# Classification and Control of Key Factors Affecting the Failure of Aviation Piston Turbocharger Systems Using Model-Based System Safety Analysis

Authors: Mengyao Bao; Shuiting Ding; Guo Li
Journal: International Journal of Aerospace Engineering
 (2021)

---

## Abstract

Turbocharging is an effective way to address the problem of reduction in power and increase in fuel consumption of aviation piston engines during high-altitude flight. However, turbochargers have greatly increased the degree of complexity of power systems. The model-based system safety analysis methods for the safety analysis of turbocharging systems are introduced in this study to overcome the limitations of the traditional safety analysis methods regarding complex matching and coupled safety issues. On the basis of the established system models and the formed failure mode work boundaries and safety boundaries, the column profile coordinatesF of correspondence analysis with the numerical deviation of the key factors are used to identify the key factors affecting failure, thereby proposing safety control strategies in a targeted manner. Then, the failure probability of the turbocharging system is assessed through the Monte Carlo method. System failure modes and probabilities before and after the execution of safety control strategies are compared to accurately determine the effectiveness of those strategies. The verification examples show that a safety control strategy that adjusts the diameter of the wastegate e2 can reduce system failure probability and enhance safety level.


---

## Body

## 1. Introduction

Aviation piston engines are an important option for general aircraft power and account for the absolute majority in the market. Turbocharging is an effective way to address the issues of reduced power and increased fuel consumption during high-altitude flight. However, turbocharging greatly increases the degree of complexity of power systems, and the associated safety issues have become increasingly prominent. A survey conducted by the US National Transportation Safety Board (NTSB) reported that most of the general aviation piston engine accidents could be attributed to turbocharger malfunction-induced engine power failure [1–3]. Therefore, the NTSB has recommended that the US Federal Aviation Administration (FAA) pay particular attention to the issue of turbocharger-induced power reduction and power loss in general aviation piston engines [1, 4–7]. Generally, turbocharger failure is caused by inherent lag characteristics and positive feedback characteristics associated with the pneumatic connection between the turbocharger and the engine [6, 8, 9]. That is, a strong, complex matching connection and closed-loop characteristics occur between the two, resulting in mutual coupling of failure forms. Consequently, it is difficult for traditional analytical methods to decompose and identify the failure modes [10, 11]. It is therefore more difficult to formulate and execute accurate and targeted safety control strategies to ensure turbocharger safety.In recent years, model-based system safety analysis methods have been developed to overcome the limitations of traditional analytical methods in handling complex coupling engineering problems [13–19]. Model-based safety analysis refers to the introduction of a complex system model that is specifically targeted at an object of study in the failure mode analysis [12, 20–24], that is, the utilization of an established model to test the system through simulation at each stage of failure mode analysis, in order to verify whether the system can operate according to the functional requirements. In the process, since the failure mode analysis and the system verification test share the same model, model-based safety analysis can reflect the matching and coupling characteristics between systems and effectively address the issue of failure mode identification. The key to model-based system safety analysis is the combination of the model-based development process with the field of safety analysis, which has received increasing amounts of attention since its inception. In 2005, Joshi and Heimdahl [20] from the University of Minnesota and Miller and Whalen from the Rockwell Collins Advanced Technology Centre jointly introduced the model-based development process into the system safety assessment process. In 2006, Joshi et al. [12] further explained the basic idea of the model-based system safety assessment process and analysis methods in a National Aeronautics and Space Administration (NASA) report and compared the model-based system safety assessment process with the traditional process, as shown in Figure 1. The processes show that the model-based system safety assessment process continues to use the traditional process but at the same time incorporates other methods based on the analysis model. In 2007, Joshi and Heimdahl [21] further explained system behaviour modelling. In 2010, Feiler [22] clarified the role of model-based system safety analysis in improving system-level safety. Chaudemar et al. [23] introduced this idea into unmanned aerial vehicle (UAV) control systems. Güdemann and Ortmeier [24, 25] further introduced a failure mode probability model into the qualitative model-based system safety analysis and attempted to carry out quantitative model testing on it. The aforementioned analyses have all shown that they can better utilize the system information in the design process to match the development process with the safety assessment process and effectively avoid the uncertain factors of design and safety evaluation transformation, thereby reducing the analytical errors caused by human subjective judgement. At present [26], Advisory Circular No. 20-115D (AC20-115D) issued by the FAA has officially confirmed that RTCA, Inc. document 331 (DO-331) model-based analysis and verification can be used for the airworthiness certification of airborne systems and equipment development.Figure 1
Comparison of the traditional system safety assessment process and the model-based system safety assessment process [12].Therefore, in connection with the complex matching and coupling safety issues of aviation piston engine turbochargers, this study introduces a model-based method for safety analysis of turbocharging systems. To identify the key factors affecting failure, the column profile coordinatesF of correspondence analysis with the numerical deviation of the key factors are used. The corresponding safety control strategy of each key factor is then proposed and assessed by failure probability. The result of this study provides a new approach to determining the influencing factors and potential inducements of the failure issues in the actual operation of aviation piston engine turbocharging systems, with the ultimate goal of ensuring safety of general aircraft.


## 2. Summary of the Model-Based Safety Assessment Process and Key Technologies for the Turbocharging System

Model-based design refers to a method of design relying on mathematical models and simulations. The established model can test and verify the system through simulation at any stage of the development process, thereby ensuring that the system can operate normally according to the requirements of the functional design. Regarding the difficulty in identifying the mutually coupled failure modes caused by the complex matching connection between the turbocharger and the engine, the model can be an effective tool in the system safety analysis and design process, overcoming the limitations of traditional safety analysis methods. The model-based development process is introduced into the system safety assessment process to form a model-based turbocharging system safety assessment process and analysis method.Figure2 gives a schematic diagram of a typical model-based safety assessment process for the engine and its systems.Figure 2
Model-based safety assessment process for the engine and its systems.Compared with the general system safety assessment process, on the basis of the original V-model assessment process, there are interactions between the system model, system safety analysis, and design process involved in the introduced model development process, such that testing, analysis, and verification are carried out at every stage in the development process. Therefore, in connection with the characteristics of the model-based system safety assessment process, the key components in the corresponding system safety analysis methods are as follows: (1) establishment of the system model, (2) description method for the work boundaries and safety boundaries of the failure modes, (3) classification method for the key influencing factors acting on the failure modes, and (4) proposal and verification of the safety control strategies. Detailed discussions of these components are presented in the subsequent sections according to the aforementioned order.


## 3. Establishment and Verification of the System Simulation Model

Regarding the failure of a piston engine turbocharger, the key is in the complex matching connection that exists between the turbocharger and the engine itself, as well as the coupling of failure modes. Therefore, a system simulation model based on the whole engine is established first to accurately reflect the system pattern, serving as the foundation for the subsequent analysis of the key influencing factors of failures. In this paper, the Rotax 914 aviation piston engine [27] equipped with a new type of two-stage turbocharger is selected and the GT-Power software is used to construct the system simulation model. To overcome the crudity of zero dimensional models and complexity of multidimensional models, a quasi-dimensional model is introduced and three subsystems with corresponding models are considered, namely, the working process model inside the cylinder, air intake and exhaust system model, and turbocharger system model. For the working process model, the Wiebe combustion function is used and the Woschni semi-empirical formula is applied in the heat transfer model. For the turbocharger system model, the modelling process includes four parts: turbocharger parameter determination, dynamical model analysis, matching principle between the compressor and turbine, and calculation of the characteristic parameter of the compressor and turbine. To simplify the analysis, the friction and scavenging models are ignored. Besides, it should be pointed out that, for this new turbocharging system, the two-stage compressors are arranged “back to back” and coaxially driven by one turbine, as shown in Figure 3. So, it is dramatically different from the traditional two-stage turbocharging system. The engine performance parameter table comparing the two is provided in Table 1. The details of this new turbocharging system are given in Reference [28].Figure 3
Schematic diagram of the two-stage turbocharging system.Table 1
Comparison of engine power when using different turbochargers.
Engine speed (r/min)Engine power (kW)Throttle positionThrottle positionThrottle positionThrottle positionThrottle position40%60%80%100%115%Two-stageOne-stageTwo-stageOne-stageTwo-stageOne-stageTwo-stageOne-stageTwo-stageOne-stage300025.4825.2927.4727.7731.4431.7530.2830.5933.4333.57400031.7731.9139.7239.7043.5343.5147.6747.6557.1157.26450034.0934.2345.3545.5050.3250.3055.4555.6065.2265.38500037.0737.0550.1550.1457.2857.2663.4063.3973.6773.66550037.5737.5554.1354.1163.2463.2269.0369.0279.6379.79To verify the accuracy of the model, data from a characteristic experiment are used for comparison with the calculation results of the simulation model. In the experiment, the ambient temperature was 20°C, and the ambient pressure was 100.7 kPa. The calculated operating points were at rotational speeds of 3,000 to 5,500 r/min, with operating points at intervals of 500 r/min, plus an additional operating point of 5,800 r/min. Comparisons of the simulation data and experimental data of the output power and torque changes of the engine are given in Figure4. Here, it should be pointed out that the torque output is from the output shaft after gearbox. Generally, the simulated values of the model and the experimental values fit fairly well within the allowable range. Therefore, the simulation model reasonably reflects the characteristics of the actual system and can be used for subsequent analysis.Figure 4
Comparison of the simulated and experimental data of power and torque.


## 4. Safety Boundary Description Method for the Failure Modes

### 4.1. Safety Boundaries of the Failure Modes

Generally, as a kind of constraint on the failure mode (i.e., the top event), the safety boundary is the maximum allowable range for the parameters at which the object of study can safely work. In a mathematical model, the safety boundary can be reflected as a parameterized expression of the functional characteristic value or safety feasible region in a situation where the failure mode (i.e., the top event) does not occur.In this paper, the object of analysis is the safety issue of matching the turbocharging system of the two-stage aviation piston engine with the whole machine; therefore, the influence of the turbocharging system on the safety of the entire engine in the context of engine is a key factor of consideration. In actual analysis, according to the model-based turbocharging system safety assessment process, the safety of the engine subsystems must also be studied from the perspective of the entire system. Therefore, there are two levels of safety requirements in the FHA stage, namely, engine level and turbocharging system level. The safety requirements involved at each level can be characterized through the engine system safety boundaries and the turbocharging system safety boundaries; that is, the maximum allowable range of the working parameters required in a safe working state is first analyzed from the safety boundaries of engine operation, after which the safety boundary requirements for the turbocharging system are issued accordingly, in order to ensure matching. In the PSSA stage, however, it is necessary to further apply the work boundaries and safety boundaries of the turbocharging system and apply the model to analyze the influencing factors that may play a role in the failure modes identified in the FHA stage.Figure5 shows the schematic diagram of engine-level FHA safety boundaries, where the possible safe operating conditions and working range of the engine are drawn using the Pe–n coordinate system. The possible safe working area of the engine is restricted to an area enclosed by the maximum power (external characteristic power line) that the engine can deliver, the minimum stable rotational speed nmin of the engine (safety boundary line on the left), the maximum working rotational speed nmax of the engine (safety boundary line on the right), and the abscissa axis. The safety design of the engine required in this study is determined according to the operating manual of the Rotax 914 engine.Figure 5
Schematic diagram of the engine-level safe working area and its safety boundaries.The safety requirements for the two-stage turbocharging engine involved in this study are determined by the engine-level FHA safe operating boundaries. Note that the matching problem of the two-stage turbocharging system leads to many safety problems for the engine. For example, if the turbocharging pressure ratioπc selected is too low, the predetermined turbocharged engine power will not be reached, and the engine exhaust temperature will be too high. On the other hand, if the turbocharging pressure ratio πc selected is too high, the maximum explosion pressure of the engine and the rotational speed of the turbocharger will be excessively high. In addition, since the flow rate Gc and the turbocharging pressure ratio πc are coupled, an inappropriate selection of flow rate will lead to poor match quality between the turbocharger and the engine. More importantly, determining the turbine flow capacity will be impossible, resulting in conditions far from the design values. The schematic diagram of turbocharging system-level FHA safety boundaries is given in Figure 6. The working range of the turbocharging system is the area enclosed by the minimum stable rotational speed nmin (left), the rated rotational speed ne of the engine (right), the maximum allowable temperature Trmax of the turbine (uppermost), the compressor surge line (upper left), the maximum rotational speed nTCmax allowed by the turbocharger (upper right), and the abscissa axis.Figure 6
Schematic diagram of the safe working area for the turbocharging system and its safety boundaries.After the safety boundaries (or safe working area) are determined, the failure modes of the turbocharging system can be further reflected through the safety boundaries. Generally, the failure of the turbocharging system may be defined as a single-failure mode or a coupling-failure mode. The schematic diagram of failure modes for the turbocharging system expressed through the safe working area and its safety boundaries is given in Figure7. Typical single-failure mode and coupling-failure mode can be summarized as follows.
(1)
Single-failure modeFigure 7
Schematic diagram of the safe working area and failure modes for the turbocharging engine.Area (1): small flow surge in the compressorArea (2): excessively high turbine inlet temperatureArea (3): excess revolution of the turbocharger rotor(2)
Coupling-failure modeArea (4): small flow surge in the compressor and excessively high turbine inlet temperatureArea (5): excessively high turbine inlet temperature and excess revolution of the turbocharger rotorFigure7 shows that if point E0, representing the state of turbocharging system operation, moves from the safe working area to point E1 in area (1), the turbocharging system can manifest a single-failure mode of a compressor surge. If point E0 moves from the safe working area to point E2 in area (4), the turbocharging system can manifest a coupling-failure mode of a compressor surge and excessively high turbine inlet temperature.


### 4.2. Determining the Boundaries of the Failure Modes

After the work boundary and safety boundary of the failure modes are determined, whether the system has failed can be judged by the containment relationship between the safety boundary and the work boundary. With reference to the requirements of ARP4761 [29], it is necessary to identify all possible failure modes that affect system functions in the FHA stage and to analyze the causes of the failure modes identified in the FHA stage within PSSA. This means that the failure mode is used as the top event, the influencing factors that may play a role in the failure mode are decomposed and parameterized, and safety protection measures are derived.The relationship between failure and the boundaries in the model-based system safety analysis method is shown in Figure8. For example, E0, E1, E2, and E3 represent the state points on the work boundary of the turbocharging system in operation under different work conditions. If point E0, representing the working state of the turbocharging system, operates within the safe working area to point E1, the turbocharging system manifests normal operation. If point E1 moves from the safe working area to point E2 on the safety boundary, the turbocharging system still manifests normal operation, but there are potential safety hazards. If point E2 moves from the safety boundary to point E3 in the unsafe area, the turbocharging system can no longer operate normally, exhibiting a single-failure mode or even a coupling-failure mode. Turbocharger failures can be judged by the containment relationship between the work boundary and the safety boundary. If the work boundary point during system operation exceeds the safety boundary, entering the unsafe area, then the system is considered to fail. If the system operates in the safe area or on the safety boundary, then the system is considered to be normal. Therefore, safety of the system can be ensured by controlling the actual work boundary in turbocharging system operation within a range that does not exceed the safety boundary.Figure 8
Determining the boundaries of the failure modes.


## 4.1. Safety Boundaries of the Failure Modes

Generally, as a kind of constraint on the failure mode (i.e., the top event), the safety boundary is the maximum allowable range for the parameters at which the object of study can safely work. In a mathematical model, the safety boundary can be reflected as a parameterized expression of the functional characteristic value or safety feasible region in a situation where the failure mode (i.e., the top event) does not occur.In this paper, the object of analysis is the safety issue of matching the turbocharging system of the two-stage aviation piston engine with the whole machine; therefore, the influence of the turbocharging system on the safety of the entire engine in the context of engine is a key factor of consideration. In actual analysis, according to the model-based turbocharging system safety assessment process, the safety of the engine subsystems must also be studied from the perspective of the entire system. Therefore, there are two levels of safety requirements in the FHA stage, namely, engine level and turbocharging system level. The safety requirements involved at each level can be characterized through the engine system safety boundaries and the turbocharging system safety boundaries; that is, the maximum allowable range of the working parameters required in a safe working state is first analyzed from the safety boundaries of engine operation, after which the safety boundary requirements for the turbocharging system are issued accordingly, in order to ensure matching. In the PSSA stage, however, it is necessary to further apply the work boundaries and safety boundaries of the turbocharging system and apply the model to analyze the influencing factors that may play a role in the failure modes identified in the FHA stage.Figure5 shows the schematic diagram of engine-level FHA safety boundaries, where the possible safe operating conditions and working range of the engine are drawn using the Pe–n coordinate system. The possible safe working area of the engine is restricted to an area enclosed by the maximum power (external characteristic power line) that the engine can deliver, the minimum stable rotational speed nmin of the engine (safety boundary line on the left), the maximum working rotational speed nmax of the engine (safety boundary line on the right), and the abscissa axis. The safety design of the engine required in this study is determined according to the operating manual of the Rotax 914 engine.Figure 5
Schematic diagram of the engine-level safe working area and its safety boundaries.The safety requirements for the two-stage turbocharging engine involved in this study are determined by the engine-level FHA safe operating boundaries. Note that the matching problem of the two-stage turbocharging system leads to many safety problems for the engine. For example, if the turbocharging pressure ratioπc selected is too low, the predetermined turbocharged engine power will not be reached, and the engine exhaust temperature will be too high. On the other hand, if the turbocharging pressure ratio πc selected is too high, the maximum explosion pressure of the engine and the rotational speed of the turbocharger will be excessively high. In addition, since the flow rate Gc and the turbocharging pressure ratio πc are coupled, an inappropriate selection of flow rate will lead to poor match quality between the turbocharger and the engine. More importantly, determining the turbine flow capacity will be impossible, resulting in conditions far from the design values. The schematic diagram of turbocharging system-level FHA safety boundaries is given in Figure 6. The working range of the turbocharging system is the area enclosed by the minimum stable rotational speed nmin (left), the rated rotational speed ne of the engine (right), the maximum allowable temperature Trmax of the turbine (uppermost), the compressor surge line (upper left), the maximum rotational speed nTCmax allowed by the turbocharger (upper right), and the abscissa axis.Figure 6
Schematic diagram of the safe working area for the turbocharging system and its safety boundaries.After the safety boundaries (or safe working area) are determined, the failure modes of the turbocharging system can be further reflected through the safety boundaries. Generally, the failure of the turbocharging system may be defined as a single-failure mode or a coupling-failure mode. The schematic diagram of failure modes for the turbocharging system expressed through the safe working area and its safety boundaries is given in Figure7. Typical single-failure mode and coupling-failure mode can be summarized as follows.
(1)
Single-failure modeFigure 7
Schematic diagram of the safe working area and failure modes for the turbocharging engine.Area (1): small flow surge in the compressorArea (2): excessively high turbine inlet temperatureArea (3): excess revolution of the turbocharger rotor(2)
Coupling-failure modeArea (4): small flow surge in the compressor and excessively high turbine inlet temperatureArea (5): excessively high turbine inlet temperature and excess revolution of the turbocharger rotorFigure7 shows that if point E0, representing the state of turbocharging system operation, moves from the safe working area to point E1 in area (1), the turbocharging system can manifest a single-failure mode of a compressor surge. If point E0 moves from the safe working area to point E2 in area (4), the turbocharging system can manifest a coupling-failure mode of a compressor surge and excessively high turbine inlet temperature.


## 4.2. Determining the Boundaries of the Failure Modes

After the work boundary and safety boundary of the failure modes are determined, whether the system has failed can be judged by the containment relationship between the safety boundary and the work boundary. With reference to the requirements of ARP4761 [29], it is necessary to identify all possible failure modes that affect system functions in the FHA stage and to analyze the causes of the failure modes identified in the FHA stage within PSSA. This means that the failure mode is used as the top event, the influencing factors that may play a role in the failure mode are decomposed and parameterized, and safety protection measures are derived.The relationship between failure and the boundaries in the model-based system safety analysis method is shown in Figure8. For example, E0, E1, E2, and E3 represent the state points on the work boundary of the turbocharging system in operation under different work conditions. If point E0, representing the working state of the turbocharging system, operates within the safe working area to point E1, the turbocharging system manifests normal operation. If point E1 moves from the safe working area to point E2 on the safety boundary, the turbocharging system still manifests normal operation, but there are potential safety hazards. If point E2 moves from the safety boundary to point E3 in the unsafe area, the turbocharging system can no longer operate normally, exhibiting a single-failure mode or even a coupling-failure mode. Turbocharger failures can be judged by the containment relationship between the work boundary and the safety boundary. If the work boundary point during system operation exceeds the safety boundary, entering the unsafe area, then the system is considered to fail. If the system operates in the safe area or on the safety boundary, then the system is considered to be normal. Therefore, safety of the system can be ensured by controlling the actual work boundary in turbocharging system operation within a range that does not exceed the safety boundary.Figure 8
Determining the boundaries of the failure modes.


## 5. Classification of the Key Influencing Factors for Failure Based on the Correspondence Analysis Method

For the turbocharging system involved in this paper, an improved correspondence analysis method is used to probe the coupling relationship and degree of closeness between the failure modes and key influencing factors in that system, in order to identify the key factors.


### 5.1. Analysis Principles and Processes of the Improved Correspondence Analysis

Correspondence analysis is a recently developed statistical analysis technique with multivariate-dependent variables, and its essence is dimension reduction to simplify a data structure [30–32]. For the turbocharging system involved in this paper, the set of key influencing factors for its failures is taken as the sample points (row points), the safety margins of the work boundaries become the variable points (column points), and the criticality of these key influencing factors regarding the safety of the turbocharging system is determined according to the relationship between the key influencing factors (independent variables) and the safety margins of the work boundaries (dependent variables). Generally, the specific implementation process includes surrogate model construction based on the response surface methodology, data type normalization, and classification of the key influencing factors.For surrogate model construction and data type normalization, the details are given in Reference [5]. The present study only focuses on the classification of the key influencing factors. That is, when the order of magnitude of the sample points is large, the variable points representing the failure modes are measured by using the column profile coordinate F. Therefore, a classification method is proposed in this paper based on F that changes with numerical changes in the key influencing factors, as shown in Figure 9. This method, by changing the values of the key influencing factors one by one, i.e., changing the sample points, causes the column profile coordinate F to change. At the same time, these changes are reflected on a two-dimensional scatter plot. The degree of influence on the position of the column points is determined by measuring the positions before and after the changes. In other words, as the values of the key influencing factors are changed one by one, changes in different key influencing factors change the column points to different degrees, so the key influencing factors can be identified based on these changes. The distance before and after the change in the column point can be represented by the Euclidean distance of two points in the plane. When a key influencing factor is changed, a greater change in the relative distance of the column point deviation means that under those conditions, this factor has a greater effect on the failure mode and vice versa. When any ei in the set of sample points E is changed, the distance before and after a change in the column point is expressed using ΔdFi:
(1)ΔdFi=Fj,2i−Fj,22+Fj,1i−Fj,12,j=1,2,⋯,p,where Fj,1 and Fj,2 are the first and second coordinate vectors of F before the column point changes, respectively, and Fj,1i and Fj,2i are the first and second coordinate vectors of F after the column point changes, respectively.Figure 9
Relative position changes of the column profile coordinateF generated as the numerical values of the key influencing factors change.


### 5.2. Realization of the Classification of Key Influencing Factors for the Turbocharging System

#### 5.2.1. Determination of the Working Range

This particular piston aviation engine equipped with a turbocharging system is mainly used for a certain type of UAV. The flight envelope requirements for that type of UAV at full altitude are given in Table2. The typical operating conditions at flight altitudes of 7-10 km are extracted for additional analysis. The calculation sample points in connection with different altitudes are shown in Table 3.Table 2
Flight envelope requirements for a UAV.
Throttle position (%)Range of the rotational speed of the engine (r/min)Flight status of the aircraft1155,200-5,800Takeoff1005,000-5,500Climb-out904,800-5,500Cruise (high altitude or high speed)804,500-5,500Cruise (high altitude or high speed)704,200-5,500Cruise (high altitude or high speed)604,000-5,500Cruise503,500-5,300Cruise403,500-5,000Cruise303,000-4,500Cruise252,500-4,000Descent12.51,500-3,500Descent0-51,400-2,500Idle (generally on the ground)Table 3
Range of operating points corresponding to the selection of sample points.
Altitude (km)Throttle position (%)Rotational speed of the engine (r/min)770-1004,200-5,5001070-1004,200-5,500


#### 5.2.2. Selection of the Variable Points (Influencing Factors)

This paper focuses on the operating conditions of an engine with a turbocharging system during high-altitude or high-speed cruise (long-term working state of the engine), which includes altitudes of 7-10 km, throttle valve openings of 70%-100%, and engine rotational speeds of 4,200-5,500 r/min. In a situation where the control system is not taken into consideration, the settings of the key influencing factors can be represented by a group of controllable design parameters. These parameters include the throttle positione1, the diameter of the wastegate e2, the altitude e3, the rotational speed of the engine e4, and the diameter of the exhaust pipe e5. In addition, the work boundaries for this type of turbocharging system include turbine inlet temperature, rotational speed, compressor pressure ratio, and maximum explosion pressure.


#### 5.2.3. Generation and Verification of the Surrogate Model

The initial simulation conditions for the controllable design parameters are given according to the operating conditions of the turbocharging system, as shown in Table4. For the described five controllable design parameters within the range considered (operating boundaries in the turbocharging system design), the central composite-faced (CCF) design is applied to generate 36 sample points. A second-order response surface surrogate model is constructed by calculating the key influencing factors and the values of various work boundary points in the system model output.Table 4
Initial simulation conditions for a group of controllable design parameters.
Controllable design parameterLower boundUpper boundThrottle positione170%100%Diameter of the wastegatee21.5 mm10.5 mmAltitudee37 km10 kmRotational speed of the enginee44,200 r/min5,500 r/minDiameter of the exhaust pipee540 mm60 mmTo ensure the accuracy of the surrogate model, the relative errors between the surrogate model and the simulation model are determined, as shown in Figure10. The errors generated by using the surrogate model for analysis are generally less than 8% and can be acceptable in the following study of this paper.Figure 10
Relative errors between the data from the surrogate model and the simulation model for the work boundaries.


#### 5.2.4. Determination of the Safety Margins

According to the principle of data type normalization, each variable point in the original matrixX is transformed into the safety margin of each corresponding work boundary, i.e., the variable points in data matrix Y, which are the safety margin of the turbine inlet temperature (Y1), the safety margin of rotational speed of the turbocharger rotor (Y2), the compressor surge margin (Y3), and the safety margin of the maximum explosion pressure (Y4).


### 5.3. Result Analysis and Determination of the Key Influencing Factors

Correspondence analysis is directly carried out on the sample points in data matrixY, and the results are shown in Figure 11. When there are too many sample points, it is difficult to intuitively observe the degree of importance of each key influencing factor in the sample points to the variable points, and classification cannot be achieved. Therefore, the key influencing factor classification method given in Section 3 is used for processing. First, based on direct correspondence analysis, the column profile coordinate F corresponding to each variable point is extracted. Each controllable design parameter in the set of sample points is changed one by one in the same proportion. In the analysis, the throttle position e1, the diameter of the wastegate e2, the altitude e3, the rotational speed of the engine e4, and the diameter of the exhaust pipe e5 are increased one by one by 5%, 10%, 20%, and 30%, respectively. The new column profile coordinate Fi generated for each variable point is projected onto the same two-dimensional plane, as shown in Figure 12. Therefore, when the numerical value of each key influencing factor is changed, sorting can be carried out according to the size of the distance in the relative change in the position of the initial column point corresponding to each column point on the two-dimensional scatter plot. A greater change in the distance means a more critical key influencing factor and vice versa.Figure 11
Results from a large number of samples for the data matrix of the turbocharging system.Figure 12
Relative position deviations generated in the safety margin of the work boundary with increase in the key influencing factors.
(a)
5% increase in parameters(b)
10% increase in parameters(c)
20% increase in parameters(d)
30% increase in parametersBased on the results from Figure12, the deviation distances for the initial column points generated by the changes in each key influencing factor are determined, as shown in Figure 13, where sorting is carried out. Changes in the diameter of the wastegate e2 have the greatest effect on the safety margin of each work boundary. According to the deviation distance, this parameter affects the safety margin of each work boundary in the following order from most to least impact: safety margin of the turbine inlet temperature (Y1), compressor surge margin (Y3), safety margin of the rotational speed of the turbocharger rotor (Y2), and safety margin of the maximum explosion pressure (Y4). In addition, the rotational speed of the engine e4 also has a relatively strong effect on the safety margins of the work boundaries, and its impacts on the work boundaries are Y3>Y1>Y2>Y4. The throttle position e1, the altitude e3, and the diameter of the exhaust pipe e5 have relatively weak effects on the safety margin of each work boundary. Therefore, these parameters are not regarded as key influencing factors.Figure 13
Relative deviations in the safety margins generated by changes in the influencing factors.Since the effects of the diameter of the wastegatee2 on the safety margin of each work boundary have been determined to be the most critical, it should be considered first when it comes to control. Note that for turbocharge piston engines in general, the wastegate diameter is a key adjustment parameter and should be given special attention. Therefore, the analytical conclusions of this paper are in line with the consensus of turbocharged piston engine control, which once again suggests reliability of the proposed method.


## 5.1. Analysis Principles and Processes of the Improved Correspondence Analysis

Correspondence analysis is a recently developed statistical analysis technique with multivariate-dependent variables, and its essence is dimension reduction to simplify a data structure [30–32]. For the turbocharging system involved in this paper, the set of key influencing factors for its failures is taken as the sample points (row points), the safety margins of the work boundaries become the variable points (column points), and the criticality of these key influencing factors regarding the safety of the turbocharging system is determined according to the relationship between the key influencing factors (independent variables) and the safety margins of the work boundaries (dependent variables). Generally, the specific implementation process includes surrogate model construction based on the response surface methodology, data type normalization, and classification of the key influencing factors.For surrogate model construction and data type normalization, the details are given in Reference [5]. The present study only focuses on the classification of the key influencing factors. That is, when the order of magnitude of the sample points is large, the variable points representing the failure modes are measured by using the column profile coordinate F. Therefore, a classification method is proposed in this paper based on F that changes with numerical changes in the key influencing factors, as shown in Figure 9. This method, by changing the values of the key influencing factors one by one, i.e., changing the sample points, causes the column profile coordinate F to change. At the same time, these changes are reflected on a two-dimensional scatter plot. The degree of influence on the position of the column points is determined by measuring the positions before and after the changes. In other words, as the values of the key influencing factors are changed one by one, changes in different key influencing factors change the column points to different degrees, so the key influencing factors can be identified based on these changes. The distance before and after the change in the column point can be represented by the Euclidean distance of two points in the plane. When a key influencing factor is changed, a greater change in the relative distance of the column point deviation means that under those conditions, this factor has a greater effect on the failure mode and vice versa. When any ei in the set of sample points E is changed, the distance before and after a change in the column point is expressed using ΔdFi:
(1)ΔdFi=Fj,2i−Fj,22+Fj,1i−Fj,12,j=1,2,⋯,p,where Fj,1 and Fj,2 are the first and second coordinate vectors of F before the column point changes, respectively, and Fj,1i and Fj,2i are the first and second coordinate vectors of F after the column point changes, respectively.Figure 9
Relative position changes of the column profile coordinateF generated as the numerical values of the key influencing factors change.


## 5.2. Realization of the Classification of Key Influencing Factors for the Turbocharging System

### 5.2.1. Determination of the Working Range

This particular piston aviation engine equipped with a turbocharging system is mainly used for a certain type of UAV. The flight envelope requirements for that type of UAV at full altitude are given in Table2. The typical operating conditions at flight altitudes of 7-10 km are extracted for additional analysis. The calculation sample points in connection with different altitudes are shown in Table 3.Table 2
Flight envelope requirements for a UAV.
Throttle position (%)Range of the rotational speed of the engine (r/min)Flight status of the aircraft1155,200-5,800Takeoff1005,000-5,500Climb-out904,800-5,500Cruise (high altitude or high speed)804,500-5,500Cruise (high altitude or high speed)704,200-5,500Cruise (high altitude or high speed)604,000-5,500Cruise503,500-5,300Cruise403,500-5,000Cruise303,000-4,500Cruise252,500-4,000Descent12.51,500-3,500Descent0-51,400-2,500Idle (generally on the ground)Table 3
Range of operating points corresponding to the selection of sample points.
Altitude (km)Throttle position (%)Rotational speed of the engine (r/min)770-1004,200-5,5001070-1004,200-5,500


### 5.2.2. Selection of the Variable Points (Influencing Factors)

This paper focuses on the operating conditions of an engine with a turbocharging system during high-altitude or high-speed cruise (long-term working state of the engine), which includes altitudes of 7-10 km, throttle valve openings of 70%-100%, and engine rotational speeds of 4,200-5,500 r/min. In a situation where the control system is not taken into consideration, the settings of the key influencing factors can be represented by a group of controllable design parameters. These parameters include the throttle positione1, the diameter of the wastegate e2, the altitude e3, the rotational speed of the engine e4, and the diameter of the exhaust pipe e5. In addition, the work boundaries for this type of turbocharging system include turbine inlet temperature, rotational speed, compressor pressure ratio, and maximum explosion pressure.


### 5.2.3. Generation and Verification of the Surrogate Model

The initial simulation conditions for the controllable design parameters are given according to the operating conditions of the turbocharging system, as shown in Table4. For the described five controllable design parameters within the range considered (operating boundaries in the turbocharging system design), the central composite-faced (CCF) design is applied to generate 36 sample points. A second-order response surface surrogate model is constructed by calculating the key influencing factors and the values of various work boundary points in the system model output.Table 4
Initial simulation conditions for a group of controllable design parameters.
Controllable design parameterLower boundUpper boundThrottle positione170%100%Diameter of the wastegatee21.5 mm10.5 mmAltitudee37 km10 kmRotational speed of the enginee44,200 r/min5,500 r/minDiameter of the exhaust pipee540 mm60 mmTo ensure the accuracy of the surrogate model, the relative errors between the surrogate model and the simulation model are determined, as shown in Figure10. The errors generated by using the surrogate model for analysis are generally less than 8% and can be acceptable in the following study of this paper.Figure 10
Relative errors between the data from the surrogate model and the simulation model for the work boundaries.


### 5.2.4. Determination of the Safety Margins

According to the principle of data type normalization, each variable point in the original matrixX is transformed into the safety margin of each corresponding work boundary, i.e., the variable points in data matrix Y, which are the safety margin of the turbine inlet temperature (Y1), the safety margin of rotational speed of the turbocharger rotor (Y2), the compressor surge margin (Y3), and the safety margin of the maximum explosion pressure (Y4).


## 5.2.1. Determination of the Working Range

This particular piston aviation engine equipped with a turbocharging system is mainly used for a certain type of UAV. The flight envelope requirements for that type of UAV at full altitude are given in Table2. The typical operating conditions at flight altitudes of 7-10 km are extracted for additional analysis. The calculation sample points in connection with different altitudes are shown in Table 3.Table 2
Flight envelope requirements for a UAV.
Throttle position (%)Range of the rotational speed of the engine (r/min)Flight status of the aircraft1155,200-5,800Takeoff1005,000-5,500Climb-out904,800-5,500Cruise (high altitude or high speed)804,500-5,500Cruise (high altitude or high speed)704,200-5,500Cruise (high altitude or high speed)604,000-5,500Cruise503,500-5,300Cruise403,500-5,000Cruise303,000-4,500Cruise252,500-4,000Descent12.51,500-3,500Descent0-51,400-2,500Idle (generally on the ground)Table 3
Range of operating points corresponding to the selection of sample points.
Altitude (km)Throttle position (%)Rotational speed of the engine (r/min)770-1004,200-5,5001070-1004,200-5,500


## 5.2.2. Selection of the Variable Points (Influencing Factors)

This paper focuses on the operating conditions of an engine with a turbocharging system during high-altitude or high-speed cruise (long-term working state of the engine), which includes altitudes of 7-10 km, throttle valve openings of 70%-100%, and engine rotational speeds of 4,200-5,500 r/min. In a situation where the control system is not taken into consideration, the settings of the key influencing factors can be represented by a group of controllable design parameters. These parameters include the throttle positione1, the diameter of the wastegate e2, the altitude e3, the rotational speed of the engine e4, and the diameter of the exhaust pipe e5. In addition, the work boundaries for this type of turbocharging system include turbine inlet temperature, rotational speed, compressor pressure ratio, and maximum explosion pressure.


## 5.2.3. Generation and Verification of the Surrogate Model

The initial simulation conditions for the controllable design parameters are given according to the operating conditions of the turbocharging system, as shown in Table4. For the described five controllable design parameters within the range considered (operating boundaries in the turbocharging system design), the central composite-faced (CCF) design is applied to generate 36 sample points. A second-order response surface surrogate model is constructed by calculating the key influencing factors and the values of various work boundary points in the system model output.Table 4
Initial simulation conditions for a group of controllable design parameters.
Controllable design parameterLower boundUpper boundThrottle positione170%100%Diameter of the wastegatee21.5 mm10.5 mmAltitudee37 km10 kmRotational speed of the enginee44,200 r/min5,500 r/minDiameter of the exhaust pipee540 mm60 mmTo ensure the accuracy of the surrogate model, the relative errors between the surrogate model and the simulation model are determined, as shown in Figure10. The errors generated by using the surrogate model for analysis are generally less than 8% and can be acceptable in the following study of this paper.Figure 10
Relative errors between the data from the surrogate model and the simulation model for the work boundaries.


## 5.2.4. Determination of the Safety Margins

According to the principle of data type normalization, each variable point in the original matrixX is transformed into the safety margin of each corresponding work boundary, i.e., the variable points in data matrix Y, which are the safety margin of the turbine inlet temperature (Y1), the safety margin of rotational speed of the turbocharger rotor (Y2), the compressor surge margin (Y3), and the safety margin of the maximum explosion pressure (Y4).


## 5.3. Result Analysis and Determination of the Key Influencing Factors

Correspondence analysis is directly carried out on the sample points in data matrixY, and the results are shown in Figure 11. When there are too many sample points, it is difficult to intuitively observe the degree of importance of each key influencing factor in the sample points to the variable points, and classification cannot be achieved. Therefore, the key influencing factor classification method given in Section 3 is used for processing. First, based on direct correspondence analysis, the column profile coordinate F corresponding to each variable point is extracted. Each controllable design parameter in the set of sample points is changed one by one in the same proportion. In the analysis, the throttle position e1, the diameter of the wastegate e2, the altitude e3, the rotational speed of the engine e4, and the diameter of the exhaust pipe e5 are increased one by one by 5%, 10%, 20%, and 30%, respectively. The new column profile coordinate Fi generated for each variable point is projected onto the same two-dimensional plane, as shown in Figure 12. Therefore, when the numerical value of each key influencing factor is changed, sorting can be carried out according to the size of the distance in the relative change in the position of the initial column point corresponding to each column point on the two-dimensional scatter plot. A greater change in the distance means a more critical key influencing factor and vice versa.Figure 11
Results from a large number of samples for the data matrix of the turbocharging system.Figure 12
Relative position deviations generated in the safety margin of the work boundary with increase in the key influencing factors.
(a)
5% increase in parameters(b)
10% increase in parameters(c)
20% increase in parameters(d)
30% increase in parametersBased on the results from Figure12, the deviation distances for the initial column points generated by the changes in each key influencing factor are determined, as shown in Figure 13, where sorting is carried out. Changes in the diameter of the wastegate e2 have the greatest effect on the safety margin of each work boundary. According to the deviation distance, this parameter affects the safety margin of each work boundary in the following order from most to least impact: safety margin of the turbine inlet temperature (Y1), compressor surge margin (Y3), safety margin of the rotational speed of the turbocharger rotor (Y2), and safety margin of the maximum explosion pressure (Y4). In addition, the rotational speed of the engine e4 also has a relatively strong effect on the safety margins of the work boundaries, and its impacts on the work boundaries are Y3>Y1>Y2>Y4. The throttle position e1, the altitude e3, and the diameter of the exhaust pipe e5 have relatively weak effects on the safety margin of each work boundary. Therefore, these parameters are not regarded as key influencing factors.Figure 13
Relative deviations in the safety margins generated by changes in the influencing factors.Since the effects of the diameter of the wastegatee2 on the safety margin of each work boundary have been determined to be the most critical, it should be considered first when it comes to control. Note that for turbocharge piston engines in general, the wastegate diameter is a key adjustment parameter and should be given special attention. Therefore, the analytical conclusions of this paper are in line with the consensus of turbocharged piston engine control, which once again suggests reliability of the proposed method.


## 6. Safety Control Strategies and Verification for the Key Influencing Factors

The classification analysis of the key influencing factors in the turbocharging system shows that changes in the key influencing factors all play a primary role in the deviation of the safety margins of the work boundaries (column points) or the sample point clusters (row points), and the degree of influence is often greater than those of the general influencing factors. Therefore, to ensure that when abnormal situations emerge in the operation of this system, the sample point clusters do not deviate or deviate as little as possible from their normal positions, the controllable key influencing factors in the design should be controlled first.Since the diameter of the wastegatee2 is the most critical influencing factor in the complex matching connection between the turbocharging system and the engine, by regulating e2 (or the diameter of the wastegate), the fuel gas flow through the turbine is regulated. This changes the rotational speed of the turbocharger rotor and the output power of the turbine, thus changing the compressor flow and turbocharging ratio. The turbocharging pressure can reach the target value of the pressure stabilization chamber, thereby achieving a good match between the turbocharger and the engine.The safety control strategies of the turbocharging system will be studied in this section. Additionally, according to the method described in Section5, the influencing factors of the two-stage turbocharging system after the safety control strategy implementation will also be reclassified and analyzed.


### 6.1. Determination of the Safety Control Strategies of the Turbocharging System

In regard to the regulation measures for the turbocharger, the simplest and most commonly used measure at present is bypass venting at the turbine end, where the wastegate driven by the motor through the actuator is its core component. Therefore, a wastegate control model is added to the original model to analyze the safety control strategies, as shown in Figure14.Figure 14
Safety control strategy with added wastegate control.


### 6.2. Analysis of the Role of Safety Control Strategies

In order to determine the degree of importance of other influencing factors after the safety control strategy is used, under the premise that types of influencing factors (e1-e5), initial simulation conditions, and work boundaries of the turbocharging system (Y1-Y4) are unchanged, classification of the influencing factors is achieved as follows. First, the response surface method is used to extract the surrogate model for the two-stage turbocharged engine system model after the safety control strategy is used. N sample points are randomly generated, and various corresponding work boundary values are generated through the surrogate model and then transformed into the safety margin of each work boundary required by the variable points in the correspondence analysis. Finally, correspondence analysis is carried out with the sample points and the variable points.Classification involves first extracting the column profile coordinateF corresponding to each variable point on the basis of the aforementioned correspondence analysis and then increasing the influencing factors e1-e5 by +5%, +10%, +20%, and +30% one by one in the same proportion, respectively. The new column profile coordinate Fi generated for each variable point is projected onto the same two-dimensional plane. Figure 15 shows the results after the increases.Figure 15
Relative position changes in the safety margin of the work boundary after the safety control strategy is used.
(a)
5% increase in parameters(b)
10% increase in parameters(c)
20% increase in parameters(d)
30% increase in parametersAs the degree of deviation of each influencing factor continues to increase, deviations generated bye3 and e4 have greater effects on the safety margin of each work boundary, but the effects of e1 and e5 are not significant. Using the +30% change as an example, the change in the distance between the relative positions of each column point on the two-dimensional scatter plot before and after the safety control strategy is used is given in Figure 16, where the deviation distances of the initial column points due to the change in each influencing factor can be further sorted to complete the reclassification.Figure 16
Comparison of the changes in the distance between the relative positions of each column point before and after using the safety control strategy.Figure16 shows that e3 has the greatest influence on the safety margin of each work boundary, making itself the most critical influencing factor in the new round. Because the effects on the safety margins of Y1 and Y3 are comparatively strong, e4 is still a key influencing factor. Therefore, e3 and e4 are determined to be the key factors in the new round. If the turbocharging system still cannot satisfy the system safety requirements after the safety control strategy is executed on e2, it is necessary to propose a corresponding safety control strategy for e3 in the subsequent safety analysis.


### 6.3. Verification Method for the Safety Analysis of the Turbocharging System

In the analysis described in the previous section, the two-stage turbocharged engine model is used as the object of analysis, and the classification and positioning of the influencing factors in terms of their effects on the failure modes are realized by introducing the improved correspondence analysis method. This determines the key influencing factors in the PSSA stage and ultimately yields the safety control strategy for the turbocharging system. However, whether the safety strategy can improve the safety level and quantification of the improvement is unknown. Therefore, in the SSA stage, to determine whether the analyzed turbocharging system model reaches the acceptable design safety level after the safety control strategy is used, the safety of this system is verified through the Monte Carlo method in this section. The Monte Carlo method is used to assess the failure probability of each failure mode, and the differences in the system failure modes and probabilities before and after using the safety control strategy are compared to explore the effectiveness of the safety control strategy.


#### 6.3.1. Monte Carlo-Based Verification Method for Safety Analysis of the Turbocharging System

From Section4, the safety boundary is a constraint for the operation of the turbocharging system, i.e., the maximum allowable range of parameters under safe operating conditions, which is composed of the compressor surge line Surgeline, the line for the maximum temperature allowed by the turbine Trmax, the line for the maximum rotational speed allowed by the turbocharger nTCmax, the line for the minimum stable rotational speed of the engine nmin, and the line for the rated rotational speed of the engine ne, as shown in Figure 17.Figure 17
Relationship between the system operating state and safety boundary.In system safety analysis, every safety boundary in Figure17 can constrain a failure mode. Therefore, one can set the safety boundaries representing the constraints of the failure modes as ysmm=1,2,⋯,n and the work boundaries representing the system operating state as yomm=1,2,⋯,n, where in connection with every safety boundary ysm and work boundary yom, GE is the system limit state function corresponding to the safety margin of the work boundary for determining the failure mode. The safety margin of each work boundary can be expressed through a group of system limit state functions:
(2)GE=ysm−yomysm.WhenGE<0, the system is operating outside the safety boundary; that is, when operating in the unsafe area, the system is in an unsafe working state. When GE=0 or GE>0, the system is operating on the safety boundary or within the safe area and is in a safe working state. In addition, from the perspective of safety, it is usually better to have a greater safety margin, but increasing the safety margin requires sacrificing some performance and economic benefits. Although decreasing the safety margin can reduce costs, it may result in greater economic losses, which requires search of a better safety margin interval within the safety margin range. However, due to the inconsistent forms of expression of the safety margin in the existing research, the application of the margin is in the qualitative description stage. Therefore, equation (3) shows that when the working state of the system is safe, the value range of GE is 0,1. When GE=1, the system is operating far from the limiting value of the safety boundary, and the system safety allowance is at its maximum. When GE=0, the system is operating on the safety boundary, the system safety allowance is at its minimum, and potential safety hazards may exist. Therefore, to comprehensively consider safety, power performance, and economic requirements of the system, it is assumed that if the safety margin of the work boundary for the system under analysis is between 0.05 and 0.5 and the frequency of occurrence is concentrated in a better state of system operation, then a certain allowance exists in the work boundary and the safety boundary of system operation at this time, and the working state is safe.In addition, to further quantitatively analyze the failure probability of the system, the Monte Carlo method is used to simulate the failure probabilitypf of any failure mode, which can be expressed as
(3)pf=PGE<0=∫DffEdE.Then, the system safety indexβ can be expressed as
(4)β=ϕ−11−pf,where E=e1,e2,⋯,eiT is a random variable of n dimensions, i.e., the vector of the influencing factor; fE=fe1,e2,⋯,en is the joint probability density function of basic random variables; GE is the group of system limit state functions; Df is the failure area corresponding to GE; and ∅. is the cumulative probability under standard normal distribution.Therefore, the failure probability expressed using the Monte Carlo method is written as(5)p∧f=1N∑i=1NIGE∧i,where N is the number of samples and ‘∧’ is the sample value. Moreover, when GE∧i<0, IGE∧i=1; when GE∧i≥0, IGE∧i=0.In the subsequent analysis, the failure probabilities of the turbocharging system before and after the safety strategy is used can be obtained by equation (3).


#### 6.3.2. Probability Distribution Characteristics of the Influencing Factors

For the turbocharging system, the input variables are influencing factors that are considered to play a more important role in the work boundary changes of the system, i.e., the influencing factors determined in the analysis in Section5.2, including e1 to e5, whereas the output variables are the functions for judging the limit states of the system failure modes, i.e., the system limit state functions determined in the analysis in Section 5.2, including Y1 to Y4. The probability distribution characteristics and related parameters of each influencing factor involved in the sample points are shown in Table 5, where the parameter values are derived from expert experience or statistical data. Note that the distribution functions for the input variables (influencing factors) and the determination of related parameters directly decide the results of safety analysis. In an actual analysis, since there are many factors that affect system safety, the corresponding statistical characteristics would be more complicated.Table 5
Probability distribution characteristics and related parameters of influencing factors (normalized).
Influencing factorDistribution typeExpectationVarianceThrottle position,e1Normal distribution10.5Diameter of the wastegate,e2Normal distribution20.5Altitude,e3Normal distribution0.60.3Rotational speed of the engine,e4Normal distribution0.60.3Diameter of the exhaust pipe,e5Normal distribution20.5


#### 6.3.3. Analysis of Impact of the Safety Control Strategy on the Failure Probability of the Turbocharging System

The input variables are randomly sampled, and calculation is carried out by using the two-stage turbocharged engine model. Probability distribution characteristics and related parameters of each system limit state function are obtained from the statistical results. Figures18–21 show the probability distributions of the safety margin for the turbine inlet temperature, the safety margin for the turbine inlet temperature, the safety margin for the rotational speed of the turbocharger rotor, the compressor surge margin, and the safety margin for the maximum explosion pressure before and after the safety control strategy is used, respectively. Overall, the distribution of each safety margin is more scattered before the safety control strategy is used and is more concentrated after, with the safety margin distribution mostly concentrated within 0.02,0.2. For example, the distribution interval for the safety margin of the rotational speed of the turbocharger rotor is changed from −0.4,0.8 to −0.2,0.5. Note that the frequency of occurrence for the safety margin distribution is clearly reduced when GE<0, which illustrates that the safety level of the rotational speed of the turbocharger rotor is improved after the control strategy is used and that the system operating state is good. The other three aspects all exhibit similar trends. Besides, it should be noted that the internal lubrication of the turbocharger is also very important for the failure of the turbocharger. However, it is not considered here because it is associated with different and more complex engine-level system models, which will be studied in more depth in future research.Figure 18
Probability distribution of the safety margin for the turbine inlet temperatureY1.Figure 19
Probability distribution of the safety margin for the rotational speedY2.Figure 20
Probability distribution of the compressor surge marginY3.Figure 21
Probability distribution of the safety margin for the maximum explosion pressureY4.To further analyze the effect of the safety control strategy on the failure probability of each failure mode, the changes in the failure probabilities of each failure mode before and after the safety control strategy is used are given in Figure22. After the safety control strategy is used, the failure probability of the system limit state function GE corresponding to the safety margin of each work boundary is lower, where the largest decrease occurs in the failure probability of the failure mode for excess revolution of the turbocharger rotor. This illustrates that after the safety control strategy is used on the wastegate, the effect on the rotational speed of the turbocharge rotor is the most significant. When some of the exhaust is discharged through the wastegate, the exhaust flow through the turbine and the exhaust back pressure decrease, thereby preventing overshooting the rotational speed of the turbocharger. If a change is generated in the degree of opening of the corresponding wastegate, changing the exhaust volume and air pressure of the turbine achieves a different rotational speed of the turbocharger rotor, thereby affecting the turbocharging pressure of the compressor intake, and therefore, the effect on the compressor surge margin is more significant. Since the connection between the turbocharger and the engine is pneumatic, the lag in the response of the compressor makes the effect of the maximum explosion pressure of the engine weaker than those of the rotational speed of the turbocharger rotor and the compressor surge margin. The positive feedback characteristics reflected will ultimately be embodied in the probability changes in the safety margin of the turbine inlet temperature. Therefore, the above analysis shows that the safety control strategy used for the turbocharging system can improve the safety level, but the degree of the improvement in the safety level of different parameters is not the same.Figure 22
Comparison of the failure probability changes for each failure mode before and after the safety control strategy is used.


## 6.1. Determination of the Safety Control Strategies of the Turbocharging System

In regard to the regulation measures for the turbocharger, the simplest and most commonly used measure at present is bypass venting at the turbine end, where the wastegate driven by the motor through the actuator is its core component. Therefore, a wastegate control model is added to the original model to analyze the safety control strategies, as shown in Figure14.Figure 14
Safety control strategy with added wastegate control.


## 6.2. Analysis of the Role of Safety Control Strategies

In order to determine the degree of importance of other influencing factors after the safety control strategy is used, under the premise that types of influencing factors (e1-e5), initial simulation conditions, and work boundaries of the turbocharging system (Y1-Y4) are unchanged, classification of the influencing factors is achieved as follows. First, the response surface method is used to extract the surrogate model for the two-stage turbocharged engine system model after the safety control strategy is used. N sample points are randomly generated, and various corresponding work boundary values are generated through the surrogate model and then transformed into the safety margin of each work boundary required by the variable points in the correspondence analysis. Finally, correspondence analysis is carried out with the sample points and the variable points.Classification involves first extracting the column profile coordinateF corresponding to each variable point on the basis of the aforementioned correspondence analysis and then increasing the influencing factors e1-e5 by +5%, +10%, +20%, and +30% one by one in the same proportion, respectively. The new column profile coordinate Fi generated for each variable point is projected onto the same two-dimensional plane. Figure 15 shows the results after the increases.Figure 15
Relative position changes in the safety margin of the work boundary after the safety control strategy is used.
(a)
5% increase in parameters(b)
10% increase in parameters(c)
20% increase in parameters(d)
30% increase in parametersAs the degree of deviation of each influencing factor continues to increase, deviations generated bye3 and e4 have greater effects on the safety margin of each work boundary, but the effects of e1 and e5 are not significant. Using the +30% change as an example, the change in the distance between the relative positions of each column point on the two-dimensional scatter plot before and after the safety control strategy is used is given in Figure 16, where the deviation distances of the initial column points due to the change in each influencing factor can be further sorted to complete the reclassification.Figure 16
Comparison of the changes in the distance between the relative positions of each column point before and after using the safety control strategy.Figure16 shows that e3 has the greatest influence on the safety margin of each work boundary, making itself the most critical influencing factor in the new round. Because the effects on the safety margins of Y1 and Y3 are comparatively strong, e4 is still a key influencing factor. Therefore, e3 and e4 are determined to be the key factors in the new round. If the turbocharging system still cannot satisfy the system safety requirements after the safety control strategy is executed on e2, it is necessary to propose a corresponding safety control strategy for e3 in the subsequent safety analysis.


## 6.3. Verification Method for the Safety Analysis of the Turbocharging System

In the analysis described in the previous section, the two-stage turbocharged engine model is used as the object of analysis, and the classification and positioning of the influencing factors in terms of their effects on the failure modes are realized by introducing the improved correspondence analysis method. This determines the key influencing factors in the PSSA stage and ultimately yields the safety control strategy for the turbocharging system. However, whether the safety strategy can improve the safety level and quantification of the improvement is unknown. Therefore, in the SSA stage, to determine whether the analyzed turbocharging system model reaches the acceptable design safety level after the safety control strategy is used, the safety of this system is verified through the Monte Carlo method in this section. The Monte Carlo method is used to assess the failure probability of each failure mode, and the differences in the system failure modes and probabilities before and after using the safety control strategy are compared to explore the effectiveness of the safety control strategy.


### 6.3.1. Monte Carlo-Based Verification Method for Safety Analysis of the Turbocharging System

From Section4, the safety boundary is a constraint for the operation of the turbocharging system, i.e., the maximum allowable range of parameters under safe operating conditions, which is composed of the compressor surge line Surgeline, the line for the maximum temperature allowed by the turbine Trmax, the line for the maximum rotational speed allowed by the turbocharger nTCmax, the line for the minimum stable rotational speed of the engine nmin, and the line for the rated rotational speed of the engine ne, as shown in Figure 17.Figure 17
Relationship between the system operating state and safety boundary.In system safety analysis, every safety boundary in Figure17 can constrain a failure mode. Therefore, one can set the safety boundaries representing the constraints of the failure modes as ysmm=1,2,⋯,n and the work boundaries representing the system operating state as yomm=1,2,⋯,n, where in connection with every safety boundary ysm and work boundary yom, GE is the system limit state function corresponding to the safety margin of the work boundary for determining the failure mode. The safety margin of each work boundary can be expressed through a group of system limit state functions:
(2)GE=ysm−yomysm.WhenGE<0, the system is operating outside the safety boundary; that is, when operating in the unsafe area, the system is in an unsafe working state. When GE=0 or GE>0, the system is operating on the safety boundary or within the safe area and is in a safe working state. In addition, from the perspective of safety, it is usually better to have a greater safety margin, but increasing the safety margin requires sacrificing some performance and economic benefits. Although decreasing the safety margin can reduce costs, it may result in greater economic losses, which requires search of a better safety margin interval within the safety margin range. However, due to the inconsistent forms of expression of the safety margin in the existing research, the application of the margin is in the qualitative description stage. Therefore, equation (3) shows that when the working state of the system is safe, the value range of GE is 0,1. When GE=1, the system is operating far from the limiting value of the safety boundary, and the system safety allowance is at its maximum. When GE=0, the system is operating on the safety boundary, the system safety allowance is at its minimum, and potential safety hazards may exist. Therefore, to comprehensively consider safety, power performance, and economic requirements of the system, it is assumed that if the safety margin of the work boundary for the system under analysis is between 0.05 and 0.5 and the frequency of occurrence is concentrated in a better state of system operation, then a certain allowance exists in the work boundary and the safety boundary of system operation at this time, and the working state is safe.In addition, to further quantitatively analyze the failure probability of the system, the Monte Carlo method is used to simulate the failure probabilitypf of any failure mode, which can be expressed as
(3)pf=PGE<0=∫DffEdE.Then, the system safety indexβ can be expressed as
(4)β=ϕ−11−pf,where E=e1,e2,⋯,eiT is a random variable of n dimensions, i.e., the vector of the influencing factor; fE=fe1,e2,⋯,en is the joint probability density function of basic random variables; GE is the group of system limit state functions; Df is the failure area corresponding to GE; and ∅. is the cumulative probability under standard normal distribution.Therefore, the failure probability expressed using the Monte Carlo method is written as(5)p∧f=1N∑i=1NIGE∧i,where N is the number of samples and ‘∧’ is the sample value. Moreover, when GE∧i<0, IGE∧i=1; when GE∧i≥0, IGE∧i=0.In the subsequent analysis, the failure probabilities of the turbocharging system before and after the safety strategy is used can be obtained by equation (3).


### 6.3.2. Probability Distribution Characteristics of the Influencing Factors

For the turbocharging system, the input variables are influencing factors that are considered to play a more important role in the work boundary changes of the system, i.e., the influencing factors determined in the analysis in Section5.2, including e1 to e5, whereas the output variables are the functions for judging the limit states of the system failure modes, i.e., the system limit state functions determined in the analysis in Section 5.2, including Y1 to Y4. The probability distribution characteristics and related parameters of each influencing factor involved in the sample points are shown in Table 5, where the parameter values are derived from expert experience or statistical data. Note that the distribution functions for the input variables (influencing factors) and the determination of related parameters directly decide the results of safety analysis. In an actual analysis, since there are many factors that affect system safety, the corresponding statistical characteristics would be more complicated.Table 5
Probability distribution characteristics and related parameters of influencing factors (normalized).
Influencing factorDistribution typeExpectationVarianceThrottle position,e1Normal distribution10.5Diameter of the wastegate,e2Normal distribution20.5Altitude,e3Normal distribution0.60.3Rotational speed of the engine,e4Normal distribution0.60.3Diameter of the exhaust pipe,e5Normal distribution20.5


### 6.3.3. Analysis of Impact of the Safety Control Strategy on the Failure Probability of the Turbocharging System

The input variables are randomly sampled, and calculation is carried out by using the two-stage turbocharged engine model. Probability distribution characteristics and related parameters of each system limit state function are obtained from the statistical results. Figures18–21 show the probability distributions of the safety margin for the turbine inlet temperature, the safety margin for the turbine inlet temperature, the safety margin for the rotational speed of the turbocharger rotor, the compressor surge margin, and the safety margin for the maximum explosion pressure before and after the safety control strategy is used, respectively. Overall, the distribution of each safety margin is more scattered before the safety control strategy is used and is more concentrated after, with the safety margin distribution mostly concentrated within 0.02,0.2. For example, the distribution interval for the safety margin of the rotational speed of the turbocharger rotor is changed from −0.4,0.8 to −0.2,0.5. Note that the frequency of occurrence for the safety margin distribution is clearly reduced when GE<0, which illustrates that the safety level of the rotational speed of the turbocharger rotor is improved after the control strategy is used and that the system operating state is good. The other three aspects all exhibit similar trends. Besides, it should be noted that the internal lubrication of the turbocharger is also very important for the failure of the turbocharger. However, it is not considered here because it is associated with different and more complex engine-level system models, which will be studied in more depth in future research.Figure 18
Probability distribution of the safety margin for the turbine inlet temperatureY1.Figure 19
Probability distribution of the safety margin for the rotational speedY2.Figure 20
Probability distribution of the compressor surge marginY3.Figure 21
Probability distribution of the safety margin for the maximum explosion pressureY4.To further analyze the effect of the safety control strategy on the failure probability of each failure mode, the changes in the failure probabilities of each failure mode before and after the safety control strategy is used are given in Figure22. After the safety control strategy is used, the failure probability of the system limit state function GE corresponding to the safety margin of each work boundary is lower, where the largest decrease occurs in the failure probability of the failure mode for excess revolution of the turbocharger rotor. This illustrates that after the safety control strategy is used on the wastegate, the effect on the rotational speed of the turbocharge rotor is the most significant. When some of the exhaust is discharged through the wastegate, the exhaust flow through the turbine and the exhaust back pressure decrease, thereby preventing overshooting the rotational speed of the turbocharger. If a change is generated in the degree of opening of the corresponding wastegate, changing the exhaust volume and air pressure of the turbine achieves a different rotational speed of the turbocharger rotor, thereby affecting the turbocharging pressure of the compressor intake, and therefore, the effect on the compressor surge margin is more significant. Since the connection between the turbocharger and the engine is pneumatic, the lag in the response of the compressor makes the effect of the maximum explosion pressure of the engine weaker than those of the rotational speed of the turbocharger rotor and the compressor surge margin. The positive feedback characteristics reflected will ultimately be embodied in the probability changes in the safety margin of the turbine inlet temperature. Therefore, the above analysis shows that the safety control strategy used for the turbocharging system can improve the safety level, but the degree of the improvement in the safety level of different parameters is not the same.Figure 22
Comparison of the failure probability changes for each failure mode before and after the safety control strategy is used.


## 6.3.1. Monte Carlo-Based Verification Method for Safety Analysis of the Turbocharging System

From Section4, the safety boundary is a constraint for the operation of the turbocharging system, i.e., the maximum allowable range of parameters under safe operating conditions, which is composed of the compressor surge line Surgeline, the line for the maximum temperature allowed by the turbine Trmax, the line for the maximum rotational speed allowed by the turbocharger nTCmax, the line for the minimum stable rotational speed of the engine nmin, and the line for the rated rotational speed of the engine ne, as shown in Figure 17.Figure 17
Relationship between the system operating state and safety boundary.In system safety analysis, every safety boundary in Figure17 can constrain a failure mode. Therefore, one can set the safety boundaries representing the constraints of the failure modes as ysmm=1,2,⋯,n and the work boundaries representing the system operating state as yomm=1,2,⋯,n, where in connection with every safety boundary ysm and work boundary yom, GE is the system limit state function corresponding to the safety margin of the work boundary for determining the failure mode. The safety margin of each work boundary can be expressed through a group of system limit state functions:
(2)GE=ysm−yomysm.WhenGE<0, the system is operating outside the safety boundary; that is, when operating in the unsafe area, the system is in an unsafe working state. When GE=0 or GE>0, the system is operating on the safety boundary or within the safe area and is in a safe working state. In addition, from the perspective of safety, it is usually better to have a greater safety margin, but increasing the safety margin requires sacrificing some performance and economic benefits. Although decreasing the safety margin can reduce costs, it may result in greater economic losses, which requires search of a better safety margin interval within the safety margin range. However, due to the inconsistent forms of expression of the safety margin in the existing research, the application of the margin is in the qualitative description stage. Therefore, equation (3) shows that when the working state of the system is safe, the value range of GE is 0,1. When GE=1, the system is operating far from the limiting value of the safety boundary, and the system safety allowance is at its maximum. When GE=0, the system is operating on the safety boundary, the system safety allowance is at its minimum, and potential safety hazards may exist. Therefore, to comprehensively consider safety, power performance, and economic requirements of the system, it is assumed that if the safety margin of the work boundary for the system under analysis is between 0.05 and 0.5 and the frequency of occurrence is concentrated in a better state of system operation, then a certain allowance exists in the work boundary and the safety boundary of system operation at this time, and the working state is safe.In addition, to further quantitatively analyze the failure probability of the system, the Monte Carlo method is used to simulate the failure probabilitypf of any failure mode, which can be expressed as
(3)pf=PGE<0=∫DffEdE.Then, the system safety indexβ can be expressed as
(4)β=ϕ−11−pf,where E=e1,e2,⋯,eiT is a random variable of n dimensions, i.e., the vector of the influencing factor; fE=fe1,e2,⋯,en is the joint probability density function of basic random variables; GE is the group of system limit state functions; Df is the failure area corresponding to GE; and ∅. is the cumulative probability under standard normal distribution.Therefore, the failure probability expressed using the Monte Carlo method is written as(5)p∧f=1N∑i=1NIGE∧i,where N is the number of samples and ‘∧’ is the sample value. Moreover, when GE∧i<0, IGE∧i=1; when GE∧i≥0, IGE∧i=0.In the subsequent analysis, the failure probabilities of the turbocharging system before and after the safety strategy is used can be obtained by equation (3).


## 6.3.2. Probability Distribution Characteristics of the Influencing Factors

For the turbocharging system, the input variables are influencing factors that are considered to play a more important role in the work boundary changes of the system, i.e., the influencing factors determined in the analysis in Section5.2, including e1 to e5, whereas the output variables are the functions for judging the limit states of the system failure modes, i.e., the system limit state functions determined in the analysis in Section 5.2, including Y1 to Y4. The probability distribution characteristics and related parameters of each influencing factor involved in the sample points are shown in Table 5, where the parameter values are derived from expert experience or statistical data. Note that the distribution functions for the input variables (influencing factors) and the determination of related parameters directly decide the results of safety analysis. In an actual analysis, since there are many factors that affect system safety, the corresponding statistical characteristics would be more complicated.Table 5
Probability distribution characteristics and related parameters of influencing factors (normalized).
Influencing factorDistribution typeExpectationVarianceThrottle position,e1Normal distribution10.5Diameter of the wastegate,e2Normal distribution20.5Altitude,e3Normal distribution0.60.3Rotational speed of the engine,e4Normal distribution0.60.3Diameter of the exhaust pipe,e5Normal distribution20.5


## 6.3.3. Analysis of Impact of the Safety Control Strategy on the Failure Probability of the Turbocharging System

The input variables are randomly sampled, and calculation is carried out by using the two-stage turbocharged engine model. Probability distribution characteristics and related parameters of each system limit state function are obtained from the statistical results. Figures18–21 show the probability distributions of the safety margin for the turbine inlet temperature, the safety margin for the turbine inlet temperature, the safety margin for the rotational speed of the turbocharger rotor, the compressor surge margin, and the safety margin for the maximum explosion pressure before and after the safety control strategy is used, respectively. Overall, the distribution of each safety margin is more scattered before the safety control strategy is used and is more concentrated after, with the safety margin distribution mostly concentrated within 0.02,0.2. For example, the distribution interval for the safety margin of the rotational speed of the turbocharger rotor is changed from −0.4,0.8 to −0.2,0.5. Note that the frequency of occurrence for the safety margin distribution is clearly reduced when GE<0, which illustrates that the safety level of the rotational speed of the turbocharger rotor is improved after the control strategy is used and that the system operating state is good. The other three aspects all exhibit similar trends. Besides, it should be noted that the internal lubrication of the turbocharger is also very important for the failure of the turbocharger. However, it is not considered here because it is associated with different and more complex engine-level system models, which will be studied in more depth in future research.Figure 18
Probability distribution of the safety margin for the turbine inlet temperatureY1.Figure 19
Probability distribution of the safety margin for the rotational speedY2.Figure 20
Probability distribution of the compressor surge marginY3.Figure 21
Probability distribution of the safety margin for the maximum explosion pressureY4.To further analyze the effect of the safety control strategy on the failure probability of each failure mode, the changes in the failure probabilities of each failure mode before and after the safety control strategy is used are given in Figure22. After the safety control strategy is used, the failure probability of the system limit state function GE corresponding to the safety margin of each work boundary is lower, where the largest decrease occurs in the failure probability of the failure mode for excess revolution of the turbocharger rotor. This illustrates that after the safety control strategy is used on the wastegate, the effect on the rotational speed of the turbocharge rotor is the most significant. When some of the exhaust is discharged through the wastegate, the exhaust flow through the turbine and the exhaust back pressure decrease, thereby preventing overshooting the rotational speed of the turbocharger. If a change is generated in the degree of opening of the corresponding wastegate, changing the exhaust volume and air pressure of the turbine achieves a different rotational speed of the turbocharger rotor, thereby affecting the turbocharging pressure of the compressor intake, and therefore, the effect on the compressor surge margin is more significant. Since the connection between the turbocharger and the engine is pneumatic, the lag in the response of the compressor makes the effect of the maximum explosion pressure of the engine weaker than those of the rotational speed of the turbocharger rotor and the compressor surge margin. The positive feedback characteristics reflected will ultimately be embodied in the probability changes in the safety margin of the turbine inlet temperature. Therefore, the above analysis shows that the safety control strategy used for the turbocharging system can improve the safety level, but the degree of the improvement in the safety level of different parameters is not the same.Figure 22
Comparison of the failure probability changes for each failure mode before and after the safety control strategy is used.


## 7. Conclusion

Starting from the general aircraft safety problems caused by the failure of the aviation piston engine turbocharging system and limitations of traditional safety analysis methods regarding complex matching and coupling safety problems, this paper incorporates a model-based system safety analysis method into the safety analysis of a turbocharging system, with the goal of forging a whole set of analytical processes and methods that accurately identify the key influencing factors of the failures. Safety control strategies are accordingly proposed and verified. The research results are summarized as follows.(1)
The model-based system safety processes and methods can handle the complex coupling failure problems of turbocharging. The key components include establishment of the system model, description method for the work boundaries and safety boundaries of the failure modes, classification method for the key influencing factors of the failure modes, and proposal and verification of safety control strategies(2)
On the basis of the established two-stage turbocharged engine model, the response surface method is used first to abstract the surrogate model from the analysis model and to determine the relationship between the influencing factors (controllable design parameters) and the work boundaries. The surrogate model is randomly sampled to generate the basic data required for correspondence analysis and to improve the correspondence analysis method, forming a classification method based on changes in the column profile coordinateF with the numerical deviations of the influencing factors. This determines the degree of criticality of these influencing factors to the safety of the turbocharging system and realizes eventual classification of the key influencing factors. The results show that the diameter of the wastegate e2 is the most important factor affecting the safety margin of each work boundary(3)
By adjusting the diameter of the wastegatee2 in the safety control strategy, the distribution of the safety margin can be more concentrated and the failure probability is decreased. After implementation of the safety control strategy, the distribution interval of the safety margin for the turbine inlet temperature, rotational speed, compressor surge margin, and maximum explosion pressure is decreased from −0.06,0.32, −0.4,0.8, −0.8,1.3, and −0.24,0.9 to −0.02,0.18, −0.2,0.5, −0.35,1.2, and −0.1,0.58, respectively



---

*Source: 9710515-2021-09-17.xml*