Fault-Tolerant Control

• Also called: FTC
• Category: Control › Feedback control
• Tags: fault-tolerance, flight-control, robust-control, reliability, multirotor

Control design that keeps a system stable and usable after faults such as a failed actuator or sensor, by tolerating the fault or by detecting it and reconfiguring the controller.

Definition

Fault-tolerant control (FTC) aims to keep a system safe and, where possible, still performing its task after something has gone wrong: an actuator stuck, weakened or lost, a sensor biased or dead, or structural damage. It is usually divided into two approaches. Passive fault-tolerant control designs one fixed controller, often using robust control techniques, that remains stable for a defined set of faults without needing to know which has occurred. Active fault-tolerant control detects and isolates the fault at run time, a step called fault detection and isolation (FDI) or fault detection and diagnosis, and then reconfigures the controller, the control allocation or the mission to suit the changed system.

The options depend on how much redundancy remains. On a hexacopter or a manipulator with spare degrees of freedom, a failed actuator can often be handled by redistributing commands among the others through control allocation. Where there is no spare actuator, the controller must give something up. A standard example is a quadrotor that loses one rotor: with the remaining three it cannot control all three rotation axes and the total thrust independently. Mueller and D'Andrea showed in 2014 that the vehicle can still be flown by letting it spin continuously about its yaw axis and controlling only the direction of its thrust axis and its position. Similar reasoning applies to aircraft with damaged control surfaces and robots that lose a joint or a leg.

Fault tolerance concerns the whole loop, not only the control law. Fault detection must be fast and reliable enough to act on before the system becomes unrecoverable, and the reconfigured controller often relies on state estimates that are themselves harder to obtain after the fault. A spinning quadrotor, for example, is difficult for standard cameras because of motion blur, which is why state estimation under such conditions has been studied with event cameras. Testing usually combines simulation of injected faults, hardware-in-the-loop experiments and, where possible, deliberate faults on tethered or protected hardware.

Why it matters

Robots and drones increasingly operate near people and far from repair. A failure that can be absorbed in software, rather than requiring extra hardware or ending in a crash, improves safety and reliability at little cost. Fault-tolerant control is also a regulatory and certification concern in aviation and in other safety-critical domains.

Key applications

• Recovering multirotors from rotor or motor failure
• Control allocation for redundant actuators on aircraft and drones
• Continuing manipulation after joint failures or locked joints
• Legged robots adapting gait after leg damage
• Sensor fault handling in state estimation and navigation

In practice

A team adds rotor-failure handling to a quadrotor's flight software. A detector compares commanded and measured angular accelerations from the IMU and flags a rotor loss within a short time window. On detection, the controller switches from the normal cascaded attitude controller to a reduced-attitude controller that lets the vehicle spin about its yaw axis while tilting the spin axis to control horizontal motion. The team tests the switch first in simulation with injected failures, then on hardware with a rotor commanded to zero thrust over a net, and checks that the vehicle's thrust-to-weight ratio leaves enough margin to hold altitude on three rotors.

Common misconceptions

• Fault tolerance always requires redundant hardware — some systems, such as quadrotors, can remain controllable after an actuator loss by giving up control of a less important degree of freedom
• Fault-tolerant control is only a controller design problem — fast fault detection and reliable state estimation after the fault are often the harder parts
• A fault-tolerant system performs as well after a fault — reconfiguration usually trades performance, such as yaw control or payload capacity, for continued safe operation

Who should know this

• Drone and flight-control engineers
• Safety and reliability engineers for autonomous systems
• Control researchers working on robust and adaptive control
• Field robotics engineers designing for remote operation

Related technologies

• Fault Detection and Isolation (FDI)
• Control Allocation
• Robust Control
• Incremental Nonlinear Dynamic Inversion (INDI)
• PX4 Autopilot

Related terms

• UAV
• Cascaded Control
• Thrust-to-Weight Ratio
• Event Camera
• Visual-Inertial Odometry
• IMU

Related projects

• MAVROS: ROS gateway for MAVLink-compatible autopilots (PX4, ArduPilot)
• Pegasus Simulator: Photorealistic multirotor simulation on NVIDIA Isaac Sim with PX4-in-the-loop