-loop system, the simultaneous design of the control law and the observation filter has been addressed (see, e.g, [START_REF] Henry | Fault diagnosis of Microscope satellite thrusters using H ∞ /Hfilters[END_REF][START_REF] Jacobson | An integrated approach to controls and diagnostics using the four-parameter controller[END_REF]). Multi-objective optimization methods are used to maximize the effect of faults on the diagnosis filter while still achieving control objectives. All these studies have made a first step towards taking into account the closed-loop behavior in the diagnosis procedure. However, it should be noted that the diagnosis filter does not use control information directly: its structure is still designed for the open-looped system.

To complete the description of the context of this study, closed-loop performance monitoring should also be mentioned. Even if this topic is weakly related to fault diagnosis in general, it is of some interest here as it focuses on detecting changes in control performances. The objective is to assess whether the controller performs suitably by comparing the observed variance of the feedback signal with its expected value, using statistical tools [START_REF] Harris | A review of performance monitoring and assessment techniques for univariate and multivariate control systems[END_REF][START_REF] Ingimundarson | Closed-loop performance monitoring using loop tuning[END_REF].

The new method proposed in the present paper considers fault diagnosis from a point of view that is similar in spirit to performance monitoring. The main assumption is that guidance and control have been designed to comply at each instant of time with the mission requirements in faultfree conditions. Thus, the closed-loop system is seen as a single entity designed with instantaneous control objectives that can be translated into residuals. Although local variations of these residuals around zero are of course unavoidable, large enough variations may be indicative of faults that affect the controlled aircraft. This paper shows that it is indeed possible to detect sensor and actuator faults and to isolate sensor faults by analyzing the adequacy of the system response. The properties of feedback control ensure high robustness of this strategy toward model uncertainty. The computational cost is low, because control objectives are generally expressed by simple static functions and there is therefore no need to integrate the differential equations of a dynamical model of the system. This paper is organized as follows. The explicit nonlinear mathematical model of a representative aeronautical case study is given in Section 2, along with its GNC scheme and models of faults and uncertainty. The new FDI approach is then detailed in Section 3. It is shown how residuals could be generated from the knowledge of the control objectives of guidance laws, and how to assess their qualitative sensitivity to sensor and actuator faults. Corresponding simulation results on a collection of faulty scenarios with strong, realistic measurement and model uncertainty are given in Section 4. Quantitative indices are computed to assess the performance of the method. Section 5 presents an analogy of this method with classical observer-based FDI. Conclusions and perspectives are discussed in Section 6.

Mathematical model of the aircraft

The vehicle considered is a surface-to-air missile on an interception mission. Actuation is performed via four classical tail flight control surfaces acting on roll, pitch and yaw, and propulsion along the main axis of the vehicle. An Inertial Measurement Unit (IMU), comprising three gyros and three accelerometers, is coupled with an Inertial Navigation System (INS) that integrates these measurements to estimate the whole state vector of the missile. These standard components are preset and there is no hardware redundancy. These features are not specific to the case study and are shared by other applications, such as an UAV on an exploratory mission. The aircraft geometry in body frame is displayed in Figure 1. The dynamics of the aircraft is modeled by a nonlinear state-space model, detailed in Section 2.1. The interception is achieved by a standard GNC scheme (see Section 2.2), including a guidance loop and a fast control loop. Two classical guidance laws are considered, namely pure pursuit (PP) and proportional navigation guidance (PNG).

Sensor faults may affect independently the measurement of any gyro or accelerometer. Concerning actuators, the loss-of-effectiveness of the thruster, the locking-in-place of the fins or their unwanted oscillation will be investigated. Mathematical models of faults are presented in Section 2.3. The meaning of all the variables and parameters involved is explained in the nomenclature.

Dynamics and state-space model

The force equation is

     vbx vby vbz      = 1 m f aero + f g -      p q r      ×      v bx v by v bz      (2.1)
where

f aero = Qs ref      -(c x0 + c xα α + c xδ l δ l + c xδm δ m + c xδn δ n ) c y0 + c yβ β + c yδ l δ l + c yδn δ n -(c z0 + c zα α + c zδm δ m )      +      f min + (f max -f min ) η 0 0      (2.
2)

f g =      -sin(θ) cos(θ) sin(ϕ) cos(θ) cos(ϕ)      mg (2.3)
Due to the geometry of the aircraft (cylindrical and symmetric), the inertia matrix is

I =      a 0 0 0 b 0 0 0 b      (2.4)
The momentum equation is then

     ṗ = Qs ref L a q = 1 b [Qs ref M -(a -b)pr] ṙ = 1 b [Qs ref N -(b -a)pq] (2.5)
where

         L = c l0 + c lβ β + c lδ l δ l + c lδn δ n + l ref √ v 2 bx +v 2 by +v 2 bz c lp p M = c m0 + c mα α + c mδm δ m + l ref √ v 2 bx +v 2 by +v 2 bz c mq q N = c n0 + c nβ β + c nδ l δ l + c nδn δ n + l ref √ v 2 bx +v 2 by +v 2 bz c nr r (2.6)
Note that the aerodynamic coefficients c (•) involved in equations (2.2) and (2.6) are nonconstant, piecewise continuous nonlinear functions of (α, β), obtained from wind-tunnel data.

The angular dynamics is

     φ θ ψ      =      1 sin ϕ tan θ cos ϕ tan θ 0 cos ϕ -sin ϕ 0 sin ϕ cos θ cos ϕ cos θ           p q r      (2.7)
The model description should be completed with the coordinate transformation from the body frame to the inertial frame,

     ẋ ẏ ż      =     
cos ψ cos θ -sin ψ cos ϕ + cos ψ sin θ sin ϕ sin ψ sin ϕ + cos ψ sin θ cos ϕ sin ψ cos θ cos ψ cos ϕ + sin ψ sin θ sin ϕ -cos ψ sin ϕ + sin ψ sin θ cos ϕ

-sin θ cos θ sin ϕ cos θ cos ϕ           v bx v by v bz      (2.8) The state vector is x = [x , y, z , v bx , v by , v bz , p, q, r , ϕ, θ, ψ]
T and the input vector is u = [δ l , δ m , δ n , η, ] T , where δ l , δ m , δ n are the equivalent deflection angles corresponding to the three axes and η is the propulsion rate. The control-affine nonlinear model obtained by gathering (2.1)-(2.8) has twelve state variables, which is typical of state-space models for rigid aircraft. Some details are now given about the devices that are embedded on the aircraft. These model and choice of sensors and actuators are representative of a large panel of autonomous aerospace vehicles, including missiles, rockets and UAVs (see, e.g., [START_REF] Ducard | Efficient nonlinear actuator fault detection and isolation system for unmanned aerial vehicles[END_REF][START_REF] Boskovic | Retrofit reconfigurable flight control in the presence of control effector damage[END_REF][START_REF] Falcoz | A nonlinear fault identification scheme for reusable launch vehicles control surfaces[END_REF]).

Model of actuators

The dynamics of the propulsion rate is described by a first-order linear model. The missile is maneuvered using classical tail control. The four flight control surfaces (see Figure 2) are two elevators with deflection angles δ 2 and δ 4 , and two rudders with deflection angles δ 1 and δ 3 . Their servomotors are modeled as second-order systems with saturations in angular position and velocity. The equivalent deflection angles are then computed as

     δ l = (δ 1 + δ 2 + δ 3 + δ 4 )/4 δ m = (δ 2 -δ 4 )/2 δ n = (δ 3 -δ 1 )/2
(2.9)

Figure 2: Tail fins (rear view)

Although there are four actuators for three actions, this is not hardware redundancy as defined in the introduction, since these devices are independent and do not achieve the same actions.

The system has nevertheless one supplementary degree of actuation, but this cannot be used straightforwardly to achieve diagnosis.

Model of sensors

The IMU measures non-gravitational acceleration via three accelerometers, and angular velocity via three gyros. The INS integrates these elements to estimate the position, velocity and orientation of the vehicle. The resulting output vector is y = [a bx , a by , a bz , p, q, r , v bx , v by , v bz , x , y, z , ϕ, θ, ψ]

T . Errors affecting the measurements are usually modeled as biases, scale factors and noise. For example, the measurement r of the yaw rate r is expressed as

r = (1 + k r )r + b r + w r (2.10)
where k r is the scale factor, b r the bias and w r is a zero-mean Gaussian white noise, with standard deviation σ r . The parameters, k i , b i and σ i (for each sensor i independently) are characteristic of the IMU and set in the simulated test case at typical values (see Table 3).

Guidance and control (GNC)

The GNC scheme is described in Figure 3. Exogenous information about the target is provided by a tracking device, which is either embedded (e.g., a seeker) or ground-based (e.g., a radar). In the present study, a ground radar is assumed to measure the position x t = [x t , y t , z t ] T and speed v t = [ ẋt , ẏt , żt ] T of the target, both in the inertial frame. These measurements are assumed to suffer zero-mean additive Gaussian white noise on each variable independently [START_REF] Lin | Modern navigation, guidance, and control processing[END_REF].

In order to reduce the distance between the missile and the target to zero, a classical GNC architecture with decoupled guidance and dynamic control is implemented. The main loop implements a guidance law that provides the desired trajectory and orientation of the missile, based on the geometric and kinematic constraints of the problem. This makes it possible to compute appropriate thrust, while the fast inner control loop acts on the fins to meet the guidance commands and stabilizes the aircraft in flight [START_REF] Lin | Modern navigation, guidance, and control processing[END_REF]. The GNC laws considered here are well-known to handle low-maneuvering targets.

Guidance laws

The geometry of the interception problem on which most guidance laws are based is now briefly recalled and illustrated in Figure 4. The following definitions are a prerequisite to describing these guidance laws [START_REF] Shneydor | Missile guidance and pursuit: kinematics, dynamics & control[END_REF].

• The difference between the missile and target positions is the line of sight (LOS), r = x t -x m .

• The opposite of the first derivative of the LOS with respect to time is the closing velocity,

v c = -ṙ = v m -v t .
• The orientation of the LOS is given by the LOS angles, which form the vector λ, and the

LOS rate is λ = (r × ṙ) / r 2 .
Two potential guidance laws are considered in this study, namely Pure Pursuit (PP) and Proportional Navigation Guidance (PNG). These laws are built on the following geometrical rules.

• Pure Pursuit: PP makes the velocity of the pursuer v m coincide with the LOS r. This is the first guidance law that has been developed, inspired by how predators catch their prey [START_REF] Shneydor | Missile guidance and pursuit: kinematics, dynamics & control[END_REF].

The simplest guidance consign is then to have the acceleration input proportional to the angle between the aircraft velocity and the LOS. This is known as velocity pursuit. Another version aims at aligning the main axis of the vehicle on the LOS: this is attitude pursuit. In this study, velocity pursuit will be used.

• Proportional navigation guidance: PNG achieves parallel navigation. The geometrical rule is to keep the direction of the LOS constant relative to inertial space, i.e., the LOS is kept parallel to its initial value. This is also called constant bearing and the rule could be very concisely stated as the LOS rate being driven to zero [START_REF] Zarchan | Tactical and strategic missile guidance[END_REF]. The guidance consign is taken proportional to the LOS rate.

Figure 5 shows a successful target interception by the missile described in Section 2.1 with either of these two guidance laws (initial conditions of the simulation are given in Section 4).

Figure 5: Interception trajectories with PP and PNG

Control

The control loop is designed so as to have a response time significantly lower than that of the guidance loop. Provided that the thruster is still operating, a proportional controller computes the propulsion rate to regulate speed at a desired reference level. The autopilot consists of three independent linear phase-lead controllers (one per axis in roll, pitch and yaw) that translate the guidance commands and angular stabilization requirements (using gyro measurements) into equivalent fin deflection angles. This control objective could be stated as the roll, pitch and yaw rates [p, q, r] T being driven to zero. The equivalent fin deflection angles are transformed into actual deflection angles (see Figure 2) as

         δ 1 = δ l -δ n δ 2 = δ l + δ m δ 3 = δ l + δ n δ 4 = δ l -δ m (2.11)

Faults and model uncertainty

A mathematical model of actuator and sensor faults is needed to complete the modeling of the problem. Two types of control inputs are distinguished: the (known) control input, as computed by the GNC module is u c , and the (unknown) actual control input as achieved by the corresponding actuator is u a . An actuator fault results in a discrepancy between u c and u a , which expresses the fact that the control input sent by the GNC module is not correctly implemented by the actuator.

The actuator faults considered are the locking-in-place or unwanted oscillation of a fin and the loss-of-effectiveness of the thruster. They will be modeled as

u a = σ f • k f • u c + (1 -σ f ) • u f (2.12)
Depending on the type of fault occurring at time t fault , one has

         σ f = 1, k f = 1 (no fault) σ f = 1, 0 < k f < 1 (loss of effectiveness) σ f = 0, k f = 1, u f = u c (t fault ) (locking in place) σ f = 0, k f = 1, u f periodic function (Oscillatory failure)
The locking-in-place of flight control surfaces may be due, e.g., to freezing or power failure. Oscillatory failure cases (OFC) are implied by electronic components generating low-frequency periodical disturbances in the control signal of the actuators [START_REF] Goupil | Oscillatory failure case detection in the A380 electrical flight control system by analytical redundancy[END_REF]. Similar modeling for actuator faults can be found in [START_REF] Boskovic | Retrofit reconfigurable flight control in the presence of control effector damage[END_REF][START_REF] Bartyś | Introduction to the DAMADICS actuator FDI benchmark study[END_REF].

Sensor faults are modeled as abrupt unexpected jumps in one or more of the uncertainty parameters of the IMU (bias, scale factors and standard deviation of the Gaussian noise, see (2.10)).

To take into account the strong uncertainty on the value of the aerodynamic coefficients, each nominal function c (•) is randomly multiplied by either 0.75 or 1.25 with probability 0.5 before each simulation, while keeping a control designed on the nominal values.

Closed-loop fault diagnosis approach

Detection and isolation of faults affecting sensors and actuators for the benchmark defined in Section 2 is a challenging issue, as the state equations are intertwined due to the changes of coordinates between inertial and body frames and to the coupling between longitudinal and lateral variables. Moreover, there is strong uncertainty on the aerodynamic coefficients of the nonlinear dynamical model, which makes it even more difficult to design a reliable estimation filter. To overcome these issues, diagnosis is considered from the point of view of the success of the mission, and thus to analyze the guidance and control objectives to generate residuals.

Principles

The new fault diagnosis approach exploits the control objectives of the closed-loop-controlled aircraft. The main assumption is that the guidance law and the control loop have been adequately tuned to achieve these objectives, based on the knowledge of the aircraft dynamics. These objectives require the aircraft to respect some geometric and kinematic constraints. The idea of the method is to use these constraints to build residuals indicative of the presence of faults. Indeed, control may fail when faults affect the aircraft [START_REF] Baïkeche | On parametric and nonparametric fault detection in linear closed-loop systems[END_REF][START_REF] Harris | A review of performance monitoring and assessment techniques for univariate and multivariate control systems[END_REF].

As they are (possibly multivariate) functions of known variables (outputs, estimated state, known references), these residuals can be computed at each instant of time, without requiring the costly integration of the nonlinear state-space model of the aircraft. Nevertheless, the knowledge of this model provides information on the sensitivity to faults of the variables involved in this computation.

In summary, control objectives portray the desired global behavior of the closed-loop system without the need to investigate the dynamics deeply. Monitoring the distance between the expected and actual values of control objectives is similar in spirit to classical FDI methods based on parameter or state estimation, which test whether the estimated values of monitored variables are consistent with their expected values. The approach proposed here is presumably totally new, as no other study seems to have reported the use of control objectives to generate residuals indicating the presence of faults. The control error has only been used in the performance-monitoring context to assess the efficiency of the controller [START_REF] Ingimundarson | Closed-loop performance monitoring using loop tuning[END_REF] but not to detect faults affecting the process. Section 3.2 explains the generation of the residuals from the guidance laws and Section 3.3 shows how to assess their sensitivity to faults.

Residuals

The control objective of a guidance law is most often to make the missile respect a geometrical rule based on the definitions of Section 2.2.1. This constraint provides an immediate collection of residuals, under the assumption that the guidance and control laws have been tuned adequately, and that the control loop is fast compared to the guidance loop.

Residuals with PP law

In velocity-pursuit guidance, the angle between the velocity vector v m of the missile and the line of sight r to the target is driven to zero. Four scalar residuals are thus generated. The first three express that the cross product of these two vectors should be close to zero and the last one expresses the fact that the scalar product should be equal to the product of their norms.

r 1→3 pp = v m × r (3.1)
r 4 pp = v T m r -v m r (3.2)
To facilitate visual interpretation, the three scalar residuals r 1→3 pp could be transformed into angular variations in degrees, by applying the transformation (180/π)

• arcsin r 1→3 pp / r 1→3 pp
, where the arcsine function is considered componentwise [START_REF] Marzat | A new model-free method performing closed-loop fault diagnosis for an aeronautical system[END_REF]. The informational content of the residuals would remain the same.

Moreover, the fast control loop has been designed to achieve stabilization and thus to drive the angular rates to zero. Therefore, the missile angular velocity ω provides three additional scalar residuals.

r 5→7 pp = ω = [p, q, r] T (3.3)

Residuals with PNG law

The objective of the proportional navigation guidance law is to nullify the LOS rate λ. Since the computational form of the LOS rate is λ = (r × ṙ) / r 2 , this is equivalent to aligning r with ṙ. Thus, as with the PP law, three residuals are obtained from the cross product of these two vectors, and the scalar product can be used to generate a fourth scalar residual. Their expressions are

r 1→3 png = r × ṙ (3.4) r 4 png = r T ṙ -r ṙ (3.5)
Since the fast control loop is independent from the guidance law, the three additional residuals derived from the nullity of the angular velocity ω could also be used here.

r 5→7 png = ω = [p, q, r] T (3.6)
Note that the residuals defined in (3.2) and (3.5) present the unusual characteristic of being nonnegative, making bilateral tests inappropriate.

Propulsion residual

The guidance residuals previously described will be used to monitor the behavior of the sensors and tail fins. However, all of these residuals are insensitive (or only momentarily sensitive) to faults occurring in the propulsion, as propulsion regulation is decoupled from the rest of the control and since the guidance constraints may still be satisfied. Another control objective should thus be investigated to monitor the behavior of the thruster. A classical indicator of the fate of the interception mission is the time-to-go, t go , defined as the time remaining before the missile reaches the target. The most frequently used estimator of t go is the quotient of the norms of LOS and closing velocity [START_REF] Tahk | Recursive time-to-go estimation for homing guidance missiles[END_REF],

t go = r v c (3.7)
Simulations with no fault on the propulsion and with a 50% loss of effectiveness, in the conditions of Figure 5, give the results displayed in Figure 6 for the PP law. Similar results are obtained when using PNG. These results illustrate the fact that, in normal operation, the time-to-go estimate is regularly decreasing and follows an almost linear slope. When a propulsion loss takes Basically, the aircraft is slowed down by this propulsion loss and, if at all possible, the interception should take place later than expected. This propulsion fault has a strong effect on velocity regulation, leading to an abrupt change of the slope. To identify this change, an adaptive slope tracker algorithm has been proposed in [START_REF] Marzat | A new model-free method performing closed-loop fault diagnosis for an aeronautical system[END_REF]. The idea is to estimate (by least-squares) the parameters of the linear slope on a time interval, and use them to predict the expected values of t go on the next interval. The mean squared error between the prediction and the value estimated by (3.7) is computed on this next interval. One error value per interval is thus obtained, except for the first one. This error signal e prop is expected to be small in normal operating conditions and large for the interval where the slope change occurs, indicating the time of the propulsion fault. Results on the evolution of this error signal with and without a 50% loss of effectiveness of the propulsion at time are displayed in Figure 7. This shows that such a fault may be detected with a delay equal to the size of the time sliding window (here 1 second).

Qualitative sensitivity analysis

Seven residuals have been designed for each guidance law, with an additional one dedicated to the analysis of the propulsion behavior. As this last signal is dedicated to one fault while being insensitive to the others, the study will focus on the analysis of the guidance residuals.

So far, the objectives of the guidance laws have led to the definition of residuals as explicit functions of the available measurements. However, no information is available yet about the sensitivity of these residuals to sensor and actuator faults. The first step to achieve this analysis is to identify the variables that are affected by the faults considered. The presence of these variables in the residuals will then reveal sensitivity to the corresponding faults.

For the PP law, (3.1) and (3.2) yield

r 1→3 pp =      ẋ ẏ ż      ×      x t -x y t -y z t -z      =      ẏ (z t -z) -ż (y t -y) ż (x t -x) -ẋ (z t -z) ẋ (y t -y) -ẏ (x t -x)      (3.8) r 4 pp = ẋ (x t -x) + ẏ (y t -y) + ż (z t -z) -v m r (3.9)
For the PNG law, (3.4) and (3.5) give similarly

r 1→3 png =      x t -x y t -y z t -z      ×      ẋt - ẋ ẏt - ẏ żt - ż      =      (y t -y) ( żt -ż) -(z t -z) ( ẏt -ẏ) (z t -z) ( ẋt -ẋ) -(x t -x) ( żt -ż) (x t -x) ( ẏt -ẏ) -(y t -y) ( ẋt -ẋ)      (3.10) r 4 png = (x t -x) ( ẋt -ẋ) + (y t -y) ( ẏt -ẏ) + (z t -z) ( żt -ż) -r ṙ (3.11)
Note that the residuals (3.3) and (3.6) are already under explicit forms.

r 5→7 pp = r 5→7 png =      p q r      (3.12)
Residuals generated with the PP and PNG laws differ, but a close look at equations (3.8) to (3.12) shows that the same variables are involved, implying that sensitivity to faults will be qualitatively the same for the two guidance laws.

Sensor faults

Consider the faults affecting the accelerometers (axes x, y and z). An additive fault on a acceleration measurement will induce a fault f x on the corresponding velocity measurement ẋ and also a fault f ix on the position measurement x via double integration. Note that this additive model is generic, as the fault can take any value. To analyze the sensitivity of the residuals to these faults, ẋ is replaced by its fault model ( ẋ + f x ) and so on for the other variables in (3.8) and (3.9), which now become

r 1→3 pp =      ( ẏ + f y ) (z t -z -f iz ) -( ż + f z ) (y t -y -f iy ) ( ż + f z ) (x t -x -f ix ) -( ẋ + f x ) (z t -z -f iz ) ( ẋ + f x ) (y t -y -f iy ) -( ẏ + f y ) (x t -x -f ix )      (3.13) r 4 pp = ( ẋ + f x ) (x t -x -f ix ) + ( ẏ + f y ) (y t -y -f iy ) + ( ż + f z ) (z t -z -f iz ) -v m r (3.14)
The way residuals (3.12) are built makes them insensitive to these accelerometer faults. The same computation can be made for the PNG residuals (3.10) and (3.11), leading to very similar expressions. The sensitivity of each residual to the accelerometer faults is given by the presence of these faults in the above expressions. Thus, r 2 pp , r 3 pp and r 4 pp are sensitive to faults affecting the x accelerometer axis, while r 1 pp , r 3 pp and r 4 pp are sensitive to faults affecting the y accelerometer axis, and r 1 pp , r 2 pp and r 4 pp are sensitive to faults affecting the z accelerometer axis. This makes it possible to fill in the first three columns of Table 1.

Consider now faults affecting the gyro axes, i.e., the measurements of p, q, r. The residuals r 5 pp and r 5 png are sensitive to faults on p, and the 6 th and 7 th residuals of each guidance law are respectively sensitive to faults affecting q and r. This makes it possible to fill in the last three rows of Table 1.

Due to the fast attitude stabilization loop, gyro faults have also an effect on the first four residuals, because the control loop involves the difference between the past and present gyro measurements. This was not the case for accelerometer faults, since acceleration measurements are used only in the guidance loop and therefore do not influence the faster stabilization loop. The study of the influence of gyro faults on the first four residuals via this loop can be carried out analytically by investigating the dynamics of the force equation (2.1). This equation contains a cross product which can be developed as

     p q r      ×      v bx v by v bz      =      qv bz -rv by rv bx -pv bz pv by -qv bx      (3.15)
This explicit form provides the following information,

• faults on measurements of q or r affect the measurement of acceleration on the x axis;

• faults on measurements of p or r affect the measurement of acceleration on the y axis;

• faults on measurements of p or q affect the measurement of acceleration on the z axis.

Residuals from (3.8) to (3.11) are made of products between at least two variables obtained from accelerometer measurements (y and z for r 1 pp ; x and z for r 2 pp ; x and y for r 3 pp ; x, y and z for r 4 pp ). From the above analysis, the four residuals are sensitive to faults on the three gyro measurements, which completes the sensitivity analysis for sensor faults.

The fault signature table for sensor faults is now complete (Table 1). This classical tool in fault diagnosis is used to summarize the potential detection and isolation of a collection of possible faults with a given set of residuals. The "X" symbol indicates that the fault is detectable with the residual considered while the "-" symbol means that the residual is structurally insensitive to the fault.

Table 1: Signature of sensor faults Acc x Acc y Acc z Gyr p Gyr q Gyr r r

1 pp or r 1 png - X X X X X r 2 pp or r 2 png X - X X X X r 3 pp or r 3 png X X - X X X r 4 pp or r 4 png X X X X X X r 5 pp or r 5 png - - - X - - r 6 pp or r 6 png - - - - X - r 7 pp or r 7 png - - - - - X
The analysis of this table reveals that all faults affecting either accelerometers or gyros are detectable and isolable, since the rank of the signature table is full (in other words, the signature of each fault is unique).

Actuator faults

A similar analytical sensitivity analysis is now performed for faults that may affect the rudders and elevators of the aircraft.

Consider first the force equation (2.1), and the influence of the equivalent actuator deflections δ l , δ m , δ n which is detailed in (2.2). Since the faults affect the actual rudders and elevators δ 1 , δ 2 , δ 3 , δ 4 , the equivalent angles should be replaced by the actual ones using (2.9). The aerodynamic forces from (2.2) can thus be rewritten

     -c x0 + cxαα + (0.25c xδ l -0.5c xδm )δ 1 + (0.25c xδ l + 0.5c xδn )δ 2 + (0.25c xδ l + 0.5c xδm )δ 3 + (0.25c xδ l -0.5c xδn )δ 4 c y0 + c yβ β + (0.25c yδ l )δ 1 + (0.25c yδ l + 0.5c yδn )δ 2 + (0.25c yδ l )δ 3 + (0.25c yδ l -0.5c yδn )δ 4 -(c z0 + czαα + (-0.5c zδm )δ 1 + (0.5c zδm )δ 3 )      (3.16)
The analysis of these new equations reveals that • accelerometer measurement on the x axis is affected by faults on δ 1 , δ 2 , δ 3 , δ 4 ;

• accelerometer measurement on the y axis is affected by faults on δ 1 , δ 2 , δ 3 , δ 4 ;

• accelerometer measurement on the z axis is affected by faults on δ 1 , δ 3 .

Guidance residuals r 1→4 pp and r 1→4 png consist of products between variables obtained from those accelerometer measurements. Therefore, the four residuals are structurally sensitive to faults affecting any of the four actuators δ 1 , δ 2 , δ 3 , δ 4 .

Consider now the momentum equation (2.5), and the influence of the actuators given by (2.6). The torques can be rewritten as functions of the actual deflection angles as A first analysis of the above torque equations indicates that measurements of p and r are sensitive to faults affecting any rudder or elevator, while the measurement of q should only be sensitive to faults on the elevators δ 1 and δ 3 . However, the dynamics of the roll, pitch and yaw rates expressed in (2.5) should be considered. The geometry of the vehicle reveals that the product pr acts on the dynamics of q, and that the product pq acts on the dynamics of r. Therefore, if a fault on δ 2 or δ 4 occurs, both measurements of p and r will be affected. This implies that the product pr would not be close to zero anymore, and thus the measurement of q will be affected by these faults through (2.5). The three residuals r 5→7 pp (and respectively r 5→7 png ) then turn out to be structurally sensitive to faults on any of the actuators δ 1 , δ 2 , δ 3 , δ 4 .

       c l0 + c lβ β + (0.25c lδ l )δ1 + (0.25c lδ l + 0.5c lδn )δ2 + (0.25c lδ l )δ3 + (0.25c lδ l -0.5c lδn )δ4 + l ref v 2 bx +v
Finally, all of the residuals r 1→7 pp and r 1→7 png are structurally sensitive to faults on any of the four actuators. Detection of such faults is thus possible but not isolation, due to the high level of coupling in the aircraft dynamics. These findings are summarized in Table 2.

Table 2: Signature of actuator faults

δ 1 δ 2 δ 3 δ 4 r 1 pp or r 1 png X X X X r 2 pp or r 2 png X X X X r 3 pp or r 3 png X X X X r 4 pp or r 4 png X X X X r 5 pp or r 5 png X X X X r 6 pp or r 6 png X X X X r 7 pp or r 7 png X X X X

Remarks

The dynamical model is not used to generate the residuals, which are derived directly from the control law and true whatever the controlled aircraft. The only step depending on the aircraft model is the structural sensitivity analysis, which does not require a deep knowledge of the value of uncertain parameters such as aerodynamic coefficients.

It is well-known that the design of a closed-loop control law does not require an extreme precision of the description of the dynamics of the system. As the test case presented in Section 4 will confirm, a high level of robustness toward model uncertainty can thus be expected. The proposed diagnosis method can be said to be as robust as the control law can be.

Although isolation of actuator faults cannot be performed through this method, their detection can still be achieved. Moreover, it is possible to distinguish between actuator and sensor faults, since the signatures of actuator faults differ from those of sensor faults. This information is thus very useful, as it is obtained at a very low computational cost (remember that the residuals are readily obtained from the guidance module). If isolation of actuator faults is required -e.g., to reconfigure the control law-then a complementary dedicated actuator fault isolation method (such as those described in [START_REF] Marzat | Nonlinear FDI based on state derivatives, as provided by inertial measurement units[END_REF][START_REF] Ducard | Efficient nonlinear actuator fault detection and isolation system for unmanned aerial vehicles[END_REF]) may be called upon to lift suspicion, once detection has been confirmed using the guidance and control residuals. However, the link between the two strategies and the detection delay induced by this new scheme remain to be addressed.

It is, however, well known that the control law may be naturally tolerant to some actuator faults [START_REF] Niemann | Robust fault detection in open loop vs. closed loop[END_REF][START_REF] Baïkeche | On parametric and nonparametric fault detection in linear closed-loop systems[END_REF]. This may particularly arise in the present case, because the control actuators have one degree of redundancy. The method that has been described is thus well suited to detect critical faults that impact the entire dynamics of the aircraft and thus endanger the mission. Also note that if the system partly tolerates an actuator fault, this would lead to an unknown fault signature that is a priori different from the one of sensor faults. When such a signature is observed, a complementary isolation method could also be employed to investigate the matter further.

Simulation results

This section shows the results of the method presented in Section 3 on the nonlinear aircraft model detailed in Section 2, for several types of sensor and actuator faults. For the sake of brevity, results are shown only for one of the guidance laws (alternatively PP or PNG) for each scenario. The only exception is Scenario 1 for which PP and PNG results are both displayed, since this non-faulty case serves as a reference.

Setting

The simulation time step is 0.01s. Flight conditions are given in Table 3, comprising nominal speed, initial position, and uncertainty parameters for the missile and target. As detailed in Section 2.3, all aerodynamic coefficients suffer a modeling error of ±25%.

A collection of fault scenarios are designed, considering the fault-free case, sensor faults and actuator faults (see summary in Table 4). The seven residuals for the two guidance laws and for each of the fault scenarios of Table 4 are displayed in Figures 9 to 18 and commented.

Scenario 1: Fault-free case (Figures 9 and 10)

This case is given as a reference. After about 5 seconds for the PP law, and at most 10 seconds for the PNG law, the seven residuals remain very small, validating the simplifying assumption of a weak influence of the transients.

Sensor faults

Sensor faults affecting either accelerometers (scenarios 2 and 3) or gyros (scenarios 4 and 5) are considered.

Accelerometer (i ∈ [x, y, z]) b i ∼ N (0, 5 • 10 -4 ) k i ∼ N (0, 2 • 10 -3 ) σ i = 2 • 10 -3 - Gyro (i ∈ [p, q, r]) b i ∼ N (0, 1 • 10 -5 ) k i ∼ N (0, 5 • 10 -5
) 11)

σ i = 3 • 10
The fault on the x axis of the accelerometer is quickly detected by the second, third and fourth residuals, while the other ones are not affected. This is in adequation with Table 1.

Scenario 3 (Figure 12)

The fault on the z axis of the accelerometer makes the first, second and fourth residuals react. Note that a small transient effect is observed on the sixth residual, but the signal immediately returns to its initial mean and this would not lead to high false alarms with a statistical decision test (see performances indices in Table 5).

4.3.3 Scenario 4 (Figure 13)

The fault on the gyro measuring p causes a change in the mean of the first, second, third, fourth and fifth residuals. This last one even allows an identification of the fault, as it corresponds to the discrepancy between the required and measured value of the roll rate.

4.3.4 Scenario 5 (Figure 14)

This scenario demonstrates the possibility to detect and isolate two successive faults affecting gyros, according to their fault signatures (see Table 1). The fault on the gyro measuring q is first detected as in Scenario 5, making the first, second, third, fourth and sixth residuals react. The second fault affecting the gyro measuring r then occurs and causes a change in the mean in the seventh residual, which also allows its identification. Note that a transient effect is observed on the fifth residual, which returns quickly to its initial small mean value.

Actuator faults

Two types of faults affecting the rudders or elevators are considered, namely oscillatory failure case and locking-in-place.

4.4.1 Scenario 6: oscillatory failure (Figure 15)

The oscillatory failure considered is a critical fault, as it makes all the residuals react according to Table 2. In this case, the entire dynamics of the aircraft is affected by the fault. Decision on fault detection is obtained quickly, however no isolation can be made. A complementary fault isolation method should be used to identify the faulty actuator once the decision has been confirmed.

4.4.2 Scenario 7: locking-in-place (Figure 16)

The locking-in-place of an actuator (here, rudder δ 3 ) is probably one of the most difficult fault to detect with the proposed method. Indeed, as there is one degree of redundancy in actuation, this fault may be tolerated. This strongly depends on the conditions of excitation of the actuators. For the PNG law, the seven residuals react to the fault (even if some react weakly), which leads to a correct detection of an actuator fault. So, the effect of faults may be spotted even with redundant actuators.

4.4.3 Scenario 8: target evasion (Figure 17)

An important concern during interception is the ability of the pursuer to reach the target. It is thus interesting to detect whether the target performs evasive maneuvers or if its speed is too high compared to that of the pursuer, which will ultimately make the interception fail. Such a problem has a direct impact on the guidance constraints that are used as residuals. Scenario 8 considers a target escaping with a speed twice that of the pursuer, which is a very simple case of impossible interception. The first four guidance residuals react, or are even unable to decrease to a small value. The control residuals monitoring the roll, pitch and yaw rates are less impacted, as the stabilization of the aircraft is still effective. Therefore, unknown fault signatures are observed, which may lead to the use of a complementary actuator fault isolation strategy (if applicable), revealing that no actuator is faulty and that the problem comes from the target that is out of the reach of the missile. Such an occurrence may also be identified by the exogenous tracking device. These results show that, at a small computational cost and on difficult problems, it is possible to detect and isolate single and possibly successive faults affecting sensors, and that actuator faults or target evasion maneuvers are detectable. The diagnosis method remains effective in the presence of strong measurement and model uncertainty, since this approach is based on the closed-loop control law, which is naturally robust to such phenomena.

Comments and quantitative performance evaluation

The method is used to generate residuals that react to the faults considered. The next step of the diagnosis procedure requires the use of a change-detection method that will analyze the residuals to decide whether these signals are close to their mean. This step provides a Boolean decision for each residual, and the complete signatures can be compared to Table 1 to make a decision on the faults that have occurred.

The chosen test can also be used to compute quantitative indices showing the performance of the method regarding, e.g., false alarm rates and detection delays. The statistical test that has been chosen here is the bilateral CUSUM test [START_REF] Gustafsson | Adaptive filtering and change detection[END_REF][START_REF] Basseville | Detection of abrupt changes: theory and application[END_REF]. The performance indices are computed as indicated in [START_REF] Bartyś | Introduction to the DAMADICS actuator FDI benchmark study[END_REF]. The nominal mean and variance of each residual are estimated from the first 100 values after convergence. The signal is then normalized to zero mean and unit variance, to be able to apply the same statistical test despite the initial differences of magnitude of the residuals. The parameters of the CUSUM test have been fixed at a change in the mean of size 1 associated with a threshold equal to 10, following the comparison study from [START_REF] Marzat | Automatic tuning via Kriging-based optimization of methods for fault detection and isolation[END_REF]. The resulting false alarm rates and detection delays, obtained by applying this decision test on the residuals, for all of the fault scenarios (except target evasion) and the two guidance laws are detailed in Table 5. 100 simulations were performed with random values drawn for uncertainty parameters reported in Table 3. The mean value of the performance indices along with the corresponding standard deviation for this collection of tests are reported.

The false alarm rates and detection delays are quite small, with almost zero false alarm, and average detection delays of 1 to 2 seconds (comparable to those reported in other studies [START_REF] Castaldi | Design of residual generators and adaptive filters for the FDI of aircraft model sensors[END_REF][START_REF] Bateman | Actuators fault diagnosis and tolerant control for an unmanned aerial vehicle[END_REF][START_REF] Ducard | Efficient nonlinear actuator fault detection and isolation system for unmanned aerial vehicles[END_REF]). Performances are similar for PP and PNG guidance laws.

Remark on robustness to wind turbulence

To assess the robustness of the method to external disturbances, a Dryden wind model is included in the simulation, similarly to other studies [START_REF] Ducard | Efficient nonlinear actuator fault detection and isolation system for unmanned aerial vehicles[END_REF][START_REF] Yamasaki | Robust trajectorytracking method for UAV guidance using proportional navigation[END_REF]. The corresponding wind speeds are displayed in Figure 8. The residuals for the fault-free case in those conditions, for the PNG law, are shown in Figure 18. The main difference that can be observed with the nominal fault-free scenario is that the residuals are noisier. However, their zero-mean character is preserved due to the inherent robustness of the guidance feedback laws, even when wind gusts occur (e.g., around 60 seconds of the simulation). Therefore, detection of faults would still be possible in those wind conditions. Stronger wind gusts may however cause transient effects that may lead to false alarms, but this would be the case with about any FDI method.

Analogy with observer-based FDI

The new FDI approach has been successfully applied to diagnose faults on sensors and actuators of a representative nonlinear aircraft. With the objective of establishing an analogy with classical observer-based FDI [START_REF] Frank | Fault diagnosis in dynamic systems using analytical and knowledge-based redundancy: A survey and some new results[END_REF][START_REF] Isermann | Supervision, fault-detection and fault-diagnosis methods: An introduction[END_REF] in mind, this section investigates the application of the method to linear systems controlled by state feedback. Consider a non-faulty deterministic linear state-space model, which may for instance correspond to a linearization of the aircraft model, The estimation error is thus sensitive to faults, and the output estimation error e y = y -ŷ can be used as a residual. This could also be expressed as e y (s) = C(sI n -A + LC) -1 f (s) in the frequency domain. If the Laplace transform of f , f (s) / ∈ ker{C(sI n -A + LC) -1 }, which is very likely, then the residual is sensitive to f . This fault diagnosis scheme is equally used either for open-looped or closed-looped systems and corresponds to classical observer-based FDI.

The new closed-loop-control approach corresponds to a slight change of viewpoint. Assume that the pair (A, B) is controllable, and the pair (C, A) observable. A state feedback can then be designed to bring the state x of the system (or its estimate x if an observer is needed) to a desired reference value x ref , which can be taken equal to 0 without loss of generality. The main assumption of the new FDI method advocated in this paper is that a suitable state feedback u = -Kx has been designed to achieve the control objective x = 0 (at least approximately). The dynamical error of the closed-loop system in the absence of fault is given by ẋ = (A -BK)x

(5.6)

A classical result in control theory is that x asymptotically goes to 0 if K is chosen to have (A -BK) Hurwitz. Even though this shows a strong analogy with observer-based fault diagnosis (BK in (5.6) playing the same role as LC in (5.3)), using the distance between the measured state and the desired reference as a residual, has never been used in the fault diagnosis literature to address the diagnosis of closed-loop systems. This could be partly explained by the usual approach that considers systems as open-looped and solely checks the consistency between inputs and outputs to achieve FDI.

With the same faulty model (5.4) as earlier, (5.6) becomes

ẋ = (A -BK)x + f (5.7)
and the same arguments as those stated for (5.5) stand true to use the distance between x and the desired reference -here 0-as a residual. In particular, in the frequency domain, (5.7) yields

x(s) = (sI n -A + BK) -1 f (s).
This confirms the possibility to use control objectives to build residuals for FDI of a process, with similar arguments to those that have popularized observer-based strategies. The method can be extended to deal with nonlinear systems, even if this is beyond the scope of this paper. Consider the model describing the normal operating condition of a nonlinear system

   ẋ = g(x, u) y = h(x) (5.8)
Assume an appropriate control law u = g u (y) has been designed to fulfill the control objective x = 0. The model (5.8) then translates into ẋ = g(x), where g(x) = g(x, g u (h(x))

(5.9)

If x = 0 is an equilibrium point of the closed-loop model (5.9), the following relation stands true locally,

ẋ ≈ Ax, where A = ∂ g(x) ∂x x=0 is Hurwitz (5.10)
If a fault vector f affects the system as ẋ = g(x, u) + f (5.11) then (5.10) becomes ẋ ≈ Ax + f (5.12)

As observer-based fault detection can be straightforwardly extended by linearization, this result is very similar to (5.7) and shows that the distance between the reference and the observed regulated state or output is a residual indicative of the presence of faults affecting the process.

Conclusions and perspectives

A new strategy to address fault diagnosis for closed-loop controlled systems has been described in this paper. The fault residuals are built from the knowledge of control objectives that should be achieved by the system. The structural sensitivity of these residuals to faults is then determined through an analytical study. The method has a very low computational cost, as the dynamical model of the system is not used to generate the residuals. The fact that the residuals are linked to the design of the control law is another interesting point, since the same residuals can be used to detect faults on several processes controlled with the same control law. The closed-loop character of the approach also makes it robust to model uncertainty, which is a critical point in classical model-based FDI methods.

The potential of the approach has been successfully demonstrated on a representative nonlinear aircraft model, equipped with non-redundant sensors and classical actuators, suffering strong measurement and model uncertainty. Based on the control objectives of two common guidance laws (PP or PNG), residuals have been generated according to the new FDI approach. It has been shown that faults affecting sensors are detectable and isolable in this framework, and that actuator faults can be detected. The computation of quantitative indices have assessed the performance of the method. The impact of evasive target behavior and wind turbulence have also been addressed.

A first step to formalize the method in the more global framework of linear and nonlinear control theory has been accomplished by showing the analogy of the proposed method with the classical observer-based FDI scheme for linear(ized) models. The complete nonlinear extension of the approach remains to be addressed. This strategy may be compared with other promising FDI methods on the basis of the test case, a comparison strategy is therefore needed to provide recommendations for aircraft securement. The results of the candidate approaches should be evaluated with respect to performance indices such as those used in this study. All the FDI strategies considered have some internal parameters that need to be chosen. To compare these strategies as objectively as possible, these inner parameters should be systematically tuned to achieve optimality in terms of the performance indices. The design of such a procedure is at the heart of current work.

List of figure captions

List of table captions

Figure 1 :

 1 Figure 1: Missile scheme in body frame

Figure 3 :Figure 4 :

 34 Figure 3: GNC scheme

Figure 6 :

 6 Figure 6: Estimation of t go in different fault conditions

Figure 7 :

 7 Figure 7: Error signal without (left) and with (right) a 50% propulsion loss at t=20s

- 4 - 1 Initial

 41 Radar noise standard deviations -position : 2 m angular : 2 • 10 -3 rad velocity : 2 m • s -

4 0. 4

 4 (std: 10 -6 ) 0.4 (std: 10 -6 ) 0 (std: 0) 0 (std: 0) 5 -fault 1 0.4 (std: 10 -6 ) 0.4 (std: 10 -6 ) 0 (std: 0) 0 (std: 0) 5 -fault 2 0.4 (std: 10 -6 ) 0.4 (std: 10 -6 ) 2 • 10 -3 (std: 10 -4 ) 0 (std: 0) 6 0.6 (std: 10 -3 ) 0.8 (std: 10 -5 ) 0 (std: 0) 0 (std: 0) 7 1.12 (std: 0.01) 1.07 (std: 0.03) 0.09 (std: 0.001) 0.02 (std: 10 -4 )

Figure 8 :

 8 Figure 8: Wind speed in m•s -1

4 )

 4 Ax + Bu + L(y -Cx) ŷ = Cx (5.2) The state-estimation error e x = x -x satisfies ėx = (A -LC)e x (5.3) and e x asymptotically goes to zero if L is chosen in such a way that (A -LC) is Hurwitz, which is always possible if the pair (C, A) is observable. Consider now a time-varying fault vector f affecting the state as This model encompasses actuator, sensor and even structural faults, as f can take any value (this can be easily shown by substitution and change of variable). Equation (5.3) becomes ėx = (A -LC)e x + f (5.5)

Figure 1 :Figure 8 : 1 Figure 9 :

 1819 Figure 1: Missile scheme in body frame Figure 2: Tail fins (rear view) Figure 3: GNC scheme Figure 4: Interception geometry Figure 5: Interception trajectories with PP and PNG Figure 6: Estimation of t go in different fault conditions Figure 7: Error signal without (left) and with (right) a 50% propulsion loss at t=20s Figure 8: Wind speed in m•s -1 Figure 9: Scenario 1 -residuals for the PP law Figure 10: Scenario 1 -residuals for the PNG law Figure 11: Scenario 2 -residuals for the PP law Figure 12: Scenario 3 -residuals for the PNG law Figure 13: Scenario 4 -residuals for the PP law Figure 14: Scenario 5 -residuals for the PNG law Figure 15: Scenario 6 -residuals for the PP law Figure 16: Scenario 7 -residuals for the PNG law Figure 17: Scenario 8 -residuals for the PP law Figure 18: Wind and no fault -residuals for the PNG law

Figure 9 :

 9 Figure 9: Scenario 1 -residuals for the PP law

Figure 10 :

 10 Figure 10: Scenario 1 -residuals for the PNG law

Figure 11 :Figure 12 :

 1112 Figure 11: Scenario 2 -residuals for the PP law

Figure 13 :Figure 14 :

 1314 Figure 13: Scenario 4 -residuals for the PP law

Figure 15 :Figure 16 :

 1516 Figure 15: Scenario 6 -residuals for the PP law

Figure 17 :

 17 Figure 17: Scenario 8 -residuals for the PP law

Figure 18 :

 18 Figure 18: Wind and no fault -residuals for the PNG law

  nβ β + (0.25c nδ l )δ1 + (0.25c nδ l + 0.5c nδn )δ2 + (0.25c nδ l )δ3 + (0.25c nδ l -0.5c nδn )δ4 +

	cm0 + cmαα + (-0.5c mδm )δ1 + (0.5c mδm )δ3 +	l ref bx +v 2 v 2 by +v 2 bz	cmqq	2 by +v 2 bz	c lp p	     
	cn0 + c l ref v 2 bx +v 2 by +v 2 bz	cnrr	
				(3.17)

Table 4 :

 4 Fault scenarios

	Scenario	Faults	see Figures
	1	No fault	9, 10
	2	Bias of magnitude 1 m•s -2 on accelerometer axis x at 31s	11
	3	Scale factor of 1.5 on accelerometer axis z at 42s	12
	4	Bias of magnitude 0.5 rad•s -1 on gyro axis p at 38s	13
	5	Bias of magnitude 0.2 rad • s -1 on gyro axis q at 33s Bias of magnitude 0.25 rad • s -1 on gyro axis r at 51s	14
	6	OFC (sine of magnitude 0.3 and period 1s) on actuator δ 2 at 45s	15
	7	Locking-in-place of actuator δ 3 at 32s	16
	8	"Evading" target with speed 600 m•s -1	17
	4.3.1 Scenario 2 (Figure

Table 5 :

 5 Performance indices

		Detection delays	False alarm rates
	Scenario	PP	PNG	PP	PNG
	1	-	-	0	0
	2	1.99 (std: 0.05) 1.63 (std: 0.02)	0 (std: 0)	0 (std: 0)
	3	1.2 (std: 0.03) 1.13 (std: 0.04)	0 (std: 0)	0 (std: 0)

Table 1 :

 1 Signature of sensor faults

Table 2 :

 2 Signature of actuator faults

Table 3 :

 3 Flight conditions

Table 4 :

 4 Fault scenarios

Table 5 :

 5 Performance indices • σ f and k f : parameters of the fault model Residual generation • f i , i ∈ {x, y, z} : fault affecting the accelerometer axis i • r i pp : i-th residual generated with pure pursuit • r i png : i-th residual generated with proportional navigation guidance • t go : time-to-go • t go : estimate of t go Linear and nonlinear models • A, B, C : state, input and output matrices of a linear model • f : fault vector • g(•) and h(•) : state and output mappings of a nonlinear model • I

n : n × n identity matrix • K : state feedback gain • L : Luenberger observer gain • u : input vector • x : state vector • y : output vector

Nomenclature

Aircraft model

• [a bx , a by , a bz ] T : non-gravitational acceleration in body frame, m • s -2

• c (.) : aerodynamic coefficient • f aero and f g : aerodynamic and gravitational forces, N

• f min and f max : lower and upper bounds of propulsion thrust, N

• s ref and l ref : reference surface, m 2 , and length, m, • η : propulsion rate

• ω = [p, q, r] T : angular velocity, rad•s -1

• [ϕ, θ, ψ] T : orientation, rad

Target and guidance model