Military Embedded Systems Summer 2006

Mil Tech Trends
Applying Model-Based
Design to a Fault
Detection, Isolation, and
Recovery system
By Jason Ghidella, PhD,
and Pieter J. Mosterman, PhD
Model-Based Design facilitates verification and validation of an executable system specification,
which prevents errors from persisting into later stages of the design process where they
are more costly to eliminate. Studying a Fault Detection, Isolation, and Recovery (FDIR)
system, in this case an aircraft elevator redundancy control system, demonstrates how to
trace requirements to a design, create tests based on those requirements, and perform coverage
analysis, which in turn reveals untested, missing, and ambiguous requirements as well as
superfluous functionality in the specification.
The complexity of modern control
systems makes it difficult to deliver highquality,
reliable, and timely products
using traditional development processes.
In such development processes, engineers
first gather high-level requirements in text.
These requirements form the system
specification that is gradually refined into
a detailed design that can be implemented.
Structured test scenarios are then used
during implementation to validate
system behavior against the original
requirements. However, errors found
during implementation are costly and time
consuming to fix, and can cause product
delays, missed opportunities, and reduced
functionality.
Companies are now adopting Model-
Based Design to overcome these limitations.
With Model-Based Design,
engineers use a graphical model, often a
block diagram, to capture requirements.
This model produces an executable
specification that describes the system
behavior and can be gradually extended
into an increasingly detailed design from
which the implementation code can be
automatically generated. Verification and
validation can occur earlier in the system
design process, which reduces costly
iterations across many design steps.
hydraulic
system 1
34 / SUMMER 2006 Military EMBEDDED SYSTEMS
left outer
actuator
Left Elevator
left inner
actuator
An FDIR application for a redundant
actuator control system is designed using
Model-Based Design. Associations are
formed between textual requirements,
items in the graphical model, and test
cases used to verify and validate the
design. Test completeness is determined
by collecting coverage data that is
derived, for example, by doing a Modified
Condition/Decision Coverage (MC/DC)
analysis of the design model as the tests
PFCU2
LDL RDL
LIO
hydraulic
system 2
PFCU1
Figure 1
RIO
right inner
actuator
Right Elevator
right outer
actuator
hydraulic
system 3
are executed. Because this activity occurs
at the model level, design errors and
requirement omissions are identified and
corrected early on, at less cost.
Designing an FDIR system
Figure 1 shows the typical redundancy
of an aircraft elevator system with one
elevator on the left and one on the right.
Each elevator can be positioned by two
hydraulic actuators, only one of which