17.1.   INTRODUCTION

Today’s complex systems, like high-performance aircraft, require sophisticated
control techniques to support all aspects of operation: from flight
controls through mission management to environmental controls, just to give
a few examples. All this, of course, is done using a multitude of computer
systems, all of which rely heavily on software technology. Software systems
now play a dual role. Not only do they implement system functionalities, but
they are also becoming the primary vehicle for system integration. One of the
main goals of software is to implement control functions: open- and closed-
loop control, from low-level regulation to high-level supervisory control.
However, software enables new capabilities in control. It offers a framework
that provides great flexibility for developing novel algorithms that significantly
improve the performance of the system. Furthermore, brand new
functionalities can be created that could not be implemented in any other
way.

Any real-life system is prone to physical (hardware) and logical (software)
failures. These systems also require a high degree of reliability and safety,
therefore, the effects of these failures must be mitigated and control must be
maintained under all fault scenarios. If systems are designed with redundancy,
control decisions have to be made about when and how backup
systems should be activated and how exactly the reconfiguration should be
executed. For instance, aircraft often have redundant actuators for control
surfaces. If one actuator fails, then the second actuator can still drive the
control surface, although larger forces will be required. In order to manage
the fault scenario described, we need to make a series of decisions and take
control actions, such as (i) the fault has to be detected, (ii) the fault
source - the actuator - has to be identified and the magnitude of failure
estimated (e.g., is it a partial degradation or a total failure), (iii) depending
on the nature of failure, a new control algorithm has to be selected that can
compensate for the partial or complete loss of the actuator, (iv) the plant has
to be reconfigured so that the faulty actuator can be moved ‘‘offline,’’ and (v)
the new control algorithm has to be brought up with the good actuator in a
way that current operation is maintained. All these decisions must be made
by a control system that incorporates not only simple regulatory loops and
the supervisory control logic, but also a set of components that detect,
isolate, and manage faults, in coordination with the control functions.

Traditional control theory gives very little guidance to the implementer of
these systems. Mathematical models and formal analysis techniques have
been developed for specific fault scenarios, but there is no general theory of
control system design and analysis that encompasses all possible scenarios.
Solutions applied to existing systems tend to take a pragmatic approach.
Potential fault situations are pre-enumerated, and appropriate fault accommodation
actions are built into the supervisory controller for each case. The
approach works well for these cases, but may break down in unforeseen
situations.