The information contained in this document is Volvo Aero Corporation Proprietary Information and it shall not – either in its original or in any modified form, in whole or in part – be reproduced, disclosed to a third party, or used for any purpose other than that for which it is supplied, without the written consent of Volvo Aero Corporation. Any infringement of these conditions will be liable to legal action. Derivation of diagnostic requirements for a distributed UAV turbofan engine control system

Volvo Aero Corporation Proprietary Information. This information is subject to restrictions on first page. Department, Name Utg. 12 Slide 2 Content  Background on gas turbine engine control system evolution  Control system and target application used in this study  Safety related requirements and analysis method  Analysis result and conclusions Flygteknik Derivation of diagnostic requirements

Volvo Aero Corporation Proprietary Information. This information is subject to restrictions on first page. Department, Name Utg. 12 Slide 3 Flygteknik Derivation of diagnostic requirements Jet engine control system begins Patent GB588083A, Fuel system

Volvo Aero Corporation Proprietary Information. This information is subject to restrictions on first page. Department, Name Utg. 12 Slide 4 Flygteknik Derivation of diagnostic requirements Gas turbine control system evolution Increase of pressure ratios, higher turbine inlet temperatures along with axial compressors and afterburning increased the stress of internal components and the need for more precise control. The evolution of more and more complex hydromechanical control systems continued during the 50’s and 60’s P3T4

Volvo Aero Corporation Proprietary Information. This information is subject to restrictions on first page. Department, Name Utg. 12 Slide 5 Flygteknik Derivation of diagnostic requirements RM8 GG-control

Volvo Aero Corporation Proprietary Information. This information is subject to restrictions on first page. Department, Name Utg. 12 Slide 6 Flygteknik Derivation of diagnostic requirements RM8 A/B control

Volvo Aero Corporation Proprietary Information. This information is subject to restrictions on first page. Department, Name Utg. 12 Slide 7 Flygteknik Derivation of diagnostic requirements Electronic Gas turbine control systems  Continued evolution of aircraft performance triggered the need for rapid acceleration/deceleration and surge free operation in military applications. Normal operation should not require attention from the pilot The invention of the transistor in the late 40’s and the introduction of integrated circuits in the 60’s enabled more advanced control systems. Electronic ’supervisory control systems’ were added to the hydro mechanical systems to improve functionality and accuracy of the control system. Analog control units have gradually been replaced with digital units.

Volvo Aero Corporation Proprietary Information. This information is subject to restrictions on first page. Department, Name Utg. 12 Slide 8 Flygteknik Derivation of diagnostic requirements Gas turbine control systems today Today’s FADEC systems have orders of magnitude better throughput than the first FADECs, enabling: - High level software development tools. - Faster execution speed. - Monitoring of engine health Issues with safety, reliability, tolerance to (electric) disturbances etc. have been kept under control despite the rapid technology evolution of electronics.

Volvo Aero Corporation Proprietary Information. This information is subject to restrictions on first page. Department, Name Utg. 12 Slide 9 Flygteknik Derivation of diagnostic requirements Gas turbine control systems today Various benefits and drawbacks of both hydromechanical and electronic control systems have all been outmatched compared to the benefits of using software to implement complex control and monitoring functions ©SAFRAN, All rights reserved During the past years, FADEC systems have matured.

Volvo Aero Corporation Proprietary Information. This information is subject to restrictions on first page. Department, Name Utg. 12 Slide 10 Flygteknik Derivation of diagnostic requirements Gas turbine control systems today FADECs have become generic. High complexity, reduction of cost, improved maintenance etc. can be dealt with in different ways, for example have Hispano-Suiza and BAE Systems created FADEC International. The ‘FADEC 3’ design is currently used in GEnx, GE90-115B, GE CF6, CFM56 and GP7200 engines.

Volvo Aero Corporation Proprietary Information. This information is subject to restrictions on first page. Department, Name Utg. 12 Slide 11 Flygteknik Derivation of diagnostic requirements Gas turbine control systems tomorrow Desired characteristics: o Lower cost (non-recurring and recurring) o Lower weight o Better reliability o Better flexibility for hardware upgrade o Better Engine Monitoring Capability How?

Volvo Aero Corporation Proprietary Information. This information is subject to restrictions on first page. Department, Name Utg. 12 Slide 12 Flygteknik Derivation of diagnostic requirements Gas turbine control systems tomorrow InputSignal processingOutput Actuator Sensor InputSignal processingOutput Actuator Sensor Cost Weight Reliability Flexibility Monitoring

Volvo Aero Corporation Proprietary Information. This information is subject to restrictions on first page. Department, Name Utg. 12 Slide 13 Flygteknik Derivation of diagnostic requirements UAV gas turbine control system FVG CVG WFM T5 T1 NLNH PS3 T25 Inlet FanCompr. Turbines T1 FVG NL T25 CVG NH PS3 WFM T5 Engine inlet temperature Variable guide vanes in the fan Fan speed Compressor inlet temperature Variable guide vanes in the compressor Compressor speed Compressor outlet pressure Fuel flow Low pressure turbine temperature The probability for improper engine thrust shall be less than The probability for mission abort shall be less than The probability for an unscheduled maintenance action after a mission shall be less than The probability that a single failure in the control system causes improper thrust shall be less than Requirements Power1 Power2 External bus WFM2 T1 NLT25NHPS3T5 CVG1 CVG2WFM1 FVG CU1 CU2

Volvo Aero Corporation Proprietary Information. This information is subject to restrictions on first page. Department, Name Utg. 12 Slide 14 Flygteknik Derivation of diagnostic requirements Control system analysis Node Permanent fault rate, p Transient fault rate, t Sensor10 -5 per hour10 -3 per hour Servo10 -5 per hour10 -3 per hour CU10 -5 per hour10 -3 per hour Power per hour0 Bus per hour0 EventRate Repair  r =360 per hour False alarm rate f = per hour

Volvo Aero Corporation Proprietary Information. This information is subject to restrictions on first page. Department, Name Utg. 12 Slide 15 Flygteknik Derivation of diagnostic requirements Control system analysis

Volvo Aero Corporation Proprietary Information. This information is subject to restrictions on first page. Department, Name Utg. 12 Slide 16 Flygteknik Derivation of diagnostic requirements Control system analysis

Volvo Aero Corporation Proprietary Information. This information is subject to restrictions on first page. Department, Name Utg. 12 Slide 17 Flygteknik Derivation of diagnostic requirements Control system analysis

Volvo Aero Corporation Proprietary Information. This information is subject to restrictions on first page. Department, Name Utg. 12 Slide 18 Flygteknik Derivation of diagnostic requirements Control system analysis result Category cctcct ccpccp ccsccs Failure prob [ /h] Comments A 11don’t care Ideal system, lower failure bound B Excellent coverage C Very good coverage on all levels D An ideal system level coverage compensates for bad node level coverage

Volvo Aero Corporation Proprietary Information. This information is subject to restrictions on first page. Department, Name Utg. 12 Slide 19 Flygteknik Derivation of diagnostic requirements Control system analysis result Category cctcct ccpccp ccsccs Failure prob [ /h] Comments E The coverage of transient faults and system coverage are most important F Even though the node level diagnostics is excellent, the overall failure probability is high if system level error diagnostics is missing G Just for comparison

Volvo Aero Corporation Proprietary Information. This information is subject to restrictions on first page. Department, Name Utg. 12 Slide 20 Conclusion Flygteknik Derivation of diagnostic requirements  A method to translate high level safety and reliability requirements into coverage factors for a distributed gas turbine control system has been presented.  The coverage factors represent diagnostic requirements, i.e. the required error handling capability for the nodes of the system.  The method use simple Markov chains in combination with Fault Tree Analysis to capture essential safety related properties.  Distributed system architecture is the way forward to manage the never ending complexity growth of ’FADEC’ systems. It allows for: Partitioning of a complex system into simpler sub systems Flexibility to add more functionality and computational capacity Physical distribution enables standardisation of nodes and competition among manufacturers

Volvo Aero Corporation Proprietary Information. This information is subject to restrictions on first page. Department, Name Utg. 12 Slide 21 Flygteknik Derivation of diagnostic requirements Thank You for your attention and welcome to