Analysis of an Aero-engine Fuel Control System, Rooted in Systems Thinking and Control Theory

Malfunctioning of the fuel control system in an aero gas turbine engine may cause the engine to operate beyond its intended temperature limits. This can cause damage to critical engine components like turbine blades. The engine control is executed by hydro-mechanical subsystems linked with sensors. Human intervention required for detection of variance in critical parameters like turbine gas temperature increases the control system complexity. In this paper we investigate the causes of in-service failure of turbine blades and temperature sensors in an aero-engine by adopting an interdisciplinary approach rooted in both systems thinking and control theory. We propose a novel methodology that combines the Functional Resonance Analysis Method (FRAM) from systems thinking with the Systems Theoretic Process Analysis (STPA) with Extended Second Order Cybernetics model from control theory. FRAM is used to analyze the fuel control system as a goal-seeking feedback-control balancing loop; and STPA is used to identify the potential causal factors and control flaws, including human factors, which could contribute to the exceeded turbine gas temperature. We further use Reflexive Analysis, a new systems thinking tool, to identify the prevalence of 'emergence' phenomenon that exacerbated the problem. The theoretical findings were validated using experimental data from test-bed runs on a fighter aircraft engine at maximum take-off thrust conditions with progressively failed temperature sensors. The newly developed models and techniques in this paper provide a novel approach towards comprehensive analysis of control systems that considers both technical and human factors, which has the potential to significantly improve system safety in a wide range of safety-critical socio-technical systems.