Runtime Monitoring of Flight Control with Incremental Nonlinear Dynamic Inversion

Runtime monitoring of flight control is an alternate approach for safety assurance, if the absence of design errors in the software of a nominal control law is not fully assured during design. A backup controller is engaged by the system after a failure of the nominal controller has been detected. Due to a lack of experience with novel aircraft configurations, the backup controller may be engaged due to unforeseen disturbances or system failures. As the backup controller provides only degraded flight control, its engagement then imposes an additional risk. In this paper, a novel concept for monitoring of a nominal controller's outputs is proposed. It allows the nominal controller to retain actuator control authority if the aircraft leaves the safety envelope of the backup controller due to exogenous disturbances. The design bases on barrier function theory, while model dependency is reduced through an incremental formulation of the correlation between the envelope's boundary and the control limits. Validation is provided by analysis of missed detections and false alarms in a simulative use case.