A “generic” high lift model has been developed
to protect intellectual property concerns for specific
customer programs. Therefore verification of this
model against physical test data model cannot be
presented. However, model verification has been
performed for customer programs at numerous
stages of the system engineering process for
example at component level and at full system rig
level. Excellent model correlation has been achieved
at both individual component and full system level
over a range of environmental temperatures,
aerodynamic loads across multiple programs.
5 POWER DRIVE UNIT FAILURE
MODES
In this section, the analysis of generic failure modes
for the Fowler flap system PDU is presented.
The rational of selecting the PDU as a case study
for fault analysis and as a LRU for future PHM work
is justified by the fact that any failure presented by
the PDU would present the following challenges:
• PDU repair or replacement with delays in the
aircraft future operations. Increase in AOG
time.
• Availability of spare parts depending on port in
which the aircraft is located. Dispatching of a
LRU to a given location would cause a
significant increase in the AOG time.
If PDU failures could be forecasted, the aircraft
could have been directed to a suitable maintenance
facility and PDU repair/replacement could take
place as part of a scheduled maintenance,
minimising the AOG time.
The first step in the design of a PHM is the
creation of a fault database, which support the
description of the component fault modes.
The fault modes are based on the operational
limits of the components and can be represented by
look up tables capturing the envelope of
performance of the LRU.
In order to understand the significance of the
fault, each fault mode is assigned a weight or
probability of its manifestation. This is evaluated
mathematically through fault tree analysis and
failure mode effects analysis (FMEA).
The probability distribution and the analysis of
the failure mode consequences/impact through a
sensitivity analysis of the failure modes provide the
foundation to create a contingency plan to mitigate
the risk of the fault realising.
Depending on the fault and its impact on the
system, different strategies to manage the health of
the system could be implemented, from design to
maintenance such as:
• Design upgrade;
• Additional redundant systems;
• Further safety monitoring systems to detect
issues if they cannot be mitigated;
• Inclusion of addition maintenance checks such
as a built in test (BIT).
Table 1 provides a subset of the failure modes
that can occur within the PDU and the system level
effects which have been simplified to aid
illustration.
The columns of the table represent the following:
1. Failure number – reference number to
support quick reference to fault case through
the paper.
2. Failure Location – the location of the fault is
referring to the Simulink model presented in
Figure 4.
3. Failure description – Brief description of the
fault.
4. Fault Monitor Triggered– Will an existing
system fault monitor identify the fault and
provide automatic corrective action (where
necessary) and annunciate the fault to the
support functions.
5. Failure Effect – Fault impact on the PDU.
6. System Issue - Fault impact on the System.
Failure numbers 1 and 3 indicate the complete
loss of hydraulic supply pressure and loss of PDU
brake capability. Both of these failures will trigger a
“system fault monitor” within the control system
which would detect the issue. For example failure
number 1: “Blockage of the hydraulic filter inside
the PDU channel 1” will cause the PDU channel 1 to
become stationary. The control system would
diagnose this via the motor velocity sensor
indicating that the motor is stationary while the
control system is commanding movement. If the
motor velocity signal remains zero for a predefined
time then a “channel jam” fault monitor would
trigger. This fault monitor would shut down the
affected channel and annunciate the condition to the
PHM system.
Failure number 3 “Complete loss of the Channel
1 PDU Brake” will prevent the PDU brake to
engage. The system would not arrest and move past
the demanded position as indicated by the PDU
position sensor. The control system would diagnose
this by triggering the uncommanded movement fault