Counter Optimization-Based Validation of Flight Control System Monitoring

Traditional certification approaches for flight control software aim at maximizing the confidence that all design errors have been removed during design time. For the certification of novel and complex flight control laws, however, this approach becomes increasingly difficult. An alternative approach is to ensure safety of flight through online monitoring of the aircraft when controlled by the complex law. The monitor switches command authority to a backup controller if the complex law has failed to respond to its inputs in a safe way. This work constitutes the first step for the design and validation of a monitoring function that evaluates the command outputs of the nominal controller with respect to its dynamic response requirements and the hazards for system safety. Thereby, we focus on the backup controllers capability of preserving safety after it is engaged by the monitoring function. We present a structured approach for approximation of the backup controllers safety set that bases on flight-physical assessment of the considered hazard for safety and incorporates set-based maneuverability requirements of the nominal controller. Furthermore, we suggest a counter optimization-based worst-case validation procedure that can be used early in the system development phase to assess the monitoring system and thereby validate the performance of the nominal controller in the presence of safety constraints. Finally, we present validation results for a high-fidelity use-case considering the system dynamics of a vertical take off and landing aircraft in hover flight.