Designing an Aircraft Elevator Control System -- Overview
In this case study, we use Model-Based Design with Simulink, Stateflow, and Simulink Verification and Validation to design
a fault detection, isolation, and recovery (FDIR) application for a pair of aircraft elevators with redundant actuators.
The system is modeled from a set of requirements. We then use requirements-based testing in order to verify that these requirements
have been met. A similar design and testing methodology could be applied to any event-driven, or complex logic-based controller.
This case study has four parts:
Description of an Elevator Control System
A typical aircraft has two elevators attached on the horizontal tails (one on each side of the fuselage). There are a number
of redundant parts in the system to ensure safety.
For example, as shown in Figure 1, there are:
- Two independent hydraulic actuators per elevator (four total)
- Three separate hydraulic circuits to drive the actuators
- Two primary flight control units (PFCU)
- Two control modules per actuator: full range control law and limited / reduced range control law
Figure 1: Components of the elevator redundancy system.
Click on image to see enlarged view.
In this example, we limit each PFCU to have only one control law, and to control only one set of actuators to reduce the complexity
of the case study. Here, the outer actuators run the full control law, and the inner actuators run the reduced-range control
law. Each outer actuator has a dedicated hydraulic circuit, whereas the inner actuators share one hydraulic circuit. By default,
the outer actuators are on, and the inner actuators are on standby. If a fault is detected in the outer actuators or in the
hydraulic circuits that are connected to them, we want the system to respond accordingly to maintain stability by turning
the outer actuators off and activating the inner actuators.
This case study focuses on the fault detection, isolation, and recovery logic that causes the actuators to switch from one
mode to another. We have created simple yet representative models of the hydraulic actuators and elevators, as well as the
feedback control laws, to illustrate the behavior of this logic.
Learn more about the key products used in this example:
From these product pages you can request a free 30-day trial, read the documentation, read user stories, request more information,
and get pricing.
You can also view a recorded webinar based on this example: Fault Management With Stateflow.
Visit The MathWorks Web site to read more about Model-Based Design, including user stories:
- Georg Mai and Mark Schröder, "Simulation of a Flight Control Systems' Redundancy Management System using Statemate MAGNUM,"
presented at 7th User Group Meeting STATEMATE, Aschheim, Germany, April 1999.
- Pieter J. Mosterman, Manuel A. Pereira Remelhe, Sebastian Engell, and Martin Otter, "Simulation for Analysis of Aircraft Elevator
Feedback and Redundancy Control," in Modelling, Analysis, and Design of Hybrid Systems, pp 369-390, Lecture Notes in Control
and Information Sciences 279, Berlin, Springer, 2002.
- Stephen Osder, "Practical View of Redundancy Management Application and Theory," in Journal of Guidance, Control, and Dynamics,
Vol.22, No. 1, 1999.
- Mosterman, P. J. and Ghidella, J., “Model Reuse for the Training of Fault Scenarios in Aerospace,” Proceedings of the AIAA
Modeling and Simulation Technologies Conference, Providence, RI, Aug. 2004, CD-ROM, ID: 2004-4931.
- Mosterman, P. J. and Ghidella, J., "Requirements-Based Testing in Aircraft Control Design," in AIAA Modeling and Simulations
Technologies Conference and Exhibit 2005, August 15-18, San Francisco, California, 2005.