See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/221145381

Aircraft Fuel Management Reconfigurable System with Smart Components for

Distributed Decision

Conference Paper · December 2008

DOI: 10.1109/ICARCV.2008.4795752 · Source: DBLP

CITATIONS READS
2 1,345

5 authors, including:

Jose Maria Giron-Sierra Santiago Cifuentes

Complutense University of Madrid Pontificia Universidad Javeriana
150 PUBLICATIONS 1,357 CITATIONS 11 PUBLICATIONS 33 CITATIONS

SEE PROFILE SEE PROFILE

Juan Jiménez
Complutense University of Madrid
58 PUBLICATIONS 552 CITATIONS

SEE PROFILE

All content following this page was uploaded by Jose Maria Giron-Sierra on 11 September 2017.

The user has requested enhancement of the downloaded file.

2008 10th Intl. Conf. on Control, Automation, Robotics and Vision
Hanoi, Vietnam, 17–20 December 2008

Aircraft Fuel Management Reconfigurable System

with Smart Components for Distributed Decision

Jose M. Giron-Sierra, Santiago Cifuentes, Juan F. Jimenez,

M. Seminario, C. Insaurralde
Dep. A.C.Y.A., Fac. Fisicas,
Universidad Complutense de Madrid
28040 Madrid, Spain
e-mail: [email protected]

Abstract –This papers introduces a current research on Our research is following a sequence of steps. First requirements
avionic distributed control systems, using smart components. The have been captured from experts. Then ideas for control distribution
research focus on fuel management systems. The nearest and for the internal architecture of the new smart components have
experimental target is real flight testing into three years. For been elicitated. Then a first laboratory prototype has been developed
safety reasons the new distributed system has to react with for experimental development and testing of hardware and software.
pertinent reconfigurations when there are problems in the Then this prototype has been tested in real scale. And during these
system, as detected by the smart components. Likewise, it is days, a new version of the system is being developed. The new
possible that the fuel plant changes, for instance whne extra tanks version includes two types of reconfiguration capabilities. One is
are added, so the distributed control system has to reconfigure its related to malfunctions. The other is related to changes in the fuel
functionality. The specific experimental platform for the research plant to be controlled (for instance, extra tanks could be added in
is an helicopter. The paper describes the control problem, the certain field applications).
control distribution concept, the smart components, and the Avionic fuel management systems are described in the books
present research for reconfiguration. [4,5].
In general fieldbuses are an important alternative for the
Keywords—avionic systems, smart components, distributed architecture of systems with sensor and actuators [6,7]. They provide
control, reconfigurable systems connectivity to intelligent devices such smart sensors or actuators. A
relevant fieldbus alternative is, for instance, the CANbus [8,9,10].
There are few incipient applications of the CANbus in avionics and
I. INTRODUCTION aerospace, as reported in the web page of CAN In Automation
organization Error! Reference source not found.. Recent avionic
applications tend to use time-triggered fieldbuses [12], in view of
In this paper a new distributed avionic control system is
obtaining determinism.
introduced. The first type of applications that has been considered is
There are many different smart actuators, mainly of
aircraft fuel management. The system is based on smart components.
electromechanical or optical (smart cameras) nature. This application
In the case of fuel management these smart components are pumps,
field is gaining momentum in connection with mechatronics and
valves and quantity sensors.
miniaturization.
This research is the nucleus of an European Research Project with
Our research proposes an architecture where smart components
seven partners: four from aeronautical industry, and three universities
have local and global knowledge of the system state, and take own
[1, 2, 3].
decisions. This corresponds to a new concept, “holons”, in the line of
Clearly aircraft fuel management is a critical subsystem, with
objects, actors and agents. The holons are nodes of an holonic
primary safety responsibilities. Therefore the fuel system must be
architecture, using local and some global system knowledge for their
developed with strict rules, and the results must be able to work even
work [13,14,15].
in the event of failures or malfunctions. Thus, structural redundances
This paper is organized as follows. First the application problem
are provided, so if a fuel path has problems, there are other possible
is biefly described. Then the new avionic control distribution
paths. For example if a valve does not open, there is another valve
principles are presented. This is followed by a section about
that can be used. This structural redundancy must be managed by the
automatic reconfiguration in the case of malfunctions. Then
control system. For instance, in the previous example of the
laboratory experimental details and some aspects of real scale testing
malfunctioning valve, since this valve is smart in our new distributed
are shown. And then there is a section about the present research
system, his Bilt-In-Test (BIT) detects the malfunction and informs to
issues, including plant reconfigurations.
the system about this event. Then the other valve decides to take
responsibility on the new situation. Of course, the malfunctioning
valve decides to isolate itself from the system. The maintenance
personnel will get information of what happened, since smart
components will keep a record of their activity.

978-1-4244-2287-6/08/$25.00 
c 2008 IEEE 1534 ICARCV 2008

Authorized licensed use limited to: Univ Complutense de Madrid. Downloaded on May 5, 2009 at 14:33 from IEEE Xplore. Restrictions apply.
 II. AVIONIC FUEL CONTROL SYSTEMS Figure 3 shows a simplified two engine aircraft fuel system with
The aircrafts considered in our research have several fuel tanks, seven tanks. Each wing includes three tanks. There is a tail tank.
and a network of pipes, valves and pumps that make possible several Along the flight fuel must be transferred to/from the tail tank for
alternatives of fuel transfers between tanks and engines. In case of control of the centre of gravity, which must lie on the wings. Fuel
pump, valve, or pipe failure, there are reconfigurations of the fluid transfers are possible from left wing to right wing, or vice-versa.
system to continue with the functionality.
Fuel is used for several purposes. Of course the main target is to
supply fuel for the engines. Also, the fuel may be used to keep the
centre of gravity of the aircraft in a proper location, and to balance
the aircraft.
The fuel control system also must operate during high-pressure
refuelling, to measure quantities and to control input valves.
Figure 1 shows a simplified helicopter fuel system, with four fuel
tanks, two input valves, and two pumps for twin engine supply. The
system is divided into two subsystems, with two tanks each. There is
a connection between the two subsystems for balancing purposes.
Figure 2 shows a skecth of how the fuel systems is placed in the
helicopter; the fuel tanks are embedded in the floor below the pilot.

Figure 3. Top view of aircraft fuel system.

III. A DISTRIBUTED CONTROL SYSTEM WITH

SMART COMPONENTS
The usual fuel control system is centralized. A computer is
responsible of all fuel management control tasks. There are point-to-
point connections between the computer and each sensor or actuator.
A main objective of our research is to eliminate the central
computer, using smart component instead. Microcontrollers are
embedded into pumps, valves and sensors, to make them smart. Each
component takes its own decisions during the fuel operations. For
instance, during refuelling the input valves do open, and decide to
close when the desired fuel quantity is reached. During flight, other
pumps and valves decide when to act, for engine supply and other
Figure 1. Schematic of the helicopter fuel system. functions.
The smart components share a time-triggered fieldbus, to
exchange information. When a component takes a decision, it
broadcast to the rest of the system that fact. All components keep a
copy of a state vector that describes the system state (in terms of the
state of each component). Figure 4 shows a diagram of the system
architecture.

Smart
Smart Smart
Smart Smart
Smart Smart
Smart Smart
Smart
Sensor
Sensor Valve
Valve Sensor
Sensor Pump
Pump Valve
Valve

Figure 4. Architecture of the distributed control system.

Figure 2. Top view of helicopter fuel system.

1535

Authorized licensed use limited to: Univ Complutense de Madrid. Downloaded on May 5, 2009 at 14:33 from IEEE Xplore. Restrictions apply.
A. Smart Components and System Levels
Each smart component consists in several parts. Figure 5 shows a System Valve 1 Pump 7 Valve 11
diagram of interconnection of these parts. The central part is occupied Mode 2 closed running fails
by the microcontroller, being sandwiched by two interfaces. One of
the interfaces allows for the interconnection with the fieldbus. The
other interface establish dialog with the component internals, so the 1 0 0 0 0 1 1 0
microcontroller acts on the transducers, and receives information
from component internal sensors. Figure 7. The state vector.
F ie ld b u s
The component number k can modify its part of the state vector in
the time window number k. When the state of a component changes,
E l e c t r o n ic
the component uses its time window to change the pertinent bits in
in te r f a c e the state vector. Since all components read the state vector, it is a way
of information broadcasting.
D ig ita l p r o c e s s o r The behaviour of each component has been established with
simple automata. The transitions are decided in function of the
E l e c t r o n ic system state.
in te r f a c e
The fuel management system has several operating modes, such
refueling, engine supply, or maintenance. Given an operating mode,
T ra n s d u c e rs
each smart component acts according to a local automaton. Figure 8
shows a conceptual example. It is a valve (number 3) in open state. If
e le c t r o m e c h a n ic s the system is in mode 2 and the valve 1 is closed, the local automaton
of valve 3 must go to closed state. The valve 3 reads the state vector.
When the conditions for state transition are met (pattern matching
Figure 5. Internal architecture of smart component. with a part of the state vector), the valve 3 closes, and waits for time
window 3 to change the state vector, so the system is informed that
Two levels can be distinguished in the fuel system. One of the valve 3 is closed.
levels is the physical plant, with the tanks, pipes, valves, fuel ,etc.
System Valve 1 Pump 7 Valve 11
The other level consists of the smart component micro-controllers Mode 2 closed running fails
connected via the fieldbus.
Figure 6 shows a simplified view of part of a fuel system. The
`physical plant level is on top, while the electronic level is below. The 1 0 0 0 0 1 1 0
smart components make both levels to interact (each micro-controller
corresponds to a smart component).
If system mode = 2
and Valve 1 = closed

Physical plant level

Valve 3
open closed
Valve 3
Valve closed

Level Tank1 pipe pipe

Tank2 Level
Sensor Sensor

Figure 8. Local automaton of smart component.

Micro-C Micro-C Micro-C

The complete system behaves according with a global automaton,

changing from one to another system mode. When a system mode is
fieldbus launched, an operation automaton starts to work. However, the only
Electronic Level real automata implemented in the system, are the local automata,
residing in the smart components, which cooperate giving rise to the
Figure 6. Two levels in the fuel system. global and operational automata.
C. Common Code
B. Broadcasting and Local Automata
A main issue in avionics is certification. In the case of this
A messaging protocol has been developed to keep all components
research, it means that code must be simple, clear and structured. In
informed of the system state. This protocol continuously repeats a
addition, for easier certification, only one program is developed. All
cycle. In each cycle a state vector is sent to the components, along
smart components have the same code. This is denoted as common
time windows. The vector contains a description of what components
code. The idea is sketched in figure 9.
are on, and what are off. It also contains what is the current system
mode. Figure 7 shows the idea of the state vector: a series of bits.

1536

Authorized licensed use limited to: Univ Complutense de Madrid. Downloaded on May 5, 2009 at 14:33 from IEEE Xplore. Restrictions apply.
 2
1
1 1 A23
A6 2
A1 2 3
4
1
3

4 A8 2

1 2
A5 2 3
1 A2
3

2 Select using
Component ID
1 A2
& System Mode
3

Figure 9. Common code.

All local automata of all components are put in a library. Each

smart component selects from the library its pertinent local
automaton, using the current system mode and the smart component
ID (a number).
Taking advantage of the digital processing capabilities, each
smart component have diagnostic procedures, so it can detect internal
problems. If a component detects a malfunction, it send that Figure 10. Refuelling reconfiguration in the helicopter system..
information to the rest of the system.

IV. AUTOMATIC RECONFIGURATION IN A FIXED PLANT

A set of possible malfunctions of each component has been V. LABORATORY EXPERIMENTS
established. Several system reconfigurations have been defined in The development of the complete system, including smart
response to malfunctions. This is a kind of global automaton that components and the required software, has been supported by
makes transitions in function of the detected malfunctions. But this is laboratory physical simulators. Figure 11 shows for example a
not a centralized automaton; again, each component decides what to laboratory simulator for the aircraft system. Notice that the
do, knowing what failure is active. inclination of each wing is considered, so most fuel transfers between
For instance, in the helicopter system. If a engine supply pump tanks are gravity transfers.
does not work, then the balancing system start to work, forcing more Figure 12 shows a detail of the electronic cards with the
fuel to the subsystem that works correctly. Another example in the microcontrollers and interfaces corresponding to each component.
helicopter system is that if a refuelling valve does not open, then the Before electronics were actually embedded into valves, pumps and
balancing system is also used, in order to fill the four tanks with the sensors, it was useful to use already available conventional
fuel that enters through the other refuelling valve. This is the case controllers and external electronics, for easiest and fastest
depicted in figure 10. Notice a connection between Tank 3 and Tank development. All microcontrollers are programmable on the field.
4 through a bidirectional pump and a valve: this is the balancing
system.

Figure 11. Laboratory simulator for the airplane fuel system.

1537

Authorized licensed use limited to: Univ Complutense de Madrid. Downloaded on May 5, 2009 at 14:33 from IEEE Xplore. Restrictions apply.
 ..
Another case is that different variations of the helicopter can be
fabricated. It would be very interesting that the corresponding
changes in the fuel management could be solved in short time and
high guarantee.
In the first part of the project the idea has been that all smart
components share the same code. Indeed a valve has to obey to its
own, small automaton; and so a pump. To accomplish the common
code, all automata has been assembled into a container of code, and
identical copies of the complte set has been put into each component.
A task of each component is to select its own automaton from the
container.
However, if we have to deal with changes in te plant, that can
even occur on the field, we think that a more flexibl approach has to
be devised.

Figure 12. Detail of the electronics associated to smart components. Now we are developing a sort of code generator tool that supports
the edition of diagrams describing the complete fuel system function
along the different system operations, and from that description the
VI. REAL SCALE TESTING
tool generates the small diagrams (automata) that corresponds to each
Once the system was developed and tested in laboratory, it was component. The small diagrams are converted into program code by
implemented on real scale, using an industrial facility with the type of the same tool, and is to be injected into each component via the
components, piping and constructive details of the real helicopter. fieldbus.
Real fuel was employed.
Figure 14 shows a simplified example of the tool main operation.
The experimental results confirmed that the distributed fuel Suppose you have two actuators A and B. The general diagram from
systems works correctly. the complete system point of view, is a simple decision between
activating one or another actuator, according to a certain event. This
Figure 13 shows a view of the industry experimental facilty for
is represented in the left hand side. The tool analyses the diagram and
fuel system testing at real scale. The fuel tanks are in the floor of the
extract two diagrams, one is to be sent to actuator A, and the other to
helicopter, under the pilot and cargo. There are two big pumps on a
actuator B. Each diagram would locally govern the action of these
bridge on top, representing the feeding of the two engines.
actuators. In this way the global system work is distributed into
components tasks.

start

?
start

A
? B

start
Figure 13. A view of the real scale experimental checking . A

? B
VII. CHANGES IN THE PLANT AND FUNCTIONAL
RECONFIGURATION
Recently the issue of changes in the fuel plant has entered into the
research scene. For instance, it may happen that a helicopter with four
fuel tanks needs more fuel for long distance reaching, so two more
tanks are added. This may imply changes in the control sequence of Figure 14. From global functional description to local descriptions.
valves and pumps along a flight.

1538

Authorized licensed use limited to: Univ Complutense de Madrid. Downloaded on May 5, 2009 at 14:33 from IEEE Xplore. Restrictions apply.
 The next step is devoted to redundancies and reconfigurations,
Nowadays the research is focusing on two main tasks. One is the trying to make the tool more intelligent for quick and easy generation
development of computer and physical simulators for system testing. of good local component working definitions.
The other is to develop and test the code generation tool. It is
intended that the computer simulators would accept directly the code ACKNOWLEDGMENT
generated by the tool, for extensive testing. The authors want to thank the European Community support,
After these steps, there is another long step devoted to through the Research Project “Smartfuel”. Likewise, the authors want
redundancies and reconfigurations. Perhaps it would be possible to to thank the collaboration of the research partners.
make the code generation tool more intelligent, so it may induce
system operation diagrams from descriptions of the plant.
REFERENCES
[1] European Commission, Community Research, “1998-2002 Project
VIII. CONCLUSIONS Synopses: New Perspectives in Aeronautics,” 2002.
[2] SmartFuel Project: “Defining the third generation digital fluid
In this paper a research on a new avionic control system has been management system,” Available at: http://www.cordis.lu/express
introduced. The new system is a distributed control system using /archive/250304/summary.htm#aaa.
smart components. Each component takes its own decisions along [3] Eurocopter homepage, Available at: http://www.eurocopter.com
fuel system operations.
[4] I. Moir, A. Seabridge, Aircraft Systems. Professional Engineering
The basic fuel system operations are refuelling, engine supply Publishing Ltd., 2001.
and aircraft balancing. [5] C. Spitzer, The Avionics Handbook. CRC Press, 2000.
A first development cycle of the new system has made clear that [6] J.R. Jordan, Serial Networked Field Instrumentation.Wiley, 1995.
the control diiistribution is possible. For such purpose the ideas have [7] Fieldbuses (www.interfacebus.com).
been that all components share a description of the current system [8] W. Lawrenz, CAN System Engineering. Springer, 1997.
state in terms of on/off state of each actuator. On this basis a [9] M. Farsi, K. Ratcliff, and M. Barbosa, “An overview of controlled area
complete first experimental system has been developed, including network,2 IEE Computing and Control Engineering, v.10, n.3, 1999, pp.
laboratory simulators and real scale testing. 113-120.
[10] K. Etschberger, Controller Area Network. IXXAT Automation, 2001.
The system can reconfigure its work in response to detected
(BIT) component malfunctions. This has been experimentally [11] CAN in Automation (www.can-cia.com).
checked. [12] R. Maier, G. Bauer, G. Stoger, and S. Poledna, “Time-triggered
architecture: a consistent computing platform,” IEEE Micro, v. 22, n.4,
At present the research is tackling the issues of having changes in 2002, pp. 36-45.
the fuel plant, so the working of components should be correctly [13] S.M. Deen, Agent-Based Manufacturing: Advances in the Holonic
modified. A code generation tool is being developed to extract from Approach. Springer, 2003.
general functional decriptions the work definition for each component. [14] S. Engell, G. Frehse,, and E. Schnieder (Eds), Modelling, Analysis and
New simulation platform are also under development for checking Design of Hybrid Systems. Springer, 2002.
thie new approach. [15] K. Fisher, “Agent-based design of holonic manufacturing systems,” J.
Robotics and Autonomous Systems, v.27, 1999, pp. 3-13.

1539

Authorized
View publication stats licensed use limited to: Univ Complutense de Madrid. Downloaded on May 5, 2009 at 14:33 from IEEE Xplore. Restrictions apply.