Software-in-the-loop and hardware-in-the-loop testing of failure prognostics and decision making tools for aircraft systems will facilitate more comprehensive and cost-effective testing than what is practical to conduct with flight tests. A framework is described for the offline recreation of dynamic loads on simulated or physical aircraft powertrain components based on a real-time simulation of airframe dynamics running on a flight simulator, an inner-loop flight control policy executed by either an autopilot routine or a human pilot, and a supervisory fault management control policy. The offline testing framework is described for the example of battery charge depletion failure scenarios onboard a prototype electric unmanned aerial vehicle.

**Abstract** In modern fighter aircraft with statically unstable airframe designs, the flight control system is considered flight critical, i.e. the aircraft will encounter a catastrophic event if the system fails. Consequently, the system design has to meet high levels of reliability and failure immunity. In this presentation, an overview will be provided on the basic concepts employed in flight critical system design for fault tolerance. Different methods of redundancy implementation, failure management, and health management will be discussed. Basic concepts in fault diagnostics will also be discussed, along with some new concepts for implementation of prognostics in reducing levels of physical system redundancy. **Bio** David S. Bodden is Lockheed Martin Senior Fellow. He recieved BS in Aerospace Engineering from Texas A&M University in 1976 and MS in Engineering Science and Mechanics from Virginia Tech in 1984. Mr. Bodden’s technical career has encompassed a broad scope of technology areas. He has worked in structural dynamics, advanced design, conceptual design, flight control systems, and prognostics. His management experience includes six years as Chief of the Control Law design and Analysis Group followed by seven years as the Senior Manager of Flight Control Systems. Mr. Bodden was selected as a Technical Fellow in Flight Controls at LM Aeronautics in 2002 and as a Senior Fellow in 2007. Mr. Bodden has authored numerous papers and technical proposals, and managed numerous technology development programs. He served on the AIAA Guidance, Navigation, and Control Technical Committee, he has served as the Chairman of the Lockheed Martin Corporate Task Force on Guidance and Control, he initiated and served as Chairman of the Lockheed Martin GNC Technology Focus Group, is former Chairman of the SAE Aerospace Control and Guidance Systems Committee, and he currently serves as Chairman of the Texas A&M Aerospace Advisory Board.

Failure prognosis - as a natural extension to the fault detection and isolation (FDI) problem - has become a key issue in a world where the economic impact of system reliability and cost-effective operation of critical assets is steadily increasing. Failure prognostic algorithms aim to characterize the evolution of incipient fault conditions in complex dynamic processes, thus allowing to estimate of the remaining useful life (RUL) of subsystems and components. Several examples can be used here to illustrate the range of possible applications for these algorithms: electro-mechanical systems, continuous-time manufacturing processes, structural damage analysis, and even fault tolerant software architectures. Most of them have in common the fact that they are highly complex, nonlinear, and affected by large-grain uncertainty. We introduce in this chapter an integrated failure prognosis architecture that is applicable to a variety of aircraft systems and industrial processes. We are targeting a specific rotorcraft system as a prototypical testbed for proof-of-concept. The overall architecture consists of an on-board and an off-board module for eventual on-platformimplementation purposes.

Actuator systems are employed widely in aerospace, transportation and industrial processes to provide power to critical loads, such as aircraft control surfaces. They must operate reliably and accurately in order for the vehicle / process to complete successfully its designated mission. Incipient actuator failure conditions may severely endanger the operational integrity of the vehicle / process and compromise its mission. The ability to maintain a stable and credible operation, even in the presence of incipient failures, is of paramount importance to accomplish “must achieve” mission objectives. This paper introduces a novel methodology for the fault-tolerant design of critical subsystems, such as an ElectroMechanical Actuator (EMA), that takes advantage of on-line, real-time estimates of the Remaining Useful Life (RUL) or Time-to-Failure (TTF) of a failing component and reconfigures the available control authority by trading off system performance with control activity. The primary goal is to complete critical mission objectives within a time window dictated by prognostic algorithms so that the fault mode is accommodated and an acceptable level of performance maintained for the duration of the mission. The proposed fault-tolerant control design is mathematically rigorous, generic and applicable to a variety of application domains. An EMA is used to illustrate the efficacy of the proposed approach.

The field of Prognostic Health Management (PHM) has been undergoing rapid growth in recent years, with development of increasingly sophisticated techniques for diagnosing faults in system components and estimating fault progression tra- jectories. Research efforts on how to utilize prognostic health information (e.g. for extending the remaining useful life of the system, increasing safety, or maximizing operational ef- fectiveness) are mostly in their early stages, however. This process of using prognostic information to determine a sys- tem’s actions or its configuration is beginning to be referred to as Prognostic Decision Making (PDM). In this paper we, first, propose a formulation of the PDM problem with the at- tributes of the aerospace domain in mind, outline some of the key requirements on PDM methods, and explore techniques that can be used as a foundation of PDM development. The problem of Pareto set viability, i.e. satisfaction of perfor- mance goals set for objective functions, is discussed next, followed by ideas for possible solutions. The ideas, termed Dynamic Constraint Redesign (DCR), have roots in the fields of Multidisciplinary Design Optimization and Game Theory. Prototype PDM and DCR algorithms are also described and results of their testing are presented.

This paper introduces a novel Prognostics-enhanced Automated Contingency Management (or ACM+P) paradigm based on both current health state (diagnosis) and future health state estimates (prognosis) for advanced autonomous systems. Including prognostics in ACM system allows not only fault accommodation, but also fault mitigation via proper control actions based on short term prognosis, and moreover, the establishment of a long term operational plan that optimizes the utility of the entire system based on long term prognostics. Technical challenges are identified and addressed by a hierarchical ACM+P architecture that allows fault accommodation and mitigation at various levels in the system ranging from component level control reconfiguration, system level control reconfiguration, to high level mission re-planning and resource redistribution. The ACM+P paradigm was developed and evaluated in a high fidelity Unmanned Aerial Vehicle (UAV) simulation environment with flight-proven baseline flight controller and simulated diagnostics and prognostics of flight control actuators. Simulation results are presented. The ACM+P concept, architecture and the generic methodologies presented in this paper are applicable to many advanced autonomous systems such as deep space probes, unmanned autonomous vehicles, and military and commercial aircraft.

One of the primary goals of Integrated Vehicle Health Management (IVHM) is to detect, diagnose, predict, and mitigate adverse events during the flight of an aircraft, regardless of the subsystem(s) from which the adverse event arises. To properly address this problem, it is critical to develop technologies that can integrate large, heterogeneous (meaning that they contain both continuous and discrete signals), asynchronous data streams from multiple subsystems in order to detect a potential adverse event, diagnose its cause, predict the effect of that event on the remaining useful life of the vehicle, and then take appropriate steps to mitigate the event if warranted. These data streams may have highly non-Gaussian distributions and can also contain discrete signals such as caution and warning messages which exhibit non-stationary and obey arbitrary noise models. At the aircraft level, a Vehicle-Level Reasoning System (VLRS) can be developed to provide aircraft with at least two significant capabilities: improvement of aircraft safety due to enhanced monitoring and reasoning about the aircraft’s health state, and also potential cost savings through Condition Based Maintenance (CBM). Along with the achieving the benefits of CBM, an important challenge facing aviation safety today is safeguarding against system- and component-level failures and malfunctions. Citation: A. N. Srivastava, D. Mylaraswamy, R. Mah, and E. Cooper, “Vehicle Level Reasoning Systems: Concept and Future Directions,” Society of Automotive Engineers Integrated Vehicle Health Management Book, Ian Jennions, Ed., 2011.

It is an inescapable truth that no matter how well a system is designed it will degrade, and if degrading parts are not repaired or replaced the system will fail. Avoiding the expense and safety risks associated with system failures is certainly a top priority in many systems; however, there is also a strong motivation not to be overly cautious in the design and maintenance of systems, due to the expense of maintenance and the undesirable sacrifices in performance and cost effectiveness incurred when systems are over designed for safety. This paper describes an analytical process that starts with the derivation of an expression to evaluate the desirability of future control outcomes, and eventually produces control routines that use uncertain prognostic information to optimize derived risk metrics. A case study on the design of fault-adaptive control for a skid-steered robot will illustrate some of the fundamental challenges of prognostics-based control design.

With the forecast increase in air traffic demand over the next decades, it is imperative to develop tools to provide traffic flow managers with the information required to support decision making. In particular, decision-support tools for traffic flow management should aid in limiting controller workload and complexity, while supporting increases in air traffic throughput. While many decision-support tools exist for short-term traffic planning, few have addressed the strategic needs for medium- and long-term planning for time horizons greater than 30 minutes. This paper seeks to address this gap through the introduction of 3D aircraft proximity maps that evaluate the future probability of presence of at least one or two aircraft at any given point of the airspace. Three types of proximity maps are presented: presence maps that indicate the local density of traffic; conflict maps that determine locations and probabilities of potential conflicts; and outliers maps that evaluate the probability of conflict due to aircraft not belonging to dominant traffic patterns. These maps provide traffic flow managers with information relating to the complexity and difficulty of managing an airspace. The intended purpose of the maps is to anticipate how aircraft flows will interact, and how outliers impact the dominant traffic flow for a given time period. This formulation is able to predict which "critical" regions may be subject to conflicts between aircraft, thereby requiring careful monitoring. These probabilities are computed using a generative aircraft flow model. Time-varying flow characteristics, such as geometrical configuration, speed, and probability density function of aircraft spatial distribution within the flow, are determined from archived Enhanced Traffic Management System data, using a tailored clustering algorithm. Aircraft not belonging to flows are identified as outliers.

A proactive approach to identifying and alleviating life-threatening conditions in the aviation system entails a well-defined process of identifying threats, evaluating causes, assessing risks, and implementing appropriate solutions. This process is not a trivial undertaking. It requires continuous monitoring of system performance in a non-punitive culture; learning from normal operational experience; comparing actual performance to expected performance; identifying the precursor events and conditions that foreshadow most accidents; designing appropriate interventions to minimize the risk of their occurrence; and having a system in place to monitor the efficacy of the interventions.