Model_Based_Development&Testing_Matlab.pdf

8/14/2019 Model_Based_Development&Testing_Matlab.pdf

1/297

Yogananda Jeppu, Chethan CUWorkshop at MIT Manipal Jan 2013

Model Based Development & Testing

of Safety Critical Control Systems

Yogananda Jeppu


2/297


2

Key Takeaway

An insight into the fascinating field of Model Baseddevelopment and testing of Safety Critical ControlSystems

A hands on experience on the technology that makes itsafer for people to fly

A set of Best Practices in this field gleaned from the use

of this type of testing on Aircraft Programs in India


3/297


3

Presenters


4/297


4

Our Background

Chethan C U is a BE from BIT, Bangalore

He joined Honeywell in 2008

He is with Moog Controls since 2009 working on Model

Based Development and Testing of Control Systems forcommercial aircrafts

He has contributed to the innovation activities at Moogand we are pursuing this with college projects

He has qualified the Simulink Blocks for certification by

the Federal Aviation Administration (FAA), USA His contribution has been to come with equations in Excel to

qualify the Control System Blocks


5/297


5

Our Background

Yogananda Jeppu has 25 years experience in ControlSystem Design, 6DOF Simulation, Model BasedVerification and Validation, System Testing.

Has worked on the Indian Light Combat Aircraft ControlSystem and the Indian SARAS aircraft.

Currently working at Moog India, as a SoftwareSpecialist, on V&V of Commercial Aircraft ControlSystem, System Testing and Matlab / Simulink

Qualification. Also responsible for University Relations and Innovationin the organization.


6/297


6

Topics

Safety Critical Control Systems Brief Overview

Basic Matlab and Simulink Hands on

Basic Control System A recap

What are these Models? a look at how they function Algorithms for implementing them Hands on

How do we test these blocks? a block by blockapproach Hands on

Best Practices


7/297


7

Tips

We are providing tips as these as we go along and hopethat it will be useful to you.


8/297


8

About MOOG

Our philosophy at Moog is a simple

one. We believe in the people who

work for us. We believe work can be a

rewarding and satisfying experience

for everyone in an atmosphere of

mutual trust and confidence.

Bill Moog, 1951


9/297


9

MOOG

Founded in 1951 by Bill Moog

Independent, international, medium-size company

Traded on the New York Stock Exchange

People-oriented environment Reputation for high quality and technical excellence


10/297


10

MOOG Aircraft Facilities

East Aurora, NY

1690 Emp loyees

Salt Lake City, UT

340 Employees

Torrance, CA

400 Employees

Tewkesbury, UK400 Employees

Baguio City, Philippines1100 Empl oyees

Sales:$673 M in FY08

Moog India Tech Centre

140 Employees


11/297


11

Moog India Technology

Centre

The MOOG India Technology Center (MITC) will be an Aircraft

Group Strategic Design Center with complete item-level design,

development, and qualification capabilities. David Ranson


12/297


12

MOOG India Technology Center

Design & Technology Center

5 Acres of Land

15000 Sq Ft of built up area

350 Employees

Mechanical, Electrical, Software Engineering Support Aerospace Qualification Testing Lab


13/297


13

Moog proprietary and/or confidential data

MITC Software Group has a r ight

mix of Software and Hardware

engineers with expertise in

Software Development & VnV asper DO-178B standards, Model

Based Control System Testing,

Test Real Time, Matlab/Simulink,

ARINC Protocols, Various

Processor Boards, Hardware

Abstract ion Layer.

Software

Engineering


14/297


14

Boeing 747-8

Development and Verification andValidation of the Platform

Software

Control System Model BasedTesting

Control System modules coding

BIT Tests Gulfstream 650

Fly-by-Wire Control System Model Based Testing

DO 178B Level A

Software

Matlab/ Simulink

Based

Requirements


15/297


15

Gulfstream 250

Flap Control System Model BasedTesting

System Level Testing

Airbus A 350

Model Development

Testing at Low and High Levels

Hardware Abstraction LayerDevelopment and Testing


16/297


16

Moog proprietary and/or confidential dataA350 Spoi ler Servo Exploded View

A350 Elevator Servo Assembly

V-Seal Test Fixture

Mechanical

Engineering


17/297


17

MITC Electrical Section has

expertise in Digital, Analog, Power,

Sensor & Motor. The Groupprovides Library and Component

Engineering Support to all MOOG

design centers.

Expertise available on DO-254

Level A VnV for PLD .

Short stroke LVDT

Generic motor

(conceptual)

Long stroke LVDT

P30 Aileron motor

P30 HSTA Motor

Electrical

Engineering


18/297


18

Moog proprietary and/or confidential data

Test Engineering

Communication Protocols, RTOS, Device Drivers

Simulation, GUI Design & Hardware Interfaces

Test & Measurement Equipments handling

Legacy test S/W Conversion

Data Reduction & Analysis

Qualification Testing

Build-to-Print Systems

Test Equipment Engineering &Production

TE environment software

Test Program Set Functional Verification andATP/ESS / Qualification

Self Test and Calibration

Technology Specialization

Breadth

ofSup

portOfferings

TE Sustenance & Support


19/297


19

Safety Critical Applications

Aviation in itself is not inherently dangerous. But to an even greater degree than the sea,

it is terribly unforgiving of any carelessness, incapacity or neglect.

Captain A. G. Lamplugh,


20/297


20

Safety Critical Control Systems

Safety Critical Application: An application where human safety is dependent upon the

correct operation of the system

Examples Railway signaling systems

Medical devices

Nuclear controllers

Aircraft fly-by-wire system


21/297


21

Railway Signaling Systems

Andreas Gerstinger, "Safety CriticalComputer Systems - Open Questionsand Approaches",Institute for Computer TechnologyFebruary 16, 2007


22/297


22

Reactor Core Modeling

Courtesy: Jin Jiang, Research in I&Cfor Nuclear Power Plants at theUniversity of Western Ontario,


23/297


23

Streamliner Artificial Heart

James Antaki, Brad E. Paden, Michael J.

Piovoso, and Siva S. Banda, "AwardWinning Control Applications", IEEEControl Systems Magazine December2002


24/297


Programmable ECUs

Peter Liebscher, "Trends in EmbeddedDevelopment", http://www.vector-worldwide.com/portal/medien/cmc/press/PSC/TrendsEmbedded_AutomobilElektronik_200602_PressArticle_EN.pdf

24


25/297


25

Safety Standards

ISO9001 Recommended minimum standard of quality

IEC1508 General standard

EN50128 Railway Industry

IEC880 Nuclear Industry RTCA/DO178B Avionics and Airborne Systems

MISRA Motor Industry

Defense Standard 00-55/00-56


26/297


26

Safety Critical Flight Controls Marvel

A longitudinally unstableplatform

Performance and Stabilityensured by the a Fly-by-

Wire Control Systemdesigned, implementedand tested in India.

Used Model Based TestApproach for Certifying

the Aircraft for FlightWorthiness


27/297


28/297


Automobile

"The complaints receivedvia our dealers centeraround when drivers areon a bumpy road or frozen

surface," said PaulNolasco, a Toyota MotorCorp. spokesman inJapan. "The driver stepson the brake, and they do

not get as full of a brakingfeel as expected. -February 04, 2010

28


29/297


30/297


Nuclear

Iran's first nuclear power planthas suffered a serious cyber-intrusion from a sophisticatedworm that infected workers'

computers, and potentiallyplant systems. Virus designedto target only Siemenssupervisory control and dataacquisition (SCADA) systems

that are configured to controland monitor specific industrialprocesses (Wiki) - September27, 2010

30


31/297


32/297


Space

The Accident InvestigationBoard concluded the rootcause of the Titan IV B-32mission mishap was due to the

failure of the softwaredevelopment, testing, andquality/mission assuranceprocess used to detect andcorrect a human error in the

manual entry of a constant. Theentire mission failed because ofthis, and the cost was about$1.23 billion.

32


33/297


Aircraft

A preliminary investigationfound that the crash wascaused primarily by theaircraft's automated

reaction which wastriggered by a faulty radioaltimeter, which had failedtwice in the previous 25hours. This caused the

autothrottle to decreasethe engine power to idleduring approach. - 25February 2009

9 Fatalities, 117 Injured

33


34/297


34


35/297


Railway

The June 2009Washington Metrotrain collision was asubway train-on-train

collision. Apreliminaryinvestigation foundthat, signals had notbeen reliably

reporting when thatstretch of track wasoccupied by a train. 9 Fatalities, 52 Injured

35


36/297


36


37/297


38/297


Medical

28 radiation therapy patientswere over exposed toradiation at the NationalOncology Institute (Instituto

Oncolgico Nacional, ION) inlate 2000 and early 2001. 23of 28 at risk patients died ofthis due to rectalcomplications.

A software used to compute the dosage could not detect the

erroneous inputs and gave 105% more dosage values

38


39/297


Standards

If you are looking for perfect safety, you

will do well to sit on a fence and watch

the birds; but if you really wish to learn,

you must mount a machine and become

acquainted with its tricks by actual trial.

Wilbur Wright

39


40/297


Aerospace Standard DO-178B

Called Software Considerations in Airborne Systems andEquipment Certification

Published by RTCA Inc (Radio Technical Commission forAeronautics a not-for-profit corporation sponsored byFederal Aviation Administration, USA)

It is a document that addresses the life cycle process ofdeveloping embedded software in aircraft systems.

It is only a guidance document and does not specify what

tools and how to comply with the objectives It is a commonly accepted standard worldwide forregulating safety in the integration of software in aircraftsystems and insisted by the certifying authorities like FAA

40


41/297



Five levels of software have been defined

Software

Criticality

Level Probability

FAR/JAR

Remarks

Catastrophic A < 10-9 Failure may cause a crash. Error or loss of critical

function required to safely fly and land aircraft.

Hazardous B < 10-7 Failure has a large negative impact on safety orperformance. Passenger injury.

Major C


42/297


Probability Vs Consequence

42


43/297



Defines a list of objectives with and without independencefor the various levels of software

Software

Levels

Number of Objectives

With Without TotalA 25 41 66

B 14 51 65

C 2 55 57

D 2 26 28

Process Planning Development Verification Config .

Control

Quality

Assurance

Certification

Liaison

Total

Objectives 7 7 40 6 3 3 66

43


44/297


DO-178B Traceability

All the software lifecycle processes are linked in anygiven application i.e. the lifecycle activities must betraceable

Test Results

Test cases and

ProceduresCode

Design

Requirements

Linkages

Reviews ensure that the

results are traceable to Test

procedures and they in turnare traceable to the Design

and High Level

Requirements

Reviews ensure that the linkages

are correct and traceable

44


45/297


Tips

45


46/297


DO-178B Certification

Certification - legal recognition by the certificationauthority that a software product complies with therequirements

Certification is done on the individual application of theproduct

Coding practices must be certified to ensure things like"dead code" are not allowed.

Certification requires that 'full testing' of the system and

all of it's components (including firmware) be done on thetarget platform in the target environment.

Certification requires code testing at the MCDC level.Coverage proof to be provided.

46


47/297


Tips

47


48/297


Tips

48


49/297


Tips

49


50/297


Matlab

Although Matlab is now a full fledged

Technical Computing Environment,

it started in the late 1970s as a simpleMatrix Laboratory. Cleve Moler

50


51/297


51

What is Matlab?

Software developed by Mathworks, Inc. since 1984

Stands for MATrix LABoratory

The current version is MATLAB R2012a

Primarily an optimized software package for matrixoperations

Behaves like a complex functional calculator or as aprogramming language


52/297


52

Parts of Matlab

High Level Development Environment

Programming Language

Graphics

Toolboxes Application Program Interface


53/297


53

Matlab Toolboxes

Several toolboxes available for specialized applicationslike

Control System Design

Signal Processing Optimization

Simulink

Real Time Workshop

So on .


54/297


54

History of Matlab


55/297


55

History of Matlab

Ancestral software to MATLAB are LINPACK andEISPACK Fortran routines

MATLAB was invented in the late 1970s by CleveMoler, then chairman of the computer sciencedepartment at the University of New Mexico. It was aFortran version.

Designed it to give his students access to the Fortranroutines

It found a strong audience within the appliedmathematics community


56/297


56

End of History

Jack Little, an engineer, was exposed to it when Molervisited Stanford University in 1983.

Recognizing its commercial potential, he joined withMoler and Steve Bangert to rewrite the package in C

It was lovingly known as JACKPAC

Little's specialty was control system design and thecommunity adopted it


57/297


57

Matlab Basics


58/297


59/297


60/297


60

Matlab as Calculator

-->basic = 30000;perks = 20000; transport = 1200; total =basic+perks+transport; tax = 0.3*total

tax =

15360.

>> 2+2

ans =

4


61/297


62/297


62

Getting Around

>> cd 'C:\Documents andSettings\jyoganan\Desktop\MIT_Manipal\workshop'

exit , quit

! windows_command (Try !notepad.exe)

help

clear all

close all

version

dir ls who, whos


63/297


63

Getting around some more

what (list of matlab specific files in the directory) which (tells you which function is called ) which fft built-in (D:\Program

Files\MATLAB\R2007a\toolbox\matlab\datafun\@logical\fft) % logical method save vals.dat a b load vals.dat a b diary filename diary off format why


64/297


64

Exercise

Explore Help Functionality

help save

load diary format who whos what

which !


65/297


65

Mathematics & Matrices


66/297


67/297


67

Special Variables

pi

i, j

eps (2.220446049250313e-016)

NaN (0/0) inf

realmin

realmax

Mathematical function names sin, cos, ...


68/297


68

Entering Numeric Arrays

a=[1 2;3 4]

a =

1 2

3 4

b=[-2.8, sqrt(-7), (3+5+6)*3/4]

b =

-2.8000 0 + 2.6458i 10.5000

b(2,5) = 23

b =

-2.8000 0 + 2.6458i 10.5000 0 0

0 0 0 0 23.0000

NOTE:

1) Row separator

semicolon (;)

2) Column separator

space OR comma (,)

Use square

brackets [ ]

Thisimagecannot currently bedisplayed.


69/297


69

The Matrix

4 10 1 6 2

8 1.2 9 4 25

7.2 5 7 1 11

0 0.5 4 5 56

23 83 13 0 10

1

2

Rows (m) 3

4

5

Columns

(n)

1 2 3 4 51 6 11 16 21

2 7 12 17 22

3 8 13 18 23

4 9 14 19 24

5 10 15 20 25

A = A (2,4)

A (17)

Rectangular Matrix:

Scalar: 1-by-1 arrayVector: m-by-1 array

1-by-n array

Matrix: m-by-n array


70/297


70

Entering Numeric Arrays

Scalar expansion

Creating sequences:colon operator (:)

Utility functions forcreating matrices.

w=[1 2;3 4] + 5

w =

6 7

8 9

x = 1:5

x =

1 2 3 4 5

y = 2:-0.5:0

y =

2.0000 1.5000 1.0000 0.5000 0

z = rand(2,4)

z =

0.9501 0.6068 0.8913 0.4565

0.2311 0.4860 0.7621 0.0185


71/297


71

Numerical Array Concatenation

a=[1 2;3 4]

a =

1 2

3 4

cat_a=[a, 2*a; 3*a, 4*a; 5*a, 6*a]cat_a =

1 2 2 4

3 4 6 8

3 6 4 8

9 12 12 16

5 10 6 12

15 20 18 24

Use [ ] to combine

existing arrays as

matrix elements

Row separator:

semicolon (;)

Column separator:

space / comma (,)

Use square

brackets [ ]

Note:

The resulting matrix must be rectangular

4*a


72/297


73/297


73

Matrix Multiplication

a = [1 2 3 4; 5 6 7 8];

b = ones(4,3);

c = a*b

c =

10 10 10

26 26 26

[2x4]

[4x3]

[2x4]*[4x3] [2x3]

a(2nd row).b(3rd column)

a = [1 2 3 4; 5 6 7 8];

b = [1:4; 1:4];

c = a.*b

c =

1 4 9 16

5 12 21 32 c(2,4) = a(2,4)*b(2,4)

Array Multiplication


74/297


74

Math Operations

+ Addition

+ Unary plus

- Subtraction

- Unary minus * Matrix multiplication

^ Matrix power

.* Array multiplication (element-wise)

.^ Array power (element-wise)

inv()


75/297


75

Matrix Creation & Manipulation

transpose

reshape, matrix(a,3,2)

eye zeros ones rand

r=rand(2,2,2,2) multidimensional array

linspace logspace

length

size

exist, exists


76/297


76

Mathematical Functions

trigonometric

sqrt

max min

mean median std

sum prod

diff

find

sort

gradient


77/297


78/297


78

Programming


79/297


79

Script vs Function

Workspace

Script executes in workspace

Interpreted

Function taken in variables.

Internal variables local

Require global variables


80/297


80

Editor


81/297


81

Script File

x=[1:10]

[m,n] = size(x);

if m == 1

m = n;end

y = sum(x)/m


82/297


82

Function File

function y = mean (x)

% MEAN Average or mean value.% For vectors, MEAN(x) returns the mean value.

% For matrices, MEAN(x) is a row vector

% containing the mean value of each column.

[m,n] = size(x);

if m == 1

m = n;

end

y = sum(x)/m;

Output Arguments Input ArgumentsFunction Name

Online Help

Function Code


83/297


84/297


84

Switch Statement

method = 'Bilinear';switch lower(method)

case {'linear','bilinear'}disp('Method is linear')

case 'cubic'disp('Method is cubic')

otherwisedisp('Unknown method.')

endMethod is linear


85/297


85

If Statement

if ((attendance >= 0.90) & (grade_average >= 60))

pass = 1;else

pass = 0;end


86/297


86

While Loop

eps = 1;

while (1+eps) > 1eps = eps/2;endeps = eps*2


87/297


87

Exercise

Write a function to generate a random vector of 1s and0s Use a for loop

Use if then else

Use rand function Use sort

Create a sorted vector T of 10 elements with values 0 to 10.

Create a time vector t, 0 to 10 step 0.01

Create a vector of length t of zeros Assign the first element with a random 1 or 0

Assign other elements toggling 1 to 0 and 0 to 1 at T points


88/297


88

Exercise

Write a function to compute the error between twosignals and generate a pass fail based on threshold

Test this function

Err_sig = abs(A-B)

If A > 1 then Err_sig = Err_sig/(abs(A))

If Err_sig > Threshold then declare fail

Function A = passfail(A,B,Threshold)

A = 1 pass, A= 0 fail


89/297


90/297


90

Graphics


91/297


91

Plotting

t=1:10;y=rand(1,10);plot(t,y);shg


92/297


92

Plot Commands

figure;plot(t,x,k,t,y,b,t,z,r);grid

legend

title

xlabel

ylabel

axis

hold

plotyy


93/297


94/297


94

Exercise

Plot the waveforms generated during the earlier exerciseand make a neat presentation


95/297

Yogananda Jeppu, Chethan CU

Workshop at MIT Manipal Jan 2013

95

Polynomials


96/297



96

Polynomial

The polynomial

is written as a = [10 12 0 15.5 -20]

Roots(a) gives the roots of the polynomial

-1.9110

-0.0209 + 1.1789i

-0.0209 - 1.1789i

0.7528


97/297



97

Polynomial

Use conv(a,b) to multiply two polynomials

Use deconv(a,b) to divide two polynomials

a=[1 3];b=[1 3 4];c= conv(a,b)

c=[1 6 13 12]

deconv(c,a) => [1 3 4]

polyval(p,x) gives the value of the polynomial


98/297


99/297



99

Definitions

Modeling = procedure to simplify investigation of theirdynamic behavior

Simulation = imitation of dynamic behavior of realsystems

Analysis = relating system behavior to a changingvariable or parameter

Diagnostics = indicating the reason for a system failure


100/297



100

Simulink

Graphical programming language Extension of Matlab

Powerful modeling tool Control systems

Transfer functions based Vehicle and Aerospace

Code generation

Verification and Validation


101/297



101

System

Uses a icon-driven interface for the construction of ablock diagram representation of a process.

A block diagram is simply a graphical representation of

a process (which is composed of an input, the system,and anoutput).


102/297



102

Invoking Simulink


103/297



103

Simulink Blocks


104/297


104

Sources

Sources library contains thesources of data signals to beused in the dynamic systemsimulation.

E.g. Constant signal, signal

generator, sinusoidal waves,step input, repeatingsequences like pulse trainsand ramps etc.


105/297


105

Sinks

Sinks library containsblocks where the signalterminates. You maystore data in a file,display it. Use the

terminator block toterminate unusedsignals. STOP block isused to stop thesimulation if the input tothe block is non-zero.


106/297


107/297


107

Non Linearity


108/297


108

Shamelessly Picked From

Bruce Mayer, PE

Licensed Electrical &Mechanical [email protected]


109/297


110/297


110

Simulink - 02 00sin10 ytdt

dy

Open ModelWindow/File

[email protected]


111/297


111

Simulink - 03

The Untitled

ModelWindow

00sin10 ytdt

dy

[email protected]


112/297


113/297


113


dy

DoubleClick SineWave icon toOpen Block-Parameters Dialog

Box

No Changes

Needed

[email protected]


114/297


114


dy

Select Math Ops Library

Drag Gain icon to Model Window

[email protected]


115/297


115


dy

DoubleClick Gain icon to OpenBlock-Parameters Dialog Box

Set Gainto 10

[email protected]


116/297


116


dy

Set ICto Zero

Select Continuous Library

Drag IntegratorBlock to

Model Window

2X-Click the Icon to Openthe Dialog Box

Set the IC to Zero

[email protected]


117/297


117


dy

Select

SinksLibrary Drag Scope Block

to Model Window

[email protected]


118/297


118


dy

Connect The Block

Outputs & Inputs

Turns to Crosswhen Clicked

[email protected]


119/297


119


dy

Open the

ConfigParameters

Dialog Box

Set 13s Stop-

Time

[email protected]


120/297


120


dy

Start Simulation Opens the Scope

Display

Wait for Bell toSound

2X Click Scope Click Binocs to

[email protected]


121/297


121


dy

Simulation Result

tz

zzdzyty

0sin100

[email protected]


122/297


122


dy

Export Simulation toWorkspace for Plotting

Add/Subtract icons

2X-Click To

WorkSpace icon

[email protected]


123/297


123


dy

Export Result Plot the Result

t ty

0 2 4 6 8 10 12 140

2

4

6

8

10

12

14

16

18

20

t

y

Example 9.2-3: Soln to dy/dy = 10sin(t) y(0) = 0

>> plot(y(:,1),y(:,2)), xlabel('t'), ylabel('y'), grid

[email protected]


124/297


124

Simulink Exercise

Make a model by having 3 inputs A,B, C and two outputsO1, O2. O1 = (A+B-C) * 3. If O1 > 10 then O2 = 10 else5. Use from workspace and to workspace. Plot theresults

Make a model with 4 inputs A,B,C,D and 1 output O1. If(A AND B) XOR C then O1 = D else O1 = (D+10.5)*10

Connect a discrete TF to a input and see its stepresponse in a scope. Use from workspace and toworkspace. Plot the results


125/297


Simulink Exercise

Use an integrator to count 1 second time

125

Unit Delay

z

1

Signal Builder 5

Signal 1

Signal Builder 4

Signal 1

Signal Builder 2

Signal 1

Signal Builder 1

Signal 1

Signal Builder

Signal 1

Scope1

Scope

Discrete -Time

Integrator 1

K Ts

z-1

xo

Discrete-Time

Integrator

K Ts

z-1

xo

Compare

To Constant

>= 1


126/297


Simulink Exercise

Use Mux Demux blocks

Use of saturation block

Use a lookup table 1 D Use the matlab function interp1

Use a lookup table 2 D Use the matlab function interp2

Use the matlab function filter with the Discrete FilterSimulink block. Compare results

126


127/297


127

Control Systems

I found a letter from my mother after

20 years between the pages of BC

Kuo An Engineer


128/297


What is stability

128

Inherent Stability


129/297


130/297


Stability

ControllerO/P

Stable Unstable

Neutrally Stable

130


131/297


Controls is not new

131

285-222 BC


132/297


Ktesibios water clock

The first feedback systemdeveloped by humans

Designed by Ktesibios, abarber, in Alexandria

Greece around 250 BC The flow of water in the

second tank is regulated bya float. This maintains theheight and thus provides a

constant flow of water

132


133/297


Simulink model of the clock

133


134/297


Simulation results

134

0 20 40 60 80 1000

0.2

0.4

0.6

0.8

1Simulation of Ktesibios Water Clock

Tank1InletValve

0 20 40 60 80 1000

5

10

15

Simulation Time

Tank1WaterLevel

Water Level

Set Point


135/297


136/297


What is control system

Feedback

Control

The milk

better not

boil

&^&%$$

136

C t f d l


137/297


Concept of delay

Feedback

Control

137

C t f i


138/297


Concept of gain

Feedback

Control

138

Si l ti


139/297


Simulation

139

Demonstration of gain FEEDBACK01

Si l ti


140/297


Simulation

140

Demonstration of delayFEEDBACK02

C f i d d l


141/297


Causes for gain and delay

Unmodeled dynamics

External changes like speed and height in aircraft. Theaircraft characterization and response varies with thesetwo important factors

Changes in load different inertia Delay due to processing

Delay due to communication

Delays due to non linearity

Nature

141

M d li t


142/297


Modeling systems

142

Th L l


143/297


The Laplace

S means differentiation

1/S means integration

Transfer function is the output to input relation

TF

InputOutput

Output

Input= TF

143

Laplace transform


144/297


Laplace transform

144

Transfer function


145/297


Transfer function

145

0 0.5 1 1.5 2 2.5 3

0

0.2

0.4

0.6

0.8

1

1.2

Control performance


146/297


Control performance

146

Control performance


147/297


Control performance

147

PID effect Increasing


148/297


PID effect - Increasing

148

C-Loop

RESPONSE

RISE TIME OVERSHOOT SETTLING

TIME

S-S ERROR

Kp Decrease Increase Small

Change

Decrease

Ki Decrease Increase Increase Eliminate

Kd Small

Change

Decrease Decrease Small

Change

Closed Loop System


149/297


Closed Loop System

Process : A system to be controlled

Controller : Provides the excitation for the plant; (PID)Designed to control the overall system behavior

The characteristics of the each of the controller should be to obtaina desired response from the closed loop system.

149

PID Controller


150/297


PID Controller

150

Demonstration ofPID FEEDBACK03

Steps to tune PID


151/297


Steps to tune PID

Obtain an open-loop response and determine whatneeds to be improved

Add a proportional control to improve the rise time

Add a derivative control to improve the overshoot

Add an integral control to eliminate the steady-state error Adjust each of Kp, Ki, and Kd until you obtain a desired

overall response.

151

Design Exercise


152/297


Design Exercise

Design a controller for the black box

152

We want this


153/297


We want this

153

0 5 10 15 20 25 30 35 40-1

-0.8

-0.6

-0.4

-0.2

0

0.2

0.4

0.6

0.8

1

Time (s)

Mag

Input

Output


154/297

Input signal


155/297


Input signal

155

0 20 40 60 80 100 120 1400

1

2

3

4

5

6

62 64 66 68 70 72

4.85

4.9

4.95

5

5.05

5.1

5.15

Output processing


156/297


Output processing

t=0:0.01:time(end);t=t';

inp=interp1(time,input,t);

out=interp1(time,simout,t);

out1=interp1(time,simout1,t);

plot([inp out out1]);shg

Simulink with variable time step gives output as different

time points. Interpolation gets all this at equal timepoints.

156

Compute response


157/297


Compute response

fi=fft(inp(2000:end));

fo=fft(out(2000:end));

fo1=fft(out1(2000:end));

trf=fo./fi;

tfr1=fo1./fi; freq=linspace(0,100,length(trf));

load freres T INP mag ph freqx

plot(freqx,mag,freq,abs(trf),freq,abs(trf1));shg

157

Time Plots


158/297


Time Plots

158

6200 6400 6600 6800 7000 7200 7400 7600

0

1

2

3

4

5


159/297

fminsearch


160/297


fminsearch

Help Fminsearch

X = FMINSEARCH(FUN,X0) starts at X0 and attempts tofind a local minimizer X of the function FUN.

Example

c = 1.5; % define parameter first

x = fminsearch(@(x) myfun(x,c),[0.3;1])

160


161/297

This will help


162/297


This will help

X=[

3.2633e-001

1.0671e+002

7.3886e+002

5.6889e+002 2.2296e+001

2.6413e+001

2.2333e+001

1.2414e+002 9.5887e-002];

162

Design a controller


163/297


g

Homework Experiment with SISOTOOL

This plant will not work with just PID. It may require a lead lagfilter also.

163


164/297


164

Control Algorithms

DTF-I-1S1Num Coeff A 0 = Nz(1)

Num Coeff A 1 = Nz(2)

Den Coeff B 1 = Dz(2)

Sample Time = DT

Discrete Transfer Function

I order 1 State

Out

Input

InitSafe

ns=[A1 A2];

ds=[1 B2];

[Nz,Dz]=c2dm(ns,ds,DT,'tustin');

sim('digital1order');

INP = inp(1);

out = inp(1);

po=out;

Pi=INP;

B=[];

for i = 1:length(o)

INP=inp(i);

if init(i) > 0

INP = inp(i);

out = inp(i);

po=out;

Pi=INP;

else

out=Nz(1)*INP+Nz(2)*Pi-Dz(2)*po;

po=out;

Pi=INP;

end

B=[B;[INP out]];

end

o1=B(:,2);

err=abs(o-o1);

iie = find(abs(o > 1 00));err(iie)=abs(err(iie)./o(iie));

S Domain First Order Filter


165/297


165

sI

O

1

1

IOsO

IOO

OIO

O

1

-

I

O

O

Make a Simulink Block

Discretization


166/297


166

Tustin approximation(Bilinear)

Tustin withPrewarping

Better (freq. resp.matches) ill-defined at andclose to z = -1

Ensures frequencyresponse matches atcritical freq

Transfer the S Domain to Z Domain


167/297

Matlab Commands


168/297


168

sys = tf(1,[0.1 1]), Tc = 0.1

Transfer function:

1

---------

0.1 s + 1

ltiview


169/297

Time Response


170/297


170

Discretization


171/297


171

sysd = c2d(sys,0.01,'tustin')

Transfer function:0.04762 z + 0.04762

-------------------z - 0.9048

Sampling time: 0.01

[nz,dz]=tfdata(sysd,'v')

nz = 4.761904761904762e-002 4.761904761904762e-002dz = 1.000000000000000e+000 -9.047619047619048e-001

Bode Plot


172/297


172

Time Response


173/297


173

First Order Filter


174/297


174

If init > 0 Set the previous values of output and input, to input

Set output equal to input

Else

Compute using the following equation out=Nz(1)*inp+Nz(2)*pri-Dz(2)*pro;

EndDTF - I-1S1

Num Coeff A 0 = Nz(1 )

Num Coeff A 1 = Nz (2 )

Den Coeff B 1 = Dz (2 )

Sample Time = DT


I order 1 State

Out

Input

Init

Safe


175/297


176/297

Second Order Filter


177/297


177

If init > 0 Set the all previous values of output and input to input

Set output equal to input

Else

Compute using the following equation out=Nz(1)*inp+Nz(2)*pri+Nz(3)*ppri

-Dz(2)*pro-Dz(3)*ppro;

End

Demonstration of second order filter

DTFB-II-2S1Num Coeff A 0 = a1

Num Coeff A 1 = a2

Num Coeff A 2 = a3

Den Coeff B 1 = b2

Den Coeff B 2 = b3

Sample Time = DT


Bilinear II Order 2 State

Out

Input

InitSafe

Use of Filters in Control Systems


178/297


178

Normally used to reduce noise

Filter out high frequency components of a system so thatit behaves in a slower manner. i.e. It does not respondvery fast to the changing input

To modify the response of the output to transients It could be a lead/lag filter or a washout filter

Second order filters are normally used as notch filters tocut out unwanted frequencies. The second order filters introduce additional phase lag in the

system and can cause erosion of margins. They have to be usedwith care

Latches


179/297


179

These are primarily flip flops used in the digital circuits

In software latches come in basically two flavors SetPriority and Reset Priority

Latches are used to latch a failure in system. It retains

its set value and can only be reset by sending a 1 to thereset input

In set priority the set signal is processed first and if it is a1 the latch is set. In reset priority the reset input isprocessed first.

Latches


180/297


180

Inputs : S,R

Output =Q

If (S==1)

Q =1 Else if (R==1)

Q =0

Else

Q = prev Q

Set Priority

Out

Set *

Reset

Safe


181/297


182/297

Rate Limiter


183/297


183

All physical systems have a rate limit. A car can go at100 kmph when the accelerator is pressed fully down.That is the velocity or rate limit.

In aerospace the aircraft surfaces can move at a finiterate for a specific command. This is the system limitwhich cannot be crossed.

It is dangerous to hit the surface rate limits. In case therate limits are hit the surface does not respond asrequired by the control system and the aircraft can (andhas) crashed.

Rate limiter blocks are introduced in control systems toavoid the commands causing a rate limit of surfaces.

Rate Limiter


184/297


184

During First frame: y = IC

During Normal Operation: PosDelta = previous output + PosRate*T

NegDelta = previous output + NegRate*T

If (x>PosDelta) where x is input y = posDelta

Else if (x


185/297


185

1-D Interpolation


186/297


186

Given a table of X and Y values and a value of x forwhich y is required

Find the two values of X between which x lies This give index i and index i+1

Find the slope s=Y(i+1)-Y(i)/((X(i+1)-X(i)) y = (x-X(i))*s + Y(i)

Normally extrapolation is not used in the safety criticalcontrol systems. One can always extrapolate offline and

use them as additional values in the table

1-D TableY Axis Data = YT

1-D Look Up

Inter

Index

Fraction

SizeSafe


187/297

2-D Interpolation


188/297


188

Altitude

1 Km 2 km 5 km 10 km

200 kmph 1.42 1.56 1.8 1.92

400 kmph 2.45 2.56 2.79 3.1

800 kmph 3.67 3.81 3.91 4.12

1000 kmph 4.78 4.90 5.2 5.2

2-D Interpolation


189/297


189

Given a table of X and Y values, a matrix Z of values.Given a value of x and y compute z from the tablelookup.

Find the two values of X between which x lies This gives index i and index i+1

Find the two values of Y between which y lies This gives index j and index j+1

Compute y1 at x by using Y(i,j) and Y(i+1,j)

Compute y2 at x by using Y(i,j+1) and Y(i+1,j+1)

Compute z by using y1 and y2 Use 1-D interpolations for the computation

2-D Interpolation


190/297


190

Y(j)

Y(j+1)

X(i) X(i+1)x

y1

y2

y z


191/297


192/297

Anti windup Integrators


193/297


193

Integrators can run away if a constant input is given. Itis possible for the output variable to have very largevalues. This is called windup

This is not a very safe situation and integrator have alimit on the state. This is called anti windup.

All integrators in a safety critical system have anti windup

INTEG 1Sample Time = DT

Integrator

Out

Initial OP

Init

Input

ULLL Safe

Integrator - Euler


194/297


194

Inputs: x, ICOutput : y

During first frame : y= IC

During normal operation :y(i) = y(i-1) + T*x(i),where T = sample time.

Anti windupIf y(i) > poslim

y(i) = poslimElseif y(i) < neglimy(i) = neglim

Integrator - Tustin


195/297


195

Inputs: x, ICOutput : y

During first frame : y= IC

During normal operation :y(i) = y(i-1) + T/2*(x(i-1)+x(i))

where T = sample time.

Persistence


196/297


196

In safety critical systems it is very important to trap wirecuts, sensor failures etc.

Persistence blocks check for such failures over a finiteperiod of time. If the failure exists for say 2 seconds theoutput of the block is set to TRUE.

Normally a failure which persists for a long durationcauses a latched failure. A latched failure requires areset to clear

Some of the failures will cause a reset inhibited latch.

Such failures aircraft cannot be cleared when the aircraftis in air. Only after the aircraft lands and the pilot givesan on ground reset is the failure cleared.

Persistence


197/297


197

Inputs: IC, Input, DTOn , DTOff Output: Out If Init True: y = IC

During normal operation (Init = False): if (input is TRUE and has remained TRUE for

DT ON frames) Out = TRUE

elseif (input is FALSE and has remainedFALSE for DT OFF frames)

Out = FALSE

Else

Out = Previous frame value of Out

Subsystem

Out

Input

Init

IcSafe

WindowOn/Off


198/297


198

WindowOn/Off is a special type of persistence block Instead of looking for a continuous failure (on or off state)

this block looks for a set of failures in a finite window size

E.g. if a failure occurs 4 times in a window of 20 frames a

failure is set.

These blocks form a part of the module calledredundancy manager. This is a must in all safety criticalsystems where multiple sensors are continuously

monitored and failures and bad sensors are voted out

WindowOn


199/297


199

Initially output is False

Open a window (assign a array) of say 20 frames

(previous example)

This array represents a moving window

Input 1/0

Sum

1 0 0 1 0

WindowOn


200/297


200

Every frame the data in each cell is shifted right. The 1stcell has the fresh input data

The sum of all cells in window is computed

If the sum is greater than threshold (4 in previous

example) then the output is set to True

Note: 1 indicates On in WindowOn block and a Off in aWindowOff block

Transient Free Switches


201/297


201

Every control system has a Transient free switchsomewhere. It is also called as fader logic.

These are used to fade from one signal to another overtime. In aircrafts the lowering of the landing gears causea change in the system behavior (change inaerodynamics). This causes a change in the controlsystem and the commands to the surface. The smoothtransition between the two phases is brought by usingthe TFS.

Transient Free Switch


202/297


202

If Event is True output = Sn for 1 If Event is False output = Sn for 0 If the Event changes state (T-> F or F->

T) Compute difference between the output and

the switched signal Compute the delta change per frame by

dividing this difference by the fade time inframes

Add this delta difference every frame to theoutput till it reaches the input signal

This works well for constants but hasproblems with continuous signals

TFSSample Time = DT

Transient Free

Switch

Out

FadeTime

Trig

Sn for 1

Sn for 0

Event

Init Safe


203/297


204/297


Model Based Testing

What is the cause of most aviation

accidents:

Usually it is because someone

does too much too soon, followed

very quickly by too little too late.

Steve Wilson,

204

Model Based Test


205/297


An executable requirement of the control system isavailable as a model

The C/Ada code for this requirement has beendeveloped and runs on a target platform

The idea of model based tests in a nutshell is to generatea set of test cases which will generate a set of inputsignals time histories. These inputs are injected into theModel and simulated to get the outputs.

The same input signals are injected into the

corresponding compiled code inputs and the expectedoutputs tapped out.

205

Model Based Test


206/297


If both Model and Code outputs match then we infer thatthe code is as per the requirements.

The assumption for a complete test is that we havegenerated the test cases which cover the Modelfunctionality 100%

The same set of test cases give 100% code coverage onthe target on an instrumented code build

The instrumented code output and non instrumentedcode output match very well with the Model output.

Very well is defined beforehand based on the targetdata, the input output quantization, etc

206

Schematic


207/297


Flight

Code

Model

Test

Cases

A frame based testing

Comparator

207

Testing Example


208/297


A small example is shown here. This was a missileimplementation which failed. The input is limited between+20 and -20, filtered through a digital filter and the outputlimited on the positive side.

SaturationSaturation

nz(z)

dz(z)

Discrete Filter

Limit Input to20.0

10/(s+10)Limit Output to +

9.5

208

Static Test


209/297


A set of constants are used to test the codeimplementation against the model

Input Model Flight

0.0 0.0 0.0-3.0 -3.0 -3.0

-25.0 -20.0 -20.0

3.0 3.0 3.025.0 9.5 9.5

The Flight code

and the Model

outputs match

exactly. Can we

pass a safety

critical system

with these tests?

209

Dynamic Test


210/297


A 10 Hz signal was injected into the system. The Flightcode and the Model match very well.

The Flight code

and the Model

outputs match

exactly. Can we

pass a safety

critical system

with these tests?

0 5 10 15 20 25 30 35 40-20

-15

-10

-5

0

5

10

15

20

Time (sec)

Magnitude

InputFlight

MODEL10 Hz

Signal

210

Dynamic Test


211/297


A 0.1 Hz signal was injected into the system.

211


212/297

Dynamic Test


213/297


nz = [5.882e-2 5.882e-2]; dz = [1.0 -8.823e-1];

Initialisation

O=inp , pinp=inp

Loop

o=nz(1)*inp+nz(2)*pinp-dz(2)*o

if o > 9.5

o = 9.5;

end if End Loop

The state is limited and

used in the

computation. This isbecause the code uses

the same variable name

o for the filter output

and the limiter output.

213


214/297


215/297


216/297

MC/DC Example


217/297


217

A

B

C

D

A B C D

F F F F

F F T FF T F F

F T T F 1

T F F F

T F T F 2

T T F F 3T T T T 4

Exercise


218/297


218

Define the MC/DC Test cases for this Combination Logic

AA

B

C

O

Answer


219/297


219

A B C A xor B NOT(A xor B) C' O

0 0 0 0 1 1 1

0 0 1 0 1 0 0

0 1 0 1 0 1 0 2

0 1 1 1 0 0 0

1 0 0 1 0 1 0 3

1 0 1 1 0 0 0

1 1 0 0 1 1 1 1

1 1 1 0 1 0 0 4

Beware of MC/DC


220/297


220

A B AND NOT(XOR)

0 0 0 1

0 1 0 0

1 0 0 0

1 1 1 1


221/297


221

Switch Blocks


222/297


222

A Switch Block mimics an IF statement in code The Trigger or Event input in the centre causes the

output equal to one of the outputs

Trigger

Testing Switches


223/297


223

In a model based approach it is usually seen that thepath till the switch inputs is normally executed. This is notso in the case of C Code. The programmer will normallyput a set of instructions inside the if-then-else logic.

As a result intermediate states may have different

values. Solution: Use an If-Then-Else block OR code like the

model!

Take care while selecting inputs. It is possible that boththe inputs to the switch may be equal due to computationin the path above. This will make the test confirmationdifficult.


224/297


224

Filters


225/297


225

Filters are dynamic elements of a control system. Theyhave a state and the output changes with time. They arevery important to a stability of a system.

The correct implementation in Code has to beascertained and demonstrated for Certification.

Type of filters used in the control system are typically First order

Second order

Notch Filters

Washout

First Order Filters


226/297


226

First order are the simplest of the filters used to cut offnoise

In model based testing they can be easily tested bygiving a step change at the input of the filter

The first order filters are characterized by a time constantand for a unit step input the value of the output isapproximately 0.632 at a time equal to the time constant.This can be used to prove the correctness of theresponse!

Normally the filter output and the filter states areinitialized to the input. This ensures that the filter outputis constant for a constant input!

1Step Response

Filter Response


227/297


227

0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 10

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

System: sys

Time (sec): 0.1

Amp li tude: 0.632

Time (sec)

Amplitu

de

1

0.1 S + 1

Discussion


228/297


228

Do we require to test Models in this fashion always,looking for a characteristic ? What is the use of Modelthen !?

Second Order Filters


229/297


229

A standard Second OrderFilter defined in the Sdomain will have a constantin the numerator and asecond order term in thedenominator

The Second order filter ischaracterized by Rise Time,Peak Amplitude, Time atPeak Amplitude and theSettling Time to 2% of its

Steady State value

2

1

2

1tan

1

1

n

Tr

22

2

2 nn

n

sX

Y

n

Ts

9.3

21

n

Tp


230/297

Testing 2nd Order Filters


231/297


231

They are tested the same way as the first order filterswith a step response

The various parameters that characterize the filter areconfirmed

Second order filters are sensitive to initialization and thefirst 3-4 frame values are very important. They can tell ifthe filter has been implemented correctly

Normally states are all initialized to the input signal. Thisin turn ensures that the filter output is constant for aconstant initial input

Discussion


232/297


232

The requirements document mentions that the filter shallbe implemented such that the output derivates are zerofor constant input. Why do they specify this?


233/297


233

Notch Filters


234/297


234

They are special 2nd OrderFilters characterized by adifferent value ofnumerator anddenominator dampingratio

They have to beprewarped for ensuringcorrect frequency domaincharacteristics

2

2

2

2

1

2

2

2

nn

nn

s

s

X

Y


235/297


235

Washout and Others


236/297


236

Washout filters are differentiating filters The first frame output is normally initialized to 0.0. Why?

Lead Lag Filters, Complimentary Filters and others are

various implementation of first order filters It is difficult to specify the exact value of the response toverify the results

Ideally i f the first order fil ter Model works for a firstorder lag it will work very well for any other filter

also. This is the charm of Model Based Testing!


237/297


237

Scheduled Filters

Th fi d d fil hi h h i


238/297


238

These are first or second order filters which have timevarying coefficients

It is simpler to specify the filter coefficients in the SDomain for these filters. A first order filter will have thetime constants varying with time

Testing these filters is easy in a Model Based Approach First the filter is tested with constant coefficients. This

checks the algorithm

Then the filter is checked with time varying coefficients

Sine Sweep signals and sinusoidal waveforms can beused to verify the filter performance


239/297


240/297


240


241/297


241

Integrators

Th bl k f j t f t l


242/297


242

These blocks form a major component of a controlsystem

Some digital filters are implemented using integrators

Integrators are used to minimize the errors in a PIDcontrol system

They are used to indicate the amount of time a particularbutton has been pressed. They can also indicate an upand down direction of button press

Integrators have anti-windup limiters. Care should be

taken to see that this is implemented properly in code orin Model.

Discussions

A th t i l t ti ?


243/297


243

Are these two implementations same?

Signal Builder

Signal 1

Scope

SaturationDiscrete-Time

Integrator1

K Ts

z-1

Discrete-Time

Integrator

K Ts

z-1

Matlab Demonstration


244/297


244

Integrator Tests

Gi t t i t d h ld th till t ti


245/297


245

Give constant inputs and hold them till saturation occurs Hold the input for some more duration and reverse sign

(if possible)

This will test the algorithm and the limits

Check the other functionalities like Integrator Reset andInitialization

A large amplitude low frequency sinusoidal waveformalso checks the functionality

Functional Coverage

The normal algorithm is tested with a constant input The


246/297


246

The normal algorithm is tested with a constant input. Theintegrator functionality is covered if from a zero value ofthe output the + and saturation limits are hit.

It is important to test the integrator behavior when itcomes out of saturation.

There are instances where the integrator limits aredynamically varying. In these cases the integrator shouldbe checked for at least 2 different values of the limits onboth sides.

The initial conditions and reset will be checked by givinga reset for at least two different values of the output


247/297

Non Linear 1D Lookup

One Dimensional Lookup Table


248/297


248

One Dimensional Lookup Table These blocks are used to modify/shape the input in a particular manner. They can be used as variable saturation limits

1D tables are characterized by an X-Y relation. The X-Y relationcould be continuous or with specified breakpoints

In control systems a linear interpolation is used to find the values inbetween breakpoints.

There are instance when the breakpoints values change based oncertain conditions. A switch and two separate tables can be used in

such a situation.

1-D Lookup Example

X Y15


249/297

Model_Based_Development&Testing_Matlab.pdf

Documents

Transcript of Model_Based_Development&Testing_Matlab.pdf