Julien Marzat

Hélène Piet-Lahanier

Frédéric Damongeot

Eric Walter

AUTONOMOUS FAULT DIAGNOSIS: STATE OF THE ART AND AERONAUTICAL BENCHMARK

Keywords: aircraft, analytical redundancy, fault detection and isolation, model-based FDI, nonlinear systems, pattern recognition

This paper briefly reviews the state of the art in Fault Detection and Isolation (FDI), and describes a test-case for in-flight fault diagnosis. The main concepts are recalled, the links between the approaches are indicated and the most promising methods are highlighted. The nonlinear models of the system, its sensors and actuators are described in the second part of the article, along with fault scenarios. Constraints restrict the approaches that are applicable on the test-case and suggest quantitative indices that can be used to evaluate fault diagnosis strategies in an aeronautical context.

INTRODUCTION

Reliability and safety of aeronautical systems have always been a major concern for aircraft manufacturers. There is an absolute necessity to identify early unexpected changes in the system (referred as faults) before they lead to a complete breakdown (failure). Fault Detection and Isolation (FDI) and Fault Tolerant Control (FTC) for aerial and space vehicles have already been addressed in a large number of papers (see, e.g., [START_REF] Ducard | Efficient nonlinear actuator fault detection and isolation system for unmanned aerial vehicles[END_REF] [START_REF] Patton | Fault detection and diagnosis in aerospace systems using analytical redundancy[END_REF]). FDI comprises fault detection ("something is wrong"), fault isolation ("the fault pertains to this component") and even fault identification ("this is the nature of the fault"). Active FTC aims at designing a control law that will fulfill the required function while taking advantage of FDI, whereas passive FTC pursues the same objective using robust control without FDI. This paper will focus exclusively on FDI, leaving aside reconfiguration. Most often, on-line fault diagnosis is tackled via hardware redundancy -multiple sensors or actuators with the same function. The major drawbacks of this approach, however, are higher costs and lower autonomy because of the additional weight, volume and power required [START_REF] Patton | Fault detection and diagnosis in aerospace systems using analytical redundancy[END_REF]. Two main groups of approaches attempt to circumvent these difficulties. The first one is analytical redundancy, which exploits the relations between measured or estimated variables in order to detect possible dysfunctions of the system. This set of methods is commonly called model-based, where model should be understood as a knowledgebased dynamical model. The behavior of the system can indeed be modeled as a set of differential equations, usually in state-space form. The second group of approaches is often referred to as model-free, although it actually uses the redundancy and correlations of the data in a hidden manner. It exploits measurements, acquired in real time or available in a previously constructed database, using a behavioral model of the signal. In what follows, we shall keep with the classical terminology distinguishing model-based and model-free approaches.

Section 2 presents a brief, but eclectic, overview of the main FDI methods. The approaches are classified according to the kind of knowledge they require. The underlying hypotheses and uncertainty modelling are also taken into account in this classification. Model-free approaches are displayed first, followed by the model-based methods. Finally, we show how fault isolation is performed independently of the class of method. Throughout Section 2, we have attempted to gather methods coming from different fields in generic groups. Details are not given for lack of space, but references are provided to complete the insight. We do not claim exhaustivity; for example discrete-event simulation (including fault trees, petri nets...) is beyond the scope of this paper.

Section 3 describes the proposed aeronautical benchmark. First, the class of aerial systems considered along with the hypotheses and knowledge available are detailed. The explicit model of the system, including its sensors and actuators, is then presented. The generic set of devices composing the vehicle is considered as a given and no hardware redundancy is allowed. The set of possible faults affecting the sensors and actuators is specified and simulation results of normal and faulty flights are shown. Finally, the most promising approaches for this generic case study are pointed out, and performance indices are proposed in accordance with robustness requirements.

FAULT DIAGNOSIS APPROACHES

Basic definitions

The main concepts in fault diagnosis are recalled here, to avoid ambiguity. Further standard definitions can be found in [START_REF] Isermann | Trends in the application of model-based fault detection and diagnosis of technical processes[END_REF]. A fault is an unpermitted deviation of at least one characteristic property or parameter of the system. It may lead to a failure, which is a permanent interruption of the system ability to perform some required function. The main goal of FDI is then to identify incipient faults as soon as possible so as to prevent failures. A fundamental problem in this context is the achievement of a satisfactory trade-off between non-detection and false alarms.

Residuals are signals computed on the basis of measurements in operation. They should remain small as long as there is no fault, and become sufficiently large to be noticeable whenever a fault occurs. Residuals are most often involved in the model-based methods, but should also be considered within model-free approaches.

Model-free approaches

When no explicit dynamical model is available, the system knowledge boils down to real-time measurements, possibly completed by process history. With such data, two main strategies could be adopted. In a sense, both aim at interpolating the new measured point based on the available data. The first strategy is classification. It involves building classes from the database either in a supervised way (i.e., with the help of an expert) or in an unsupervised manner (i.e., collecting elements of the database that are close to one another). A classifier is then trained with respect to these classes to perform the classification of the newly measured variables as representative of a healthy or faulty behavior. The second strategy is regression. It builds a statistical model that uses the redundancy of the process history in order to predict the values of the new variables and generate residuals by comparing predictions to measured values.

Qualitative approaches:

When no process history is available, the only exploitable information concerning the system monitored is the empirical knowledge of experts, which can be used to build expert systems. An expert system consists of a set of rules that aim to mimic human reasoning, by associating premises and conclusions to determine the logical chain of events. A fault is then reported if a forbidden sequence of events is detected. The major drawbacks of this approach are its lack of generality and its inability to handle situations that have not been explicitly taken into account in the design of the knowledge base [START_REF] Angeli | On-line fault detection techniques for technical system: A survey[END_REF].

Another class of methods, close to the previous one, is known as qualitative trend analysis (QTA). Its purpose is to decompose a measured signal into a sequence of known primitives (e.g "stable", "increase" or "decrease"). This recognition can be achieved either by analyzing the sign of the successive derivatives and using them in a rule base, or by matching patterns with a database containing samples of known primitives [START_REF] Venkatasubramanian | A review of process fault detection and diagnosis Part III: Process history based methods[END_REF]. Both techniques imply the cautious design of heuristic rules. Faults are identified in the same manner as with expert systems.

Early tendencies in pattern recognition for fault diagnosis:

When a process history is available, diagnosis can be viewed as a pattern recognition task where newly acquired measurements are to be classified in predetermined modes. The main tasks to be achieved are precisely described in [START_REF] Dubuisson | Diagnostic et reconnaissance des formes[END_REF] and summarized in this section. The prior knowledge is a database comprising d observations of the n variables. First, two off-line operations have to be carried out. The data must be clustered into classes and a decision rule should be trained. M classes are thus defined and each vector of the database is assigned to one of them. For diagnosis, the modes to be considered are the healthy one and all of the possible faulty ones. Labeling can be performed by an expert, if available, or with an algorithm like k-means clustering [START_REF] Patton | Artificial Intelligence Approaches to Fault Diagnosis for Dynamic Systems[END_REF]. If the database contains only non-faulty measurements, another solution is to perform one-class classification [START_REF] Shin | One-class support vector machines: an application in machine fault detection and classification[END_REF], although this will not make fault isolation practicable. Once the data have been labeled, a decision rule must be chosen and trained so as to classify the vectors in the proper classes. Parametric and non-parametric approaches are available for that purpose.

Parametric discrimination: If the probability density function of the observations is assumed fixed, it can be estimated from the data (e.g., with a maximum-likelihood method under hypotheses on the law). If moreover a prior probability is assigned to each class, then new measurement vectors can be classified using the Bayes rule. When there is no information concerning prior probability density functions of the observations and classes, only parametric discrimination by the mean of direct boundary computation is feasible. The simplest case is linear binary classification, on which most methods are built. Considering two classes, its aim is to find a hyperplane that splits the data into two parts with respect to the predefined labels. This separator is designed optimally according to some predefined cost function; a norm should be chosen to achieve data fitting, along with a regularization term to avoid overfitting. The solution is then obtained by minimizing this cost with, e.g., the Ho-Kashyap algorithm. For nonlinear problems where no linear separator exists, more complex functions (quadratic, cubic...) could be used but involve the tuning of a dangerously increasing set of parameters. A very popular solution to design separators for classification (or approximators for regression) has been to resort to neural networks. Actually, the design difficulty moves from choosing the parameters of the analytical separator to the selection of an activation function and the choice of the structure of the network, i.e., the number of layers and the number of neurons composing each of them. Minimizing the quadratic distance between the output of the network and the label of the class requires the tuning of the weights of the neurons, usually with the well-known back-propagation algorithm. Note that the convergence of this gradient algorithm to a global minimizer of the cost function is not guaranteed. These tools have been widely used in FDI for a large panel of applications [START_REF] Patton | Fault diagnosis in nonlinear dynamic systems via neural networks[END_REF].

Non-parametric classification methods: If the design of a separator is intractable, a distance combined with a voting scheme can complete classification. Considering the labeled data, a new point is classified in conformity with its neighborhood. The best-known method is the k-nearest neighbor algorithm, which gives its value to the new point according to the majority of the labels of the k-nearest points. Of course, a distance should be chosen to determine which points are the "nearest". A histogram or a grid could also replace the distance to analyze the neighborhood influence on the point considered.

On-line classification is then carried out in conformity with the separation rule chosen. To take care of unexpected situations, rejection (both in distance and ambiguity) may also be considered. Distance rejection means that if the newly acquired measure is considered too far from the existing classes, then it is not taken into account. Ambiguity rejection concerns the points that are too close to the border of the classes, alternative solutions being the introduction of fuzzy borders or Bayesian priors. Rejected points may be used to add new classes to the classifier or to redefine the classification rule on-line.

Advanced pattern recognition -Kernel machines:

Two key notions are used in modern pattern recognition, namely those of kernel and of sparsity. Kernel classifiers look for a function separating the classes. This function is built using training data. The main difficulty then is to represent the link between the samples and particularly to extract useful information from the large amount of redundant data. The kernel trick makes it possible to generalize linear methods, such as those described in Section 2.2.2, by mapping the data into a high-dimensional feature space. The output of a kernel machine could be expressed as y m (x) = d i=1 α i • k(x, x i ) where x is the new input point, the x i 's are training points, k(., .) is the kernel and the α i 's are weights to be tuned. The main advantage of this formulation is that it provides an easily computable kernel function that expresses the distance between two data points. There is also a need for sparsity as it would be computationally expensive to have significant weights on all the samples while all the points are not relevant. This is accomplished through an appropriate design of the cost function that will be minimized to find the weights α i of the kernel machine. Mathematical details concerning statistical learning theory may be found in [START_REF] Györfi | Principles of Nonparametric Learning[END_REF].

Vapnik's Support Vector Machines (SVM) have popularized these concepts [START_REF] Vapnik | An overview of statistical learning theory[END_REF]. The goal of SVM is to find a linear separator of the data in the higher-dimensional feature space. The linear separator is designed in order to achieve structural risk minimization (SRM). It aims at avoiding overfitting, which is the main problem of parametric discrimination approaches such as neural networks. The final function is expressed as a projection onto support vectors. Another interesting approach is the use of Gaussian Processes (GP), which generalize multivariate Gaussian distributions to infinite-dimensional spaces. Gaussian-process regression has been called Kriging by the geostatistical community. The covariance of the GP plays the role of the kernel, and sparsity facilitates computation for large-scale problems. These two methods have been shown to be closely related to other wellknown regularization techniques, such as ridge regression or least-square classification [START_REF] Rasmussen | Gaussian Processes for Machine Learning[END_REF].

The use of the tools described in this section is only at its beginning in the FDI field, which is surprising considering how straightforward it is to adapt these powerful new tools to the problems considered in Section 2.2.2. Very few applications of kernel machines to diagnosis have been reported so far [START_REF] Shin | One-class support vector machines: an application in machine fault detection and classification[END_REF], but it seems a promising way to perform or enhance fault detection. Moreover, the criteria used could be modified to perform regression. It then becomes possible to use the same formalism to create a black-box model that can generate residuals by comparing its outputs and the measurements on the system to detect the faults. Finally, it should be pointed out that the choice of the kernel and cost function is crucial and far from trivial, and that adequacy to the data must be carefully checked.

2.2.4. Principal Component Analysis (PCA): PCA projects the training data onto the eigenvectors of the covariance matrix and keeps only the most relevant ones, through a threshold on the eigenvalues, to achieve dimension reduction. The selected eigenvectors are then used to build a linear time-invariant statistical model that can serve to estimate the variables of the process in order to generate residuals. That could be seen as a kernel machine too, since a linear covariance corresponds to a possible choice of kernel. A recursive form exists for dynamical systems [START_REF] Li | Recursive PCA for adaptive process monitoring[END_REF] and PCA can also be extended to the nonlinear case by the kernel-trick, as described previously [START_REF] Lee | Nonlinear process monitoring using kernel principal component analysis[END_REF]. An alternative method with similar extensions is Partial Least Squares (PLS) [START_REF] Venkatasubramanian | A review of process fault detection and diagnosis Part III: Process history based methods[END_REF].

Model-based approaches

When the physics of the process is well known, it becomes possible to use an explicit knowledge-based dynamical model. Fault detection then amounts to checking whether the behavior of the monitored process is inconsistent with that of its model. This is done by exploiting the structure of the model and the existing input-output relationships.

2.3.1.

Qualitative tools: If a model of the process is available but the confidence in its parameters and quantitative outputs is very low, a first approach could be to derive a qualitative model. Qualitative equations are then used to express the type of variation of the process variables. This qualitative physics has the same goal as the methods outlined in paragraph 2.2.1, i.e., to predict the evolution of the process in order to detect abnormal behaviors [START_REF] Chittaro | Hierarchical model-based diagnosis based on structural abstraction[END_REF]. These causal links could also be modeled under the form of a signed digraph (SDG) [START_REF] Montmain | Dynamic causal model diagnostic reasoning for online technical process supervision[END_REF]. Although complex systems cannot be efficiently supervised with these approaches, semi-qualitative methods may be of great help to monitor uncertain systems [START_REF] Combastel | Model-based and wavelet approaches to induction motor on-line fault detection[END_REF].

Parameter monitoring:

For faults that may affect the values of some characteristic constants of the system itself, such as leaks entailing abnormal mass variations, parameter estimation techniques should be considered. The nominal value (or a set of admissible values in a bounded-error context [START_REF] Castillo | Constraint satisfaction techniques under uncertain conditions for fault diagnosis in nonlinear dynamic systems[END_REF]) of the monitored parameter vector is supposed known and FDI then boils down to estimating on-line the value of the parameters to generate residuals. Parameter estimation for models that are linear in their parameters can be achieved with, e.g., the recursive leastsquare algorithm, provided that the input signal is persistent. Nonlinear parameter estimation could be addressed in the same way but the techniques involved may be computationally much more expensive and not guaranteed to converge to an optimal solution.

When a system may suffer from abnormal oscillations or vibrations, diagnosis could be carried out by frequency analysis. Parametric signal models can be used to estimate the main frequencies and estimate possible changes in the system behavior [START_REF] Basseville | Detection of Abrupt Changes: Theory and Application[END_REF].

State estimation:

Estimating the state and output of the system makes it possible to create residuals by comparing the reconstructed signals with their real values. State estimators may be classified according to how they represent uncertainty. Considering linear systems first, Luenberger observers allow the reconstruction of the state variables under deterministic hypotheses, while Kalman filtering achieves the same operation in a stochastic context with assumptions on the distribution of the measurement noise and state perturbations. These now classical methods have been widely used for a large panel of applications [START_REF] Isermann | Trends in the application of model-based fault detection and diagnosis of technical processes[END_REF]. A very useful extension for fault detection is the Unknown-Input Observer (UIO), which can be designed in deterministic and stochastic settings. The UIO aims at performing state estimation with minimal influence of the unknown inputs (i.e., exogenous disturbances).

Nonlinear state estimation is often addressed by linearizing the model around an operating point or along a trajectory in order to apply the previous techniques. This has given birth to the Extended Luenberger Observer (ELO), the Extended Kalman Filter (EKF) and recently the Extended Unknown Input Observer (EUIO) [START_REF] Witczak | Modelling and Estimation Strategies for Fault Diagnosis of Non-Linear Systems: From Analytical to Soft Computing Approaches[END_REF]. These approaches lead to relatively easy computation, however linearizing implies losing information.

Contrary to the previous extensions of the Kalman filter, the Unscented Kalman Filter (UKF) does not linearize the model. This technique predicts the system behavior by using evaluations of the nonlinear model at a set of points approximating a Gaussian distribution of the state vector [START_REF] Cork | Sensor fault detection for UAVs using a nonlinear dynamic model and the IMM-UKF algorithm[END_REF]. Based on a similar idea, sequential Monte Carlo methods such as Particle Filtering (PF) are a very promising approach to deal with nonlinearity. PF is now commonly used for tackling complex fault detection issues [START_REF] Verma | Real-time fault diagnosis[END_REF].

Many observer structures using the nonlinear model without linearizing it have been proposed, from the sliding mode observer [START_REF] Xiong | Sliding mode observer for nonlinear uncertain systems[END_REF] to nonlinear adaptive observers [START_REF] Frank | Fuzzy logic and neural network applications to fault diagnosis[END_REF] and high-gain observers [START_REF] Busvelle | High-gain and non high-gain observers for nonlinear systems[END_REF]. No general nonlinear structure can be defined and therefore tuning complexity is increasing. Recently a unifying theory of nonlinear observers has emerged [START_REF] Andrieu | On the existence of a Kazantzis-Kravaris/Luenberger observer[END_REF], proposing the solving of a partial differential equation as the design methodology. If such a solution is reachable for aerospace applications, this could be an interesting framework to consider for observerbased fault diagnosis.

The methods presented so far either do not use an explicit uncertainty representation or assume a statistical distribution, most often Gaussian. An alternative approach is to use bounds on errors. This bounded-error approach can be used for linear and nonlinear models. In nonlinear state estimation, for example, interval analysis can be used to predict the evolution of the set of possible values for the state vector [START_REF] Jaulin | Applied interval analysis[END_REF]. Part of the predicted set that are inconsistent with measurements can then be eliminated. Fault detection can then be performed by checking whether the resulting set is empty [START_REF] Ingimundarson | Robust fault detection using zonotope-based set-membership consistency test[END_REF]. This uncertainty modelling is not specific to state estimation and can be used in parameter estimation or in the context of decoupling methods (see Section 2.3.4).

To avoid heavy computations, multiple-model strategies are also being investigated. They assume that the nonlinear model of the system can be approximated by interpolating between local linear models. This Takagi-Sugeno representation may be obtained analytically or by system identification. It is then possible to build a set of interpolating linear observers and achieve diagnosis operations [START_REF] Orjuela | State estimation for non-linear systems using a decoupled multiple model[END_REF].

To complete this overview, we would like to mention the very recent differential-algebra approach of [START_REF] Fliess | Non-linear estimation is easy[END_REF], based on fast state-derivative estimations.

Decoupling methods :

The Fundamental Problem of Residual Generation (FPRG) [START_REF] De Persis | A geometric approach to nonlinear fault detection and isolation[END_REF] is the maximization of sensitivity to faults while minimizing the influence of disturbances. Ideally, each generated residual should be sensitive to one particular fault only. Most classical FDI methods do not take perturbations into account and therefore do not address the FPRG. UIOs address the FPRG by considering the disturbances as unknown inputs, but can only be applied for specific perturbations structures.

Parity relations eliminate unknown state variables from model equations so as to produce residuals that only depend on the system inputs and outputs. This is done by exploiting the model structure and temporal redundancy on a short horizon. The methodology was initially developed for linear systems but it has been extended to bilinear and polynomial models (with the help of elimination theory for the latter). This method has also been applied to systems with unknown parameters [START_REF] Shumsky | Redundancy relations for fault diagnosis in nonlinear uncertain systems[END_REF]. Links between parity space methods and observers have been investigated in [START_REF] Patton | Robust fault detection using eigenstructure assignment: a tutorial consideration and some new results[END_REF].

Polynomial approximation of nonlinear systems does not always allow the design of robust FDI filters. A nonlinear geometric approach has been proposed to deal with the FPRG for a larger class of nonlinear systems [START_REF] De Persis | A geometric approach to nonlinear fault detection and isolation[END_REF]. This method aims at finding a state and output coordinates transformation that leads to a new set of observable decoupled residuals. The algorithm has been successfully applied to an aircraft nonlinear model [START_REF] Meskin | Nonlinear geometric approach to fault detection and isolation in an aircraft nonlinear longitudinal model[END_REF].

The FPRG could also be addressed through the H ∞ methodology. This multi-objective optimization approach provides a residual filter that maximizes (according to the H ∞ norm) the effect of the faults while minimizing some measure of the influence of the disturbances. One of the difficulties lies in transforming the system into standard form before applying the method [START_REF] Grenaille | A method for designing fault diagnosis filters for LPV polytopic systems[END_REF].

Performing Fault Isolation and Residual analysis

If decoupling methods succeed in producing residuals that are sensitive to only one fault, fault isolation is directly achieved. Using observer-based techniques, two schemes for fault isolation have been considered, namely the dedicated observer scheme (DOS) and the generalized observer scheme (GOS). DOS is a bank of observers sensitive to only one fault while GOS is composed of observers sensitive to all faults except one. If such a decoupling is impossible, a fault-incidence matrix should be built. This Boolean table shows the influence of each fault on all the residuals. For fault isolation to be possible, each fault should affect a different set of residuals. Note that structural analysis could help a great deal to construct this incidence matrix [START_REF] Düştegör | Structural analysis of fault isolability in the DAMADICS benchmark[END_REF].

When fault isolation has been shown to be possible, whatever the fault detection method employed, a residual analysis has to be performed. A test of the statistical hypotheses should be carried out to distinguish faulty from normal signal behavior. If a learning algorithm is considered, the test will determine whether the current operating point is located in a healthy class or in a faulty one, with the help of the preceding measurements. For a residual generated with a model-based approach, the test will identify a drift in the signal.

Direct fault diagnosis methods apply a fixed threshold as a detection test, but this ignores the previous values of the signal and it is very sensitive to outliers. More sophisticated tests are generally defined to detect a change in the mean of the signal. The Wald test (also called Sequential Probability Ratio Test -SPRT ) and the Page-Hinkley test (also known as the cumulative sum algorithm -CUSUM), based on the maximum likelihood criterion, are most commonly encountered in residual processing. Remarkable on-line extensions of these basic tests have been developed [START_REF] Basseville | Detection of Abrupt Changes: Theory and Application[END_REF].

AERONAUTICAL BENCHMARK

Hypotheses and airframe dynamics

Test cases for fault diagnosis have already been defined for industrial applications (DAMADICS project [START_REF] Bartyś | Introduction to the DAMADICS actuator FDI benchmark study[END_REF]) or for specific problems affecting commercial planes such as oscillatory faults [START_REF] Lavigne | Oscillatory failure case detection for new generation Airbus aircraft: a model-based challenge[END_REF]. The aeronautical benchmark we aim at defining is centered on an autonomous guided aerial vehicle with typical sensors and actuating devices.

In this paper, the proposed case study involves a six-degree-of-freedom surface-to-air missile. Actuating is performed using usual flight control surfaces and propulsion regulation (either turboprop or ramjet). The main sensor is an Inertial Measurement Unit (IMU), comprising gyrometers and accelerometers. It could possibly be combined with a GPS, however this case is not considered here. These standard components are preset and there is no hardware redundancy. We consider a missile with body-of-revolution symmetry, thus the inertia matrix is I = diag(a, b, b). The position of the center of gravity on the missile axis is marked by x bG , [ϕ, θ, ψ] are the Euler angles, [v bx , v by , v bz ] is the speed in body coordinates, [p, q, r] is the angular velocity, [x, y, z] is the position in the inertial frame,

Q = 1 2 • ρ • (v 2 bx + v 2 by + v 2 bz )
is the dynamic pressure, m is the aircraft mass, s ref and l ref are characteristic dimensions. The aerodynamic coefficients c (.) are piecewise constant, except c zb , which is a function of the Mach number and the angle of attack. With this notation, the dynamics is described by the following state equations.

                                                                ẋ ẏ ż    =   
cos ψ cos θ -sin ψ cos ϕ + cos ψ sin θ sin ϕ sin ψ sin ϕ + cos ψsinθ cos ϕ sin ψ cos θ cos ψ cos ϕ + sin ψ sin θ sin ϕ -cos ψ sin ϕ + sin ψ sin θ cos ϕ -sin θ cos θ sin ϕ cos θ cos ϕ

   •    v bx v by v bz    v bx = r • v by -q • v bz -sin θ • g + 1 m • [-Q • s ref • c x + f x ] v by = p • v bz -r • v bx + cos θ • sin ϕ • g + 1 m • -Q • s ref • c zb • v by √ v 2 by +v 2 bz v bz = q • v bx -p • v by + cos θ • cos ϕ • g + 1 m • -Q • s ref • c zb • v bz √ v 2 by +v 2 bz ṗ = 1 a • Q • s ref • l ref • c lδ l • δ l q = 1 b • (b -a) • p • r + Q • s ref • l ref • δ m -Q • s ref • c zb • v bz √ v 2 by +v 2 bz • (x bG -x bGref ) ṙ = 1 b • (a -b) • p • q + Q • s ref • l ref • δ n + Q • s ref • c zb • v by √ v 2 by +v 2 bz • (x bG -x bGref ) φ = p + (q sin ϕ + r cos ϕ) tan θ θ = q cos ϕ -r sin ϕ ψ = (q sin ϕ + r cos ϕ) 1 cos θ
The state vector is x = [x, y, z, v bx , v by , v bz , p, q, r, ϕ, θ, ψ] T , the input vector is u = [δ l , δ m , δ n , f x ] T where the δ (.) 's are the deflection angles corresponding to the three axes and f x is the propulsion rate. The IMU/INS system provides a measure of the entire state vector. IMU measurements are subject to errors such as biases, scale factors and noise. Considering, for example, a one-axis sensor δω p measuring the roll rate p, the measure is expressed as: δω p = k p • p + b p + G(0, σ p ) where k p is the scale factor, b p the bias and σ p the standard deviation of a zero-mean Gaussian white noise. These three parameters (for each sensor) are characteristic of the IMU and should fall within a set of values provided by the manufacturer.

The aircraft model belongs to the general class of nonlinear control-affine systems, which could be written as:

ẋ = f (x) + G(x) • u + H • w y = C • x + v
where f , G, H and C are smooth vector field and matrices with appropriate dimensions, and w and v are the perturbation vector and measurement noise.

The aircraft has four flight control surfaces in a symmetric scheme with two elevators (δ m1 , δ m2 ) and two rudders (δ n1 , δ n2 ). Servomotors are modeled as second-order systems saturated in position and velocity. The equivalent deflection angles are computed as:

     δ l = 1 4 • (-δ m1 + δ m2 -δ n1 + δ n2 ) δ m = 1 2 • (δ m1 + δ m2 ) δ n = 1 2 • (δ n1 + δ n2 )
These modelling and choice of sensors and actuators are representative of a large panel of aerospace vehicles [START_REF] Boskovic | Retrofit reconfigurable flight control in the presence of control effector damage[END_REF].

Flight scenario

The surface-to-air missile aims at intercepting a target that is following a given path at a constant altitude. Taking off from the ground, the missile is guided toward its goal via a proportional navigation guidance law. A groundbased radar provides the missile-target line-of-sight rate to compute the guidance orders. Examples of target and interceptor trajectories are shown in Figure 1. The corresponding initial conditions are in Table I.

Table I INITIAL CONDITIONS

Faults

A mathematical model of actuator faults should be precisely defined. As in [START_REF] Bartyś | Introduction to the DAMADICS actuator FDI benchmark study[END_REF] and [START_REF] Boskovic | Retrofit reconfigurable flight control in the presence of control effector damage[END_REF], we express the control input as u

= σ f • k f • u c + (1 -σ f ) • ū
where u c is the control input that should be applied if no fault disturbed the system. The other parameters, depending on the type of fault taking place, are specified as follows:

∀t > t fault ,          No fault : σ f = 1, k f = 1 Loss of effectiveness : σ f = 1, 0 < k f < 1 Freezing : σ f = 0, k f = 1, ū = u(t fault ): Lock -in -place u im or u iM (end stops) : hard -over
Most often in FDI applications, sensor faults are expressed as additive biases on the measurements. Considering the form of the measurement equation, as explained in Section 3.1, it seems appropriate to consider faults that statistically affect the biases, scale factors or noise standard deviations of the sensor model. This actually represents an awry IMU and is more realistic than a bias appearing abruptly. Based on the possible faults influencing the components that have been defined, Table II illustrates faults that can be applied on the case study. Trajectories corresponding to Fault 2 (actuator fault) and to Fault 3 (sensor fault) are plotted in Figure 1.

Methods to be investigated and quantitative performance indices

As seen in Section 2, reliability on the knowledge about the system is a major criterion for method selection. The model described in Section 3.1 has been validated by previous works in flight mechanics. It represents the behavior of the vehicle satisfactory for given speed and altitude conditions. In actual flight conditions its inner parameters are inaccurate, especially aerodynamic coefficients whose in-flight variations are not well known. This suggests that modern pattern recognition approaches could be of great help to enhance diagnosis robustness to these sources of uncertainty. Nevertheless, these techniques cannot be used alone because no record is available before the mission, and prior knowledge on the system should not be ignored. An interesting approach would be to assist a model-based algorithm with a model-free one, based on in-flight measurements. A line of inquiry may be given by a semi-parametric kernel machine taking into account the influences of both model and measurements to regularize the estimation.

The highly nonlinear dynamics governing the missile is limiting the range of methods using an explicit knowledgebased dynamical model. Indeed, linearization or polynomial approximation would only add more uncertainty to an already inaccurate model. Therefore, we tend to favor particle filtering and nonlinear geometric decoupling as the analytical methods to be considered. Nonlinear observers and multiple model techniques are also interesting contenders, if applicable. The assumption of bounded errors is an attractive way to handle uncertainty, and the aforementioned methods could be adapted in this context.

It must be kept in mind that the missile is controlled by a closed-loop guidance algorithm. This control scheme may lessen the impact of failing components, by modifying the fault dynamics. This may be taken into account in the design of fault detection methods that will test consistency between computed control inputs (i.e., controller outputs) and measured system outputs. It is even possible to design control inputs in such a way as to facilitate FDI; this is known as active diagnosis [START_REF] Bateman | Active fault detection and isolation strategy for an unmanned aerial vehicle with redundant flight control surfaces[END_REF].

Objective evaluation of all these methods is necessary in order to build an efficient aircraft FDI methodology. Method-indepedent performance indices must be defined to compare them. These indices should reflect the reliability of the decision rules, as it is a major concern in fault diagnosis. False-alarm and non-detection rates along with their relative amplitude provide such information. It is also essential that faults are detected as quickly as possible to allow the required safety measures to be taken. This is measured by the detection delay. See [START_REF] Bartyś | Introduction to the DAMADICS actuator FDI benchmark study[END_REF] for precise definitions of a number of performance indices, including those mentioned above.

CONCLUSIONS

A survey of the main fault diagnosis approaches has been conducted in this paper. A classification according to the type of knowledge available has been proposed, and the links between apparently dissimilar techniques coming from different communities have been emphasized. We defined a test-case for in-flight FDI, based on an interceptor missile with a predetermined set of sensors and actuators with no hardware redundancy. The nonlinear models of the aircraft, its components and the faults affecting them were described in detail. Finally, methods to be further investigated along with the performance criteria to compare them were set forth.

Figure 1 .

 1 Figure 1. Target, healthy and faulty missile trajectories


Julien Marzat
email: julien.marzat@onera.fr

Hélène Piet-Lahanier

Frédéric Damongeot

Eric Walter
email: eric.walter@lss.supelec.fr

A new model-free method performing closed-loop fault diagnosis for an aeronautical system

Keywords: aircraft, closed-loop system, fault detection and isolation, fault diagnosis, guidance and control

Fault diagnosis for a closed-loop controlled aeronautical system is considered. The geometry of the problem, the nonlinear model of the aircraft and two guidance laws are described. A new approach to perform fault detection, based on the study of the control signals, is then introduced. The method proposed allows the detection and isolation of actuator faults. Simulation results with measurement uncertainty illustrate the relevance of the approach. The influence of the guidance law and perspectives are discussed.

INTRODUCTION

In-flight securement of aircrafts can be performed either by completing on-board equipment with additional measurement devices or by means of algorithmic procedures exploiting the available measurements. In this paper, we aim at identifying early unexpected changes (faults) in an aerial system before they lead to a complete breakdown (failure), without adding sensors. This objective should be fulfilled by applying Fault Detection and Isolation (FDI) methods to a class of aerial systems with typical sensors and actuators. The set of devices is fixed and no hardware redundancy is allowed. A nonlinear knowledge-based dynamical model of the vehicle in state-space form is also available, but will only be used to design the control law. FDI for aerial and space vehicles have already been addressed in many papers (see, e.g., [START_REF] Patton | Fault detection and diagnosis in aerospace systems using analytical redundancy[END_REF]). Most of the work of the diagnosis community has been focused on linear systems but recently there has been some trend toward fault detection methods for nonlinear systems (see, e.g., [START_REF] Witczak | Modelling and Estimation Strategies for Fault Diagnosis of Non-Linear Systems: From Analytical to Soft Computing Approaches[END_REF]). In [START_REF] Marzat | Autonomous fault diagnosis: state of the art and aeronautical benchmark[END_REF], a survey of the main FDI methods is presented, where both modelfree and model-based methods are described and the most promising approaches for the aircraft securement problem in question are shortlisted. However, all these approaches are passive as they solely check the consistency between the inputs and outputs of the monitored system. The control is ignored in this framework although it may lessen the impact of the failing components, by modifying the fault dynamics. Control information provides additional insight on the system behavior and should be exploited. This is mainly performed either by applying active methods or by studying the closed-loop behavior.

Active fault diagnosis injects an auxiliary input into the system. The goal of this additional test signal is to distinguish faulty behavior from the normal one [START_REF] Campbell | Auxiliary signal design for failure detection[END_REF]). Designing this input can be seen as a multi-objective optimization problem. The signal should be large enough to permit detection, but also small enough to avoid performance degradation. This study has been carried out for linear models only [START_REF] Niemann | Active fault diagnosis in closedloop uncertain systems[END_REF]). The use of feedback information to design the auxiliary input has been investigated recently [START_REF] Ashari | Feedback in active fault detection[END_REF]). The major drawback of this approach is that the parameters of the two models (nominal and faulty) are supposed to be known, which is scarcely the case in real-world applications. Concerning aerospace systems, an interesting attempt is reported in [START_REF] Bateman | Actuators fault diagnosis and tolerant control for an unmanned aerial vehicle[END_REF], where an active diagnosis procedure for an UAV (unmanned aerial vehicle) with redundant flight control surfaces is proposed. Each actuator is excited with a specific signal such that the global resultant forces and moments are negligible if there is no fault.

To avoid the complex design of an additional input, an interesting alternative is to study the behavior of the system and its faults within the closed loop. The effect of feedback on robustness of fault diagnosis methods has been analyzed by [START_REF] Niemann | Robust fault detection in open loop vs. closed loop[END_REF] and more recently by [START_REF] Baïkeche | On parametric and nonparametric fault detection in linear closed-loop systems[END_REF]. For linear transfer function models, it has been shown that model uncertainty or multiplicative faults make the generated residuals depend on the control signal. A trade-off must be achieved between fault detection and performance of the closed-loop system. This is closely related to dual control, where a control law is designed in order to enhance a particular property of the system such as observability or diagnosability while preserving performance (see, e.g., [START_REF] Wittenmark | Adaptive dual control methods: An overview[END_REF]).

In this paper an alternative approach is described following the remark in [START_REF] Baïkeche | On parametric and nonparametric fault detection in linear closed-loop systems[END_REF]: in a feedbackcontrolled system, the control input is the signal containing the most information concerning faults. The originality of the present work is to study the fault detection problem from the point of view of a successful mission. If control fails, then faults may affect the regulated system. This paper shows how it is possible to detect and isolate them by analyzing the adequacy of the system response. Contrary to the active or control-loop based methods, we do not use any auxiliary input or trade-off controller that can affect performance. The control law is designed to fulfill the mission requirements and the monitoring is based on residuals showing adequacy to control objectives. The approach can be said to be model-free, as these signals are only functions of the measurements and do not rely on the explicit model of the system.

Section 2 describes the aeronautical case study. The model of the system, including its sensors and actuators is presented. Guidance and control laws are described along with the geometry of the problem. The set of possible faults affecting the system is also specified. Section 3 explains the principles of the new approach and presents the expression of residuals for guidance and control laws previously given. Section 4 describes the flight scenario, and the results of the approach for the considered aircraft. Finally, conclusions and perspectives are detailed.

MODEL

The case study considered here is based on the aeronautical benchmark described in [START_REF] Marzat | Autonomous fault diagnosis: state of the art and aeronautical benchmark[END_REF]. It involves a six-degree-of-freedom surface-to-air missile but only longitudinal movement is considered here. The autonomous vehicle aims at intercepting a non-maneuvering target whose position and speed are measured. It could also be seen as the following of waypoints by an UAV.

In this planar case, two means of control are used. One is a rudder whose axis is perpendicular to the plane where the vehicle flies and the other is propulsion rate. The main sensor is an Inertial Measurement Unit (IMU) comprising gyrometers and accelerometers, which is part of an Inertial Navigation System (INS). These standard components are preset and there is no hardware redundancy. With this notation, the dynamics is described by the following state equations.

State-space model

• b is the inertia term, • [x, z] is the position in the inertial frame, • [v bx , v bz ] is the speed in body coordinates, • θ is the orientation in the (x, z) plane, • q is the angular velocity, • δ m is the rudder deflection angle, • η is the propulsion rate, • Q = 1 2 ρ(v 2 bx + v 2 bz ) is the dynamic pressure, • α = arctan( v bz v bx )
                             ẋ = cos(θ)v bx + sin(θ)v bz ż = cos(θ)v bz -sin(θ)v bx v bx = -qv bz -sin(θ)g - Qs ref m [c x0 + c xA α + c xδm δm] + 1 m [f min + (fmax -f min )η] v bz = qv bx + cos(θ)g - Qs ref m [c z0 + c zA α + c zδm δm] q = Qs ref l ref b c m0 + cmaα + c mδm δm + l ref v 2 bx + v 2 bz cmqq θ = q
where the aerodynamic coefficients c (.) are piecewise continuous nonlinear functions of the Mach value and angle of attack. The state vector is x = [x, z, v bx , v bz , q, θ] T , the input vector is u = [δ m , η] T . This model belongs to the general class of nonlinear control-affine systems. Note that the design of the FDI methodology will not involve these equations, which are only used to tune the control law and simulate the process.

Measurements

The IMU provides measurements of non-gravitational acceleration and angular rate. The INS integrates these signals to estimate position, speed and orientation. The output vector is thus y = [x, z, ẋ, ż, v bx , v bz , θ, q, a bx , a bz ] T . Speed and position of the target are measured either with a ground radar or with an embedded tracking sensor. The target information vector is c = [x c , z c , ẋc , żc ] T .

Guidance and control

Interception involves finding a control law such that the distance between the missile and target goes to zero. The classical approach defines, in a decoupled way, a guidance law and then an autopilot that implements the acceleration orders. The interception criterion can be expressed in various geometrical ways, which leads to several guidance laws. In order to describe them, we need the following definitions: Guidance laws We consider two classical guidance laws, namely pure pursuit (PP) and proportional navigation guidance (PNG). The geometrical rules of both laws are given next (see [START_REF] Shneydor | Missile Guidance and Pursuit: Kinematics, Dynamics & Control[END_REF] for more details).

•
• Pure pursuit: PP makes the velocity of the pursuer v M coincide with the LOS r. This is the first guidance law that has been developed, inspired by how predators catch their prey. The simplest guidance consign is then to have the acceleration input proportional to the angle between the aircraft velocity and the LOS. This is known as velocity pursuit. Another version aims at aligning the axis of the vehicle on the LOS: this is attitude pursuit. In this study, velocity pursuit will be used. • Proportional navigation guidance: PNG achieves parallel navigation. The geometrical rule is to keep the direction of the LOS constant relative to inertial space, i.e., the LOS is kept parallel to the initial LOS. This is also called constant bearing and the rule could be very concisely stated as the LOS rate being equal to zero. The guidance consign is taken proportional to the LOS rate.

There exist many variations of these two guidance laws [START_REF] Lin | Modern navigation, guidance, and control processing[END_REF]). PP is less sensitive to noise than PNG, but PNG is more effective than PP because of its geometrical rule (PNG is almost following the optimal straight path). PNG is the most used law in the majority of guidance problems.

Fig. 2. Interception with PP (left) and PNG (right)

Control

An autopilot has been designed in order to achieve the guidance acceleration. Propulsion rate is obtained by a proportional regulation of the velocity to a reference. A linear controller computes the appropriate rudder angle.

Failures

We consider two types of actuator faults: the loss of half of the thrust due to an engine problem, and the locking of the rudder. Sensor faults are not considered here and will be addressed elsewhere.

APPROACH

Principles

The starting point is to acknowledge that control signals hold relevant information concerning faults in closed-loop systems. The controller is effectively trying to compensate for faults so as to reach its initial goal. For our interception problem, the success of the mission is a safetycritical operation. The fault diagnosis module should give enough information to decide whether to abort the task. Therefore, the diagnosis problem can be seen as that of assessing the adequacy of the system to fulfill the control requirements. It is equivalent to assuming that there is no fault if the controlled system is successful. How to detect faults in this context is now explained.

The fault detection method checks whether the specific geometrical rules of the guidance law are satisfied. Guidance residuals, for the two laws described in Section 2.3, are given in Section 3.2. Another signal that shows the behavior of the propulsion rate and will be used to build a residual is proposed in Section 3.3. These signals have predictable behavior when the guidance objective is fulfilled (equivalent to the absence of faults with our point of view). Mathematical expressions for all the residuals are in Table 1.

Guidance residuals

Pure pursuit Two residuals can be computed for this guidance law.

• The vehicle velocity should be aligned with the LOS.

The first residual r pp1 is the angle between the speed of the aircraft and the LOS. • In both attitude and velocity pursuit, the missile is required to turn at a rate equal to the LOS rate. Therefore, the angular velocity should be equal to the LOS rate for low maneuvering targets. This gives our second residual, r pp2 .

Proportional navigation

The only computable residual r png for this law is equal to the LOS rate, which should be equal to zero.

Propulsion signal analysis

The residuals described in the previous paragraph, monitor the behavior of the rudder. We also need checking the effectiveness of propulsion. A fault on the propulsion system is usually sudden. The relevant signal to analyze this process, r prop , is the quotient of the remaining distance (the LOS module) to the current speed of the vehicle. When such a fault occurs, there will be an abrupt change in the convergence rate of this signal.

Table 1. Expression of the residuals

r pp1 = 180 π arcsin v M v M × r r r pp2 = q -λ rpng = r × ṙ r 2 rprop = r v M

Residual analysis

This section presents the residual analysis procedure used to decide if faults have occurred.

Guidance residual If the control objective is achieved, we expect the guidance residuals to be small. They cannot be exactly equal to zero because of the configuration of the problem: the target is moving and the actuator response is not instantaneous. Nevertheless, we have a good idea of the expected response of the system when the guidance law is designed. Based on that prior knowledge and the uncertainty level of the sensors (given by the manufacturer), a simple threshold decision logic can be chosen. Note that, once the convergence of the residuals is achieved, the signals do not vary much. It seems then interesting to monitor the derivatives of the residuals (if the noise level allows it) or to use a statistical test to detect a drift in the mean. This is not the principal scope of this paper but the decision issue should be further addressed to enhance robustness.

Propulsion residual r prop is another kind of signal. In normal conditions, this "time-to-go" is regularly decreasing following a globally linear slope. When a propulsion loss appears, the slope changes. Basically, the aircraft is slowed down by this fault and thus the interception may still be possible but later than expected. To identify this slope change, we propose the following adaptive slope tracker algorithm which estimates (with a least-square method) the parameters of the slope on an interval, and uses them to predict the expected values of r prop on the next interval. The mean squared error between the prediction and the real value is computed on this next interval.

We thus obtain one error value for each interval, except the first one. This error signal is expected to be small in normal operating conditions and large for the interval where the slope change occurs.

Algorithm 1. Online slope change detection

n ← number of points in each interval k ← 1 e prop ← 0 [a 1 , a 2 ] ← [0, 0] loop • On interval [k, k + n], estimate [a 1 , a 2 ] such as r prop = a 1 t + a 2 • On interval [k + n, k + 2n], e prop (k) = 1 n k+2n j=k+n [r prop (j) -(a 1 j + a 2 )] 2 • k ← k + n end loop

SIMULATION RESULTS

This section shows the results of the method presented in Section 3 on the model detailed in Section 2. The simulation time step is 0.01s.

Flight scenario and fault occurrences

Flight conditions are given in Table 2 and faults considered in Table 3. Successful interception trajectories have been shown in Figure 2. Missed interception for both laws due to rudder locking is displayed in Figure 3. Note that the propulsion fault may just delay the interception, but could also make it fail if the missile becomes slower than its target. The rudder mainly controls the vehicle orientation, while the thrust influences the norm of the velocity. The guidance residuals contain only angle or angular velocity information and thus will strongly react to rudder locking. The propulsion residual is function of the velocity norm and will be affected by propulsion loss only. We now describe the uncertainty affecting the IMU and the target tracking device. IMU measurements are subject to various errors such as biases, scale factors and noise. Considering, for example, a one-axis sensor q measuring the roll rate q, the measure is modeled as: q = k q q + b q + N (0, σ 2 q ) where k q is the scale factor, b q the bias and σ q the standard deviation of a zero-mean Gaussian white noise. These three parameters (for each sensor) are characteristic of the IMU and should fall within a set of values provided by the manufacturer. The target tracking device is supposed to be only affected by zeromean Gaussian white noise.

Results

The first case we consider is the locking of the rudder alone.

Pure pursuit guidance

Remember that we have two residuals for the PP guidance law. The first one, r pp1 , is not much affected by measurement uncertainty because it only uses the measured position of the target and the velocity measurements provided by the aircraft IMU/INS. The second residual, r pp2 , is much noisier because its computation requires both position and velocity of the target. The two signals, filtered with a fourth-order Butterworth low-pass filter to reduce the noise effect, are shown in Figure 4. Both residuals are reacting to the fault in the same time scale.

Proportional navigation guidance

The r png signal is very noisy, due to the use of the measurements of target position and speed, along with IMU outputs. Therefore, if we use a simple threshold logic we have to choose a relatively high value to avoid a high false-alarm rate. Figure 5 displays the r png signal in normal and faulty circumstances. It has been filtered the same way as the other residuals. It would probably be preferable to use a statistical test to detect an abrupt change in the mean of this residual. This remark also stands for the processing of r pp2 . Thrust residual Consider now the 50% loss of propulsion.

The residual r prop that should monitor the propulsion behavior depends little on the guidance law. This is why only the results with PNG are shown on Figure 6, as the results with PP should be similar. On this figure is also displayed the error signal e prop obtained with Algorithm 1, which is actually our residual. The detection is achieved with a delay equal to the width of the interval window.

Here a window of 100 points has been chosen, leading to a one-second delay.

Chosen thresholds and corresponding detection delays for all the residuals are shown in Table 4. Two choices are given for each threshold: an optimistic one and a conservative one. Note that the detection delay for the rudder fault may appear high, but it is justified by the incipient behavior of the fault.

Finally, we consider the two faults successively: first the rudder locking at 18s then the thrust loss at 20s. Figure 7 shows that each residual (e prop to the propulsion and The PP law allows a more reliable decision than with only the PNG residual, because its two available residuals contain little noise. However, proportional navigation guidance has been found to be more efficient in most applications: miss distance and interception time are lower than those obtained with PP. Selection of either law becomes a trade-off between efficiency and safety.

Elements of comparison

The newly proposed method has to be compared with other approaches to evaluate its potential as objectively as possible. A first comparison strategy is to extract results from papers on closely related topics. However, models and simulation conditions differ so the exercise is limited in scope to some rather general statement. For example, the active method described in [START_REF] Bateman | Actuators fault diagnosis and tolerant control for an unmanned aerial vehicle[END_REF] is applied to an UAV in order to detect rudder locking. The results reported in this paper show detection delays comparable to our values. This active method, however, requires hardware redundancy and may destabilize the system with the additional inputs involved. On the contrary, the missile involved in our case study is equipped with non-redundant devices and leaves the control law unchanged.

A complementary comparison strategy, which is being carried out but requires much more time, is to implement all the approaches to be compared on the same significant test case. The system used in the present paper is part of a generic test-case for in-flight FDI, which has classical dynamics, sensors, actuators and faults scenarios (cf [START_REF] Marzat | Autonomous fault diagnosis: state of the art and aeronautical benchmark[END_REF]). The results of the candidate approaches should be evaluated with respect to detection delays, but also to false-alarm and non-detection rates, and computational complexity. The development of a systematic comparison method between diagnosis approaches is seeked for. Such a method should tune each diagnosis procedure to its best before comparing them on the basis of performance indices such as those mentioned above. The design of this methodology is beyond the scope of this paper but at the heart of our future work.

Nevertheless, the way our method is built already gives us some information on its usefulness. Model-based methods will require more knowledge of the system, more parameters to be tuned and more computational complexity than the one proposed here, which should be particularly interesting when no model is available, or when the model turns out to be too complex to be employed.

CONCLUSIONS

A model-free fault diagnosis method based on the study of closed-loop control signals has been proposed. This strategy has been applied to a realistic aeronautical benchmark composed of an aircraft with typical non-redundant sensors and actuators, described by its nonlinear longitudinal model. These first results are encouraging, but further investigations are needed to enhance the decision process (with, e.g., statistical considerations). The tuning of the thresholds should not only consider detection delay but also other performance indices such as false-alarm and non-detection rates. The effect of possible disturbances (wind) may be taken into account. Note that these robustness issues stand true for every diagnosis method and no simple solution is available. To clarify the situation, the design of a systematic comparison method between diagnosis approaches is to be addressed in the immediate future.

More generally, the new approach we have described has attractive properties compared to those described in Section 1. Active fault diagnosis may cause stability or controllability problems, due to unknown dynamics induced by additional inputs. Our method exploits the guidance constraints that form the basis of the elaboration of the control law. Therefore no performance reduction is observed, contrary to methods that try to combine control and diagnosis. If the control law is correctly designed according to the mission and physical constraints, fault diagnosis can be performed easily within the described framework. The model-free nature of the approach allows its application to every kind of model and not linear ones only.

Extension to the three-dimensional case should be straightforward. We will then have three different residuals that should allow detection of faults on each rudder (and partial isolation, due to coupling), along with the propulsion residual to identify thrust trouble.

  is the angle of attack, • m is the aircraft mass, • f min and f max are constants of the propulsion model, • s ref and l ref are characteristic dimensions, • c (.) are the aerodynamic coefficients.

  Fig. 1. Geometry of the problem

Fig. 3 .

 3 Fig. 3. Missed interception with PP (left) and PNG (right)

Fig. 4 .

 4 Fig. 4. Pursuit residuals: no fault (up) and rudder locked (down)

Fig. 6 .

 6 Fig. 6. Propulsion residual: no fault (left) and half propulsion (right)

Fig. 7 .

 7 Fig. 7. Two successive faults: propulsion (left) and rudder (right) residuals r png to the rudder) is sensitive to only one fault. This demonstrates the possibility of fault isolation.

Table 2 .

 2 Flight conditions

		Nominal speed Initial position
	Target	150 m/s	x = 5000 m z = 3000 m
	Missile	270 m/s	x = 0 m z = 0 m

Table 3 .

 3 Faults considered

	Component affected	Propulsion	Rudder
	Fault	50% loss	lock-in-place
	Interpretation	engine failure	power failure, freezing
	Instant	18 s	20 s

Table 4 .

 4 Residual analysis and detection delays

	Residual	Threshold values	Detection delay
	r pp1	1.75°2	°3.6 s 5.3 s
	r pp2	0.002 s -1 0.003 s -1	2.3 s 4.86 s
	rpng	0.003 s -1 0.004 s -1	2.5 s 5.19 s
	eprop	> 0.0005	1 s