This paper presents a method for deriving requirements for the efficiency of diagnostic functions in distributed electronic turbofan engine control systems. Distributed engine control systems consist of sensor, actuator, and control unit nodes that exchange data over a communication network. The method is applicable to engine control systems that are partially redundant. Traditionally, turbofan engine control systems use dual channel solutions in which all units are duplicated. Our method is intended for analyzing the diagnostic requirements for systems in which a subset of the sensors and the actuators is nonredundant. Such systems rely on intelligent monitoring and analytical redundancy to detect and tolerate failures in the nonredundant units. These techniques cannot provide perfect diagnostic coverage and, hence, our method focuses on analyzing the impact of nonperfect diagnostic coverage on the reliability and safety of distributed engine control systems. The method is based on a probabilistic analysis that combines fault trees and Markov chains. The input parameters for these models include failure rates as well as several coverage factors that characterize the performance of the diagnostic functions. Since the use of intelligent monitoring can cause false alarms, i.e., an error is falsely indicated by a diagnostic function, the parameters also include a false alarm rate. The method was used to derive the diagnostic requirements for a hypothetical unmanned aerial vehicle engine control system. Given the requirement that an engine failure due to the control system is not allowed to occur more than ten times per million hours, the diagnostic functions in a node must achieve 99% error coverage for transient faults and 90–99% error coverage for permanent faults. The system-level diagnosis must achieve 90–95% detection coverage for node failures, which are not detected by the nodes themselves. These results are based on the assumption that transient faults are 100 times more frequent than permanent faults. It is important to have a method for deriving probabilistic requirements on diagnostic functions for engine control systems that rely on analytical redundancy as a means to reduce the hardware redundancy. The proposed method allows us to do this using an existing tool (FAULTTREE+) for safety and reliability analysis.

A thrust control concept for a military turbofan engine is evaluated at sea level and static operation. Most of the design is performed in the linear domain and most validations are done by simulations of nonlinear models. The thrust control is included as an add-on to a robust and multivariable control concept. The presented methods are also applicable for control of other estimated properties. The thrust in this concept is estimated from engine measurements and engine control inputs and both a linear and a nonlinear estimator are presented. The simulation results are promising and the design methods are straight forward. For the estimator a Kalman filter is designed and the thrust control loop are simplified to a single input single output system with the estimator included, which allows standard design methods to be applied. For the operating regime the linear designs have also shown to be applicable to the nonlinear system.

No abstract

This article will present that a robust Kalman filter design has a favorable property, when applied on thrust estimation on a low bypass turbofan gas turbine engine, compared to the regular Kalman filter design. This property is a larger operation range in parameters around the linearization point. On the other hand, the robust Kalman filter has marginally lower accuracy at the linearization point. This paper will present a method for describing the uncertainties in the engine model for use in the design of a robust Kalman filter. Both a regular Kalman filter and a robust Kalman filters are evaluated through simulations around a linearization point by using simulations of a nonlinear military turbofan engine.

This paper presents a method to derive the efficiency of diagnostic functions so that consistency with safety requirements is met. The method is applied to a distributed UAV engine control system, but could as well be applicable to any other mechatronic system. A control system architecture is proposed with a minimum of hardware redundancy for lowest cost and simple design. Efficient diagnostic functions (executable assertions in software) are used to detect and isolate errors. The goal is to completely recover from any transient error and reconfigure the system after a permanent error so that engine thrust remains unaffected. Given the requirement that an engine failure due to the control system is not allowed to occur more than 10 times per million hours, any permanent or transient error must be correctly handled with 99% certainty on node level and 90–95% on system level. The high error coverage figures are much driven by the assumption that a transient error occurs 1 time per 1000 hours in any control system node. The high number used for transient errors are due to the concern about Single Event Upsets (SEUs) that have become a dominating cause of errors in electronic equipment in flight applications.