Airplane Flap Failure Modeling Using Wolfram SystemModeler

Translated by Anneli Mossberg and Olle Isaksson's post " Modeling Aircraft Flap System Failure Scenarios with SystemModeler ".
I express my deep gratitude to Kirill Guzenko for help with the translation.

---

Have you heard anything about the Boeing 747 Dreamlifter, which flew to the wrong airport and was forced to land on a too short airstrip? Fortunately, this story had a happy ending, and none of the passengers were injured. Nevertheless, this is a very dangerous situation - when the actual landing distance (hereinafter referred to as the FPD) is longer than the runway, and it can arise not only due to the error of the pilot who strayed from the right track.

One possible reason for this scenario is flap malfunction. Flaps - hinged devices located on the rear edges of the wings, their angular position is adjustable to change the lifting properties of the aircraft. For example, a certain flap position may allow the aircraft to fly at a lower speed when climbing, or land at a steeper angle, without increasing speed. One of their main advantages is that the PDF is getting shorter. Here's what puzzles me: Can a small flap malfunction increase the FPD so much that the runway turns out to be too short?

To answer this question, you need to understand how the malfunctions of individual components affect the system as a whole. How will the management system react to this? How to detect this during testing? Is there any safe procedure to compensate for this, and what will happen if the pilot or maintenance personnel fail to follow this procedure for some reason?



Together with my colleague, engineer Olle Isaksson, we decided to use the Wolfram SystemModeler 4 and the recently released Wolfram Hydraulic Library to simulate and analyze possible problems that could occur with the flaps of the Cessna 441 Conquest II.



The optimal angular position of the flaps on this Cessna model is manually set by the pilot through the aircraft dashboard. In addition to some other factors, the optimal flap angle depends on what phase of the flight the plane is in, and the phase of flight, in turn, determines which flight characteristics will be optimal. For example, during takeoff, the flaps deviate by 10 degrees to provide additional lift, and during landing they deviate by 30 degrees to increase both lift and braking forces. These seemingly small adjustments to the position of the flaps allow you to land on shorter runways, reduce the force exerted on the aircraft, give the pilot more time to react. For this particular aircraft, there are two additional provisions: 0 degrees for the main part of the flight and 20 degrees when approaching landing. Check out the video below to get an idea of ​​how flaps move.



Cessna flaps are electronically controlled and hydraulically driven. That is, the flaps are controlled by electrical signals, and the change in their position is provided by the hydraulic system, which includes pumps, valves, cylinders and other necessary components. The pilot controls the flap position through the flap position switch, which is located on the dashboard. When the switch position is changed, an electrical signal is sent, which, together with the limit switches, supplies the check valve, which increases the pressure in the hydraulic system.



Together with the feed to the check valve, the solenoid controlling the flaps of the valve receives a charge, as a result of which the connection between the cylinder (flap drive), the pump and the tank opens. The hydraulic cylinder is mechanically connected to the flaps, that is, the movement of the cylinder causes a change in the position of the flaps, and the movement of the cylinder occurs due to a change in pressure in the chambers.

Model

The Cessna flap system model we introduced in SystemModeler consists of six configurable components: pilot, electrical system, propulsion system, hydraulic system, flaps, and landing gear.



As shown above, the Cessna model is hierarchical, with several sublevels. The pilot receives signals from both the electrical subsystem and the flaps. For example, in the form of data on the pressure in the system and information on the current position of the flaps. The power supply subsystem consists of two engines that are connected to the pumps of the hydraulic system, which, in turn, supply the working fluid under pressure to the flaps and chassis subsystems. In order not to stretch the post to the dimensions of War and Peace, I will have to omit some details in the description of the model, however they will be given in a subsequent post in which the modeling process will be described in more detail.



Now that the components of the model and their interactions have been described in general terms, it's time to talk about some potential problems. Despite my fear of flying, I still researched some Cessna aircraft accident reports. It follows that switch failures, leaks in the hydraulic system, and mechanical damage are examples of flap failures that affect all aircraft systems. Thus, let's include the following scenarios in the fault analysis:

1. Pipe leak in the flaps subsystem.

2. Failure of the mechanical rod connecting the flap to the cylinder.

3. Electrical failure in the flap control valve during flight.

First, consider the scenario when everything works as it should, and the pilot can safely control the flaps. The pilot moves the switch, bringing it to the positions 10 ° -> 20 ° -> 30 ° -> 0 °, which correspond to take - off -> approach -> landing -> flight . It is worth noting that this is a rather strange combination of commands for flaps, which in real life is unlikely to ever be implemented in 20 seconds; it has only an educational purpose. It, for example, can be considered as a test for the correct operation of the flaps.

First you should download WSMLink and set the model.



My colleague Olle systematized the types of problems in the various components of the Cessna model. And in order to investigate, for example, the closure of contacts on the solenoid, I just need to switch to the closure mode of the solenoid, and then start the simulation.



For the nominal case, all fault parameters are set to zero, that is, all components are working properly. Since the fault modes are structural parameters, you need to use WSMSetValues instead of WSMParameterValues .



In what position will the flaps actually be compared to what position the pilot set in the nominal case?



As you can see, the position of the flaps varies depending on the pilot's commands, however, the position changes with a certain delay caused by a certain time of retraction / retraction of the flaps.

Let's also look at how pressure is created in the discharge hydraulic valve, which corresponds to the pressure that is supplied to the flaps. Another interesting aspect, especially for electrical faults, is the electrical signal that tells the flaps to open.



In the graphs above, you can see how the pressure peaks correspond to the position of the flaps, and how the peaks of the electrical signals correspond to the commands for changing their position that the pilot sends.

Now let's look at other options and see how they relate to the nominal.

Scenario: Leaking in a pipe

In this scenario, flap malfunctions have the same initial position as in the nominal case, but the pipe has a leak in the flap subsystem. The leak can be embedded in the model by changing the fm parameter for the pipe in the range from 0 to 2.



The images show the model of the system with the current pipe - on the left is the controlled flap angle and the actual flap angle, on the right is the pressure change in the discharge valve in the hydraulic power subsystem hydraulicPower .

We can see that leakage reduces the pressure in the system, which in turn reduces the pressure force of the cylinder. The decrease leads to a slower movement of the flaps, which, on a system-wide scale, increases the response time. Such a scenario can be dangerous if the pilot is in a position where the flaps must quickly change their position, for example, if the aircraft approaches the runway too quickly or at the wrong angle.

Scenario: Broken Rod

As previously mentioned, the flap subsystem includes a hydraulic cylinder that controls the movement of the flaps. Let's investigate what happens if a rod connected to the flaps breaks, that is, no force can be transmitted through this rod.



In the bottom two graphs, we can see that an increase in pressure occurs in the system, and the behavior of the electrical signal turns out to be as expected. Despite this, the flaps remain in position. Since the rod is broken, the cylinder cannot transmit any forces to change the position of the flaps (see the upper right graph), regardless of what commands are received. In this case, a seemingly small malfunction will lead to a significantly longer PDF.

Scenario: Failure of the electronic system during the flight.

Sometimes a malfunction becomes possible to detect only when the plane is already in the air, and it is very important to foresee such situations and have some algorithm of actions that would allow correcting any malfunctions. Let's look at the scenario when there were problems in the electronic system during the flight. The pilot could not test the flaps before takeoff, that is, the command to retract the flaps was sent for the first time during the flight. An electrical malfunction in the control flap of the flap occurs due to the closure of the contacts of the solenoid. A short-circuited solenoid opens the circuit during flight, causing the pilot to lose control of the flaps.



The pilot will not notice this malfunction until he has to change the position of the flaps from 10 degrees to zero, while the flaps can still be pulled out. However, at the moment when the pilot tries to pull the flaps, a short circuit will extend to the circuit breaker and all control of the flaps will be lost, as a result of which the aircraft will need a longer runway to land. So-so perspective, right? However, we could test some algorithm of actions that would help correct the situation.

Scenario: Failure of the electronic system during the flight and troubleshooting procedure

You can use the Cessna model to implement the troubleshooting procedure, which allows you to safely land the plane, despite the malfunction of the electronic system. This procedure, for example, could be to switch the switch to landing and then reset the circuit breaker. After the reset, it would be possible to directly put the flaps into the landing position and land safely, even if the retraction of the flaps still does not work. Let's see if this works.



In the image you can see a simulation of a failure of the electronic system during flight, when a short-circuited solenoid activates an emergency flap system.

A short-circuited solenoid opens the circuit during flight, causing the pilot to lose control of the flaps. Then the pilot puts the switch in the landing position, resets the circuit breaker and successfully opens the flaps.

What is the conclusion?

Let's get back to my question: Can a small flap malfunction increase the FPD so much that the runway is too short?

Judging by the failure analysis, this is probably a plausible scenario. This can happen if the increase in the PDF caused by a flap malfunction (for example, a malfunction of the electronic system during the flight, which was discussed above) exceeds the length of the runway. It is worth noting that this model was developed without cooperation with Cessna, that is, some assumptions were made about the device, for example, the electronic system and the values ​​of some parameters. In other words, it cannot be guaranteed that all aspects of the model are 100% accurate or complete. Nevertheless, it shows the possibility of using modeling as a means of studying various scenarios of the occurrence of problems, how they can be detected and how to develop procedures for eliminating them.

I used WolframSystemModeler for analyzing problems after a certain sequence of commands, that is, what could be done during the tests, for example. Using the same principles, you can use SystemModeler to analyze code failures in difficult-to-diagnose systems. I also tested the proposed troubleshooting procedure and checked how it all interacts in the system as a whole, what kind of reactions the system has. Such tests allow a better understanding of the principles of human-machine interaction.

If you want to simulate some malfunctions yourself or just get an idea of ​​the tools that I worked with in this post, you can download trial versions of both SystemModeler and Mathematica. Yes, both the Wolfram Hydraulic library and some other libraries can be downloaded from the new Wolfram SystemModeler Library Store .