Feasibility Study of a PHM System for Electro-hydraulic Servo-actuators for Primary Flight Controls

Electro-Hydraulic Servo-Actuators (EHSA) are by far the mostly used type of actuators in aircraft primary flight control systems. Though electrical actuation is been considered since long as a possible replacement of hydraulic actuation for aircraft systems, EHSAs are still the technology of choice in the primary flight control systems of new commercial aircrafts. Considering that 10 or more EHSAs are typically used in an aircraft flight control system, the development of an effective PHM system for this equipment could provide large benefits and be of great interest for the OEMs and for the air fleet operators. This paper presents the results of a feasibility study making up the first part of an ongoing research activity focused on the development of a PHM system for EHSAs used in fly-bywire primary flight control systems and takes as a use case the primary flight control actuator of a wide body commercial aircraft. One of the key features of the research is the implementation of a PHM system without the addition of new sensors, taking advantage of the available signals. This offers the possibility of implementation of the PHM system on the existing platforms and not only as a proposition for new aircrafts designed with a complement of additional sensors. The enabling technologies for this PHM system borrow from the area of Bayesian estimation theory and specifically particle filtering and the information acquired from EHSA inflight and during pre-flight check is processed by appropriate algorithms in order to obtain relevant features, detect the degradation and estimate the Remaining Useful Life (RUL). The results are evaluated through appropriate metrics in order to assess the performance and effectiveness of the implemented PHM. This paper describes the methodology of the feasibility study, which shows how the novel PHM technologies proposed for a PHM system for the EHSAs of primary flight control actuators can allow the migration from unscheduled / oncondition maintenance to condition based maintenance targeting the perceived objectives of the OEM and of the aircraft operator.


INTRODUCTION
Flight control systems and their associated flight control servo-actuators are one of the critical aircraft systems and belong to the top operational disruption contributors.Developing effective PHM algorithms for primary flight control actuators that can be integrated in a health monitoring system for the entire aircraft flight control system will lead to a valuable technological advancement.
The benefits achievable from developing an efficient health monitoring system able to anticipate the failures of the aircraft flight control system fall in two areas: Improving troubleshooting of failures Costs related to unscheduled maintenance operation and to flight disruptions resulting from unexpected failures may vary in a relatively large range, depending on the type of aircraft and of its flight control system, on the operational environment, on the maintenance policies and on the aircraft usage.Though not easily quantifiable, these costs are at present a large fraction of the aircraft life cycle cost.
IATA projection for global spending in 2020 for maintenance, repair and overhaul is US$ 65 billion (IATA, 2011).Although the spending for flight control actuators will be only a fraction of that total figure, it is evident that the contribution gained from the introduction of an effective health monitoring system for aircraft flight control actuators will still contribute to a large cost saving for maintenance operations.Another large cost saving is obtained from the reduction of flight disruptions and delays.A recent study on integrated disruption management and flight planning shows that suitable planning can mitigate the effects of flight disruptions and lead to about 6% cost saving for the airline (Marla, Vaaben, Barnhart, 2011).
Primary flight control systems are an engineering area where PHM has found so far very limited interest, although they are one of the critical aircraft systems.This is attributed primarily to lack of relevant data, major difficulties in modeling and testing and a sound understanding of EHSA failure mechanisms.Some work has been reported on PHM for electromechanical flight control actuators, but almost very little or nothing for electrohydraulic servo-actuators (EHSA) for primary flight controls.However, although electromechanical actuators (EMA) for primary flight control systems are a long-term objective, some unresolved technological barriers, including the sensitivity to certain single point of failures that can lead to mechanical jams, result in a reluctance to adopt EMAs for flight safety critical applications.EMAs for primary flight controls have so far been limited to UAVs (Jacazio, 2008).For these reasons EHSAs remain the preferred solution for the primary flight control systems of new commercial aircraft as well as being almost universally used on the aircraft in service now and for the next decade.The only exception are some electrohydrostatic actuators (EHA) used as a backup to conventional EHSAs in the flight control systems of Airbus A380, A350, A400M, KC390, F35 and Gulfstream G650.This makes the development of a PHM system for EHSAs used in primary flight controls a proposition able to bring large benefits to the operation of an aircraft fleet.
Research and development of PHM systems for primary flight controls focused mostly on EMAs due to the growing interest in Unmanned Aerial Vehicle (UAV); moreover, the EMAs have a greater probability of critical failure than EHSAs.Byington, Watson and Edwards (2004) presented one of the few research papers focused on the hydraulic actuators for aviation.The authors examine the possibility of developing a PHM system for the F/A-18 stabilizer Electro-Hydraulic Servo-Valves (EHSVs).The data-driven approach developed uses neural network error-tracking techniques, along with fuzzy logic classifiers, Kalman filter state predictors, and feature fusion strategies.An interesting work was presented by NASA Ames Research Center (Narasimhan, Roychoudhury, Balaban & Saxena, 2010).The paper proposed a combined model-based and feature-driven diagnosis methodology that allows the detection of the common EMAs fault modes.Brown et al. (2009a and2009b) have shown the possibility of exploiting the particle filter for the diagnostics and prognostics of EHAs.

MOTIVATION
The physical and operational complexities typically encountered in critical EHSA systems necessitate new and innovative technologies whose underpinnings take advantage of physics of failure mechanisms, first principle models, novel Condition Indicator (CI) extraction and selection techniques, rigorous diagnostic and prognostic algorithms accompanied by appropriate performance metrics, and extensive seeded fault testing procedures.The challenges are: selection and placement of sensors for actuator systems, sensing of various actuator components for stress factors difficult to accomplish accurately and reliably, first principle or physics-based baseline and fatigue models, seeded fault testing for components.All require new and innovative approaches.A fundamental challenge in prognosis stems from the "large-grain" uncertainty inherent in the prediction task.Long-term prediction of the fault evolution requires means to represent and manage the inherent uncertainty.
An initial study of a PHM system for primary flight control actuators was performed by two of the authors of this paper and presented at the PHM Society Conference in 2015; the feasibility study described in this paper draws on the results of that initial work and shows how an innovative fault diagnosis and failure prognosis framework for EHSAs can successfully be developed by integrating effectively and mathematically rigorous and validated signal processing, feature extraction, diagnostic and prognostic algorithms with novel uncertainty representation and management tools in a platform that is computationally efficient and ready to be transitioned on-board an aircraft.
The feasibility study was performed taking as a use case the EHSA of a flight control actuator of a commercial aircraft in revenue service whose characteristics and performance are well known and documented.An extensive failure modes identification and analysis task was carried out to focus on critical/severe, frequent and testable failure modes, such as demagnetization of the servo-valve torque motor, crack of the servo-valve internal feedback spring, backlash in the actuator rod end.A high-fidelity mathematical model was developed which accepts the injection and progression of faults described by a physics based model of the fault development as a function of usage, time, operational and environmental conditions.Data relevant to a large number of flights of 10 aircraft were generated with the EHSA in healthy and progressively faulty conditions.Flights along different routes with different and varying environmental and operational conditions were considered, and the faults resulting as most critical from a FMECA analysis were addressed.

METHODOLOGY
The proposed methodology is based on an integrated framework for fault diagnosis and failure prognosis that relies on systems engineering principles and takes advantage of physics of failure models, Bayesian estimation methods and measurements acquired through the high-fidelity modeling effort; any available data from seeded fault testing and/or onboard the aircraft are used primarily for validation purposes.Fundamental to this approach is the development of highfidelity physics-based failure or fatigue models and the optimum selection and extraction of features or Condition Indicators (CI's) from raw data that form the characteristic signatures of specific fault modes.The latter are selected based on such criteria as sensitivity to particular fault modes and their correlation to ground truth data.The proposed framework employs a nonlinear state-space model of the plant, i.e. critical aircraft component, with unknown timevarying parameters and a Bayesian estimation algorithm, called particle filtering, to estimate the probability density function (PDF) of the state in real time (Orchard & Vachtsevanos, 2009).The state PDF is used to predict the evolution in time of the fault indicator, obtaining as a result the PDF of the Remaining Useful Life (RUL) for the faulty component/system.A critical fault is detected and identified by calling on the particle filter-based module that expresses the fault growth dynamics.Prognosis has been called the Achilles' heel of CBM/PHM due to major challenges arising from the inherent uncertainty in prediction.Prognosis may be understood as the result of the procedure where long-term (multi-step) predictions -describing the evolution in time of a fault indicatorare generated with the purpose of estimating the RUL of a failing component (Roemer, Byington, Kacprszynski, Vachtsevanos & Goebel, 2011).We begin by detailing the EHSA configuration adopted in this research, followed by a description of the modeling effort.The latter constitutes the essential source for baseline and fault data, determination of the optimum sensor selection and placement, inserted to monitor the components' behavioral modes, as well as validation of the diagnostic and prognostic algorithms.

EHSA CONFIGURATION
The EHSA used in this research is a typical electrohydraulic primary flight control actuator.It is composed of the hydraulic and the control parts.The first consists of one electrohydraulic servo-valve and a linear hydraulic actuator.The servo-valve is of the jet pipe type and it is made up of two stages with the first stage receiving the current command as the input and using the torque motor in order to move the jet projector thus creating a pressure differential between the two sides of the second stage spool, which controls the flow to the hydraulic actuator.The control structure uses a linear position transducer as the feedback sensor for closed loop position control.The reference architecture for the EHSA is shown in Figure 1.In order to ensure redundancy of the drives and, consequently, greater safety, two actuators acting on the same flight control surface are employed with the two EHSAs operating in an active-standby mode.
The EHSA is dual electrical interfacing with two independent electrical lanes.When in the active mode, the solenoid valve is energized and a pressure pilot signal for the mode valve is generated that brings this valve in a position such to connect the servo-valve control ports to the actuator ports, thereby allowing the actuator to move in response to the electrical signals received by the servo-valve.When the solenoid valve is de-energized, the hydraulic lines connected to the servovalve control ports are blocked while an interconnecting passage is created between the two ports of the hydraulic actuator; a damping orifice is located in the hydraulic bypass that is instrumental in generating a damping force on the actuator proportional to the actuator velocity.This avoids the insurgence of possible aeroelastic instability (flutter) in case of failure of both EHSAs connected to the same flight control surface.
In addition to the actuator position transducer, the EHSA has the following sensors: -A sensor measuring the position of the servo-valve spool -A sensor measuring the pressure differential between the two sides of the actuator -A sensor measuring the position of the mode valve These sensors are used in the existing EHSAs, together with other sing modalities, to implement continuous monitoring functions for detection of potentially flight critical failures (C-BIT) and to perform pre-flight checks (P-BIT) to ensure that no failure exists before flight.The sensor selection and placement problem presents significant challenges to the designer and is addressed via an optimization method that maximizes the (fault) signal to noise ratio.
The signals generated by the whole complement of sensors, together with the servo-valve and solenoid valve currents are effectively exploited by a PHM system, as detailed in this paper.In the application considered in this feasibility study, two equal EHSAs, mounted in parallel, control the position of a primary flight control surface, and are operated in an activestandby mode.At the beginning of each flight, one EHSA is activated, while the other one is kept in standby mode, and is activated in case of failure of the first one.The roles of the two EHSAs are periodically exchanged.

HIGH-FIDELITY MATHEMATICAL MODEL
A high-fidelity mathematical model is an essential tool to allow performing simulations of the equipment behavior in realistic flight conditions, thereby collecting data similar to those that could be obtained in flight.The following subparagraphs present the main features of the model.

Model characteristics
The mathematical model is a physics-based high-fidelity model made up by a complex set of differential and algebraic equations defining the relationships among the state variables and the physical parameters of all components of the EHSA.The model fully describes the set of two EHSAs working in active-standby mode to control the position of the flight control surface.Figure 2 shows the schematics of the interconnection between the two EHSAs (Actuator 1, Actuator 2) and the flight control surface subjected to the aerodynamic load.The mechanical connection between actuator and aerodynamic surface takes into account stiffness (ksa), structural damping (csa) and backlash (B).External damping associated to the surface movement in the atmosphere (cext) is also considered as well as the inertia of the aerodynamic surface.The torque obtained from the modeling of the torque motor is combined with the dynamic equations of the servo-valve jet pipe.The position of the jet pipe causes a different pressure recovery in the receiving ducts with ensuing variation of the pressures at the two opposite sides of the second stage spool of the servovalve.These pressures determined are then used in the dynamic equation of the spool to calculate the opening of the servo-valve metering ports.
The equations that describe the kinematic system take into account the influence of the feedback spring force, coulomb and viscous friction and structural stiffness and damping.
Starting from the position of the servo-valve spool, the flow resistance and continuity equations are written for the hydraulic sub-system made up by servo-valve, passageways and hydraulic linear actuator that allow computing the pressures in the two chambers of the actuator.
A 3-Degree-of-Freedom model describes the hydraulic linear actuator dynamics.In fact, the mathematical model considers the following state variables relevant to the positions: Position of the actuator output rod  Position of the underlying airframe structure, that deforms elastically when subjected to the actuator reaction loads It must also be noted that the model takes into account the dynamics of the two actuators connected to the flight control surface (Figure 2) acting in active-standby mode.The actuator model also considers the effect of coulomb friction as a function of the dynamic condition of the rod and of the geometrical and physical data of the seal as well as the pressures in the actuator chambers (Martini, L. J. 1984).
The mathematical model includes the description of all sensors, of the analog-to-digital and digital-to-analog converters, of the characteristics of the microprocessor closing the actuator position control loop (recursion rate, computation time) and of the control laws with the relevant gains implemented in the EHSA control electronics.
As a whole, the high-fidelity mathematical model makes up a virtual hardware enabling the generation of simulated data in healthy and degraded conditions to be used by the PHM system for determining the health status of the EHSA.

Software code
The high-fidelity mathematical model is implemented in a Matlab-Simulink software code, which is structured in different blocks according to the composition of the EHSA, allowing for rapid reconfiguration of the model whenever changes of the EHSA components are introduced.
The software code includes the mathematical description of the operational scenario, thereby allowing the flights simulations described in section 10, and the description of the physical processes that cause an initial fault to progress with usage and time that are presented in section 11.
The optimisation between stability and computational effort led to a fixed integration step of 10 -4 s corresponding to 6-9 hours to simulate a single flight.The fixed step was preferred to the variable step because the discretization of the signal during the analog-to-digital conversion was read by the solver as a discontinuity to be addressed reducing the time step.Moreover the fixed step simplifies the process to perform Software-In-the-Loop tests and allows the implementation of the actual Electronic Control Unit.
The capabilities offered by the server hosting the simulation software allow to perform simultaneously the simulations of the flights of ten aircraft.

Validation
The model validation was carried out using data acquired from tests and which included system frequency responses and responses to different stimuli.As shown in the example of Figure 3, the response of the mathematical model to a 2 Hz sinusoidal command is very close to the actual behavior, concerning both the servo-valve and the actuator.

DATA COLLECTION AND DATA MINING
Data can be collected both in-flight and on-ground during the pre-flight checks that are regularly performed before flight initiation to verify the correct operation of all actuator components that could enhance the health usage and monitoring system effectiveness.Furthermore, a PHM system for EHSAs could perform effectively by injecting selected stimuli in preflight.Specific motion profiles could be executed during ground checkout targeted towards identifying faults that otherwise may be difficult to be detected.A PHM system could also be provided with means to adjust the motion profiles to be executed based on the analysis of the preceding ones (e.g. if a fault needs to be confirmed or disambiguated, or if its severity needs to be established).Data collection for EHSAs for primary flight control actuators presents specific issues that are discussed in the following.

Data collection
Contrary to other mechanical systems that run continuously, primary flight control actuators are subjected most of the time during flight to commands of very small amplitude and duration, occurring randomly.Large commands are seldom given in flight and, therefore, techniques for signal collection and processing used in other systems may not be fully applicable.Moreover, flight control actuators are not normally provided with force sensors, temperature sensor, and supply and return pressure sensors; hence, the responses to the same command in flight may be different depending on the actual load, oil temperature and pressure.
Signals collected on ground during regular pre-flight checks (and possible additional checks) have the advantage of being assembled in more uniform conditions, but present the issue of requiring long periods to acquire a sufficiently large sequence of data.Consider a long-range aircraft with a typical flight mission of 10 hours.A series of 50 data points for performing a prognostic assessment would imply a time length of 500 flight hours, during which a fault could develop and progress to failure before the PHM system could generate an alert.It seems thus extremely difficult to develop an effective PHM system for EHSAs by relying on data collected on ground; a more promising approach may rely on a suitable combination of in-flight and on-ground data for the development and realization of a PHM system.

Signals availability and data processing
Important information, such as actuator load, oil pressure and temperature, is normally not available, though some information on the load could be inferred from the measurement of the pressure differential between the actuator chambers.Of course, a force sensor, as well as oil temperature and pressure sensors could be added to the sensor suite and considered for future implementation, but the current emphasis is in the development of a PHM system making use of only the already available signals.Actually, the load acting on the EHSA could be inferred from information available from other aircraft systems (dynamic pressure, aircraft attitude, ambient temperature), as the oil pressure and temperature are measured by sensors monitoring the aircraft hydraulic system, but that would require data exchange with other systems that could be implemented within the context of an Integrated Vehicle Health Monitoring (IVHM) system.Data pre-processing aims to improve the raw signal to noise ratio.Data processing, on the other hand, seeks to derive useful information from pre-processed signals, in terms of features or Condition Indicators (CIs).Details are deferred to a later section of this document.

Interdependence among aircraft systems
Most often, more than one actuator drives a primary flight control surface.Depending on the control architecture and the actuators configuration, a fault in one actuator may affect the performance of the healthy actuators driving the same flight control surface.Similarly, a healthy actuator may mask a fault in the parallel actuator.
EHSAs accept the hydraulic power supply from the aircraft hydraulic system.A fault in one part of this aircraft system may affect the performance of the flight control actuator.For instance, a failure of the high-pressure filter of the hydraulic system will cause a degradation of the EHSA performance.Such interdependencies are not considered in current study and will be introduced in future developments.

THE PARTICLE FILTERING FRAMEWORK FOR FAULT DIAGNOSIS AND FAILURE PROGNOSIS
Particle filtering has a direct application in the arena of fault detection and identification (FDI) as well as prediction of the time to failure of a critical component.Indeed, once the current state of the system is known, it is natural to implement FDI procedures by comparing the process behavior with patterns regarding normal or faulty operating conditions.(Vachtsevanos, Lewis, Romer, Hess & Wu, 2006;Arulampalam, Maskell, Gordon & Clapp, 2002).Similarly, particle filtering allows for the accurate prediction of the remaining useful life accounting robustly for uncertainty issues.
A fault diagnosis procedure involves the tasks of fault detection and identification (assessment of the severity of the fault).In this sense, the proposed particle-filter-based diagnosis framework aims to accomplish these tasks, under general assumptions of non-Gaussian noise structures and nonlinearities in process dynamic models, using a reduced particle population to represent the state pdf (Orchard, Kacprzynski, Goebel, Saha & Vachtsevanos, 2008).A compromise between model-based and data-driven techniques is accomplished by the use of a particle filterbased module built upon the nonlinear dynamic state model: {   ( + 1) =   (  (), ())   ( + 1) =   (  (),   (), ())   () = ℎ  (  (),   (), ()) . (1) Where fb, ft and ht are non-linear mappings, xd(t) is a collection of Boolean states associated with the presence of a particular operating condition in the system (normal operation, fault condition) xc(t) is a set of continuous-valued states that describe the evolution of the system given those operating conditions, fp(t) is a feature measurement, ω(t) and v(t) are non-Gaussian distributions that characterize the process and feature noise signals, respectively.
The second Equation in (1) describes the fault evolution as a function of time.In this document, it is represented by a symbolic regression model, as suggested in the sequel.At any given instant of time, this framework provides an estimate of the probability masses associated with each fault mode, as well as a Probability Density Function (PDF) estimate for meaningful physical variables in the system.PDF estimates for the system continuous-valued states (computed at the moment of fault detection) may be used as initial conditions in failure prognostic routines.As a result, a swift transition between the two modules (fault detection and prognosis) may be performed and reliable prognosis can be achieved within a few cycles of operation after the fault is declared.This characteristic is one of the main advantages of the particlefilter-based framework.
The overall workflow followed in this research study is summarized in the conceptual schematic of Figure 4.
Use cases are firstly defined that provide inputs to the failure analysis, the EHSA high-fidelity model and contribute to the development of the PHM system.The results of the failure analysis are used to select the most significant failures to be addressed by the PHM system; the corresponding fault progression models are developed next.Available actual operational data are used to create a representative operational scenario, which is used to perform flight simulations in healthy and faulty conditions using the EHSA high-fidelity model.The flight data obtained from these simulations are fed to the PHM system for analysis.The PHM system development follows the suggested guidelines and receives inputs from the use case definition, the failure analysis, the flight data and any laboratory tests that are performed on equipment in which specific degradation conditions are introduced.The PHM system performs feature identification, faults diagnosis and failure prognosis, while its accuracy is assessed according to appropriate PHM system performance metrics.
A PHM system for primary flight control actuators presents some critical issues that are peculiar to this type of systems, as briefly discussed in the following sub-paragraph.In case additional pre (post) flight tests are required for a more effective PHM system, the way these tests will be initiated (automatically from the Flight Control Computer?Upon pilot command?) must be addressed and accounted for.Whatever the solution, the process has safety implications and must be approved by the certification authorities.

FAILURE ANALYSIS
The first step in failure analysis is a Failure Modes and Effects Criticality Analysis (FMECA) in which all possible failures, their criticality and probability of occurrence were addressed.Then, a rule set was defined for determining an overall value of the criticality of a failure and eventually rank them in terms of their severity.For each failure, four possible ranges associated with values from 1 to 4 were identified.The adopted convention was such that the greater the score, the more critical the failure mode.The evaluation of the overall severity of a failure, and hence, the importance of developing suitable PHM algorithms to alert that an incipient failure is progressing, and may eventually lead to the failure considered the following criteria, as necessary for implementing PHM strategies:  Defect rate: the higher is the probability of a defect to occur, the greater the need of a PHM capability to alert of the defect. Severity: this is the criticality of the consequences of the failure.It is obvious that the more critical are the consequences of a failure, the greater the need to develop a PHM system. Replaceability: In case a component fails, different situations can occur ranging from the possibility to rapidly replace the failed component directly on the aircraft to the need to remove the entire actuator and replace the failed component in the shop.As the operations of replace a failed component become lengthier, the greater advantage is provided by a PHM system.
 Testability: Depending on its type, suitably processing the available signals, either online, or offline can recognize a developing fault, or additional sensors are required to detect the fault.This entails a lower or greater difficulty of developing a relevant PHM capability for that type of fault.
The following Table 1 presents a summary of the faults evaluation rules.For each fault the total score was computed and the faults overall severity was determined.This provided an indication on the initial selections of the faults to be considered in the feasibility study.

PHM SYSTEM ARCHITECTURE
The EHSA considered as a use case and shown in Figure 1 has the following complement of sensors:  Two LVDT type position transducers measuring the actuator output position. One LVT type position transducer measuring the position of the servo-valve spool. One LVT type position transducer measuring the position of the spool of the mode valve. A pressure differential transducer measuring the pressure difference between the two sides of the hydraulic actuator.In addition to the signals provided by the sensors listed above, the PHM system takes advantage of the knowledge of the following other information which is available in the Electronic Control Unit performing closed loop control and monitor of the EHSA: All data provided by the sensors both in flight and during specific tests performed on ground are properly manipulated to generate the features making up the basis for assessing the health status of the EHSA.The health status of the EHSA is currently monitored by dedicated procedures known as "C-BIT", "P-BIT" and "I-BIT".The C-BITs are monitoring routines continuously performed in flight to detect failures that are potentially flight safety critical and disable the EHSA operation when the failure is detected The P-BITs are specific checks performed in pre-flight to make sure that there are no dormant failures in the EHSA components designated to bring it in a safe mode if a failure is detected in flight by the C-BITs.The I-BITs are checks performed periodically on ground to check the condition of a few components of the EHSA.The scope of the existing "C-BIT", "P-BIT" and "I-BIT" is to determine whether the EHSA is operating correctly, or is failed.They are not used to identify a progressive degradation, or, in case of failure, which specific part of the EHSA is the root cause of the failure.The PHM system, which is being addressed in the present research, aims at responding to the following points: continuously, or at pre-flight.It must be noticed that a few features are built in a way similar to that used by C-BITs and P-BITs to detect failures.However, while these built-in tests provide a discrete output (good or failed) and an immediate corrective action is taken, the values of the features of the PHM system are used by its other modules to detect degradations and map their progression.Their outputs thus provide a fundamental indication of the EHSA health status, which allows the maintainer to properly schedule pertinent maintenance activities.After a fault is detected, it is classified calling upon an appropriate methodology based on a neural network construct analyzing the differences between nominal and actual feature values.The neural network is trained using a Bayesian regulation backpropagation algorithm.
A PHM system for EHSAs can be most effective by processing data collected in flight and on ground during dedicated tests as described in the following sub-paragraphs.

Data collection in flight
The scope of collecting data in flight is to:  Take advantage of the continuous streaming of data to generate a very large dataset that can be exploited by the reasoning system to generate an early warning of a degradation  Facilitate the detection of faults that are difficult to be identified in the ground tests  Provide alerts to be further investigated with specific ground tests between flights aimed at confirming the presence of a degradation and at disambiguating the fault modes

Data collection on ground
Pre-flight (or post-flight) tests are carried out to collect signals in response to a well-defined sequence of position commands.Figure 6 shows the sequence of position commands to be injected into the actuators that has been identified as the most effective for detecting EHSA degradations.It must be emphasized that in addition to the command sequence of Figure 6, specific additional tests could be carried out on ground when deemed necessary following alerts generated in flight.
The ground tests are performed with one actuator active, while the other actuator is in standby, are then repeated reversing the operating conditions for the two actuators.
Since two electrical lanes control the servo-valve and the solenoid valve, each ground test is performed twice, each time with one of the two electrical lanes active.

Data processing
Data Pre-Processing -Raw sensor data (current, voltage, pressure, temperature, etc.) must be pre-processed in order to reduce the data dimensionality and improve the (fault) Signal to Noise Ratio (SNR).Typical pre-processing routines include data compression and filtering, Time Synchronous Averaging (TSA) of vibration data, FFTs, among others.We introduce a de-noising methodology based on blind deconvolution.The process of blind deconvolution attempts to restore the unknown signal by estimating an inverse filter, which is related to the fault at hand.

FLIGHT SIMULATIONS
A fundamental step in this research work was to run a very large number of realistic simulations representative of flights of several aircraft with equipments in healthy and faulty conditions.This firstly required to set up an operational scenario which could reproduce as closely as possible the variable conditions encountered during an aircraft flight as outlined in the next sub-paragraphs.

Operational scenario
An operational scenario was developed with the intent of allowing simulations of aircraft flights in the range of variable environmental and operating conditions that can be encountered in real operations, with the end objective of generating data equivalent to those that could be collected in actual flights.
The operational scenario was built taking as a basis data on commands, loads, aircraft altitude, etc., collected in several flights, and a random variability within an expected maximum range was introduced for each input variable during each simulated flight in order to reproduce the different operating conditions to which the EHSA could be subjected during each flight.
The operational scenario defines at each instant of the simulated flight the position command, the load acting on the actuator, and the environmental and operational conditions.
The time sequence of commands is comprised of three terms: (2) where: xb(t) is a basic sequence of position commands which is given during a typical flight xv(t) is a variable sequence of position commands which is varied in each flight xl(t) are commands generated from the flight control computer in response to the disturbances to the aircraft attitude created by variations of the external loads (gusts, turbulence) The load FA acting on the actuator is the sum of a term proportional to the actuator position xc (and hence to the position of the aerodynamic surface) and of a disturbance resulting from wind turbulence: FA = kL(xc+xo) + Fd (3) where: FA = Load acting on the actuator kL = Ratio between force acting on the actuator and actuator position xc = Actuator position xo = Additional term allowing to take into account that the force acting on the actuator in flight is different from zero when the actuator position xc is equal to zero Fd = Load on the actuator resulting from wind turbulence The coefficient kL is not constant, but is a variable during flight.After having defined a maximum value kLmax, the coefficient kL is assumed to vary linearly with time from 0.3kLmax at takeoff to kLmax at cruising altitude, then decreasing linearly with time form kLmax to 0.3 kLmax during the descent phase.The Dryden turbulence model represents the wind turbulence, which is a mathematical model of continuous gusts.The Dryden model treats the linear and angular velocity components of continuous gusts as spatially varying stochastic processes and specifies each component's power spectral density.The operational scenario takes into account via appropriate models the possible variations during flight of the following quantities:  Temperature of the hydraulic fluid  Supply and return pressures  Vibrations  Electrical noise

Operation on ground
When the EHSA is commanded through the specified command sequence, the variability of conditions on ground is taken into account, again considering the effects of wind turbulence, variation of hydraulic fluid pressure and temperature, and electrical noise.

Operation with healthy actuators
After having defined the operational scenario, representative of actual aircraft flights, flight simulations were run for 10 different aircrafts with the same EHSA of each aircraft in a healthy state, but the values of the characteristic parameters of each EHSA were different from each other, albeit within the normal tolerance band.In total, 100 flights of 5 hours were simulated for each aircraft, with each flight in different operating and environmental conditions, thereby accumulating data for 5000 flight hours.This very large database of the EHSA signals made up the reference for healthy actuators in the ensuing PHM analysis.

Fault injection
A number of fault cases were selected among the most critical ones resulting from the failure analysis discussed previously.
For each fault case, it was assumed that an initial small fault appears at a certain instant in time, then progressing with usage and time according to a physics based model describing the fault-to-failure mechanism for that specific type of fault (Equation 1).It must be emphasized that the fault which is simulated is not the variation of a performance parameter of the EHSA (for instance: variation of null bias, increased actuator leakage, etc.), but the actual degradation of a physical characteristic, such as variation of the radial clearance between spool and sleeve of the servo-valve due to wear resulting from relative movements in the presence of contaminated hydraulic fluid, etc.For each of the fault cases considered, the same fault was injected in the EHSAs of three different aircraft, and flights were then simulated paralleling the healthy conditions.That was important to best assess the merits of the PHM algorithms in recognizing the fault and, eventually, predicting the remaining useful life.In this feasibility study, the presence of only one fault at a time was considered because the simultaneous occurrence of multiple faults is an event of very low probability.However, the methodology followed in this study could be extended to the case of multiple faults.

Feature selection
For each of the fault cases addressed, the feature(s) best describing the fault progression was identified and selected to alert of a developing degradation.Features are extracted from the raw data after subjecting them to a de-noising process, as suggested previously.

FAULT DIAGNOSIS AND FAILURE PROGNOSIS
Several faults of different components of the EHSA have been addressed, which were selected based on the results of the failure analysis described in Section 8.Here below, the procedure followed for fault diagnosis and failure prognosis is described, then two significant fault cases are presented.

The modeling framework
Degradation detection and prediction algorithms rely on data, a model of the degradation process and an estimation method that, given the current state of the system, predicts its evolution over the next time step.Such models are typically based on first principles while others are built on the basis of data.We exploit in this effort a modeling framework called Symbolic Regression.
Symbolic Regression searches the space of mathematical expressions to find the model that best fits a given dataset, both in terms of accuracy and simplicity.No particular model is provided as a starting point to the algorithm.Instead, initial expressions are formed by randomly combining mathematical building blocks such as mathematical operators, analytic functions, constants, and state variables.New equations are then formed by combining previous ones, using genetic programming.In linear regression, the dependent variable is a linear combination of the parameters (but need not be linear in the independent variables).
Nonlinear Symbolic Regression and other regression techniques incorporating uncertainty are based on similar principles.We take advantage of the Symbolic Regression tool provided by Schmidt and Lipson (2009) to represent the features as function of time.The model parameters can be tuned on-line as data is streaming in, following an iterative procedure featuring a recursive least square algorithm over properly sized moving time windows.Fitting quality and most significantly the time required to converge to the real data sequence depend on the initial guess for the model parameters and on the size of the moving window.

Fault detection through data driven approach
The approach for fault detection is a purely data-driven one.
A baseline representing the feature behavior under healthy conditions is built upon the first 100 data points and an automatic, customizable threshold is set to a value covering 95% of the baseline probability distribution.Simulation data are then streamed in and compared to the initial baseline; the anomaly detection flag is raised when the new distribution differs from the baseline by a customizable confidence level equal to or greater than 95%.The fault detection is performed through a purely data-driven method, comparing the current feature distribution with a predefined baseline representative of the healthy conditions as shown in the examples of fault cases presented in paragraphs from 11.4 to 11.7.

Failure prognosis
The prognostic framework takes advantage of a nonlinear process (fault / degradation) model, a Bayesian estimation method using particle filtering and real-time measurements (Orchard & Vachtsevanos, 2009) where x i 0:t is the state trajectory and y1:t are the measurements up to time t.The simplest implementation of this algorithm, the Sequential Importance Re-sampling (SIR) particle filter (Orchard, 2007), updates the weights using the likelihood of yt as: =  −1 (  |  ) Long-term predictions are used to estimate the probability of failure in a system given a hazard zone that is defined via a probability density function with lower and upper bounds for the domain of the random variable, denoted as Hlb and Hup, respectively.The probability of failure at any future time instant is estimated by combining both the weights w (i) t+k of predicted trajectories and specifications for the hazard zone through the application of the Law of Total Probabilities.The resulting RUL pdf, where tRUL refers to RUL, provides the basis for the generation of confidence intervals and expectations for prognosis, ̂  = ∑ (Failure| =  ̂ () ,   ,   )

𝑖=1
As shown in Figure 7, this approach makes use of degradation models that are tuned or their parameters adjusted to compute the current a-priori state of the system, (  | 1:−1 ), and to perform the iterative calculation that leads to the long term prediction ( + | 1: ).Auto-tuned models are required to describe and follow changes in the degradation process and to describe, in the best possible way, the process and measurement noise.So, in order to match the model behavior to the real system, as closely as possible, one time-dependent tunable model is used.The use of particle filter techniques for prognosis involves the a-priori definition of:  The non-linear degradation model (a symbolic regression model, as mentioned above) and feature mapping (4) (5) If for any reason a crack is generated in the internal feedback spring of the servo-valve, the stresses developed in the crack as the servo-valve operates may cause a growth of the crack with a corresponding progressive reduction of its stiffness and a variation of the servo-valve and hence of the whole EHSA performance.This process can be described by applying the basic principles of fracture mechanics.The crack propagation depends on the cyclic variation of the stress intensity factor, which on its turn depends on the torque developed by the torque motor as a function of the time sequence of commands received by the Flight Control Computer during the flight.The main effect of the crack propagation on the system performances is the progressive increase of the mechanical gain of the servo-valve, defined as the ratio between the spool displacement and the commanded servo-valve current.This behavior can be well observed through the analysis of the pre-flight checks reported in Figure 6.The mechanical gain behavior has been investigated through the analysis of the simulated in-flight data as well, showing good correlation with the fault growth and relatively high signal-to-noise ratio as described in Figure 8.
The fault detection is performed through a purely data-driven method, comparing the current feature distribution with a predefined baseline representative of the healthy conditions An example of its behavior is reported in Figure 9.The average fault size at detection is 15.3 %.The analysis of mappings and noise has been performed through the study of large data sets while taking advantages of symbolic regression techniques.The threshold for failure declaration has been defined as the 50 th percentile of the feature distribution associated with a crack progression equal to 30% of its critical value.After this value, the crack growth becomes extremely fast in the studied case due to the inception of instability conditions in the actuator.
An example of the output of the prognostic framework is reported in Figure 11.The performance of the prognostic routine are investigated through the  analysis reported in Figure 12 and the associated prognostic horizon is 44 flight hours.The mean Relative Accuracy (RA) is 88%, while the Cumulative Relative Accuracy (RA) is 84.5%.Demagnetization of the torque motor leads to a reduction of the torque motor gain, which is the ratio between torque developed and input current.Demagnetization can be originated by different causes, one of which is the increase of the temperature T above a limit To.The temperature prevailing in the torque motor magnets is a function of the temperatures of ambient and hydraulic fluid, on the time history of the current through the torque motor coils and on the heat transfer between magnets, hydraulic fluid and ambient.A model for the degradation of the magnetic properties of the torque motor was hence prepared and used for representing this fault case.The main effect associated with the demagnetization of the torque motor is the decrease of the mechanical gain, which can be observed during preflight checks through the behavior of the servo-valve spool position and currents, as in Figure 13.The selected feature is the complementary to one of the mechanical gain; its behavior for in-flight data is reported in Figure 14.The fault detection algorithm is able to observe the fault inception at 18.9% of its critical value.The threshold for failure declaration has been set at 80% of the fault progression that is the value associated with the loss of the actuator control.The analysis, of which an example is reported in Figure 15, allows observing a prognostic horizon of 42 hours.The RA is equal to 86.2%, while the CRA is 83.4%.
It must be noted that although the  diagram becomes accurate only in the last phases of the fault progression, it still provides the comfortable prognostic horizon of 42 hours.This is due to a very early detection of the fault, which then takes long time to progress and become a failure.A distortion of the jet pipe can occur in several ways; however, its main consequence is a non-symmetrical direction of the jet pipe flow when the servo-valve current is equal to zero.This entails a change of the servo-valve null bias from its initial value.
The distortion of the jet pipe can be originated by different causes; strong vibrations of the aircraft are one potential main cause.In fact, it is possible that due to a small construction flaw, sudden accelerations of the aircraft structure induced by gusts cause a permanent deformation of the jet pipe in one direction, but not in the other, hence leading to a progressive increasing distortion.This fault can be described by relating a permanent deformation increase of the jet pipe to the load generated on the actuator by gusts when such loads are greater than a limit value.
The most significant effect of the jet pipe distortion fault mode is the generation and increase of a null-bias current in the servo-valve, which the system is forced to command to offset the asymmetry induced in the hydraulic amplifier.
The null-bias increase can be observed on-ground as the mean value of the servo-valve current during the sinusoidal command, while it can be computed in-flight by a properly sized moving average of the servo-valve current, as shown in Figure 16 and Figure 17, where it is reported in a nondimensional form with respect to its maximum value of 4 mA.The data-driven fault detection algorithm is able to recognize the anomaly inception for an average fault size of 13.4% of its critical value.
The RA for prognosis is 82.28%, while the cumulative value is 80.15%.2009), making this solution suitable for effective prognosis.
On an average degradation lasting 20000 flight hours, the fault detection algorithm is able to detect defects within 8.7% of the critical size, while the prognostic routines provides an average prognostic horizon higher than 500 flight hours, with RA 74% and CRA 86.6%.The associated  analysis is reported in Figure 20.The algorithm has been hence tested on faster degradations (up to 8000 flight hours), providing consistent results.
Figure 20:  analysis for wear in the rod-ends

CONCLUSION
The feasibility study presented in this paper is focused on demonstrating the possibility of creating an effective PHM system for EHSAs used in primary flight control systems.A rigorous and fully comprehensive approach was undertaken for describing the faults and their progression based on physics models, identifying the most significant features, simulating aircraft flights in a realistic environment, collecting data, processing them, and developing data-driven fault detectors capable of detecting the occurrence of faults in their incipient stages for a safety critical aircraft actuation system.Furthermore, a particle filtering estimation method was adopted for prediction of the remaining useful life of the EHSA.An overview of the PHM architecture was presented and applied to a few EHSA fault modes based on a FMECA study.The fault modes were modeled using physics-offailure mechanisms indicating the primary failure effects.Features were derived using statistical analysis to quantify the primary failure effect.Then, simulation data were acquired to validate the models.Although the feasibility study is focused on EHSAs for primary flight controls, the overall PHM architecture developed in this study can be applied to an entire range of systems and application domains.In fact, similar techniques, which allow for early fault detection with acceptable performance in the presence of faults, are being developed for a wide variety of system actuators in both manned and unmanned air vehicles.Therefore, the concept of using system health information (diagnosis and prognosis) is at the forefront of modern space and aviation applications requiring increasingly sophisticated diagnostic and prognostic systems that are robust, reliable, and relatively inexpensive.


Improvement of the aircraft operational reliability and dispatch ability by avoiding: o Aircraft on ground immobilization o Takeoff delays and cancellations o Re-routing o In-flight turn back  Reduction of direct maintenance costs by: o Performing maintenance operations of anticipated failures at an airline main base o

Figure 2 :
Figure 2: Schematics of the connection between the EHSAs and the flight controil surface The servo-valve torque motor is modelled using the Urata (2007a) magnetic circuit model.Applying the proposed equations is possible to express the torque generated as a function of the magnetic flux density of each air-gap.The model also takes into account the influence of unequal airgap thickness in servo valve torque motor, this is achieved by expressing the reluctance of the air-gap as a function of airgap thickness.

Figure 3 :
Figure 3: Example of EHSA mathematical model validation

Figure 4 :
Figure 4: Research flow block diagram


Detect a progressive degradation of an EHSA component  Disambiguate among the possible different origins of the EHSA faulty behaviour  Perform a prediction of the fault evolution and estimate the remaining useful life 9.1.PHM system organization The general architecture of the health monitoring system for the EHSA is shown in Figure 5. C-BITs and P-BITs are run in parallel to the acquisition and processing of the EHSA signals that generates the health indexes.The I-BITs are not shown in the diagram of Figure 5 because they are not run

Figure 5 :
Figure 5: General architecture of the EHSA health monitoring system The PHM functions can be conceptually grouped in a few modules indicated in Figure 5 as:  Feature extraction / condition assessment  Reasoner  Fault diagnostics  Failure prognostics The function of the first module (Feature extraction / condition assessment) is to process all available signals to generate the most significant features.The same module applies also de-noising techniques to raw signals accepted from the sensors.In addition, the module receives the indication of the operational condition (in-flight, on-ground, EHSA active or in standby), that defines the relevant feature calculation.The Reasoner module receives the stream of features and performs the function of determining whether the EHSA is healthy or faulty, and in the second case, disambiguates among the possible different faults indicating which part of Selection -Condition Indicator (CI) selection and extraction constitute the cornerstone for accurate and reliable fault diagnosis.The objective is to transform high dimensional raw data into tractable low dimensional form (information) without loss of useful information.Feature selection is application dependent.We are seeking those CIs, for a particular class of fault modes, from a large candidate set that possesses properties of fault distinguishability and detectability.CI extraction, on the other hand, is an algorithmic process where features are extracted in a computationally efficient manner from sensor data, while preserving the maximum information content.Examples of features are the servo-valve mechanical gain and null bias.

Figure 6 :
Figure 6: Command sequence for on-ground tests The final step is to map the computed condition indicators to the known fault values inserted during the seeded fault test.
Figure 7 -The prognostic framework

Figure 9 :
Figure 9: Mechanical gain for degrading servo-valve feedback spring

Figure 14 :
Figure 14: Feature for degrading magnets in the torquemotor

Figure 18 :
Figure 18:  analysis for jet-pipe distortion 11.7.Fault case #4: Backlash in the actuator rod endThe spherical bearings of the actuator rod ends are sized such to be subjected to a small backlash increase over the actuator service life.However, failures have occurred in which an anomalous wear of the spherical bearing caused a large backlash increase leading to high airframe vibrations in flight.A model of wear of the bearing was created providing the description of the backlash increase as a function of the combination of actuator loads and bearing rotation.Due to the active-stand by configuration, the backlash effects can be observed only through the on-ground tests by comparing the signals of the LVDTs integral with the two actuators, as shown in Figure19.

Figure 19 :
Figure 19: Actuators position with degrading rod-endsThe reliance on pre-flight data only would be an issue for the other investigated degradations due to data scarcity; the degradation of the hydraulic actuators rod-end usually follows a much slower degradation pattern (van denBossche, 2009), making this solution suitable for effective prognosis.On an average degradation lasting 20000 flight hours, the fault detection algorithm is able to detect defects within 8.7% of the critical size, while the prognostic routines provides an average prognostic horizon higher than 500 flight hours, with

Table 1 :
Faults evaluation rules . Prognosis is achieved by performing two sequential steps, prediction and filtering.Prediction uses both the knowledge of the previous state estimate and the process model to generate the a priori state pdf estimate for the next time instant,