1 Introduction

The design of moveable actuation systems, together with the associated control surface mechanisms is highly affected by wing design, aerodynamic performance of the wing in different flight states and the functions, which have to be addressed by the moveable. In particular high lift systems often consist of complex mechanisms and mechanical transmission systems. Whereas classic high lift systems were designed to reconfigure the wing in fixed configurations to match different flight phases in take-off, approach and landing (i.e. gated positions), state of the art high lift devices incorporate a higher degree of functional flexibility to allow improvement of performance during cruise, as well as the continuous control of span-wise lift distribution to reduce loads on the wing structure [1]. The allocation of additional functions to a moveable might require novel system components and an adaption of the system architecture. Both, classical and multifunctional high-lift system designs, require addressing system safety—i.e. redundancy concepts and monitoring functions—and occurring loads. In order to evaluate the feasibility of designs in operational conditions comprehensive testing efforts are crucial [2]. Testing, however, is generally only possible when physical prototypes are available. Moreover, tests on system level require not only the prototypes of single components, but the whole system. In addition to that, the interconnection of systems and structural components of the wing and control surfaces can impact the behavior and functionality of control and monitoring functions. This often leads to rather complex rig assemblies. The test rig itself adds new levels of complexity, causes significant costs and adds to the lead time [3]. Therefore, the trend goes towards a wider range of virtual testing efforts in order to gain more in-depth knowledge on system behavior in different modes of operation [4,5,6]. These include, besides nominal operation also the failure cases, where especially the highly transient loads need to be accounted for in design of actuators, drive shafts, mechanism, and structural components [7]. Building verification loops on system level in an early design stage enables to identify shortcomings or weaknesses in the architecture design and hence reduce the risk of profound changes later in the design phase.

In this context the German Aerospace Center (DLR) has started the Virtual Product House (VPH) to generate a platform for the virtual design and test of aircraft components and systems with respect to certification relevant aspects. The VPH has started with a project, funded by the European Regional Development Fund. In this project a multidisciplinary toolchain is developed, where a high-lift trailing edge flap is designed and evaluated towards a virtual representation of the product in an automated process. As inputs to the process overall aircraft design (OAD) results, load cases, the structural concept as well as the actuation system architecture are used. Figure 1 depicts the VPH process with the three consecutive stages: virtual design, virtual manufacturing and virtual testing.

Fig. 1
figure 1

VPH process [8, 12]

Full size image

The design stage is shortly described in this section, however, a detailed description of this process can be found in [8]. The design and sizing of the moveable is performed by high fidelity computational fluid dynamics (CFD) analyses and fluid–structure coupled evaluation of the wing and flap structure under defined sizing design load cases. In order to generate the loads for the control surface mechanism and actuation system sizing, aerodynamic panel methods are used [9]. Control surface mechanisms and the actuation system is then sized according to [10] and [11].

The control surface structural model, which is generated in the design stage, undergoes manufacturing simulations in order to assess the influence of manufacturing processes on the structural properties and cost of the control surface. An in-depth view into this is given in [12].

Lastly, the virtual testing stage of the VPH process assesses the moveable and the actuation system under operational conditions. Virtual tests are performed as a bottom up testing approach with monodisciplinary unit tests for the flap structure, and integration tests of the actuation system. The goal of this work is to give an overview of the implemented virtual structural and systems testing methods and processes.

The paper is structured as follows: Sect. 2 depicts the virtual testing approach at VPH. In Sect. 3 the structural testing approach and methods are presented. Section 4 covers the main part of this work and shows the testing approach for the actuation system including a representation of the system architecture and requirements modelled in a SysML model, the model generation and parametrization process as well as a presentation of shaft disconnect tests and results for a use case architecture. Finally, Sect. 5 concludes the work and gives an outlook on further topics and future work in virtual testing activities within VPH.

2 Virtual testing at VPH

The term virtual testing describes the evaluation of properties and behavior of the system under test through numerical simulation. For structural mechanics a definition of virtual testing is given in [13]. It mainly focuses on the methods used for modeling and simulation in the structural mechanics domain. In [14] a definition referring flight control actuation systems is presented. Here, the basis for virtual testing is the assurance of system properties with respect to underlying system requirements. The choice of the modelling and simulation technique depends on the type of result, which shall be obtained. Moreover, the objective of the virtual tests defines, where most emphasis on the process has to lie. If, e.g., virtual testing is applied to gain knowledge of the system a priori to building prototypes in early development phases, credibility of the modelling techniques as well as experience may suffice for the intended use. If, on the other hand, virtual testing shall be used in product qualification and certification, extensive care must be taken considering the validity of the models and the remaining uncertainties [15]. For the current work, focus lies on methods and the implementation of the end-to-end process. Concepts for validation and credibility of the generated simulation models are part of future works.

The approach at VPH aims to generate an end-to-end evaluation process, where all necessary information for the generation of simulation models come from within the process or the set of input parameters. This enables the evaluation process to investigate the impact on conceptual changes—i.e. for example in the structural concept or in system architecture—on the design and hence test results with respect to certification relevant requirements.

Figure 2 depicts the approach. The VPH design stage enables the model generation and sizing of structural components, control surface mechanisms and the actuation system. Virtual testing on unit testing level focusses on the verification of these designs with the focus on detailed analyses of the effects of accidental damages of the structural components.

Fig. 2
figure 2

VPH virtual testing approach

Full size image

On the integration test level, virtual tests of the flight control actuation system are conducted. These tests serve the objective to verify functional requirements on system level, which consider performance in nominal cases, and safety functions in failure cases. An example of such functional requirements for a system specific failure case is depicted in Sect. 4.3. Moreover, these tests allow the evaluation of critical loads, which system and structural components need to sustain during operation. This is done using physics-based modelling of the actuation system components with lumped parameters implemented in the object-oriented modelling language Modelica. Without the need of an in-depth modelling on equipment and component level such an approach showed to generate valid results in comparison to physical tests [16].

As done for the whole VPH process chain, all testing steps are implemented as components in the remote workflow execution tool RCE [17]. This allows the test process to be extended with additional test methods and tools.

3 Virtual structural testing

Compliance with the requirement for structural integrity has to be shown for the use case. These requirements are commonly defined in terms of certification specifications (CS), such as CS-25 [18]. In general, compliance can be shown by test or analyses supported by tests through a vigorous verification and validation process. This is usually performed by means of a building-block approach, as shown in Fig. 3.

Fig. 3
figure 3

Building-block approach [19]

Full size image

Within the scope of the VPH start-up-project for the multifunctional moveable use case it is assumed that the derivation a material and structural allowables already exists. Thus, the focus is on the structural behavior of sub-components, components and the whole virtual product. By including effects of manufacturing and production [12], simulation-based analyses in the VPH process enable an increased understanding of the structural behavior beyond the limited capabilities of physical test rigs and specimen to model loading scenarios. These assessment capabilities are provided as modular components within the VPH. The improved understanding of the structural behavior can be used to determine the robustness of a solution and enable opportunities to reduce conservatisms.

Each method for the structural sizing during the VPH design stage [8] can already be seen as a virtual test. Therein, mainly strength, stability and other global stiffness requirements are used to generate a feasible structural configuration based on a finite element model. During virtual structural testing special emphasis is shown to more detailed analyses for certain criteria which require more elaborate idealization and discretization methods. The focus is especially on compliance with CS 25.305, 25.307, 25.571 [18]. Different analysis methods for certain physical phenomena have been developed over the years and are now implemented as components in the virtual structural testing of the VPH process.

The extend of phenomena and possible analyses requires a focus at this point. Simulation methods to assess the effects of accidental damage events on the residual strength of composite structures [20] are used as a prototypical implementation for further analysis (see Fig. 4). The associated modeling and simulation approaches as well as their software implementation are analyzed within the scope of the current work and evaluated with regard to their suitability for simulation-based certification and their application limits in conjunction with [15] and [21]. This approach serves as a blueprint for evaluating and integrating other assessment options.

Fig. 4
figure 4

Residual strength analysis step examples [22]

Full size image

The results are evaluated and structural changes undertaken where necessary. The resulting GFEM model is used as input for a Craig-Bampton method to derive the flexible body for later use in a multi-body simulation in combination with the flight control actuation system. An outlook on this setup is given in Sect. 5.

4 Virtual testing of flight control actuation systems at VPH

At this point of the VPH start-up project virtual testing for flight control actuation systems focuses on the evaluation of system function and loads during operational and failure cases. For the initial use case, the required functions and reference system architecture represent a classic high-lift approach, although the presented virtual testing process serves similarly for multifunctional moveable approaches. Within the start-up project different architectures will be investigated.

In this section test cases derived from a system model are introduced. Moreover, the generation and execution of simulation models for the integration tests is shown. The reference system architecture for which the process is presented, is depicted in the sequel.

4.1 Reference system architecture

A civil long-range aircraft serves as reference for the use case of this work. The actuation system topology is illustrated in Fig. 5. The trailing edge flaps are actuated via a shaft transmission system and five supports per wing similar to the Airbus A330/340 actuation system [23]. The inboard flap is deployed via two and the outboard flap via three actuator stations. All mechanisms are of the type track-rear-link. The mechanisms are driven by geared rotary actuators (GRA), which are powered mechanically via a shaft transmission system. The main transmission is equipped with down drive gear boxes (DDGB) at each track, which comprise torque limiters (TL). Between the last two DDGBs at each wing a wing tip brake (WTB) is installed to secure the flap in place in case of a failure, such as a shaft disconnect in the transmission system. In order to adjust the alignment of the transmission to the position of the outboard flap, a kink bevel gearbox (KBGB) is installed between the two flaps. At the center of the shaft transmission system torque limiters (STL) are placed between the power control unit (PCU) and the shaft transmission of each wing. Position pick-off units are located at the tips of both wings (asymmetry position pick-off unit, APPU) and at the PCU output (feedback position pick-off unit, FPPU) to measure flap deployment and detect asymmetry in the case of an error.

Fig. 5
figure 5

Actuation system architecture

Full size image

4.2 Virtual integration testing process

Figure 6 depicts the integration testing process and data. First, a system model is introduced, which serves as a means to store system architecture and requirements for the reference system of Sect. 4.1. Moreover, test configurations and test cases are generated and managed here. For this work, the actuation system model is executed with Dymola [24]. In order to execute the virtual tests a simulation configuration is generated for each test case. This configuration comprises information on test specific parameters. These can be failure case, stimulus signals, and controller parametrizations, such as detection thresholds. These settings are stored in a simulation setup file. Furthermore, aerodynamic loads on the actuation system are defined in a separate load file. The simulation model of the actuation system itself is built out of equipment models from a model library. The parametrization from the system under test and the system topology are results of the VPH design stage. A parameter mapping chooses, which implementation of an equipment model is to be used for the specific test and maps parameters from design results to the equipment models. After the simulation run a test case specific post processing routine is executed, which derives key performance indicators (KPIs) for the test case evaluation. These are used to verify the test related requirements in the system model.

Fig. 6
figure 6

VPH virtual integration testing process

Full size image

In the sequel the system model, the test configurations and test cases as well as all remaining process inputs and steps are presented. In the end exemplary results for shaft disconnect tests are shown.

4.3 System model, requirements and test configurations with SysML

A foundation of the test cases on systems level for the actuation system are the requirements resulting from the system architecture design. The design of safety–critical aircraft systems incorporates several design and analysis steps according to [25]. The architecture designs have to comply with certification requirements. For the actuation system, these are e.g. CS25.671 and CS25.1309, respectively [18]. Each architecture design needs the identification of possible system failures. This leads to the definition of system requirements with respect to actuation system function and performance. For the system architecture of this work’s use case (see. Fig. 5), a possible failure mode is the disconnect of a transmission shaft during operation. This failure must not lead to an asymmetrical displacement of the trailing edge flaps and hence an uncontrollable flight state, which would cause the loss of the aircraft. Therefore, mitigation means are necessary. Here, the mitigation strategy is to assure, that after a shaft disconnect failure, the asymmetric flap deflection has to be detected and unwanted flap movement stopped within the allowable ranges. On actuation systems level, this means, that the resulting difference of angular displacement measurements at FPPU and APPU after the failure, must stay within certain bounds. In Fig. 7 this requirement and the requirements, where it is derived from are shown.

Fig. 7
figure 7

Exemplary requirement of the shaft transmission system design, based on requirements hierarchy in the system model. Since the shaft transmission comprises several gear ratios, the maximum allowed asymmetry angle between APPU and FPPU in ASR-3.2 differs from the maximum allowed control surface asymmetry in SR-4.2

Full size image

In order to support the system architecture design methods of model-based systems engineering (MBSE) can be used. For this work a system model of the reference system from Sect. 4.1 was developed in the Systems Modelling Language (SysML). SysML uses different diagram types, which allow to describe requirements, system structure, behavior and parametrics [26]. In combination with a modelling software (here: Cameo Systems Modeler [27]), a SysML model offers the possibility to store design and analysis results centrally. By refining textual requirements by SysML constraints an automated requirement evaluation within the model is possible. Figure 7 shows an example of a refined requirement for the maximum allowed asymmetry.

Since the system model holds information on requirements and structure in addition to the fact that the modeling tool allows requirements evaluation, the test cases for the reference system are also defined within the system model. For that a test configuration is introduced. It holds the system requirements, which shall be verified through the test. Moreover, it can be connected to other model elements, such as system failures. Figure 8 shows the test configuration of the shaft disconnect test. In order to interface with the simulation, the test configuration comprises value properties with path variables, which point to test related files, such as the simulation setup, the parameter mapping, the aerodynamic load definitions for the test case as well as the test result files.

Fig. 8
figure 8

Test configuration for shaft disconnect tests

Full size image

Additionally, the provenance information, which is used in the VPH process (see [21]), can be stored in the test configuration. With this setup a simple test management solution is implemented for the VPH process.

For the different variations of the shaft disconnect test—e.g. with respect to aerodynamic loads, failure detection thresholds, or failing equipment—instance specifications of this configuration are created. Each instance serves as a test case, which can be executed separately. Based on the test cases, the simulations are executed in the respective simulation environment. After post processing, the KPIs can be linked to the test case again, and the requirement verification is performed automatically. In the current implementation, the generation of test configurations and test cases is performed manually on the basis of the system model. However, model-based testing techniques (MBT) have the potential to automatically generate test configurations and hence automate virtual testing further.

4.4 Model integration

Based on the test cases the simulation configuration is generated in the model integration step according to Fig. 6. The necessary inputs to the model integration step are depicted in this section.

First, the simulation setup defines the test procedure. Besides the definition of stimulus signals to the actuation system, it contains information on equipment failures, detection thresholds of the safety monitors of the control computer models, as well as simulation specific parameters, such as solver settings. Furthermore, KPIs for the test cases are defined here for the post processing.

The aerodynamic loads for the virtual tests are obtained using the LIFTING LINE tool from the VPH digital design process [8]. Specific flight states can be selected to match the requirements of the test case. For this work a flight state is chosen, where the trailing edge flaps are deployed. Flap loads are calculated for several flap settings at this specific flight state to generate the load profile for the flap deployment. Using the mechanism analysis tool presented in [8], the loads on the flap bodies are transformed to actuator torques. In the simulation of the test case the actuator torques are generated depending on the actuator angle by a linear interpolation between the values of the discrete flap settings.

The actual system under test (SuT) is the result of the VPH digital design process (see [8]). The sizing results of the actuation system are stored in a file containing parameter values and the system topology information. At this point it should be noted, that, depending on the sizing method used and available, the set of necessary parameters for the simulation models may not be complete. Depending on the type of simulation model, a large number of parameters defines the behavior of actuation system. If not all necessary parameters can be obtained from the sizing process, the missing values are approximately taken from a parameter database for similar equipment of the actuation system.

Since the VPH process shall be able to combine different sizing and virtual testing components, a parameter mapping has to be performed in order to map the sizing results to the simulation model. For this means an xml-based mapping dictionary is used. Each part of equipment, which is sized in the design stage is matched with an equipment model from the model library. Moreover, the parameters, which result from the sizing process are mapped to the corresponding parameters of the model.

With these inputs the model integration can be performed. The result is a simulation configuration file, which contains all necessary information for test case simulations. Together with the Modelica equipment model library, which is presented in the next section, the simulation model can be built and executed.

4.5 Modelica equipment model library

The model library used within this virtual testing setup is developed in the object-oriented and equation-based modeling language Modelica. Such an acausal modeling language reduces the modeling effort and maximizes the flexibility and reusability [28]. The model library enables the simulation of the actuation system as well as of the flap mechanisms.

The actuation system library enabling the modeling of multifunctional high lift systems was introduced in [29]. The library consists of two main packages: the component package and the equipment package. Each component model represents a specific physical effect as illustrated in Fig. 9 for the main components of the mechanical rotational domain.

Fig. 9
figure 9

Main component models of the mechanical rotational domain

Full size image

By connecting those components all required equipment models can be generated. The shaft represents the simplest equipment model. As depicted in Fig. 10(A), this model consists of only the components SpringDamper and Inertia. The equipment model gearbox (Fig. 10B) requires a representation of backlash (ElastoBacklash) and speed-dependent frictional losses including a break-out torque and meshing efficiency (GearEfficiencyDrag).

Fig. 10
figure 10

Equipment models of a shaft (A) and a gearbox (B)

Full size image

The developed model library enables the simulation of a mechanical disconnect and jam. In order to set up a shaft disconnect test, the nominal spring-damper component of a shaft (see Fig. 10) is replaced by a modified one. Using the modified component, the value of the spring constant and of the damping coefficient can be decreased to zero triggered by an external signal. In this way, the transmission of the mechanical power can be cut. A more detailed description of the equipment models comprising the modelling of certain physical effects and underlying mathematical relations is presented in [29].

The control surface mechanisms have different representations in the model library, which can be chosen according to the requirements of the test case. The simplest implementation does not contain the kinematic description of the mechanism itself, but a load look-up table, which outputs the actuator loads based on the actuator angle directly. A more detailed mechanism model consists of multibody models of single mechanisms based on components of the Modelica standard multi body library [30]. In order to account for the interaction of flap structure, mechanisms and transmission system a co-simulation setup will be realized as outlined in Sect. 5.

4.6 Shaft disconnect tests

Figure 11 shows the graphical representation of the simulation model for one wing. On the left hand side the model of the control computer followed by the hydraulic motor, afterwards, the transmission system of the right wing are depicted. Here, the shaft model of the transmission shaft upstream the WTB (shaft 6) is replaced by a model containing the disconnect failure, which is triggered through a step signal generator. For the setup in this work, joints and steady bearings are neglected and the number of transmission shafts between the other equipment models is reduced to one. The aerodynamic loads are modelled as single station loads, which means that the control surface mechanisms and flap structures are not part of the simulation model. Hence, the effects of the interaction between the actuation system and the structure is not modelled. According to the test case description of Sect. 4.3, the flaps are deployed from a retracted position until the shaft disconnect is engaged.

Fig. 11
figure 11

Model of the shaft transmission system of the right wing with disconnect of shaft 6

Full size image

For the shaft disconnect test configuration of Fig. 8 three test cases are investigated exemplarily. First, the test case according to Fig. 11 is evaluated (i.e. shaft6failure). The second test case describes the rupture of the transmission shafts between the two flaps (i.e. shaft4failure). For the third test case, the shaft disconnect between inboard flap and the STL is evaluated (i.e. shaft2failure). The parametrization of control computer functions and the aerodynamic loads on the actuation system are chosen the same for all three test cases.

Figure 12 shows the measured angle differences between APPU and FPPU (asymmetry angle) for all three tests. Before the shaft disconnect is engaged the asymmetry angle stays well below 1°. Afterwards the angle difference rises. For each test this happens at different rates. For shaft2failure all five drive stations are disconnected from the PCU and are hence pushed back by the aerodynamic loads, which results in a fast increase of the asymmetry. Therefore, the failure is detected first for this test case. After detection, the PCU is stopped and the WTB is activated by the control computer, which causes the asymmetry angle to settle at a steady value. Due to the fact, that for shaft2failure a major part of the transmission system is accelerated backwards by the aerodynamic loads after the disconnect, the maximum resulting asymmetry is largest here. Figure 13 shows the brake torque after the WTB is activated. As described earlier, the WTB is engaged first for shaft2failure and last for shaft6failure.

Fig. 12
figure 12

Asymmetry angle for three disconnect test cases

Full size image
Fig. 13
figure 13

Wing tip brake torques for three disconnect test cases

Full size image

According to the constraints shown in the test configuration of Fig. 8, the maximum asymmetry requirement for all three test cases can be fulfilled. However, shaft2failure violates the maximum brake torque constraint and hence fails. After evaluation of the tests, requirements verification can be conducted in the system model. Figure 14 depicts this in the form of an instance table of the test cases.

Fig. 14
figure 14

Instance table of shaft disconnect test cases in system model

Full size image

5 Conclusion and future works

Virtual testing is a powerful way to gain system insights in early design stages. In this work the virtual testing approach was presented for the use case of the VPH start-up project. It was shown that the end-to-end capability of the presented method allows to quickly evaluate design changes and test variations and trace the results back to the underlying system requirements. Through the automation of the model integration steps, this can be performed without a large amount of manual and error-prone work.

Based on the digital design of the trailing edge flap, simulation models of the flap structure are evaluated with respect to certification requirements. In particular the approach for virtual unit tests containing the evaluation of the structural integrity after accidental damage was outlined. For virtual integration testing, a process for the automated model generation and execution of functional tests of the actuation system was shown. Exemplary results for the use case system where presented. A SysML model comprising the system architecture and requirements was used to define test configurations and test cases. Each test case is linked to simulation setups and results, which allows quick evaluation of the tests. After design changes, these test setups can be used again to automatically build and execute the virtual tests for the updated design. Together with the provenance information which is included in the test setup and results files, this method serves as a simple model data and test management.

Currently the design of the test procedures is performed manually. However, with a detailed system model, MBT methods could be developed in order to generate and parametrize the test configurations and test cases automatically. This would allow to increase the level of automation and ensure high test coverage for the virtual tests. In terms of modelling and simulation, the process chain in its current implementation can cover virtual test setups with models, which are implemented in the Modelica modeling language. In the future this setup shall be further developed to allow a multidisciplinary co-simulation with an automatically generated multi-body representation of flap mechanisms, the flap structural model and distributed aerodynamic loads. With this a deeper understanding of the system design can be obtained through virtual tests. Especially the transient loads at failure conditions, can be investigated at the interface between flap structure and mechanisms, which would allow feedback of that information into consecutive design iterations of the VPH process. The implementation of the VPH process aims to be easily expandable, which would allow to increase the number of virtual test methods depending on the needs of the use cases.

When these methods shall support product qualification, the reliability of the methods and simulation models needs to be assured. Intensive work must be done to quantify and reduce parameter and model uncertainties. Therefore, validation techniques and hybrid test approaches need to be investigated in order to get the full potential out of virtual testing.