Elevator Control System

A typical aircraft has two elevators, one on each side of the fuselage, attached on the horizontal tails. To enhance the safety of the aircraft, the elevator control system contains these redundant parts:

If the aircraft is flying perfectly level, then the actuator position should maintain a constant value. The fault detection system registers a failure in an actuator if:

The fault detection system also registers a fault in one of the hydraulic circuits if the pressure is out of bounds or if the pressure changes rapidly. In this example, the fault detection system checks that:

Fault Detection Control Logic

The Stateflow® chart Mode Logic defines the fault detection logic for the elevator control system. The chart contains a parallel substate for each actuator in the system. Each actuator can be in one of five modes:Passive,Standby,Active,Off, andIsolated. These operating modes are represented as substates of the parallel states.

By default, the outer actuators start inActivemode and the inner actuators start inStandbymode. If a failure is detected in the outer actuators or in the hydraulic circuits that are connected to them, the fault detection system responds by disabling the outer actuators and activating the inner actuators.

Inject Failures Into Fault Detection System

To experiment with the model, during simulation, you can introduce hydraulic circuit and actuator position failures into the fault detection system through the Failure Injection UI.

For example, to inject a failure in Hydraulic Circuit 1, select theH1check box and clickUpdate. The UI runs this MATLAB® code to communicate with the Simulink® model:

blockname=[mname '/Signal conditioning '... 'and failures /Hydraulic Pressures/Measured ',char(10),... 'Hydraulic system 1 ',... 'pressures/Hydraulic pressure/H1_fail']; val=get(handles.H1,'Value');

if val set_param(blockname,'value','1'); else set_param(blockname,'value','0'); end

This code turns on a switch in the Signal conditioning subsystem that causes the fault detection system to register a fault in the hydraulic circuit.

The chart Mode Logic responds to failures in the hydraulic circuits and actuators by using truth table functions and event broadcasting. For example, if the fault detection system registers an isolated failure in Hydraulic Circuit 1, then:

After the fault detection systems registers a failure in Hydraulic Circuit 1, the left outer actuator is turned off, the right outer actuator is placed on standby, and the inner actuators are activated.

Recover from Hydraulic Failures

The fault detection control logic enables the system to recover from a hydraulic circuit failure. For example, to bring the Hydraulic Circuit 1 back online, in the Failure Injection UI, clear theH1check box and clickUpdate. In the chart, the condition!u.low_press[0]becomes true, so the substateLOtransitions from theOffmode to theStandbymode. As a result, the left outer actuator can then be activated in the event that the fault detection system registers another failure later in the simulation.

Isolate Actuators After Failures

When the fault detection system registers a failure in one of the actuators, that actuator can no longer be activated. In the chart Mode Logic, the failure of an actuator is represented by the substateIsolated. This substate has no outgoing transitions so once an actuator enters theIsolated状态,它仍然在该州的the simulation.

References

Pieter J. Mosterman and Jason Ghidella, "Model Reuse for the Training of Fault Scenarios in Aerospace," inProceedings of the AIAA® Modeling and Simulation Technologies Conference, CD-ROM, paper 2004-4931, August 16 - 19, 2004, Rhode Island Convention Center, Providence, RI.

Jason R. Ghidella and Pieter J. Mosterman, "Applying Model-Based Design to a Fault Detection, Isolation, and Recovery System," inMilitary Embedded Systems, Summer, 2006.