Aerospace and Electronic Systems Magazine April 2017 - 5

plication domains of FDIR. FDIR systems (1) generate a set of
residuals to detect if a fault has occurred [15]-[19], (2) isolate the
type of the fault, and (3) reconfigure the system according to the
fault type, using precomputed strategies or recalculating control
parameters online [20]. To alleviate the effect of noise on residuals, robust residual generation techniques, such as a Kalman Filter
based approach [21], have been used. Hansen and Blanke have
used error residuals from different sources including ground speed,
estimated wind speed, and propeller speed, to successfully detect
and isolate airspeed sensor faults [22]. The false positive and false
negative detection rate of a FDIR method can be evaluated by several statistical models [20], [23].

PILOTS
The PILOTS programming language and software [13], [24], [25]
uses established mathematical relationships between different data
streams to monitor incoming data and
detect errors.1 Combining dynamic data
driven modeling and real-time instrumentation monitoring, PILOTS is an
effective way to catch and correct errors
before they become a problem in order to
ensure continued use of reliable data. Our
PILOTS approach differs from information fusion by combining data and physics-based models to resolve anomalies as
opposed to averaging out the estimation
errors to maintain flight positions. The
central theme is a dynamic data-driven
applications system (DDDAS) [26] applied to avionics that utilizes measurements, model relationships, and software
for rapidly correcting for aircraft sensor
errors.
Since PILOTS implements faulttolerant functionality to withstand data
errors, it is expected that PILOTS'
framework has resemblance to FDIR
1

Available in open-source form at:
http://wcl.cs.rpi.edu/pilots/.

APRIL 2017

systems. Due to PILOTS' domain-specific programming language
approach, PILOTS users have the ability to control error conditions more generally through error signatures. The differences between PILOTS' error signatures and FDIR's error residuals [27],
[28] will be analyzed in the Discussion section.
In this article, we first introduce our model for data-error-tolerant stream processing and review flight accidents primarily due to
sensor faults. Second, we describe the mathematical concepts we
have developed to detect sensor faults from independently-measured redundant data streams, namely error signatures [24] and
mode likelihood vectors. Third, we illustrate the use of the PILOTS
system in analyzing two commercial aviation accidents initially
caused by erroneous data coming from malfunctioning or incorrect sensors: Air France 447's pitot tubes icing and Tuninter 1153's
installation of a wrong fuel quantity indicator. Finally, we discuss
related work and advocate advances in sensor processing for safer
air transportation.

Figure 1.

Aircraft airspeed sensor configuration. (Adapted from https://en.wikipedia.org/wiki/Pitot-static_system.)

IEEE A&E SYSTEMS MAGAZINE

https://en.wikipedia.org/wiki/Pitot-static_system http://wcl.cs.rpi.edu/pilots/

Table of Contents for the Digital Edition of Aerospace and Electronic Systems Magazine April 2017