are controlled with valves, and may follow several alternative paths, since structural fuel system redundancies are provided

several purposes. In general, the aircraft fuel system [5,6] has structural redundancies, so there are alternatives

tion is to test the use of new components in an airplane fuel system. Simulink was selected as a suitable tool to

* Corresponding author. Tel.: +34913944387; fax: +34913944687.E-mail address: gironsi@dacya.ucm.es (J.M. Giron-Sierra).

Simulation Modelling Practice and Theory 15 (2007) 544564

www.elsevier.com/locate/simpat1569-190X/$ - see front matter 2007 Elsevier B.V. All rights reserved.to get around possible problems, such as malfunction in a valve or a pump, and get the transfers done. A fuelmanagement system, with a specic computer, is responsible for the monitoring and control of the fuel systemunder normal or abnormal conditions. It is convenient to provide a platform to study the logic that the com-puter must implement to respond to a variety of circumstances. The platform must be exible and intuitiveenough, in view of the many types of aircraft fuel systems and the characteristics of the normal and abnormalcases to be specied and studied.

This article introduces a MATLAB-Simulink environment for aircraft fuel management studies. This sim-ulation environment has been developed as part of a European Research Project, denoted SmartFuel, whichproposes a new aircraft fuel management system using smart components [2,3,8]. The purpose of the simula-for evident reasons. An on board program for the management and reconguration of the fuel system must be developedand tested. The article introduces an aircraft fuel management system simulation, which provides a platform for the studyof the fuel system logic and sequencing that the on board program must implement for normal ights and for malfunctioncases. The simulation environment can be easily modied and extended, for instance to consider the use of new compo-nents. A specic example is considered: an aircraft with six tanks in the wings and a tail tank. The article presents atwo-layer model, the use of the model for simulation experiments, and some illustrative examples. 2007 Elsevier B.V. All rights reserved.

Keywords: Aircraft fuel systems; Control reconguration; Hybrid system simulation

1. Introduction

Depending on the number and location of tanks, the fuel in an aircraft is subject to certain transfers forA simulation of aircraft fuel management system

Juan F. Jimenez, Jose M. Giron-Sierra *, C. Insaurralde, M. Seminario

Departmento ACYA, Fac. Fsicas, Universidad Complutense de Madrid, 28040 Madrid, Spain

Received 6 June 2006; received in revised form 2 December 2006; accepted 23 January 2007Available online 7 February 2007

Abstract

Aircrafts usually have several fuel tanks, and there are fuel transfers among these tanks along a ight. These transfersdoi:10.1016/j.simpat.2007.01.007

develop the model by two reasons: rst, its inherent interactivity, second it deals well with hybrid systems. Aparticular fuel system conguration for a two-engine aircraft has been specied, as an initial reference for sys-tem logic study. The two-engine aircraft is relatively large and is intended for long ights. Its fuel systemincludes seven tanks. One of the missions of the fuel management system is to control the position of the air-craft centre of gravity (CoG) along the ight.

It is interesting to notice the dierent benets of establishing a simulation in a research involving severalpartners. Part of the partners in the SmartFuel Project are aircraft sensors and actuators manufacturers, oth-ers are nal users (big aircraft companies), and some others are university research groups. The process ofmaking the fuel system simulation served as a common table to establish communication between dierentmentalities, and is eective as part of a requirement engineering step. Once an operational version of the sim-ulation is established, this becomes a very useful tool for decision support and system logic analysis, develop-ment and testing.

The order of the article is as follows: rst a description of the process to be simulated is made; then there aretwo sections devoted to the development, and then the use, of the simulation; this is followed by a section withexamples, showing system reconguration features; nally the article draws some conclusions.

2. The process to be simulated

Some aircrafts, especially those intended to perform large intercontinental ights, can be furnished with afuel tank (trim tank) in the tail. This tank helps to get a good aircraft trim angle along the ight and to main-tain aircraft stability, shifting backwards the aircraft CoG by means of the extra fuel located in such tank.Fig. 1 shows a schematic of the aircraft fuel system that has been specied for this research. There are three

J.F. Jimenez et al. / Simulation Modelling Practice and Theory 15 (2007) 544564 545fuel tanks in each wing, and one trim tank in the tail. Each tank is furnished with suitable sensors to gauge thefuel quantity contained in it. There are two engines, LE and RE.

The fuel transfers between tanks are controlled with valves and pumps. Certain fuel transfers can be donewith no necessity of pumps, for instance, by taking advantage of wings inclination for simple gravity transfers.The pumps ensure certain functions, for instance, engine supply (pumps P1P4).

Notice that the system embodies some fuel path redundancies, to guarantee engine supply even when thereare component failures. For instance, gravity transfers between the tanks of the left wing can be done through

LE RE

LOT

LMT LFTJ

K

P1 P2

A BCTP1

ROT

RMTRFTM

L

P4P3

FED TP2

N

G

OTTH TP4TP3Fig. 1. Schematic of the aircraft fuel system.

valves J and K, or (perhaps with the help of pump TP1) through valves A, B and C that are connected to acommon gallery. The same happens with valves M and L, or (pump TP2) F, E and D in the right wing.

The tanks LFT and RFT, close to the fuselage, are the engine feed tanks. It is important to maintain thefuel quantity in these tanks above a certain minimum level. The tanks in the middle of the wings, LMT andRMT, play a central role in fuel transfers. Usually the outer tanks, LOT and ROT, are full as long as possible,since they contribute to counteract upwards bending of the wings.

Fuel transfers between wings can be performed, though they are not common. Likewise, transfers from andto the tail tank can be done, through valve G, being a normal procedure along the ight as it will be describedbelow. Valves H and O isolate the trim tank; pumps TP3 and TP4 are used to transfer fuel from the trim tankto the wing tanks.

Let us introduce a simple notation to abbreviate the description of fuel transfers along a ight. Forexample,

LMT ! K ! LFTwhich represents the transfer of fuel from the left middle tank to the left feed tank, through valve K.

Fig. 2 shows the evolution of fuel content into the tanks in the left wing and the tail along the dierentphases of a typical ight. Greek letters have been used to denote the time intervals of these phases. The evo-lution of fuel content in the right wing tanks is similar to the evolution of fuel content in the left wing tanks.

Here is a brief description of the fuel system work during the main phases of the ight:

During the take o, phase (a), the engines consumption rate is the highest, taking the fuel from the feed

546 J.F. Jimenez et al. / Simulation Modelling Practice and Theory 15 (2007) 544564tanks LFT and RFT. During this short period no fuel transfers take place among the tanks. Once the aircraft has reached a predetermined ight level, phase (b) begins. The engines consumption rate,taking fuel from LFT and RFT, decreases. The following fuel transfers start:

LMT ! TP1B ! G ! O ! TTRMT ! TP2E ! G ! O ! TT

Phase (c) starts when the quantity of fuel in TT reaches 10,000 kg. Fuel transfers are suspended. Phase (d) starts when the fuel in feed tanks reaches a minimum level of 4000 kg. The following fuel transfersstart:

0 0.5 1 1.5 2 2.5 3

x 104

0

0.5

1

1.5

2

2.5x 10

4

Time

Kg

Left tanks

LFT

LMT

TT

LOT Fig. 2. Evolution of fuel tanks content along a typical ight.

LMT ! TP1B ! C ! LFTRMT ! TP2E ! D ! RFT

Phase (k) starts when again the fuel in feed tanks reaches a minimum level of 4000 kg. The following fueltransfers start:

TT ! TP3=TP4H ! G ! C ! LFTTT ! TP3=TP4H ! G ! D ! RFT

Notice that the evolution of TT during phase (k) has two parts. The rst part describes the controlled transferof fuel from the aft to the fed tanks to assure that CoG is always inside its security region. The second parttakes place just before landing: it is necessary to transfer the remaining fuel in the aft tank as fast as possible tothe fed tanks. No fuel should remain in the aft tank during landing.

Fuel consumption and transfers cause a motion of the CoG. It is important to keep the CoG inside a secu-rity zone. In the airplane engineering context, this problem is analyzed using a special graphical representa-tion. The CoG position is expressed as a percentage of the mean aerodynamic chord (MAC). Dependingon the specic aerodynamics of each aircraft, the CoG should not surpass certain limits which are alsoexpressed as a percentage of the MAC. These limits depend also on the total aircraft weight and thus, theychange during the ight as fuel is consumed.

In consequence, a key experiment to be done in the simulation environment is to reproduce a completeight and see the evolution of the CoG position. Fig. 3 shows the results for a typical ight.

In Fig. 3 the CoG limits are represented by an external perimeter formed with straight stretches. The CoGevolution as depicted in Fig. 3 is a curve, starting from A (take-o) and ending in B (landing), that is always

From the point of view of control, the fuel management system is a hybrid control system [1]. There is a

J.F. Jimenez et al. / Simulation Modelling Practice and Theory 15 (2007) 544564 547combination of continuous variables, such as fuel quantity, and discrete variables, due to the use of on/o

0 10 20 30 40 50 60 701.2

1.3

1.4

1.5

1.6

1.7

1.8

1.9

2

2.1

2.2x 105

% MAC

kg

A

B inside the perimeter (as should be).

3. Simulink model of the processFig. 3. Evolution of the CoG during a typical ight.

valves and pumps. All valves are on/o except for the valve G, which is proportional (it opens more or lessdepending on a voltage control input).

The computer model of the fuel management system was developed using MATLAB-Simulink [9]. It oersseveral important advantages for the project. It can be easily edited, so both component characteristics andinteractions can be modied, to consider specic airplanes.

There are several steps involved in the model development. First, the components are modelled using Sim-ulink icons. Second, the components are connected to each other. The logic of the system (the system intelli-gence) is expressed in part by the components, which can be of logical nature, and in part by theinterconnection structure.

Considering the objectives of the fuel system simulation, which focus on logic and scheduling, a two-layermodel structure has been devised. The top level is devoted to fuel ow routing, and the low level refers tosequencing logic. Both levels are interconnected by signal linking icons. Let us describe in more detail eachof the model layers.

3.1. The process model layer

Fig. 4 shows the Simulink diagram with the process model layer. The main phenomenon to be modelled isthat engines cause a decreasing of the fuel content in the tanks; this implies that the arrows in the diagramoriginate in the engines and end in the tanks. There are four kinds of icons, corresponding to valves, tanks,engines, and signal linking. By clicking on a valve, tank or engine icon, a window opens showing the modelthat is represented by the icon. The core of the generic tank model is an integrator; the arrows pointing to the

M

valve M

F

valve F

Right Outer Tank

ROT

M

M

F

F

E

0.00

548 J.F. Jimenez et al. / Simulation Modelling Practice and Theory 15 (2007) 544564J

valve j

O

valve O

N

valve N

L

valve L

K

valve K

H

valve H

G

valve G

E

valve E

D

valve D

C

valve C

B

valve B

A

valve A

Aft Trim Tank

TT

Right Mid Tank

RMT

Right Feed Tank

RFT

Left Outer Tank

LOT

Left Mid Tank

LMT

Left Feed Tank

LFT

L

L

K

K

J

J

Fuel computer

FTEngine R

FTEngine L

E

D

D

C

C

B

B

A

A

O

O

H

H

0.00

0.00

0.00

0.00

0.00

0.00Fig. 4. The process model layer in Simulink.

tank inputs represent fuel consumption (so arrows are opposite to fuel ow). The interconnection of the iconscorresponds to the calculation of fuel consumption, for dierent alternatives of fuel ow routing in the aircraftsystem.

Both Engines have been modelled in an identical way: they are considered as sinks of fuel. They subtractfrom feed tanks a constant fuel rate that depends only on the nominal consumption rate assigned to theengines in each ight phase.

Most valves have only two possible states: open or closed. The nominal ow rate through valves is imposedexternally by the sequencing control model layer. For simplication, transitions between both states are con-sidered to be instantaneous. This approach is known in the literature as a time scale abstraction and the dis-crete transition that copes with the change of ow is known as a pinnacle [7].

From a mathematical point of view, the model is a collection of simple integrators. In this way, a tank icould be modelled asZ

J.F. Jimenez et al. / Simulation Modelling Practice and Theory 15 (2007) 544564 549mit mi0 t

0

Xi

cijs; sds 1

where mi(t) represents the fuel mass in tank i, mi0 represents the initial mass of tank i, and cij(s,s) is the owrate between tank i and tank (or engine) j. Usually cij(s,s) represent the ow rate of a single valve and dependsonly on the (discrete) state of the system s: cij(s,s) = cij(s).

When several valves are serially connected along the route that links i and j, cij(s) is the product of the indi-vidual valve ow rates. It is noteworthy that not every valve has been modelled in the same way, as it will beexplained below.

The symbol before cij(s,s) combined with the own cij(s,s) sign expresses the sense in which the fuel ows.These fuel ow senses have been established in a way that assures proper completeness conditions: such as thetotal mass of the system at any time is the dierence between the initial total fuel mass and the fuel mass con-sumed by the engines.

The models of the valves vary slightly according to the role of each valve. All valve models are governed bytwo main parameters: opening control input and ow rate. The opening control input takes values between 0(close) and 1 (full open), and the ow rate establishes the value of the fuel ow rate when the valve is fullyopen.

Valves M, L, J and K have the same, simplest, model. Fig. 5 depicts the model of valve M. The openingcontrol input is denoted svm (state variable for valve m) and the ow rate is denoted cvm.

Valves D and C connect the feed tanks with the common fuel gallery. They have the same model. For thesevalves the fuel rate is obtained in accordance with the fuel ow in the common gallery and the state of othervalves connected to the gallery. Fig. 6 depicts the model of valve D.

Valves E and B connect the mid tanks with the common gallery. They have the same model, which consid-ers the state of the other valves connected to the gallery. Fig. 7 depicts the model of valve E.

Fig. 8 shows the model of valve F (valve A has the same model). Valves A and F are also connected to thefuel gallery.

1Out1

Switch

[cvm]

From1

[svm]

From

0

ConstantFig. 5. Model of valve M.

1Out1

svc

sva

svf

Switch2

Switch1Switch

Product

cva

From2

cvf

From1

svd

From

0

Constant3

0

Constant2

1

Constant1

0

Constant

1In2

Fig. 6. Model of valve D.

1Out1

sve

sve

svocve

cve1

cve

cve

Switch2Switch1

Switch

sva

svc

svd

svf

0

Constant

Fig. 7. Model of valve E.

1Out1 Switch1Switch

Product

cvf

From1

svf

From

0

Constant2

1

Constant1

0

Constant

1In1

Fig. 8. Model of valve F.

550 J.F. Jimenez et al. / Simulation Modelling Practice and Theory 15 (2007) 544564

J.F. Jimenez et al. / Simulation Modelling Practice and Theory 15 (2007) 544564 551Fig. 9 shows the model of valve H (valve O has the same model) and the model of valve G. The fuel owthrough valves H and O (transfers from/to tail tank) is controlled by the proportional valve G.

Valve N is a particular case. It can be operated only by hand.Coming back to the mathematical view of the model, it is possible now to take a deeper insight into cij(s,s)

terms. So, valves M, L, K and J directly generate time independent cij(s) with a zero or constant value, depend-ing on s. Valves D, C, O, H just act serially connected with other valves, for this reason their contribution tocij(s,s) terms takes only a multiplicative 0 or 1 value. Valves E, B, F, and A can work sometimes like valve Mand other times like valve D, the reason is that they are fully revertible and operate in a very dierent waywhen they extract fuel from their connected tank and when they put fuel in it. Valve G represents a specialcase, because its contribution to cij(s,s) terms is fully time dependent

cGij s;s cGij s P RCoGs;sCoGsD dRCoGs;sCoGs

dt IZ s0

RCoGs;s0 CoGs0ds0

2

where cGij s; s represents the contribution of G valve to a generic cij(s,s), RCoG is a time dependent referencevalue for the aircraft Centre of Gravity position which typically runs 2% inside the CoG limits described inFig. 3 but which can change for some states, CoG(s) is the aircraft centre of gravity during the ight andP, I, D are the parameters of a typical PID controller. The term cGij s modulates the PID output, accordingto the state.

Now, it could be valuable to point out again the hybrid character of the system. There is a continuous part,described by Eq. (1) for mass evolution in the tanks, These equations can be considered from a theoreticalpoint of view as monoid actions l:S M!, where the monoid will be (RP0; 0; as a representation of

1Out1

max/min valveopening

[svg]

cvg1

[cvg]cvg

0

Constant

1Out1

[svh]

svoSwitch

0

Constant

1In1

a b

Fig. 9. (a) Model of valve G. (b) Model of valve H.the real continuous time, the action l of this monoid, represented by Eq. (1), is on the set S of system states.It is trivial to check that Eq. (1) fulls the requirements of a monoid action: l(s,0) = s andl(s,a + b) = l(l(s,a),b).

On the other hand, there are also discrete transitions from one state to another that can be describedemploying an automaton and thus, this last has a typical coalgebraic structure; with an alphabet A (phaseight, fuel level limits, failures, etc.) acting on the same state space of the system S and a set of observableoutputs B. Following a common notation for coalgebras, it is possible to represent this discrete dynamic ashd,ei :S! SA B, where d represents a transition function d :S! SA B and e is an observation functione:S! B. Monoid action and coalgebra can be combined to dene the hybrid model as hd,ei:l(s,a)! SA B,where the state s evolves continuously on time under the monoid action and the coalgebra acts on the resultingstate. A detailed description of this theoretical formulation is beyond the scope of this paper and can be foundin [4].

The automaton has been implemented using a Simulink s-function [9] and it is part of the sequencing con-trol model layer.

3.2. The sequencing control model layer

Fig. 10 shows the Simulink diagram with the sequencing control model layer. There are several subsystemsincluded in the diagram. Labels q1q9 have been added in Fig. 10 to help describe the model.

Subsystem q1 in Fig. 10 is devoted to valve control (except for valve G), so it is responsible to obtain theproper values of cij(s,s). The subsystem has a lot of inputs, to know the present state of valves and other rel-evant parameters such as the remaining fuel quantities in the tanks and some specic ags. The informationfrom the inputs is processed by a Simulink S-function, which appears in the diagram as a block denoted svalv-ulas. Basically it is a MATLAB program with a large set of if..then sentences. This block is the core of theautomaton previously described, It deals with 45 dierent input parameters which describe the current states and also the input elements of alphabet A.

Fig. 11 shows a simplied view of the whole automaton, showing the state transitions during the phases of anormal ight. It is interesting to remark that the complete performance of the automaton is too much complexas to be represented in a single diagram. Fig. 11 does not represent, for example, valve failure or lateral imbal-ance states.

Notice at the top left part of q1 a group of blocks, which use another function that obtains the CoG posi-tion, from subsystem q3, and computes its distance to the allowable limits. The subsystem q1 gets also its own

viewer

valves flow

svjcsvj

svf

sve

svd

svc

svb

sva

svfc

svbc

svec

svcc

svdc

cogsvac

[mtt][motr]

[motl]

[mmtr]

[mmtr]

[mmtl]

[Gs][D]

[L][E]

[M][F]

[mftr]

[H][O]

[mftr]

[A][J]

[B][K]

[C]

[mftr]

[mftl][erc]

L35TR

L4TR

ctrf

ctre

ctrd

ctrc

ctrb

ctra

[cotl]

[cmtr]

>=

MATLABFunction

[ctt]

[L4TR]

[cftr]

[svjc]

[svfc]

[cmtl][svec]

[svdc]

[svcc]

[svbc]

[svac]

[cftl]

[cotr]

[cog]

[TFT]

[clk]

[FL255]

[L4TL]

[L35TR]

em

27000

CoG

q2

q3

q6

q7q9

552 J.F. Jimenez et al. / Simulation Modelling Practice and Theory 15 (2007) 544564vave flow

valves opening

svmc

svkcsvlc

svgc

svgc

svl

svk

svg

svh

svn

svo

svm

[mtt]

[mtt]mtt1

[motr]

[motl]

[mmtl]

[pump][cvg]

[svh][mmtr]

[mftr]

[mftr]

[svo]

[Gs]

[mftl]

[mmtl]

[mftl]

[mftl]

[mftl]

fuel in tanks

[svgc]flight Scheduler

[erc]

cvg

L35TL

L4TL

cva

cvb

ctro

ctrn

ctrm

ctrl

ctrk

ctrj

ctrh

ctrg

[flagl]

[flagr]

[cmtr]svalvulasS-Function

svoc

cvfcvj

cvl

cve

svhc

cvk

flagrflagl

cvm

G valvecontroller

[elc]

[svb]

[FL255][svo]

[svoc]

[svm][svl]

[svk][svj]

[svf][sve]

[sva][svj]

[svb][svk]

[svc]

[svhc]

[svd][svl]

[sve][svm]

[svf]

[svmc]

[svlc]

[svkc]

[elc]

[cmtl]

[svc]

[L35TL]

[svh]

[cog]

[TFT]

[svd]

[sva]em

B

B

B

1

q1q4

q5

q8Fig. 10. The sequencing control model layer in Simulink.

J.F. Jimenez et al. / Simulation Modelling Practice and Theory 15 (2007) 544564 553outputs as they were calculated in the previous time step. With all this information, svalvulas establishes thepresent state of the system and commands new values for the valves state and the fuel ow rates through them.The right hand side of subsystem q1 shows the outputs for the commands.

In case any valve is broken, it does not obey to commands, svalvulas detects the failure by comparing,in the next time step, the commanded state with the real obtained state (as measured from the processmodel layer). If it is possible, when a fault is detected, svalvulas triggers a reconguration to counteract thefailure.

Subsystem q3 in Fig. 10 computes the CoG position during the ight. It also computes the total aircraftmass, including fuel.

Subsystem q4 performs the control of valve G employing a PID type controller. The complete simulationenvironment has been useful for a good tuning of this controller.

Subsystem q2 activates a ag when the fuel in the right feed tank reaches the 4000 kg limit, and a dierentag if it reaches 3500 kg. Subsystem q5 does the same for the left feed tank.

Subsystem q9 connects the commands given by subsystem q1 to the actual valve inputs. Here, in subsystemq9, we can introduce delays and faults.

The other subsystems in Fig. 10 are devoted to visualization purposes, as will be described next.

4. Using the simulation

Simulink models can be edited, by clicking on the icons and setting parameters. For instance, we could clickon the icons representing tanks (Fig. 4) to specify initial fuel quantities; we could click on valve icons (Fig. 10)

Fig. 11. Simplied view of the aircraft fuel control automaton (only transitions corresponding to a normal ight are shown).

for action specications; or we could click on the G valve controller icon (Fig. 10) to change P.I.D. param-eters. In addition to this conventional way, we added several windows for an easiest handling of thesimulation.

Simulation experiments are specied and launched from a main initial window with seven panes. Fig. 12shows this window.

The initial fuel weight pane contains seven entries to change the fuel weights in every aircraft fuel tank. Bydefault, the program checks if there is enough fuel to perform the ight scheduled in the panel ight sched-uled. If there is not enough fuel, a pop up message is launched but no action is taken to amend the error, i.e. itis the users decision to change the values. In case no further change is performed, the model shall not haveenough fuel to complete the simulation.

554 J.F. Jimenez et al. / Simulation Modelling Practice and Theory 15 (2007) 544564Fig. 12. Main initial window for simulation experiments.

J.F. Jimenez et al. / Simulation Modelling Practice and Theory 15 (2007) 544564 555Simulations can be paused, changes are admitted in the pause, and then resumed. The total quantity of fuelon board is calculated every time a change is performed in the fuel content of any tank.

The pane contains also a radio button entitled: Fit Cruise Time. Activating this radio button has two eects:

1. It opens a hidden entry entitled RFBAL. This entry shows the scheduled Remaining Fuel on Board AfterLanding.

2. It ts the cruise time according to the available fuel and the scheduled RFBAL, when the fuel content ofany tank is modied.

Fig. 13. Visualization of CoG in a simulation.

556 J.F. Jimenez et al. / Simulation Modelling Practice and Theory 15 (2007) 544564The ight schedule pane contains entries to perform changes in the lengths of the ight phases. It has beenconsidered that only the cruise time changes, while the lengths of the other ight phases usually remain thesame. For this reason, only the cruise time and the total ight time entries are enabled by default. In casethe user needs to change other dierent ight phases, it is enough to push the radio button entitled FlightPhases Mode Enable and every ight phase becomes enabled.

Fig. 14. Visualization of fuel ow rates through the valves in a simulation.

Total ight length will change with any modication introduced in the ight phases length; but modica-tions performed in the total ight time only aect the cruise time.

The engines fuel consumption rate pane has two entries, one per engine. The entries have a vector structurewith three values. The rst one is the engine consumption during take o, the second one is the consumptionduring the cruise and the last one is the consumption during landing. The values can be dierent for eachengine.

The aircraft zero fuel weight and zero fuel CoG position panes allow modifying the weight of the aircraftwithout fuel and the position of the centre of gravity. This last parameter is expressed as a percentage ofthe Mean Aerodynamic Chord.

The valve failures test pane has a set of radio buttons to be employed for valve failures simulation. The fail-ures can be induced both before and during simulation time. The radio buttons are located in rows of threebuttons. Each row is related with one of the valves. When the left side radio button is pressed, the state of thecorresponding valve changes to broken and the remaining two radio buttons of the row become active. Thesetwo radio buttons are mutually exclusive, and allow for establishing the fault as broken-open or broken-close.

The pump failure button is used to simulate that one of the aft pumps, TP3 or TP4, is broken. The twobuttons for manual cross engine feed, using valve N, are mutually exclusive.

There are two buttons located in the upper part of the window for Start/stop and Pause/resume thesimulation.

Once an experiment is specied, this specication can be saved on disk and used at any time.

J.F. Jimenez et al. / Simulation Modelling Practice and Theory 15 (2007) 544564 557In simulation time three windows appear. One of the windows contains a plot similar to Fig. 2, showing theevolution of fuel quantity in the tanks along the ight. The other two windows show with animated graphicsthe CoG evolution and the fuel ow rates through the valves.

Fig. 13 depicts the window showing the CoG evolution: its position on the aircraft and the kg vs. MACcurve.

Fig. 14 shows the window with the fuel ow rates through the valves along a typical ight.

5. Some experiments

The results for a typical ight have already been shown in Figs. 13 and 14. Let us present the results forsome illustrative examples of ights with problems.

0 0.5 1 1.5 2 2.5 3

x 104

0

0.5

1

1.5

2

2.5x 104

Time

Kg

Left tanks

LFT

LMT

LOT Fig. 15. Evolution of fuel tanks content when valve E is broken.

-101

F

0

0.5M

-101

E

012

L

-101

D

-100

10G

012

C

0

0.5K

012

B

0

0.5J

-101

A

-101

O

0 0.5 1 1.5 2 2.5 3x 104

-101

Time

H

Fig. 16. Fuel ow rates through valves when valve E is broken.

0 10 20 30 40 50 60 701.2

1.3

1.4

1.5

1.6

1.7

1.8

1.9

2

2.1

2.2x 105

% MAC

kg

A

B

Fig. 17. CoG evolution when valve E is broken.

558 J.F. Jimenez et al. / Simulation Modelling Practice and Theory 15 (2007) 544564

5.1. Valve E is broken

In case valve E is broken, the fuel management system decides not to transfer to the tail tank, so valve Gremains closed. Fig. 15 depicts the evolution of fuel content in the left wing tanks (it is the same evolution as inthe right wing tanks). A comparison can be made with Fig. 2.

The only transfers that take place start when the fuel in feed tanks reaches a minimum level of 4000 kg:

LMT ! TP1B ! C ! LFTRMT ! L ! RFT

Fig. 16 shows the fuel ow rates through the valves.Fig. 17 depicts the CoG evolution in this case. A comparison can be made with Fig. 3.

5.2. Valve E breaks in transfer

Let us suppose that valve E breaks and closes during the initial transfer to the tail tank, phase (b) of theight. In this moment the transfers to the tail tank are suspended. This has two consequences:

The mid tanks have more fuel than usual during phase (c). So the transfer to feed tanks during phase (d)takes longer:

LMT ! TP1B ! C ! LFTRMT ! L ! RFT

J.F. Jimenez et al. / Simulation Modelling Practice and Theory 15 (2007) 544564 559 The tail tank has less fuel than usual, so it decreases to zero in a shorter time, phase (k):

TT ! TP3=TP4H ! G ! C ! LFTTT ! TP3=TP4H ! G ! D ! RFT

It is interesting to note that the logic of the system, in response to the breaking of valve E, does change withtime of ight.

0 0.5 1 1.5 2 2.5 3

x 104

0

0.5

1

1.5

2

2.5x 10

4

Time

Kg

Left tanks

LFT

LMT

TT

LOTFig. 18. Evolution of fuel tanks content when valve E is broken in transfer.

-101

F

0

0.5M

00.5

1E

012

L

024

D

-100

10G

024

C

0

0.5K

012

B

0

0.5J

-101

A

024

O

0 0.5 1 1.5 2 2.5 3x 104

05

10

Time

H

Fig. 19. Fuel ow rates through valves when valve E is broken in transfer.

0 10 20 30 40 50 60 701.2

1.3

1.4

1.5

1.6

1.7

1.8

1.9

2

2.1

2.2x 105

% MAC

kg

A

B

Fig. 20. CoG evolution when valve E is broken in transfer.

560 J.F. Jimenez et al. / Simulation Modelling Practice and Theory 15 (2007) 544564

01

J.F. Jimenez et al. / Simulation Modelling Practice and Theory 15 (2007) 544564 561-10

-100

10

012

024

-505

0

0.5

1

A

J

B

K

C

D-101

0

0.5

-505

24

L

E

M

FFig. 18 depicts the evolution of fuel content in the left wing tanks (it is the same evolution as in the rightwing tanks). A comparison can be made with Fig. 15.

Fig. 19 shows the fuel ow rates through the valves in this case. A comparison can be made with Fig. 16.Fig. 20 depicts the CoG evolution in this case. A comparison can be made with Fig. 17.

5.3. Valve D is broken

In case valve D is broken, the transfers from RMT to RFT are made through valve L, with the same owrate as the normal routing (through valves E and D). Pertaining to the evolution of fuel tanks content and tothe evolution of the CoG, everything is like a typical ight (Figs. 2 and 3). The only changes are in the owrates through valves, as visualized in Fig. 21.

5.4. Lateral imbalance

In this experiment a lateral imbalance will be manually introduced, by blocking the action of pumps P1 andP2 along a time interval DT. This is done shortly after take-o. While P1 and P2 are not working, the fuelcontent of LFT is constant. Along the interval DT, the fuel is transferred from RFT through valve N tothe LE engine. A lateral imbalance is caused, with the left wing having more fuel than the right wing.

After the interval DT, the pumps P1 and P2 are allowed to work normally. See the initial shape of LFT andRFT curves in Fig. 22, which depicts the fuel tanks content evolution.

-10

024

0 0.5 1 1.5 2 2.5 3x 104

05

10

Time

H

O

G

Fig. 21. Fuel ow rates through valves when valve D is broken.

562 J.F. Jimenez et al. / Simulation Modelling Practice and Theory 15 (2007) 5445640 0.5 1 1.5 2 2.5 34

0

0.5

1

1.5

2

2.5x 104

Kg

Right tanks

RFT

RMT

TT

ROT Since the tank RFT is required to feed both engines along DT, its contents quickly decrease, soon reachingthe 4000 kg low limit. At this moment, the transfer from mid tanks to the tail tank is suspended. Now, the fuelis transferred from RMT to RFT, as follows:

RMT ! TP2E ! D ! RFTThis transfer continues till RMT gets empty, and valve D closes. Shortly afterwards, the fuel in tank RMTreaches again the 4000 kg low limit. Now fuel is reclaimed from the tail tank (valve D opens again):

TT ! TP3=TP4H ! G ! D ! RFTNo fuel from TT goes to LFT, to compensate for the imbalance.

When the fuel in tank RFT reaches the 3500 kg limit, the fuel is reclaimed from ROT:

ROT ! M ! RMT ! L ! RFTIn the left wing, the content of LFT decreases until it reaches the 4000 kg low limit. At this moment, the fuel istransferred from LMT:

x 10

0 0.5 1 1.5 2 2.5 3

x 104

0

0.5

1

1.5

2

2.5x 104

Time

Kg

Left tanks

LFT

LMT

TT

LOT

Fig. 22. Evolution of fuel tanks content in the imbalance experiment.

-101

F

012

M

012

E

012

L

012

D

-100

10G

012

C

012

K

012

B

-101

J

-101

A

024

O

0 0.5 1 1.5 2 2.5 3x 104

012

Time

H

Fig. 23. Fuel ow rates through valves in the imbalance experiment.

0 10 20 30 40 50 60 701.2

1.3

1.4

1.5

1.6

1.7

1.8

1.9

2

2.1

2.2x 105

% MAC

kg

A

B

Fig. 24. CoG evolution in the imbalance experiment.

J.F. Jimenez et al. / Simulation Modelling Practice and Theory 15 (2007) 544564 563

LMT ! TP1B ! C ! LFTFig. 23 shows the fuel ow rates through the valves for this experiment.

Fig. 24 depicts the CoG evolution in this case. A comparison can be made with Fig. 3.

6. Conclusion

A simulation of an aircraft fuel management system has been introduced. Considering the purpose of thesimulation, a two-layer interconnected structure has been adopted, corresponding to the fact that the aircraftfuel system is a hybrid system.

564 J.F. Jimenez et al. / Simulation Modelling Practice and Theory 15 (2007) 544564Aircraft fuel management systems have structural redundancies, oering several path alternatives for fueltransfers. An aircraft on board program has to be developed for the fuel system management andreconguration.

The simulation provides a platform for analysis and development of the on-board fuel system managementprogram, including adequate system reactions to dierent possible failures. Although a specic fuel systemstructure has been modelled, an aircraft with six tanks in the wings and a tail tank, the modelling techniquecan be easily applied to other aircrafts and fuel system structures.

The simulation environment makes the study of many cases easy, concerning normal ights with severalinitial conditions or cases with malfunctions. The article describes some examples. Actually, more than 80 dif-ferent cases have been studied with simulation.

Acknowledgements

The authors thank the European Community support through the Research Project SmartFuel. Like-wise, the authors thank the collaboration of the research partners.

References

[1] S. Engell, G. Frehse, E. Schnieder (Eds.), Modelling, Analysis and Design of Hybrid Systems, Lecture Notes in Control andInformation Sciences, Springer-Verlag, 2002.

[2] J.M. Giron-Sierra, C.C. Insaurralde, M.A. Seminario, J.F. Jimenez, Distributed control system for fuel management using CANBUS,in: Proceedings of the IEEE 23rd Digital Avionics Systems Conference (DASC), Salt Lake City, UT, USA, 2004, CD-ROM 8.D.2.1-9.

[3] J.M. Giron-Sierra, M. Seminario, C. Insaurralde, J.F. Jimenez, P. Klose, J.A. Frutos, I. Perez, E. Buesa, A new distributed avionicssystem based on the CANbus and homogeneous nodes, in: Proceedings IEEE International Conference Industrial Technology,Hammamet, Tunisia, 2004, pp. 892897.

[4] B. Jacobs, Object-oriented hybrid systems of coalgebras plus monoid actions, Theoretical Computer Science 239 (2000) 4195.[5] D.A. Lombardo, Aircraft Systems, McGraw-Hill, 1998.[6] I. Moir, A. Seabridge, Aircraft systems: mechanical, electrical, and avionics subsystems integration, AIAA Education Series (2001).[7] P.J. Mosterman, G. Biswas, A comprehensive methodology for building hybrid models of physical systems, Articial Intelligence 121

(2000) 171209.[8] SmartFuel Project, 2003. Dening the third generation digital uid management system, .[9] The Mathworks, MATLAB & Simulink Tutorials, .

A simulation of aircraft fuel management systemIntroductionThe process to be simulatedSimulink model of the processThe process model layerThe sequencing control model layer

Using the simulationSome experimentsValve E is brokenValve E breaks in transferValve D is brokenLateral imbalance

ConclusionAcknowledgementsReferences