Formal specification of requirements for analytical redundancy ba

Graduate Theses, Dissertations, and Problem Reports 2000 Formal specification of requirements for analytical redundancy- based fault -tolerant flight control systems Diego Del Gobbo West Virginia University Follow this and additional works at: https://researchrepository.edu/etd Recommended Citation Del Gobbo, Diego, "Formal specification of requirements for analytical redundancy-based fault -tolerant flight control systems" (2000). Graduate Theses, Dissertations, and Problem Reports.edu/etd/2378 This Dissertation is protected by copyright and/or related rights. It has been brought to you by the The Research Repository @ WVU with permission from the rights-holder(s). You are free to use this Dissertation in any way that is permitted by the copyright and related rights legislation that applies to your use.

For other uses you must obtain permission from the rights-holder(s) directly, unless additional rights are indicated by a Creative Commons license in the record and/ or on the work itself. This Dissertation has been accepted for inclusion in WVU Graduate Theses, Dissertations, and Problem Reports collection by an authorized administrator of The Research Repository @ WVU. For more information, please contact researchrepository@mail. Formal Specification of Requirements for Analytical Redundancy based Fault Tolerant Flight Control Systems Diego Del Gobbo Dissertation submitted to the College of Engineering and Mineral Resources at West Virginia University in partial fulfillment of the requirements for the degree of Doctor of Philosophy in Aerospace Engineering Marcello Napolitano, Ph., Chair Larry Banta, Ph.

Robert Bond, Ph. Ali Mili, Ph. Gary Morris, Ph. Department of Mechanical and Aerospace Engineering Morgantown, West Virginia 2000 Keywords: Fault Tolerance, Flight Control System, Analytic Redundancy, System Requirements Specification, Relational Algebra Copyright 2000 Diego Del Gobbo Abstract Formal Specification of Requirements for Analytical Redundancy based Fault Tolerant Flight Control Systems By Diego Del Gobbo Flight control systems are undergoing a rapid process of automation.

The use of Fly-By-Wire digital flight control systems in commercial aviation (Airbus 320 and Boeing FBW-B777) is a clear sign of this trend. The increased automation goes in par- allel with an increased complexity of flight control systems with obvious consequences on reliability and safety. Flight control systems must meet strict fault-tolerance re- quirements. The standard solution to achieving fault tolerance capability relies on multi-string architectures.

On the other hand, multi-string architectures further in- crease the complexity of the system inducing a reduction of overall reliability. In the past two decades a variety of techniques based on analytical redundancy have been suggested for fault diagnosis purposes. While research on analytical redun- dancy has obtained desirable results, a design methodology involving requirements specification and feasibility analysis of analytical redundancy based fault tolerant flight control systems is missing. The main objective of this research work is to describe within a formal frame- work the implications of adopting analytical redundancy as a basis to achieve fault tolerance.

The research activity involves analysis of the analytical redundancy ap- proach, analysis of flight control system informal requirements, and re-engineering (modeling and specification) of the fault tolerance requirements. The USAF mili- tary specification MIL-F-9490D and supporting documents are adopted as source for the flight control informal requirements. The De Havilland DHC-2 general aviation aircraft equipped with standard autopilot control functions is adopted as pilot appli- cation. Relational algebra is adopted as formal framework for the specification of the requirements.

The detailed analysis and formalization of the requirements resulted in a better definition of the fault tolerance problem in the framework of analytical redundancy. Fault tolerance requirements and related certification procedures turned out to be considerably more demanding than those typically adopted in the literature. Fur- thermore, the research work brought up to light important issues in all fields involved in the specification process, namely flight control system requirements, analytical redundancy, and requirements engineering. Acknowledgments I would like to thank Dr.

Marcello Napolitano, my advisor, for his support during this research. I am thankful to Dr. Ali Mili for having brought some light in the chaos that characterized the early phases of this work. His guidance was crucial to the successful completion of this project.

I am also thankful to Dr. Francesco Nasuti for his friendship and for the numerous helpful discussions on the many faces of analytical redundancy. I wish to thank all of the Drs., researchers, and students who played a role in this research work. Among them I would like to cite Dr.

Wu Wen, Dr. Jack Callahan, Dr. Steve Easterbrook, Dr. Bojan Cukic, Dr.

Mark Shereshevsky, Dr. Harjinder Sandhu, and Dr. In the years of meetings and discussions since the start of the project, they helped me understand the hidden truth behind a multidisciplinary research work. I have no words to thank my wife Teresa, without her love and support I would not be here now.

Of course, I am grateful to my parents for their unbounded love, and to my grandmother for ”being the origin of the family”, as she says. I am also grateful to my brothers for not hanging me upside down this time, and to my sister for her unforgettable shout of joy. Finally, I wish to thank all of those who kept asking: ”So. have you done?”.

I have! iii Contents 1 Introduction 1 2 Background information 5 2.1 Issues on the analytical redundancy approach in fault tolerant flight control systems .2 Analytical redundancy in flight control systems .2 Formal specification of system requirements .2 Advantages of adopting a formal specification language .1 FTC: the system to be specified .2 Main functions of the FTC system .3 FTC interface with its environment .3 Military specification for AFCS. 31 4 Formal specification of the FTC environment 35 4.1 Relational specification of elementary requirements .2 Composition of elementary requirements .3 Formal specification of the FTC environment .1 Performance requirement composition .2 DHC-2 detail-specification .3 Correctness of AFCS design. 60 5 Formal requirements specification of the FTC 62 5.1 FTC functional requirements .2 FTC non-functional requirements .3 FTC-AR requirements .2 Formal specification of FTC-AR .2 Formal specification of fault hypotheses .3 Relational specification of the FTC-AR requirements .1 Traditional interpretation of detectability and identifiability .2 Formal definition of detectability and identifiability. 80 6 Conclusions 82 A Predicate Logic and Relational Algebra 92 A.2 Relational algebra and requirements specification .1 Basics of relational algebra.

97 B Elementary specifications of the AR-FTC environment 102 B.1 Elementary requirements of AFCS performance specification .2 Elementary requirements of DHC-2 detail-specification .1 DHC-2 airplane dynamics .2 DHC-2 Flight Control System Hardware .3 DHC-2 Flight Control System Software .1 Control-surface fault modes .2 Engine fault modes .3 Actuator fault modes .4 Rate gyro fault modes .5 Accelerometer fault modes .6 Air data sensor fault modes .7 Angle of attack sensor fault modes .8 Attitude and heading sensor fault modes .4 DHC-2 requirement space restriction sets .5 Elementary requirements of interface blocks to AR-FTC system. 138 C Support tables of the specification 141 v List of Tables 3.1 DHC-2 autopilot functions and related controls .1 Constants used within the specification of the HH function.2 Domain and image variables used within the specification of the HH function.3 Quantified variables used within the specification of the HH function.4 Predicates and functions used within the specification of the HH function.1 Syntax of propositional logic .2 Semantics of propositional logic .3 Syntax of predicate logic .1 Minimum acceptable control accuracy for ALH function .5 Spaces used within the requirements specification .6 Domain and image variables. 182 vi List of Figures 3.1 Environment of the FTC system.2 FTC within its environment.3 Block diagram of DHC-2 aircraft and its FCS.1 Sample requirements specification structure.2 Structure of the AFCS performance requirements specification.3 Structure of the DHC-2 detail-specification.1 DHC-2 and FTFCS requirements specification structure. 68 vii List of Symbols and Abbreviations ACT Actuator ADC Analog to Digital Converter AFCS Automatic Flight Control System ALH Altitude Hold AR Analytical Redundancy AR-FTFCS Analytical Redundancy based Fault Tolerant Flight Control System CP Control Panel Cin Computer input Cout Computer output DAC Digital to Analog Converter DHC-2 De Havilland DHC-2 aircraft DP Display Panel FBW Fly-By-Wire FCC Flight Control Computer FCL Flight Control Law FCS Flight Control System FCSw Flight Control Software FDC Flight Dynamics and Control FTC Fault Tolerance Capability FTC-ADC Fault Tolerance Capability – Analog to Digital Converter FTC-AR Fault Tolerance Capability – Analytical Redundancy module FTC-CP Fault Tolerance Capability – Control Panel module FTC-DAC Fault Tolerance Capability – Digital to Analog Converter FTC-DP Fault Tolerance Capability – Display Panel module FTC-IN Fault Tolerance Capability – software Input interface FTC-OUT Fault Tolerance Capability – software Output interface FTC-SW Fault Tolerance Capability – Safety switch FTFCS Fault Tolerant Flight Control System HH Heading Hold HS Heading Select MFCS Manual Flight Control System PAH Pitch Attitude Hold RAH Roll Attitude Hold UAV Unmanned Aerial Vehicle viii ,
Infallible / fail-operational software component Infallible / fail-operational hardware component Subsystem made of more than one component Fallible hardware component Directional data stream Infallible / fail-operational software component of FTC system Infallible / fail-operational hardware component of FTC system Physics law Note: Symbols used in the document are collected in the tables of Appendix C ix Chapter 1 Introduction The use of Fly-By-Wire (FBW) digital flight control systems is playing a more and more prominent role in commercial aviation.

Airbus and Boeing FBW-airliners pro- vide a clear sign of this trend. In FBW technology electronic devices coupled to a digital computer replace conventional mechanical controls. The net result is a more efficient, easier to control aircraft. However, this increased automation goes in parallel with an increased complexity of flight control systems with obvious conse- quences on reliability and safety.

A FBW flight control system is made up of several subsystems including mechanical, electronic, and software components. Each of these subsystems may fail during flight, with disastrous consequences. For this reason flight control systems must meet strict fault-tolerance requirements. The standard solution to achieving fault tolerance capability is the adoption of a multi-string architecture.

This architecture is based on redundant units working in parallel and a voting scheme that disengages a unit when faulty. Triple and quadruple string architectures are cur- rent practice in flight control systems of both military and commercial aviation [62], [21]. On the other hand, multi-string architectures further increase the complexity of the system, induce a reduction of overall reliability, bind to closer maintenance 1 schedule, and require larger budgets. These factors have induced in recent years an increased interest toward alternative approaches to achieving fault tolerance in flight control systems.

Similar interest comes from fields related to satellite and Unmanned Aerial Ve- hicle (UAV) applications. Under the ongoing process of globalization the telecom- munication industry is growing without rest and commercial satellites are playing an important role in this growth. Weight and size largely affect launching costs of satellites. Weight and size also affect UAV applications.

Starting in the late ’80s a variety of UAVs have been built for either military or scientific purposes. They vary significantly in size, mission profile, and payload weight carrying capability. With some of them having a payload weight below 20 lbs and dimensions below 15 feet it is clear how weight and room requirements are a major issue. Despite costs, complexity, and weight drawbacks physical redundancy is adopted to achieve fault tolerance.

Redundancy is a must in achieving fault tolerance; the question is whether re- dundancy other than physical can be adopted. In the past two decades a variety of techniques based on analytical redundancy have been suggested for fault diagnosis purposes. Analytical redundancy identifies with the functional redundancy of the sys- tem. No extra hardware is required; fault tolerance is achieved by means of software routines that process sensor outputs and actuator inputs to check for consistency with respect to the analytical model of the system.

If an inconsistency is detected, the faulty component is isolated and the control law is reconfigured accordingly. The first analytical redundancy scheme implemented within a flight control systems dates 2 back to the 70’s, when the same aircraft used to conduct research on fly-by-wire tech- nology was also used as testbed for an analytical redundancy management algorithm [56].