Data has been recorded for 22 different failure modes of the fuel rig system. In each case, the fault was injected into the fuel rig during a phased mission. The mission consisted of five phases, extending over a period of 300 s. Using the phase numbering established in Section 3.2, in the first mission phase, the fuel rig system was in operational phase one, no flow through the system. After 15 s, the fuel rig transitioned to mission and operational phase two, both engine pumps set to a demand of 50% creating flow paths from the LH and RH wing tanks to the LH and RH engines. After 90 s, the fuel rig transitioned to mission and operational phase three as the auxiliary pump demand was set to 75% and flow paths were established from the LH and RH auxiliary tanks to the LH and RH wing tanks. After 90 s, the fuel rig transitioned to mission phase four and reverted back to operational phase two, only flow paths from LH and RH wing tanks to LH and RH engines. After a further 90 s, the fuel rig returned to operational phase one as it entered the final mission phase for a period of 15 s. In each phased mission, the fault was injected into the fuel rig after 60 s, during operational phase two.
Pump vibration effects
The engine pumps of an aircraft fuel system are represented on the fuel rig using peristaltic pumps. When operational, the rotational motor within the pumps causes the fuel rig to vibrate. The effect is greater as the pump demand is increased and the motor turns at a greater speed. Figure 6 shows the effect of the vibrations on the RH auxiliary fuel tank level. The figure shows the tank levels recorded for the phased mission described above but with the auxiliary tank isolation valve closed to prevent any fluid leaving the tank.
It can be seen that at the start of phase three as the auxiliary pump demand is created, there is a significant increase in the tank level. A similar effect can be seen at the start of phase two when the engine pump demand is established. Both of these increases are related to the pump-induced rig vibrations that cause the fluid in the fuel tanks to shake. As would be expected, once the pump demands are removed at the start of phases four and five, the tank level falls. This coincides with the pumps turning off and no longer creating a vibration in the system. As the isolation valve from the auxiliary tank is closed, all of these level changes occur with no fluid loss or gain in the tank.
The figure also shows that when there is a demand to the auxiliary pump, the recorded tank level is noisier than when only the engine pump is active. Similar results can be seen with the wing tank level variables. Figure 7 shows the RH wing tank level over the course of the phased mission. As the RH auxiliary tank isolation valve is closed, the wing tank does not receive any input flow in phase three.
Figure 7 shows an increase in the wing tank level at the start of both phases two and three. A decrease in the wing tank level can be identified at the start of phases four and five. The results also exhibit an increased level of noise in phase three when all of the pumps on the system are in operation. These results indicate that the pump-induced system vibrations are affecting both the auxiliary and wing tanks on the fuel rig. It is therefore necessary to attempt to quantify these vibration effects to enable accurate fault verification.
The auxiliary pump vibration effect will be quantified by comparing the recorded tank levels when only the engine pumps are on and when the engine and auxiliary pumps are on. During the tests, the auxiliary and engine tank isolation valves were closed to prevent any flow leaving the tanks. The tests were performed at a number of tank level heights to investigate if the vibration effect varied with tank level.
Figures 8 and 9 show the auxiliary engine off vs auxiliary engine on tank levels for the RH auxiliary and wing tank, respectively. Both figures show a clear increase in the tank level when the auxiliary tanks are on and that the effect is greater at higher tank levels. Using the gradient of a linear trendline through the points plotted when the auxiliary engine is on, the vibration effect on each of the four tanks can be roughly quantified.
Using a process of trial and error, it was identified that the effect of the vibration on both wing tanks could be accounted for by a single equation. Therefore, during the process of fault verification, all wing tank level values predicted in phase three are multiplied by 1.033. Conversely, the auxiliary tanks have to be considered individually with LH auxiliary tank levels multiplied by 1.05 and the RH auxiliary levels subject to the formula shown in Equation (2). In Equation (2), L′ represents the adjusted RH auxiliary tank level, and L represents the initially predicted tank level.
Verifying a genuine fault
The ability of the software to verify the failure mode ‘RH Auxiliary Tank Isolation Valve Blocked’ will be considered in more detail. The effect of this fault occurring, in the context of the phased mission described above, should be to prevent a flow path from the RH auxiliary tank to the RH wing tank in mission phase three. The consequences of the fault should be clear in the outputs of the RH auxiliary tank level and the RH wing tank level. Figures 10 and 11 show the values recorded from the fuel rig and predicted by the PN model for these variables over the course of the phased mission. It should be noted that due to system noise present at the start of the mission and immediately after phase changes data from these parts of the mission are ignored so as not to bias the fault verification results.
Figures 10 and 11 show the PN model has accurately represented the behaviour of the RH fuel tanks in the presence of the fault. Also of note is how the model results are now much more similar to the fuel rig results in phase three when all the system pumps are active. The PN results in Figure 11 show a slight deviation from those recorded from the fuel rig in phases four and five. However, given the noise in the system and the vibration issues identified above, a small deviation can be expected.
The SD of the RH wing tank level residuals is 0.58 cm and for the LH wing tank residuals is 0.54 cm. The SD of the auxiliary tank level residuals are 0.89 and 0.67 cm for the RH and LH tanks, respectively. Given the SD tolerance for the wings tanks is 1.5 cm, it can be concluded that the PN model has accurately modelled the behaviour of the fuel tanks in the presence of a fault on the RH side and in normal operation on the LH side of the system. Had the impact of the pump vibrations not been taken into account, the SD of the LH and RH auxiliary tank level residuals would have been 1.09 and 1.24cm. With these values, even a small increase in the system noise or a short period of increased vibration beyond that accounted for could have caused the tolerance level to be exceeded and the fault report to be ignored. The SD of the LH and RH wing tank level residuals would have been 0.66 and 0.75 cm had the pump vibrations not been accounted for. The technique applied to account for the pump vibrations can therefore be considered appropriate.
Figures 12 and 13 show the LH and RH flow rate and the RH flow pressure variable over the course of the phased mission. Theoretically, in spite of the fault, the LH and RH engine pump demands should be satisfied throughout the mission, as neither wing tank level falls to zero. The figures show that the fuel rig behaviour matches that predicted and the PN model has represented this behaviour well.
Figure 12 shows the RH engine flow rate to be around 0.5 L/min greater than the LH engine flow rate throughout the mission. A number of factors have been identified as causes for this discrepancy. Although similar components have been used to construct the fuel rig, the use of the LH and RH engine pumps may not have been consistent over their lifetime. As a result, the efficiency and performance of some components may not be as great as others. The pipe configuration to the LH and RH engine pumps from the wing tanks is also not consistent. The longer series of piping feeding the LH engine pump will exhibit a lower back pressure which will result in a reduced flow rate. The operation of the peristaltic pumps also creates distorted, irregular flow which affects the flow rate values recorded. Finally, measurement variances at the flow meter could cause inaccuracies in the flow rates recorded. Nonetheless, the SD results for the LH and RH flow rate values were 0.09 and 0.18 L/min respectively. Given a proposed tolerance of 0.3 L/min, the PN model results can be considered an accurate representation of the behaviour of the flow rate variable.
The SD results for the LH and RH engine flow pressure variables were 729 and 1833 Pa, respectively. A tolerance of 9000 Pa is proposed for the respective LH and RH variable outputs, and therefore both results would have passed their particular tests thereby contributing to the overall verification of the fault. It is necessary to apply a relatively high tolerance to the flow pressure variable due to the scale of the values recorded. Table 3 shows that the flow pressure SD can significantly exceed the tolerance level proposed when a false fault is evaluated.
Having evaluated all of the variable results using the SD technique, the presence of the failure mode can be assessed. As the SD results of all tank level, flow rate and flow pressure variables are within the proposed tolerance levels, the presence of the fault ‘RH Auxiliary Tank Isolation Valve Blocked’ can be confirmed as genuine. This demonstrates that the proposed PN model and SD fault verification technique can be successfully applied to verify the presence of genuine faults in complex, phased mission systems.
Verifying leak arisings
The only fault type that is not evaluated using the technique described above is a tank leak. It is necessary to consider leak fault reports separately because depending on the size and location of the leak, the symptoms observed in the system will be different.
The process created to verify a leak fault report considers both the tank level and flow rate variables of the tank under consideration. In order to compare the two variables directly, the flow rate data must be converted into tank level values. Equation (3) is used to convert the flow rate data (FRi) at every timestep (Δt) in the mission into the volume of liquid that leaves/enters the tank (V). Both flow rates out of and into the tank under consideration must be subject to Equation (3). Equation (4) then converts the volume into a change in the tank level (L′) using the tank cross-sectional area (CSA). Given the initial tank level, this result can be used to give the flow rate determined tank level throughout the mission.
In Equation (3), the flow rate data is measured in L/s. The volume is expressed in cm3. The CSA of the tank is measured in cm2 and the change in tank level is expressed in cm.
To reduce the noise effects seen in the tank level graphs of Figures 6, 7, 10 and 11, a 10-point moving average has been applied to the level sensor data. This filter determines a tank level by averaging the nine previous data points with the point under consideration. This significantly reduces the noise in the level sensor output and enables a more accurate comparison with the flow rate data to be carried out.
Using the same phased mission described previously, a leak was injected into the side of the LH auxiliary tank of the fuel rig after 60 s. For this test, a flow rate meter was placed at the outlet from the LH auxiliary tank thereby ensuring flow rates out of the auxiliary tank were measured. The structure of the system means there can be no flow into the auxiliary tanks, and therefore only the flow rate out of the tank had to be monitored. Figure 14 shows the tank levels for the LH auxiliary tank over the course of the mission as determined from the moving averaged level sensor data and the flow rate data.
The figure shows that the initial effects of the leak in phase two are only visible from the level sensor data. This is a result of the fact that only the level sensor results include the effect of the leak. As none of the leak flow passes through the flow rate meter, its effects are not captured in the flow rate data. The flow rate determined tank level only falls in phase three when the auxiliary pump is on. At the start of phase three, the level sensor curve also becomes steeper indicating an increased flow out of the tank. This effect however only lasts until the middle of the phase when the gradient becomes more gradual. This change is a result of the tank level falling below the height of the leak and no longer having an effect. Beyond this point, the gradients of the level sensor and flow rate tank level curves are similar.
To verify the presence of a leak fault report, the tank level gradients prior to and after the fault report time are assessed. Gradients, m, are calculated from the data recorded by both the level sensor and flow rate data using Equation (5).
To reduce unnecessary analysis, only data from the phase in which the fault report occurs and beyond is evaluated. In finding the tank level gradients prior to the fault report, the first data point is taken as that 20 s after the phase start time. It is necessary to avoid using the data points in the first 10 s of the phase to ensure phase transition effects are not considered. A further 10-s delay has to then be accounted for to allow the moving averaged level sensor values to settle. The second data point is the time of the fault report. By treating the fault report time as a phase change, the data points used in Equation (5) to find the post fault report gradients are 20 and 30 s after the time of the fault report.
In order to verify the presence of a leak, the gradient residual prior to and after the fault report must be considered. The gradient residual is found by subtracting the flow rate tank level gradient from the level sensor tank level gradient. If a leak is present, the gradient residual after the fault report will be less than prior to the fault report. A leak will be verified if the gradient residual after the fault report is lower than the gradient residual value prior to the fault less 0.019 cm/s. Equation (6) expresses this as an equation where RGrad − Pre is the gradient residual prior to the arising and RGrad − Post is the gradient residual after the arising.
In the phased mission considered above, the fault report occurs in the second phase of the mission which began after 15 s. The leak fault report was recorded at 60 s. The pre fault report tank level gradients are therefore found using the tank level and flow rate sensor data points at 35 and 60 s. The post fault report gradients are found using the data points at 80 and 90 s. Table 1 lists the tank level gradient values found using the above equations and the gradient residual values for the phased mission being considered.
Table 1. Level sensor and flow rate determined tank level gradients
| ||Pre-arising (cm/s)||Post-arising (cm/s)|
|Flow rate sensor||−0.0002||−0.0001|
It can be seen that while the gradients determined from the flow rate data show only a small amount of change, the gradients determined from the level sensor data show a much larger amount of change. This has also caused the residual values to decrease. The gradient residual value decreased by 0.1738 cm/s due to the leak. From Equation (6) and Table 1, it can be seen that if the gradient residual after the fault report was less than −0.0203 cm/s, a leak would be verified. As this condition has been satisfied, the presence of a leak in the LH auxiliary tank can be confirmed. The size of the leak is equivalent to the change of the gradient residual values, i.e. 0.1738 cm/s.
The final step, having verified the presence of a leak, is to identify the location or height of the leak. As was shown above, when a leak occurs, the gradient residual value decreases. It follows then that if the tank level were to fall below the height of the leak, the gradient residual value would increase to a value approaching that found prior to the leak appearing. It was shown previously that in order for a leak to be verified the gradient residual value after the fault report had to be at least 0.019 cm/s lower than the value prior to the report. It therefore follows that in order to confirm the tank level is below the leak height, the residual gradient must be greater than the residual gradient prior to the arising less 0.019 cm/s.
To find the leak height as accurately as possible, gradient residual values are found at 15 s intervals starting from the last time considered to find the post fault report gradients, i.e. 30 s after the fault report. The leak height will have therefore been identified if Equation (7) is satisfied. In the equation, RGrad − Pre is the gradient residual prior to the arising, and RGrad − Interval is the gradient residual at the time of an interval.
Using the gradient residuals calculated above when the leak was verified, if the gradient residual at any interval is greater than −0.0203 cm/s, then the tank level will have dropped below the leak height.
Table 2 lists the gradient residuals for the phased mission described above. Intervals which include data that falls within the first 10 s of a phase are ignored due to phase transition effects.
Table 2. Residual values after arising
|Interval (s)||Interval residual (cm/s)|
|15 – 60||−0.0013|
|60 – 90||−0.1750|
|90 – 105||−0.1592|
|120 – 135||−0.1127|
|135 – 150||−0.0865|
|150 – 165||0.0190|
|165 – 180||0.0415|
|180 – 195||0.0488|
|210 – 225||0.0038|
|225 – 240||−0.0063|
|240 – 255||−0.0004|
|255 – 270||−0.0015|
|270 – 285||0.0052|
The results show that the gradient residuals calculated at the first three intervals are all lower than the value required to identify the leak height. The interval from 150 to 165 s represents the first time that the gradient residual is greater than −0.0203 cm/s. It can also be seen that all subsequent values are greater than this minimum value. It is clear therefore that at 150 s, the tank level has fallen below the height of the leak. This result also matches well with the observations that were made of the tank level curves in Figure 14. The leak height can therefore be found from the level sensor data at 150 s. A leak height of 23.6 cm is found by averaging the tank level values over the first 3 s of the interval. If a leak is verified but the gradient residuals evaluated when trying to find the leak height never exceed the minimum gradient residual, it is possible the leak could be present anywhere between the base of the tank and the tank level at the end of the mission.
Assessing genuine and false faults
In addition to verifying the presence of genuine faults, the proposed fault verification technique must also filter false faults. By evaluating a health log file that contains multiple fault reports, where only one is true, the ability of the software to both verify genuine and filter false faults will be established.
Using the five phase mission described previously, the fault ‘RH Flow Pressure Sensor Failed Off’ has been induced in the fuel rig. The additional false faults included in the health log file are ‘RH Flow Pressure Sensor Failed Stuck’, ‘RH WT Isolation Valve Blocked’ and ‘RH Flow Sensor Failed Stuck’. Including two failure modes of the same component will ensure the PN and fault verification software can decipher between them.
Table 3 lists the SD results of modelling the faults listed above and comparing the predicted system behaviour with that of the fuel rig when the ‘RH Flow Pressure Sensor Failed Off’ fault was injected. Those SD results that exceed the variable tolerance are highlighted in bold.
Table 3. Failure mode SD results
|Failure mode||Pressure sensor||Pressure sensor||Wing tank iso-||Flow sensor|
|failed off||stuck||valve blocked||stuck|
|RH wing tank||0.46||0.46||4.30||0.46|
|LH wing tank||0.56||0.56||0.56||0.56|
|RH auxiliary tank||0.93||0.93||0.93||0.93|
|LH auxiliary tank||0.49||0.49||0.49||0.49|
|RH flow rate||0.19||0.19||1.99||0.77|
|LH flow rate||0.11||0.11||0.11||0.11|
|RH flow pressure||751||46,830||38,260||46,736|
|LH flow pressure||1,467||1,467||1,467||1,467|
As only faults on the RH side of the fuel rig system have been considered, the SD results of the variables on the LH side are the same irrespective of the failure mode. Considering the false faults modelled by the software, Table 3 shows that the RH flow pressure tolerance level has been exceeded in all three scenarios. In the case of the wing tank isolation valve blocked and flow sensor stuck faults, additional results have exceeded the tolerance levels of the respective variables.
Figure 15 shows the predicted flow pressure behaviour when all of the faults considered are propagated through the PN model. Also plotted is the flow pressure recorded from the fuel rig during the mission. When the flow pressure sensor fails off, it outputs a value of −103,500 Pa. This value represents the zero volt value of the flow pressure sensor after having been converted from a voltage to a pressure value.
Figure 15 shows that the predicted and actual flow pressure behaviour is only similar when the flow pressure sensor fails off fault is modelled. In the other scenarios, the predicted behaviour is significantly different from that recorded on the fuel rig. Due to this and the scale of the flow pressure variable, the SD results of the false faults exceed the tolerance of 8500 Pa by a large margin.
Using the SD results of the RH flow pressure variable alone, it can be seen that the fault verification process has successfully identified the false faults which would enable them to be filtered. Tolerance levels have also been exceeded in the RH flow rate and RH wing tank variable results. Given the failure modes propagated through the PN model in these instances, these results could have been predicted and are therefore correct.
The results of this test have demonstrated the ability of the fault verification technique to not only verify the presence of genuine faults but also to identify false faults reported in phased mission systems.