Home

Appendix to 9490 User Manual

1. Sada 3 arit Lc i a 29 30 31 32 33 34 35 36 37 38 9 40 41 42 43 Walters G F and McCall J A The Development of Metrics for Software R amp M Annual Keliability and Maintainability Symposium Proceedings IEEE 1978 Anderson P G Redundancy Techniques for Software Quality Annual Reliability and Maintainability Symposium Proceedings 1978 White B B Program Standards Help Software Maintainability Annual Reliability and Maintainability Symposium Proceedings 1978 Masreliez C J Bjurman B E Fault Tolerant System Reliability Modeling Analysis Of Airborne Advanced Reconfigurable Computer System for Flight Control Guidance and Control Conference Proceedings August 16 18 1976 Hendrick R C Electronics Plus Fluidics for V STOL Flight Control Proceedings of the Navy NASA V STOL Flying Qualities August 1977 Leonard J B Fluidic Backup Flight Control Why How aad Impact on Specs and Prime System Flight Control Systems Criteria Symposium Naval Postgraduate School July 1978 Deets D A Design and Development Experience with a Digital Fly By Wire Control System in an F 8C Airplane National Aeronautics and Space Administration 1976 Lock W P Peterson W R Whitman G B Mechanization of and Experience with a Triplex Fly By Wire Backup Control System National Aeronautics and Space Administration 1976 Miller N
2. ADA094717 n fad ILE C A E mr ta goa hi 09 AFFDL TR 74 116 Sup 1 APPENDIX TO BACKGROUND INFORMATION AND USER GUIDE FOR MIL F 9490D AFFDL TR 74 116 JOHN F MOYNES NORTHROP CORPORATION AIRCRAFT GROUP 3901 WEST BROADWAY HAWTHORNE GA 90250 JANUARY 1980 TECHNICAL REPORT AFFDL TR 74 116 SUP 1 Final Report Juiy 1979 January 1980 Approved for public release distribution unlimited AIR FORCE FLIGHT DYNAMICS LABORATORY AIR FORCE WRIGHT AERONAUTICAL LABORATORIES AIR FORCE SYSTEMS COMMAND WRIGHT PATTERSON AIR FORCE BASE OHIO 45433 dac ari lan DA E E O ee eile hos ee ADOS CHI n D ST ET See gt ui n z i a ati E mic e ET EE A URN ili E ci SD ai Er E ue devo ye cir Mr SEN AAA DD i tia y NOTICE When Government drawings specifications or other data are used or any purpose other than in connection with a definitely relatea Governmei i pro curement operation the United States Governmnet thereby incurs no responsibility nor any obligation whatsoever and the fact that the government may have formulated furnished or in any way supplied the said drawings specifications or other data is not to be regarded by implication or otherwise as in any manner licensing the holder or any other person or corporation or conveying any rights or permission to manufacture use or sell any patented invention that may in any way be related thereto mu This report h
3. Amendments to the ruality assurance requirements provide a thorough and comprehensive documentation of FCS design requirements in particular software documentation and test requirements relative to system development and performance verification as influenced by aircraft type and FCS concept For some requirements there were no amendments However User Guide discussions were expanded in an effort to incorporate recent experiences and current thinking In some cases such as stability margins and survivability the amendment modifies the emphasis of the requirement rather than making a quantitative change In others such as reliability and system test and monitoring amendments were felt to be either undesirable given the general ity of the specification or out of scope given the size of the contract effort o cane iie M i a y ce e nodi A aS Ri A APPENDIX A Appendix in support of Amendment 1 to MIL F 9490D and Background Information and User Guide for MIL F 9490D 7 Soe ts EE wie or ef cuf XD LISTO tt IE antc YU EL CERE eer PANE Em EE a 2 i TABLE OF CONTENTS j Page 2 APPLICABLE DOCUMENTS 4 1 esso 4o es Mae ov s ow l5 3 2 1 Mu DNE MEE 3 2 9 0th amp x publicdtions ceg vox mom x nane 5 3s REQUIREMENTS AN Mo e we vow Se a do ET i 3 1 2 AFCS Performance requirements e e e s 17 3 1 2 2 Heading hold so ware a we we oe ew wo woe 17 3 1 2 3 Heading
4. aw PRECEDING PAGE BLANK NOT FILMED 4 e E A a Arar Al be A AN NI CINE NS ste i I s PS lut lA AA ta nl Lau Un LP Oa os pav cui uL oo ath Dai See O Aer E e ar eut tie vert tuas m X X Se e Ger A d Mor sare MMA AA Ce e ee A g s aY an Sa ETE COSA C ut Ho p cite IA gg ts CS S LS a ME TA AE QUT Discussion The applications of the documents which have been added to this section are addressed in the discussicns of the appropriate amended requirements of sections 3 and 4 and addition of defiritions in Para 6 6 hus di ET A ESR ze TE s menger aca CERN zm D 2 M ASAS E PE s Ear MEE a Kr ya en anm a Meme pee Ure IT 3 REQUIREMENTS 3 1 2 AFCS performance requirements Line l Before the first sentence insert Fngage and disengage selection logic and functional safety criteria and limits for each AFCS function shall be established and specified in the detail flight control specification Discussion The intent of this amendment is to highlight the need for AFCS require ments to be tailored to each particular procurement activity thereby allowing flexibility and freedom in AFCS design 3 1 2 2 Heading hold Line 4 Delete the last sentence and substitute When heading hold is engaged the aircraft shall roll towards wings level The reference heading shall be that heading that exists when the aircraft passes through a roll
5. Discussion This paragraph covers only general requirements for VOR and TACAN navigation modes and definition of terms Specific requirements for inertial navigation area navigation or vertical navigation control are not included in this specification since these requirements will depend on the aircraft mission Normally these requirements will be included in the procurement detailed specification when such functions are required Requirements for a microwave landing system MLS approach mode have not been included at this time because of the lack of definitive information on MLS ground facilities and contingent approach procedures 3 1 2 8 1 VOR TACAN Discussion The VOR and TACAN overshoot and tracking accuracy requirements are stated in terms of angular error with respect to the selected radial Thus the allowable error automatically decreases with decreasing distance to the station The TACAN requirements are more stringent than those for VOR reflecting the improved performance that should be achieved through use of the TACAN range information The tracking accuracy requirements are stated in terms of RMS errors over a defined distance from the station that is far enough removed to be out of the geometric sensitive area All distances are given in terms of nautical miles to be compatible with Air Traffic Control data format The overstation requirements allow for resetting the capture logic if it is found
6. to a landing the following performance shall be provided when uny lateral directional AFCS function is engaged Discussion Delibezately induced sideslip maneuvers such as those which might be used during coupled autoland modes are excluded from this requirement The acceleration and sideslip limits as previously defined did not account for deliberate sideslip maneuvers Autoland implementations and the advent of control configured vehicles require that these limits not be applied during deliberate side slip or side force maneuvers 3 1 2 4 1 Coordination in steady banked turns Line 1 Delete the first sentence and substitute The incremental sideslip angle shall not exceed eS ii ES e ST SET 2 degrees from the trimmed value and lateral acceleration shall not exceed 0 03g while at steady bank angles up to the maneuver bank angle limit reached during normal maneuvers with the AFCS engaged 3 1 2 4 2 Lateral acceleration limits rosling Line 2 Delete aircraft with and substitute flight condition with aircraft line 3 Delete aircraft with and substitute flight condition with aircraft line 4 Delete aircraft with and s s itute flight condition with aircraft Discussion This change recognizes that an aircraft s roll rate capability will vary within the aircraft s flight envelope and as roll rate capability varies so will the required lateral acceleration limits For example if an aircraft with a
7. 0 0 ene o e 3 1 10 2 2 2 Provision for portable test equipment software ee se ww o wee 0 4 Maintenance personnel safety provisions 0 5 Software maintenance and verifiability Pilot controls and displays ss Pilot controls for CTCL aircraft 5 Trim switches ee ee 2 8 Normal disengagement means el FCS annunciation ess 2 2 e e e 9 s o e pg e 2 e e o 2 Failure status e 0 3 Control authority annunciation General requirements e o Rigging Provisions 000 0 0 0 o Control Cable e PPP 2 Fairleads and rubbing strips oe eee Wire Terminations e s 0 e Multiplexing eass we we wo rn Interchangeablity e a e 0 0 0 0 we Electrical signal computation 1 Analog computation s e es e es sea 2 Digital computation e e e e a 2 1 Memory protection s sss 2 2 Program scaling es 0 0 oo 2 3 e NE 3 Software support e seseo Computational input output growth capability e o o o n 1 2 Invulnerability to lightning strikes ind static ep o o gt e sa e 3 2 6 Actuation e e e ene e oe aver e 3 2 7 3 2 Mi croelectronics ees D D D e D 3 2 7 3 3 Bu n in 9 9 e o o Denotes requirements which are discussed but for which changes
8. 57 APT DEM MART MERE TRUE mop te enhn need is particularly evident with the advent of multi role aircraft such as the F 18 It has been stated that maintenance can account for more than 50 percent of the life cycle costs of software These costs include both the correction of software errors and changes necessary for system improvement and adaptation Because of the significance of software maintenance costs it is important that the software maintenance procedures be well thought out and not only safe but efficient Some of the inputs tasks and outputs relative to software maintenance are listed in Table 1 from reference 40 TABLE 1 SOFTWARE MAINTENANCE IM eee NM IS pe Ee ge ee NCMO Inputs Tasks Outputs l Software documentation Develop a plan for Revised software software maintenance documentation Software code Review change control Revised software Test procedures procedures for field use Software maintenance Change control procedures Define requalification plan change proce procedures Idures and retestingl plans During the initial phases of the F 18 full scale development program software changes were first made in a core memory program and flown on the flight simulator and Iron Bird Upon satisfactory demonstration PROM s were burned for incorporation in flight units Prior to use in flight these PROM s were
9. It is generally agreed chat 6 db gain and 45 degrees phase margin are adequate aud may even be conserv qur NEP ative once all aerodynamic and aeroelastic characteristics are well known Te be E egen E ie eR rat Z nt A and other concerns such as residual oscillations and hardware wear effects X are satisfied For initial flights of an aircraft type larger margins are NG i desirable as recommended in reference 23 This recommendation is largely based on actual test experience revealing lower than predicted stability margins due to prediction inaccuracies in aerodynamic or aeroelastic charac i teristics sampling effects in digital implementation and jump resonance type non linearity attributed to actuator rate saturation The requirement TE ceti e aime A Pc o we A A EN 39 y E H A n D k Y M 5 p pU y t E y allows the necessary latitude to consider each weapon system on an individual basis thus insuring its applicability to future procurements 3 1 3 7 Operation in turbulence Delete the entire paragraph and substitute the following The FCS must be capable of operating while flying in the following applicable random and discrete turbulence environments The dynamic analysis or other means used to satisfy this requirement shall include the effects of rigid body motion significant flexible degrees of freedom and the flight control system The effect of the turbul
10. e oM n Een A A AAA AAA IA cdd er Juni i Lit tee ca INTRODUCTION This report is the second of two documents prepared in fulfillment of the Air Force contract for the update of MIL F 9490D the general specifica tion for the design test and installation of flight control systems for piloted aircraft The objective of this contract effort was to incorporate through an amendment to the specification and supporting user information up to date requirements and information necessary for more efficient system acquisition This report provides User Guide information and substantiating background material in support of the first document Amendment 1 to MIL F 9490D MIL F 9490D is scheduled to be converted into MIL Prime SPEC format in 1982 However results of a validation rogram conducted under contract by Northrop Corporation with Lockheed Georgia Company as subcontractor and the release of pertinent new data have indicated that an updated amendment would aid in the preparation of the revision and increase the usefulness of the specification until the new revision is available MERE I er PIO EA ad a il LU A AA E A ea o ai es omata im VE o cl A dt A A AAA D D D EK SCOPE In this program only existing flight control system data was to be used in the substantiation of new specification requirements Pecommenda tions and background information were to be
11. external store configuration throughout the operational envelope and during ground operations i 3 1 3 6 2 Sensitivity analysis Line 6 After the first sentence insert the following In addition these tolerances shall also include normally anticipated uncertainties in predicted aerodynamic characteristics aeroelastic effects and structural modes For digital flight control systems the 37 E nite stai o EE c ee ETS tolerances established shall specifically include the effects of sampling rates input and output filters digital filter implementation and integration technique Discussion The modification to the stability requirement paragraphs reflects the experience gained in recent aircraft development programs in the areas of flight control structural dynamics interaction and digital flight control implementation This experience highlighted the need for a comprehensive analytical approach couplementing the test verification process to provide the required stability margins Inherent to the success of the analytical approach is the comprehensive ness of the model used in the analysis Overly simplistic models although valuable in visualizing trends may lead to optimistic predictions as pointed out in the related discussion of reference 46 The analysis model must provide a valid representation of the airframe structural dynamics and control sys
12. E et al Backup Flight Control Design Procedures to Increase Survivability of Aircraft Report NADC 76192 30 Volume III September 1976 Moynes J F and Nelson W E Jr Flaperon Control The Versatile Surface for Fighter Aircraft AGARD Fluid Dynamics Panel Symposium CP 262 May 1979 Report No FAA RE 79 6 FAA Florida Institute of Technology Workshop on Grounding and Lightning Technology March 6 8 1979 Rang E R et al Digital Flight Control Software Validation Study AFFDL TR 79 3076 June 1979 Kisslinger R L et al Design and Development of the Digital Flight Contro System for the F i8 AIAA IEEE 3rd Digital Avionics Systems Conference Noveno r 1979 General D amics Preliminary Draft Computer Program Development Specification for the AFTI F 16 Flight Control System Operational Flight Program Spec20ZC001 CDRL 1022 2 September 1979 Gallagher J T and Saworotnow I Experience with Digital Flight Control Systems AIAA 76 1914 August 16 18 1976 83 en 6 T ___ zum d 1 b RS e de DES a Y de h d 1 Ri hi MEUS E o ta 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 Cunningham T et al Fault Tolerant Digital Flight Control with Analytical Redundancy AFFDL TR 77 25 May 1977 Scott M Electrical Flight Con
13. F 16 system to date With the ability to overcome the problems of electrical power loss comes the potential for the next step in dissimilar backup the use of dissim lar backup software Here the concept of dissimilar software does not imply the approach used on the Concorde SST program which was very complex and costly Rather it involves a simplified constant gain software program resident in each computer which provides the minimum required control capability of either FCS Operation State IV or State V as required The potential for this approach has been discussed in reference 6 and demonstrated in work performed on the F 8DFBW program Although never flown a dissimilar software program and additional 51 DH ARRS Nal pay adis afus enrio Uk Hu dis Mo Vegte pe io ti TEE N RIEL ITE ue U JE e strie Sta SR E CO ar ente e Vitae gk Mm gt enn mapa Pre e anni t be lo Keng hardware were implemented on the F 8 When the new hardware detected a sim ultaneous fault in all computational channels it was assumed to be a software error and computation reverted to the backup program This testing was performed by programming some typical software errors into the operational light program In the implementation of dissimilar backup control systems a frequent problem 1s the synchronization of the two systems The goal is to minimize the transients in the transfer from one system to the other As in the F 18 there must be a capabilit
14. The F A 18A flight control system utilizes quadruplex digital computation direct electrical links and a mechanical bac up system in pl ch and roll The leading and trailing edge flaps and horizuptal rolling tull have quad E TL redundant servovalves and the rudders and aileron surfaces have a dual dual elect ical capability All actuators have access to two separate hydraulic systems The digital flight contro computers and the electrical system overall have a two fail operate capability Hydromechanically the system has at least a fail operate capability For the performance of redundancy management the F A 18 inflight monitoring AS ARA ug is very comprehensive In addition to thorough computer self test the system hi 1 has two voting planes Through a cross channel data link the first evaluates the input signals to the flight control computers where failed signals are ignored and the remaining good signals are averaged 34 i _ _ _ ___ lt _ nm 7 The second conceptual voting plane pertains to the actuator quad coil drive current summing concept To evaluate the status of actuators and actu ator signals the redundancy management employs differential pressure sensing to evaluate the EHV cross CAS monitoring to evaluate CAS ram main ram and input signals aad a current monitor to check servoamplifiers and EHV coils The current
15. and evaluation Significant phase lags attributed to sampling effects were found in the actual system relative to earlier linear simulation results with an attendant degradation in limit cycle SIE TILT ITEMS LETI E Be Gm stability characteristics By their nature digital systems also incorporate numerous linear filter stages such as aliasing filters smoothing filters and sample hold characteristics that are not required in analog systems and need to be accounted for in any simulation of digital systems In addition to exploring some of the impacts of digital flight control implementation reference 24 documents one of the most extensive ground test programs ever performed on an aircraft and provides a valuable guide toward A ur wr SO Se E 7 a planning a test program for a muiti loop highly complex control system 4 4 1 Flight control system development plan Under line 26 Add the following h Where applicable a computer program development plan CPDP to define how the flight software is to be developed documented controlled and verified including specific documentation stages as they relate to computer hardware design and overall flight control system development and verification AFR 800 14 shall be used for guidance in the development of the CPDP Discussion The minimum list of elements to be included in the flight control system development plan is quite extensive but none of
16. attitude that is wings level plus or minus a tolerance Discussion It may be arguable that a heading hold accuracy of 40 5 degrees does not appreciably enhance mission effectiveneas or aircraft operational efficiency over an accuracy of 1 0 degree for the heading hold mode Since however the state of the art now allows realization of the more stringent requirement without undue penalty in cost the requirement is considered valid The 5 degree RMS heading deviation requirement for operation in light tur ulence is desirable This prevents design of an easily saturable mode while not restricting the functional design of the overall AFCS reference 1l If a flight controller is used when the controller is returned to detent the aircraft shall roll towards wings level the reference heading shall be that heading that exists when the aircraft passes through a roll attitude that is wings level plus or minus a tolerance nv a eed la maker m ROUTER tn itn een S pP e wt i The equirement states that heading hold shall automatically engage as the controller is returned to the detent The use of the word as makes his confusing The word when is proper in this case A majority of the aircraft use the detent position as the logic for going to the heading hold mode reference l For initial engagement of heading hold or subsequeat return to heading hold from control stick
17. away from the runway threshold during capture The system shall be considered to be in the tracking mode whenever the following conditions are satisfied Localizer beam error is 1 degree 75pa or less localizer beam rate is 0 025deg sec 2ua sec or less During beam tracking the system shall exhibit a damping ratio of 0 2 or greater From the outer marker to an altitude of 300 feet above runway elevation on the approach path the AFCS shall maintain the aircraft 2 sigma position within 0 47 degrees 35ua of the localizer beam center On the approach path from 300 feet above runway elevation to the decision altitude of 100 feet the AFCS shall maintain the aircraft 2 sigma position wstnin 0 33 degrees 254a The performance during the tracking mode shall be free of sustained oscillations These enmeta A 6 criteria shall be hased on a Category II localizer ground installation Discussion It is felt tbat the requirements of this paragraph are too stringent and do not provide maximum designer freedom while retaining required flight safety The overshoot requirement of 0 5 degrees 37 5 microamperes radial error is very tight and could require a special design such as a variable gain pD M M 1 system for a requirement that is not critical The point at which the beam capture is initiated should be specified It is felt that 150 microamperes is the best point to start beam capture This requiremen
18. be initiated 9 Check data address and control lines by reading out of memory data patterns of zeroes and ones stored in predetermined locations 10 Memory sum checks for those portions of memory containing constants and instructions The sum check requires more execution time than can be used immediately following computer start up 11 Sample problems to check the CPU designed to exercise the instructions used to solve the control laws 12 An arithmetic fault interrupt to sense overflows 13 Parity to monitor continuously the transmission of data over the I O channels When bad parity is detected an interrupt will be initiated When a choice exists between the implementation of hardware or software to perform monitoring tasks the use of software is preferred since hardware results in a higher channel failure rate due to additional parts and con sequently regults in a higher probability of loss of control For any fligl t control system utilizing inflight monitoring there are A two aspects which currently have no requirement in the specification but which require consideration The first addresses the allowable frequency of nuisance disconnects and false alurms and the second is concerned with the recording of failures and transient failures which occur during flight During the flight testing of the YF 17 and the DIGITAC programs numerous nuisance disconnects were encountered in the early phases of each
19. field interactions not adequately verified in flight Line 6 Change operational envelope to permissable flight envelope per MIL F 8785 li Line 6 After the first sentence insert Such supplementary j means shall provide control power for a specified duration Lees 21 0 dal adi Lue E d c Lo A ane dile cod meta O Led a a dia oma 2d Mal ui cei Discussion The purpose of these amendments is to give the requirement the explicit coverage and definition it is meant to have The effect of airframe inlet flowfield interactions on engine performance is a critical area which should be differentiated from airframe aerodynamics In support of more efficient systems acquisition the second amendment establishes the need for a definite time relative to the accomplishment of the survivability requirement i 3 1 9 2 Invulnerability to lightning strikes and static atmospheric electricity Discussion i i In the User Guide discussion of this requirement the concluding paragraph oo states Reference 85 Final Draft Aerospace Recommended Practice Lightning Effects Tests on Aerospace Vehicles and Hardware prepared by SAE Committee AE4 Special Task F 1 May 1974 provides a definitive comprehensive guide to lightning simulation and verification testing of aerospace vehicles This document has wide general acceptance and is expected to be formalized in 1975 To date this document has not been
20. from the TACAN radial beam center RMS tracking error shall be measured over a 10 minute period between 100 and 10 nautical miles from the station or averaged over the nominal aircraft flight time between the same distance limits whichever time is shorter The required 0 3 damping ratio shall be exhibited for continuous tracking between 100 and 10 nautical miles from the station Discussion The TACAN capture and tracking requirements were translated to angular measure and the required tracking accuracy defined The requirement as compared with VOR tracking accuracy requireuents reflects the improved accuracy chat can be achieved through use of the range information 3 1 2 8 1 3 Overstation Line 3 At the end of the first sentence remove the period and insert in a no wind condition Discussion The overstation mode requirements for VOR and TACAN defined in this paragraph include provisions for resetting the beam capture logic One of the more common complaints from military and commercial pilots relates to M limited capture performance for the outbound radial Generally these com pla nts have occurred because the AFCS remains in a tracking mode during station overflight Consequently outbound captures are hampered by extremely limited bank angles etc designed to ensure good tracking performance 1 Future configurations should provide ror more favorable outbound c
21. he used for proportional trim subject to approval by the procuring agency Discussion The additions of MIL S 3950 and MIL S 6743 provide for coverage of trim switches which are not included in MIL G 25561 and MIL S 9419 The reference to trim knobs is added in recognition of their widespread use for proportional trim 59 1 Mh ac rn An un kuer Pad A A c LL A lia i puram cti AA Lua Obs n Nier ev n 3 2 1 1 8 Normal disengagement means Delete the entire paragraph and sub stitute Means for disengagement of all AFCS and non critical MFCS modes shall be provided which are compatible with the requirements of 3 1 9 6 Disengagement capability for flight phase essential FCS modes shall require approval by the procuring agency Discussion To assure consistency with the requirements of 3 1 3 2 this requirenent should apply not only to AFCS modes but also to all non critical and flight phase essential FCS modes The reference made to compatibility with the requirements of 3 1 9 6 does not provide adequate safeguards relative to disengagement capability for flight phase essential modes so specific approval by the procuring agency should be required For the F 18 flight test aircraft there are means for CAS disengagement of the MFCS in three separate axes pitch roll and yaw These provisions allow the evaluation of degraded modes This disengage capability is not includ
22. its survivability discussion the User Guide predicted a requirement for a standby flight control capability will also exist in future aircraft 4 equipped with active redundant fly by wire control systems i In light of the F 16 it is apparent that this prediction did not come to pass However with qualification it was and still is a good prediction i While the analog F 16 fly by wire control system does not have a standby flight control capability or more to the point a dissimilar backup system by being quadruplex it does have one more computational channel than analysis would predict necessary While dissimilar backup systems may not be required tor analog fly by wire cortrul systems at this time it appears very likely they will be required for all digital fiy by wire control system applications The question to be SH AAA en A AE A A en rem cicci iii mg d resolved however is what constitutes a dissimilar backup system The concern j on this subject is this What if a glitch in the software leads to a sim A ultaneous multiple redundant channel drop ou 50 e e A E HOSA Fio EV aoa a m ssh papi ITA TARA MIGONE gii Sii gie To provide a dissimilar backup capability both hydromechanical and fluidic signal computation techniques have been studied and employed For the F 15 a dual electronic control augmentation system was utilized with an active mechanical control system In the
23. levels of nonlinear characteristics or instabilities Discussion The need for adequate growth capability and proper scaling is as real for analog computers as for digital The inclusion of these amendments makes the requirements for analog computetion parallel the existing requirements for digital computation AA i l Eu Sf aua tns de E E Hou tei tb ghee Nr alid HO nut sy aat aV iae ce oH Ce HR are a o ssi ot eot LL AL EDO H d di d bo 1 Y h A d DES RS M pss EE T REI E E Kei One of the improvements of the F 16 aircraft resulting from the YF 16 ex perience was a rescaling of the roll stick inputs The benefits of this im provement were more desirable roll response adequate stability margins and prevention of pilot induced oscillations during power BppPRoRGh a 3 2 4 3 2 Digital computation Line 1 Insert as the first sentence Redundant signal computation in particular redundancy management shall be implemented as required by the flight safety and failure immunity and invul nerability requirements specified herein to prevent propagation of failures across channels Line 4 Delete Resident and bulk and substitute Program and workspace Discussion As discussed in the redundancy management section it is necessary to prevent the cross channel propagation of failures One apprcach has been the use of fiber optics for multiplexed cross channel communication Employed on the YC 14
24. modifications piloted simulations can be performed to find any major or critical problems before beginning flight tests To date this approach has been successfully implemented in the F 18 program In the application of piloted simulation to the evaluation of the FCS development it is paramount particularly for fighter aircraft that the Simulation go beyond l g flight The simulation must address critical areas such as high angle of attack PIO and landing tasks and areas where the aerodynamics are uncertain such as departure In view of the potential importance of motion cues in evaluating handling characteristics and failure effects in these critical areas a portion of the piloted simulation for highly maneuverable aircraft may need to be conducted on a motion based simulator 4 3 1 2 Acceptance tests Line 2 After the first sentence add Where interfacing components of the FCS are procured from various sources sufficient acceptance testing shall be performed to ensure overall system performance repeatability Discussion With the advent of comprehensive built in test and inflight monitoring in modern aircraft the potential for interface problems between FCS components exists as a result of the levels of sensitivity within the components This requirement serves to insure proper integration during the development phase and to establish the allowable tolerances of interfacing components This interface problem is typified f
25. the ele ments of airborne equipment and more generally includes the ground bas d equipment ne essary fcr completion of an all weather landing All weather landings comprise the operations and procedures required to conduct approaches and landings during Category II anc III visibility conditions defined by the International Civil Aviation Organization No ia 0o rot v adii dl STET ER BERN A E LER CM C d x p vi A 2 diii men cet E Li Ma Dari aam oa niii at TR a IRR RE o Rat III n i Mee This definition states that an ALS ineludes all aircraft equipment ground based equipment operations and procedures over some of which the contractor has no authority or control Since this specification is intended to cover the design installation and test of flight control systems by establishing general performance design development and quality assurance requirements for the flight control systems the requirement for an automatic landing system as defined is believed to be beyond the scope of this specifi cation The majo ity of the performance requirements stated in the require ments however are pertinent to an automatic landing mode It is recognized that the procuring agency has the need to exercise its prerogatives for ground and flight procedures and equipment and for weather minimums for which the aircraft should be cleared The contractor must satisfy the requirements insofar as he is able within the limitations imp
26. then evaluated with the flight simulator and Iron Bird 3 2 1 Pilot controls and displays Line 5 After with insert the appli cable provisions of MIL C 81774 and 1 Discussion MIL C 81774 is the general specification for aircraft control panels and as such is applicable to FCS design It must therefore be referenced in this requirement 3 2 1 1 Pilot controls for CTOL aircraft Line 4 Delete Strict adherence to the prescribed location and maximum range of motion of these controls is required Discussion The reclining angle of the pilot s seat impacts on the validity of dimen sions specified in DH 2 2 SN 1 1 and makes comparisons more academic than practical The application of control concepts such as force feel side arm primary hand controllers dual controls etc will make it additionally diffi cult to formalize cockpit arrangement dimensions Dimensions applicable to cockpit arrangement of controls should be included in the design specification as exemplary of recormended values to serve as a guide Locating dimensions and range of travel of flight controls would be established by mockup and a basic dimension control drawing subject to approval by the procuring agency 3 2 1 1 5 Trim switches Line 1 Change the title to Trim controls Line 5 Delete MIL S 9419 and substitute MIL S 9419 MIL S 3950 or MIL S 6743 Line 5 After the last sentence add Knob type trim controls may
27. used approximately 73 percent of the total memory available a final design aspect of the digital software was modulariza tion to permit partitioning of the original programming task This allowed i the debugging and validation of the software changes to be greatly simplified during the flight test evaluation It also permitted software changes to be accomplished more easily and in less time A further discussion of this con cept and a description of the modules identified as computer program compo nents can be found in reference 5 In both the space shuttle and F 18 programs the impact of transport lags has been felt While transport lags are not attributable to digital computa tion alone the implementation of digital computation plays a critical role in both the creation and the solution of transport lag problems It is of interest to note that in the F 18 flight control system develop ment the preliminary design was based on a continuous system For this system the design goal for all control loops was a gain margin of at least 10 db and a phase margin of at least 45 degrees 3 2 4 5 2 1 Memory protection 3 2 4 3 2 2 Program scaling Discussion As discussed in the system test and monitoring section there is a need T LSP for nonvolatile memory which can record in flight failures transient failures a i a rra cs i i E a ar n LAN rin a en it rc IA init and system status This memory must he protected in a way t
28. we wo ew wo ow 30 4 3 1 3 1 1 Redundancy management e e s e e es oee 31 1 3 1 3 3 4 Failure transients se see 36 3 1 3 6 1 Stability margins e es eso eee eee 37 d 3 1 3 6 2 Sensitivity analysis e ee 0 0 0 e 1 37 i 3 1 3 7 Operation in turbulence ess esos oo 40 i 3 1 3 7 1 Random turbulence e e e ees oses os o Al 3 1 3 9 System test and monitoring provisions 41 Denotes requirements v hich are discussed but for which no changes are recommended 9 4 rr M M a t 7 77 xt k d or S GL a do i aia encase saleable zs IZ i n i pu f PAR PO cuum t Y L i h A j 3 1 A AR mE CO GO CO CO WWW WW Gc CO CO L L Y CO L CO LI CO LI La CO TABLE OF CONTENTS continued Mission accomplishment reliability Quantitative flight safety ea 0 e All engines out control ate ee 3 1 6 3 1 7 3 1 8 Survivability s s ee we eee wee 3 1 8 3 1 9 atmospheric electricity 0 se 3 1 9 4 Invulnerability to onboard failures of other systems and equipment e 0 e o e eo 9 5 Invulnerability to maintenance error 9 5 1 invulnerability to software maintenance ETOF e o celle amp 9 1 9 9 o m ws 3 1 10 Maintenance provisions s ees e 3 1 10 2 1 Use of cockpit instrumentation 3 1 10 2 2 1 Provision for portable test equipment growth e e
29. wheel steering or flight controller commanded bank angle the selection of the reference heading is not made until two criteria are satisfied 1 heading hold is selected and 2 the roll attitude is approximately wings level This dual criterion ensures that the aircraft will not be forced to make an appreciable turn in the opposite direction in order to capture a heading that existed while the aircraft was in a turn and heading hold was engaged 3 1 2 3 Heuding select Line 7 After the fourth sentence insert Entry into and exit from the turn shall be smooth and rapid Discussion The imposition of limits on roll rate and roll acceleration when maneuvering to the new heading estab ishes an upper limit for the rates and accelerations but does not address a minimum acceptable The requirement for smooth and rapid assures that minimum rates as well as maximum will be acceptable The roll rate and acceleration upper limits are specified to preclude an overly rapid response The requirement for smooth and rapid roll in and roll out of the turn is stated to ensure that the response is not unduly siuggish reference 1 3 1 2 4 Lateral acceleration and sideslip limits Line 1 Delete the first sentence and substitute Except for flight phases using direct side force control or during which sideslip is del berately induced e g forward slip 18 7 n o S el if ur coa e MER i ne a PRA i e nn A R T CM
30. would depend on the aircraft and mission requirements If such a mode is required then this requirement with the provision that autopilot steering commands are displayed on the flight director would be relevant for present and future aircraft 3 1 2 9 3 2 Lateral heading AFCS go around performance standards Line 3 After planes insert defined in FAA Advisory Circular 120 29 Discussion This requirement is valid for present and future aircraft with a change The first sentence should be changed to include reference to the FAA Advisory Circular 120 29 which is implied It should be noted that the performance requiremert of the last sentence is completely dependent on pilot reaction and performance and is not an operational performance requirement on the AFCS It does affect the system design of the automatic go around mode in the area of failure announcement and affect of failures or disengagement of the mode on the aircraft flight path No change is suggested in this area 3 1 2 9 3 3 Minimum go around altitude Discussion The requirement is valid for present and future aircraft with the understanding that it assumes that all aircraft will require a minimum alti tude for engaging the go around mode The C 5A and C 141 flight testing has shown that minimum altitude for these aircraft is the runway alt tude 27 pr NM SA UTE M AAA EPA d PEN TIER es 3 1 2 10 All weath
31. 1 Delete For programmable computers a software and substitute A software SS I Line l Insert as the first three sentences For programmable computers system software shall be developed and controlled in accordance 1 with specifications prepared by the contractor and approved by the AF in accordance with MIL STD 490 and as supplemented by MIL STD 483 Definition of the software development plan shali be contained in the computer program development plan CPDP outlined in requirement 4 4 1 of this specification This software will constitute the operational flight program OFP portion of the Computer Program Configuration Item CPCI A Line 7 At the end of the last sentence change the period NM to a comma and add and shall encompass the software maintenance requirement Zelo 10 5 Discussion The title of this section was modified to reflect the fact that software for digital computation requires both development and support and that the two are complementary The reference to MIL STD 490 and MIL STD 483 places this specification in compliance with those specifications as required by AF procedures The in clusion of this requirement was endorsed in the Digital Flight Control Software Validation study and implemented in the AFTI program The software development plan establishes the actions and procedures that will be followed during the software development cycle The plan also describes Umm the phasin
32. 4 116 Background Information and User Guide for MIL F 9490D In addition to substantiating background for the amended requirements the document provides additional user guide information for interpretation and use of the specification The bulk of this report addresses the interrelated topics of digital l 1 1 4 i 1 i i 1 DII e gie Sn DL i O ae Ld iiA ERRARE o DO 152593 1473 EDITION oF NOV 65 IS OBSOLETE SECURITY CLASSIFICATION OF THIS PAGE When Data Entered finto gt E E DEE SE xd ET EENS E EE LP LA x x S ry init Dn i TR a E ET to At ee o ruaas aiat L K aS AUT SECURITY CLASSIFICATI N GF THIS PAGE When Data Entered 20 Cont d flight controls fly by wire controls and self test and monitoring These topics are addressed in many requirement areas Of particular note are the additions of a redundancy management requirement and discussion which were absent in the D revision and the integration of software requirements for FCS design and documentation into the specification _ SECURITY CLASSIFICATION OF Yu PAGE When Data Entered d paruum pw La ci n e ili da E Sail i ir ie iana a it i i LAM me e E ioni en Wl A EE E TE DET EE EES OPINION REP TTT CES PREFACE This techrical report was prepared by Northrop Corporation Aircraft Group Hawthorne California for the Flight Dynamics Laboratory under
33. 743 Switches Sensitive and Push Snap Action Actuators and Enclosures General Specifica tion for Under line 91 MIL M 38510 insert MIL S 52779 Software Quality Assurance Requireuents and MIL C 81774 Control Panel Aircraft General Requirement for Under line 103 the Selection of insert MIL STD 203 Aircrew Station Controls and Displays for Fixed Wing Aircraft Under line 111 ments for Equipment insert MIL STD 471A Maintainability Verification Demonstration Evaluation Under line 113 and Waivers insert MIL STD 483 Configura tion Management Practices for Systems Equipment Munitions and Computer Programs and MIL STD 490 Specification Practices and MIL STD 499 Engineer ing Management Under l ne 119 Equipment and Facilities insert MIL STD 1521 Technical Reviews and Audits for Systems Equipment and Computer Programs Under line 115 of insert MIL STD 781 Reliability Design Qualification and Production Acceptance Tests Exponential Distribution Under l ne 147 AFSC DH 2 2 insert the following heading A ci et EE E EH and publication title Air Force Regulations Document AFR 800 14 Vol I Management of Computer Resources in Systens Vol II Acquisition and Support Procedures for Computer Resources in Systems i 2 2 Other publications Line 20 Change the heading to FAA Advisory Circulara
34. 90 deg sec maximum roll rate capability can only roll at 30 deg sec in some portion of the envelope then at that condition the tolerance chould be 0 1g not 0 5g 3 1 2 4 3 Coordination in straight and level flight Line l Delete the first sentence and substitute The accuracy while the aircraft is in straight and level flight shall be maintained with an incremental sideslip angle of 1 degree from the trimmed value or a lateral acceleration of 0 02g at the Cg whichever is lower Discussion n order to account for steady state trimmed sideslip angles which are required to support vehicle and store asymmetries the requirement has been changed from absolute to incremental values of sideslip and lateral acceleration Vehicle asymmetries especially those caused by asymmetric stores will require a steady state sideslip angle to balance the unsymmetrical aerodynamic forces Non zero bank angles may also be required to support steady state trim Under these conditions 1t is necessary to replace the absolute sideslip angle restriction with incremental sideslip from unaccelerated flight reference sideslip values 3 1 2 6 Mach hold Line 1 Before the first sentence insert The re quirements of this paragraph shall be met in straight steady flight including climb or descent Line 7 After the last sentence add Ad justment capability of at least 40 01 Mach shall be available to allow the pilot to vary the refere
35. Air Force Contract F33615 79 C 3617 This report covers work performed between July 1979 and January 1980 The principal investigator and author of this report was John F Moynes d of the Flight Control Developmeat organization Alex Dobos Bubno of Flight f Control Development served as the lead technical advisor and W H Faulkner of Flight Control Research was the chief coordinator The author woul like i to acknowledge the contributions of E E Schulze Jr W E Nelson Jr 1 and J L Lockenour to this program Thomas D Lewis AFWAL FIGL the project manager for this effort was supported by a committee consisting of Robert Woodcock AFWAL FIGC and John Davison AFWAL FIGL and Richard Kammerer and Rush Spradley of Aeronautical System Division ASD ENFTC pric TS te Unit er Tuniipioni ton E Mo came cn AA Accession Tor wets GUASI W I O ce dome tec INTRODUCTION SCOPE esas SUMMARY OF RESULTS APPENDIX A REFERENCES ITA RATA IRA SET SE Geng ET Eege TABLE OF CONTENTS on wu ws AAA M i ei TUE etum eee tere VU TIU ae ea LIST OF ILLUSTRATIONS Figure Page i Software development process 48 2 Software configuration control 49 3 Exarple of software system development 69 LIST OF TABLES Page Table 1 Software maintenance sas eses n 58 E EP ee r
36. August 1975 Wilde W C F 16 Flight Control Design Analysis Report General Dynamics 16PR276A CDRL A01W 22 November 1976 Damman Lawerence et al Flight Test Development and Evaluation of a Multimode Digital Flight Control System Implemented in an A 7D Digitac Volume I AFFTC TR 76 15 June 1976 Szalai K J et al Digital Fly By Wire Flight Control Validation Experience Charles Draper Laboratory R 1164 prepared for NASA Workshop on Advanced Flight Control Program Experience at NASA DFRC June 1978 Hynes R J et al Feasibilitv Study of a Minimum Redundancy Fail Operational Digital Flight Control System Technical Report NADC 76 134 30 July 1977 Westermeier T F In Line Monitoring of Digital Flight Control Computers NAECON 78 Proceedings of the National Aerospace and Electronics Conference May 16 18 1978 Volume I 1978 pp 62 69 Bjurman B E et al Airborne Advanced Reconfigurable Computer System ARCS Boeing Commercial Aircraft Company Seattle N76 30865 August 1976 Emfinger J E ACT System Design for Reliability Maintainability and Redundancy Management Society of Automative Engineers National Aerospace Engineering and Manuracturing Meeting 751052 November 17 20 1975 Rice Jimmy W and McCorkle Richard D Digital Flight Control Reliability Effects of Redundancy Level Architecture and Redundancy Management Technique AIAA 79 1893 1979 Livingston E C Fly By Wir
37. E 9490pg AFFDL TR 74 116 her ERLE E UMBER s PER e y Le ci d vi TEROTHOR 2 Ny ws John F Moynes i 1 eege 7 ADDRESS 10 PROGRAM ELEMENT PROJECT TASK i 9 PERFORMING ORGANIZATION NAME AND AREA WORK UNIT NUM BERS Northrop Corporation Aircraft Group 3901 West Broadway SCH 2493 02 55 lv Hawthorne CA 90250 T CONTROLLING OFFICE NAME AND ADDRESS 12 RERORT DATE Flight Dynamics Laboratory FIGL if Januery 1980 Air Force Wright Aeronautical Laboratories 13 NUMBER OF PAGES un n E Wright Patterson Air Force Base Ohio 45433 4 MONITORING AGENCY NAME A ADDRESS iI different from Controlling Oflice FE a ee 15 SECURITY CLASS SI thia report Unclassified 15a DECL ASSIFICATION DOWNGRADING SCHEOULE 16 DISTRIBUTION STATEMENT of this Report Approved for public release distribution unlimited 17 DISTRIBUTION STATEMENT of the abatract entered in Block 20 if ditlerent trom Report Ein E E G ES acl s fa 18 SUPPLEMENTARY NOTES 19 KEY WORDS Continue on reverse side l necessary and identify by block number Specifications Flight Contro Systems Requirements l ABSTRACT Continus on reverse aide If necessary and Identify by block number 7 This document is in support of Amendment 1 of Military Specification MIL F 9490D Flight Control Systems Design Installation and Test of Piloted Aircraft General Specification For and AFFDL TR 7
38. INST a ROLLI at aas SONVWHOdH3d WILSAS NOILWVOIJIOSdS WILSAS NOILVOI3IOS34S WVuDOHd WalSAS HILNIROD AHVNOIIOIQ viva SLHVHO DNIWIL NCILVZINVONO AHOWUW SISYL NDISIO INIHOHNVHISH hour can then be believable The actual value of the number can be significant in this circumstance A change iu this number can change the number of i redundant channels required Numerical analysis may have Little or no value in proving that the prob i ability of failure is low due to other failures such as design errors common me failures and generic software errors These classes of faults i may be the most likely A number like 1079 may not be valuable as a legalistic uumber that must be proven with pounds of paper It may be valuable as a i positive goal toward which everyone strives For commercial aircraft the number 107 seews to be reasonable It is likely that if advanced electronic flight control systems can offer even some d of the advantages claimed for them they will be used on virtually all aircraft for at least a generation If it is assumed that an aircraft generation is at pu Pe least 15 years and with at least 6 X 10 commercial aircraft flight hours per year in the U S alone a total of at least 108 System operating hours can be assumed The number 1079 thus means that the probability of a catastrophe due to a system failure is l in 10 3 1 8 Survivability Discussion In
39. SE EE et if al Das ais paragraph which specifically addresses provisions for software maintenance error 3 1 9 5 After this paragraph add the following as a new paragraph 3 1 9 5 1 Invulnerability to software maintenance error For systems utilizing digital computation means for identification of the operational LIA c dia s a adi Dali cl flight program shall be provided and procedures shall be established to prohibit the implementation of unintended versions of software in the flight control system Discussion For systems which utilize digital computation particular care must be given to software maintenance because of its complexity and importance for proper FCS operation The best expression of the need for the requirement is in the 3 1 9 5 User Guide discussion This requirement is especially taa Dre EA A AS important with the increasing complexity of flight control systems and com ponents wn ch tend to increase the potential for serious maladjustment through maintenance error To this end means for identification and procedures for implementation need to be mandatory to provide invulnerability to software error Note that requirements addressing software maintenance provisions are specified in paragraph 3 1 10 5 3 1 10 Maintenance provisions Line 4 Delete facilitate the accomplishment of all required and substitute permit the accomplishment within the allocated AT A PRA E maintenan
40. The second requirement insures that all software developed relative to ni c iai it A EE rin AP the flight control system is addressed through this specification in order M to obtain efficient consistent and well documented software implementation 1 3 1 10 4 Maintenance personnel safety provisions After this paragraph add h the following as a new paragraph 3 1 10 5 Software maintenance and verifiability Any modification to system i software shall be evaluated prior to implementation on an aircraft in accordance N with the appropriate procedures of analysis inspection and test defined in the quality assurance section of this specification To aid in software maintenance safety and reliability each Programmable Read Only Memory PROM shall reserve one word or more to serve in identification of the software version and operational flight program OFP portion contained within the PROM Discussion Similar to other maintenance requirements of 3 1 10 this requirement addresses an area requiring particular attention Because of the importance of software maintenance in the development and operational modification of a digital flight control system there is a need for established service procedures to insure flight safety In addition once service has been performed provisions are necessary for efficient verification that the proper version of software has been implemented Thic
41. alid contribution For example numerical analysis can be used to compute the probability of system failure in a redundant system due to random component failure Random component failure rates are large enough to be demonstrated in practice The mathematical techniques for combining these failure rates are also well established Numerical analysis showing a system failure rate of 10 9 per bo a pra a ES E T REP icf ju Aa A c BAR T s R ito O Seta ra Ese bes A el E Mater sede Pete een tns ed Ge dd Ee EVA ISIL NOIIYINZRNIOG NOITYINIWNIOA dAOHddWV LSZ dOOT sd ATH ads NOIIVOIJINSA NOI IVINIRTIZNI INIHI IODA HILSAS NOISAC wWSLSAS TAVALIOS qisw3 13H NVid ISIL NOIIVOIAIH3A X4100H EVE A NS SE Ie A BA ON ssao01d 4ueudo sAep DAPAJJOS SHVMLJOS Ga ONddV ISIL FONELIIIIY ETIERISSY 3009 32HDOS NOITWDIIIDIAS FIINWITTIOY I eanbrid ISIL 48 SININIFINOIA TYNOILIGGY LIGU SMY OYLNODO NOIXIVOIJIOH S SMS3IASNH n a ciens rni Hen s Ea m ET QR I EE PT EP E ERR roll et PES Lh WWE DONA IVNIZ XIHLVW ALITIGWAOWUL INIWIZIOVIA ONILSIL NOILYINWNIOA JO NMOG dOL 3SV3 I3H Twwuod SHOnOHHIL N IVM TIUNLINYLS SIIN MITAIY ONIANVIDOY A CEINLINZILS TO13U09 UOTIRANSTJUOS SIPMIJOS soads ZFONWWICIZIA FITYMLIOS y NOILVOIJIOS3aS TINdOW ATADO TULNIHOD SININIZINOIA NOILWZITWILINI VLVG eg NOILITEISIA SAIIVHHVN NOILONAJI asodand Z S
42. ance or the F 12 flight control system reliability is the mission recording system Each essential parameter of the various vehicle subsystems is monitored for use in a magnetic tape recorder For the design of preflight BIT and maintenance BIT consideration needs to be given to the time desired for the performance of these tasks system the estimated time to perform a built in test which functioned for 1 In a definition study for an advanced fighter digital flight control both preflight and maintenance was gi BIT with hydraulics 20 seconds triplex 29 seconds quadruplex BIT without hydraulics w 10 seconds While these times appear to be very desirable and one day attainable up to this time no aircraft preflight or maintenance BIT has come close In the NASA F 8 Digital FBW Program the F 8 flight time preflight BIT took approximately 40 minutes for all checks about 5 minutes of which was attributed to digital systems tests It was felt however that the plane was over tested prior to flight 9 20 For the F A 18A the Navy hae set the times of 1 minute for preflight BIT and 2 minutes for maintenance BT as the desired BIT performance times Currently the preflight BIT or as they term it Initiated BIT for this air craft takes 8 minutes to complete and the maintenance BIT takes even longer it should be noted that these times are expected to be reduced significantly However this result s
43. apture 4 e ee eee cw e performance by development of more comprehensive control laws or providing capture logic reset as a function of station overflight wos 3 1 2 9 Automatic instrument low approach system Line l Change the title to Automatic approach system ILS Discussion This change denotes that the 3 1 2 9 subparagrapns are applicable to only ILS systems 3 1 2 9 1 Localizer mode Delete the entire paragraph and substitute the following The AFCS shall maintain a constant heading until the aircraft is within 150 microamperes of the beam center at which point the aircraft vill be maneuvered to capture the localizer beam Heading or roll rate and attitude mmr commands shall be limited to provide a smooth capture and subsequent tracking ot the localizer beam The niticl overshoot during capture shall not ym tos EN i ie A ES dee N 3 onerat Zb x i mine Aui da ia saa os ge SS radicali e MUTET De y n LUDERE ue T TA E SZ uA HE ef e exceed 75 microamperes and the system shall exhibit a damping ratio of at least 0 1 with intercent angles of 45 degrees at 8 miles frow runway threshold and increasing linearly to 60 degrees at 18 miles from runway threshold in a A bie i Gen adi eco IT E AA A E ini no wind condition For intercept angles less than 45 degrees the FCS shall always maneuver the aircraft toward the course centerline There shall be no movement
44. as been reviewed by the Office of Public Affairs ASD PA and 4 is releasable to the National Technical Information Service NTIS At NTIS it will be available to the general public including foreign nations tI APRITE TT FIS a TTT we 2 d lt ii This technical report has been reviewed and is approved for publication THOMAS D LEWIS EVARD H FLINN Chief Project Engineer Control Systems Development Branch Flight Control Division a cen ii ri ict E e ril e tti ee Te E FOR COMMANDER ROBERT C ETTINGER Cof USAF Chief Flight Control Division e e i list or if the addressee is no longer employed by your organization please notify AFWAL FIGL W PAFB OH 45433 to help us maintain a current mailing list If your address has changed if you wish to be removed from cur mailing PATATA er Copies of this report should not be returned unless return is required by security considerations contractual obligazions or notice on a specific document AIR FORCE 56780 9 January 1981 400 SECURITY sWASSIFIC ATION OF THIS FAGE When Date Entered Eege a READ INSTRUCTIONS BEFORE COMPLETING FORM Ss L QL JREPORT DOCUMENTATION PAGE UT T 2 GOVT ACCESSION NO 3 RECIPIENT S CATALOG NUMBER f La g V8 Varrorffra 74 orbugurrto ND Hoty 77 CAI REPORT amp PERIOD COVERED Final ente ns vo 4 TITLE and Syftit APPENDIX N Q BACKGROUND INFORMATION AND SER GUIDE FOR Me
45. ation of acceptable probability of coverage values for first and second failures are the mission reliability and flight safety requirements of paragraphs 3 1 6 and 3 1 7 When assured adequate reliability and safety other influencing factors are the tradeoffs between system complexity weight and cost 32 see e uM cues eec ee ie eer sb seni sla In the development of redundant flight control systems to satisfy the flight safety requirements there have been as many different approaches as there have been types of aircraft The DIGITAC aircraft a modified A 7D containing dual digital computers references 5 and 6 is designed to be fail safe for all failures and fail cperation fail safe for failures in the computer and memory units The fail operation fail safe capability of the dual computers and memories was achieved by extensive self test and the fail safe function of the servos and sensors was made possible by comparison monitoring of dual servos and sensors for all flight critical parameters Through computer monitoring the interfacing units were fail safe Development problems uncovered by this program are contributing to future designs One example is the problem of interaction between self test routines In one instance a power supply problem caused one computer to fail An unforeseen timing situation in the self test of the cross computer data link caused the good computer to shut itself off This problem was correct
46. ations of aircraft and airborne equipment configurations Discussion This requirement is valid for present and future aircraft except for the title All weather landing system This should be changed to Automatic landing system See the evaluation on requirement 3 1 2 10 3 1 2 10 2 Performance standards ground based equipment variations Delete the entire paragraph and substitute the following Proof of compliance with performance requirements for automatic landing systems shall include the effects of expected variation in type and quality of the ground based equipment Discussion This requ rement includes areas that should not be included in a flight control system specification such as touchdown zone lighting and taxi zones Only flight control requirements that the aircraft manufacturer is responsible for should be included in this specification to insure that compliance with requirements can be demonstrated This same subject is discussed in the evaluation of requirement 3 1 2 10 This requirement should include the expected variatiou of the ILS beam that should be considered during design and evaluation 3 1 3 1 Redundancy Discussion In support of the redundancy discussion in the User Guide formal defi nitions of the terms fail operate fail passive and fail safe have been included as an update to the Definitions paragraph 6 6 In a discussion of the survivability requirements of 3 1 8 the topic of dissim
47. based on existing data and require no additional study and analysis programs Because of the short duration of the contract it was necessary to identify and limit the potential areas for revision or discussion early only areas of significant impact were to be considered The following is a list of the areas identified in coordination with the Air Force Update Panel b d Co d 3 d e f 8 h Vigital flight controls requirements relative to redundancy manage ment data transmission microprocessor applications and software verification validation Fly by wire controls requirements relative to electrical design signal transmission actuation failure management and immunity to associated subsystem failures Self test capability requirements versus complexity confidence level and preflight test duration Cockpit controls displays design requirements to accommodate high g cockpit geometry constraints and integrated displays Actuation requirements to reflect the application of high performance rotary mechanical actuators and electromechanical actuators to essential or flight phase essential functions Controls structure interaction and integration requirements relative to analysis and test verification Simulation requirements relative to system development and perfor mance verification as influenced by type of aircraft and flight control system concept Compatibility between the update amendment and the new revi
48. c aircraft and its warning system and natural cues These are the seme factors for consideration in 9490 Transients due to failures are also discussed in the Characteristics of the Primary Flight Control System section paragraph 3 5 5 1 of 8785C This is where load factor roll rate etc response limits are stated j The objective in both specifications is to assure crew acceptance and flight safety Therefore the same quantitative limits are used in each specification 9490D was closely aligned with the Operational State III after failure condition which required the transients not to exceed 75 percent of limit load factor or 1 5 g s from the initial value whichever was less For most aircraft of course the 1 5g was the governing requirement and this was significantly more restrictive than che structural limit allowed cem suae RO ci MEER ni i a rl At by 8785 However one must consider that even l 5g s might be excessive especially at low speed close to the ground For that reason both specifications require that no flight path deviations be encountered from which recovery is impossible 3 1 3 6 1 Stability margins Line 15 Delete the last sentence and substi tute the following The margins specified by Table III shall apply regardless of system implementation analog or digital and shall be maintained under flight conditions of most adverse center of gravity mass distribution and A arma
49. ce budget and personnel skill leve of all required organizational and intermediate level 55 e ee Line 7 Change overhaul to repair Line 7 After the last sentence add In addition the design shall employ provisions to facilitate efficient overhaul and perfor mance verification at the depot level Discussion Ease of maintenance has always been a desired objective but was usually relegated to secondary importance relative to such prime design considerations as volume weight and unit cost This practice resulted in weapon systems with excessive down time maintenance hours per flight hour and spares requirements With increasingly more complex systems coming into the inventory this situation has worsened acutely To reverse this trend maintainability considerations are now receiving prime emphasis and are expressed as firm quantitative requirements with a suitable plan for demonstration of complAance Such quantitative requirements are Maintenance Man Hour Per Flight Hour MMH FH and Mean Time Between Actions MTBA for organizational level and Mean Time to Repair MITR for intermediate level and are established in consideration of the overall aircraft maintenance budget Achievement of these numerical objectives and demonstration of compliance involves units systems dedicated to maintainability development and demonstration To reflect this trend and in recognition of the direct relationship be
50. croelectronics Delete the entire paragraph and substitute Microelectronic devices conforming to the provisions of MIL M 38510 and available from qualified sources shall be used in preference to other similar devices Discussion The use of specially designed and newly developed microelectronic devices in the YF 17 flight control el ctronics was necessary to achieve the minimal size weight and power design objectives for these electronic assemblies If the selection of devices had been limited to microcircuits qualified to MIL M 38510 severe size weight and power penalties wovld have resulted and possibly some compromises in functional performance The time span required to qualify a micrcelectronic device to MIL M 38510 is so long and the evolution of microcircuit technology is so rapid that often by the time a particular device is qualified it is obsolete The unamended requirement limits the Air Force in its application of state of the art technology The amended requirement provides an opportunity for flexibility in the implementation of microelectronics for future aircraft procurement and con forms with the recommendation in the User Guide which states The use of microelectronic chnology should be considered in the design of all systems equipment An ol tive appraisal of all factors concerning the system equip ment design should ve made with the view of maximizing reliability and mini mizing total cost of ownership weig
51. ctor reserve capacity It serves to oid a bottleneck in signal transmission This parallels requirements in the AFTI F 16 Development and Integration Program in which a 20 percent growth capability is specified for analog and digital input and output signals 3 2 6 Actuation Discussion While the state of the art for actuation has progressed since the speci fication and User Guide were irsued the actuation requirements appear quite sufficient with little need for amendments References 52 53 54 55 56 and 57 provide a cross section of some of the work which has been done since that time The topics frciude design objectives for improved actuation direct drive control valves electrical actuation concepts and 8000 psi hydraulic control systems Reference 57 is 68 rane ENTM NOVO TUE SO CO a ER TIR NIST tt ICT SET RE E d 3ueudo sAep ueis S 318M3JOS jo o duexq fi ved d E eangSrq HSONVNALNIVW MT CS tat WILSAS in NOILVOIJIJINSO WILSAS ONILSAL WNILSAS ONILSSL IIVMLIOS 69 A009 NI NOILWINSWNITANI TAVMLIOS ININIZINOOCIA MYT IONLNOO N975S430 ATHVMLJOS NOILINIiGSG LNSNSHIDO ZXH IUYML I0S NOILVOIJ3JIOddS T mm er e 3 an Aic Force Technical Memorandum which addresses the general design cri teria for hydraulic power operated aircraft flight control actuators 3 2 7 3 2 Mi
52. d subsequent failure Fail passive The capability of the FCS to automatically disconnect and to revert to a passive state following a failure Allowable failure transient or out of trim condition is to be within the limits as established for the particular procurement Fail safe The capability of the FCS in a single channel mode of operation to revert to a safe state following an automatic disconnect in the event of a failure or pilot initiated disconnect Safe state may be achieved by authority limiting and positive removal of actuation motive power The allowable authority limits need to be established to provide the desired performance objectives and in consideration oi structural design limits and safe recovery characteristics Discussion Refer to the 3 1 3 1 paragraph discussion in this document i aiea e a SR ZARE aba E A aio E 10 11 12 REFERENCES Hylton Ralph J Kettering Charles W and Valery Harold A Validation of MIL F 9490D General Specification for Flight Control System for Piloted Military Aircraft Volume III C 5A Heavy Logistics Transport Validation AFFDL TR 77 7 Volume III April 1977 General Dynamics Preliminary Draft Computer Program Development Specification for the AFTI F 16 Control System Operational Flight Program Specification Number 20ZC001 CDRL 1022 2 September 1979 General Dynamics F 16 Flight Control System F16 00 8 Volume 8 12
53. dy limit cycle and ground structural rescnance stability depend ng on the relative confidence in the predicted aerodynamic aeroelastic and structural mode characteristics Paragraph e is auded in concert with the recommendations of references 21 and 58 Reference 58 documents the extensive ground vibration testing and analysis correlation effort conducted on the YF 16 under a research contract METTE TEMA SRS cm to improve test methodology on fighter aircraft with active controls This effort led to the conclusion that the mathenatical model used in aeroservo elastic stability analysis can be and must be validated or improved by GVT with active controls Paragraph f is added to reflect the recommendation of reference 21 This requirement does not add to the set of tests already performed prior to first flight but increases the utility of the taxi test to provide addi tional confidence relative to servoelastic stability The random inputs dur ing taxi provide excitation of the structural modes and evoke control system responses similar to those in the low speed flight environment In view of the recent experiences with the YF 16 and YF 17 aircraft air craft ground tests however extensive can no longer be considered adequate to insure stability in flight for state of the art structures and flight control designs Analysis ground tests and flight test evaluation are mandatory to achieve this end However the u
54. e Flight Control System Design Considerations for Fighter Aircraft SAE National Aerospace Engineering and Manufacturing Meeting November 1975 d EE eps adt Za ai DAD ae cia l alii ea a PRES tt rix bend tle bat care ania FINUM EE HE Deli D a ma ee ic e ta arda n eem me 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Yechout Capt T R and Oelschlaeger D R Digitac Multimode Flight Control Syst AIAA Paper No 75 1085 August 20 22 1975 Hooker D S et al Definition Study for an Advance Fighter Digital Flight Control system AFFDL TR 75 59 June 1975 Boudreaw Dean A Integrated Flight Control System Design for CCV AIAA 76 941 September 27 29 1976 General Dynamics Prelimina y Draft Prime Item Development Specification for Digital Fly By Wire Flight Control System Al System AFTI F 16 Contract F32615 78 C 3022 Project 2061 Spec 20ZC017 29 June 1979 Pliska T F et al BIT External Test Figures of Merit and Demonstration Techniques Report FR 79 16 76 Revision A June 1979 McGough J t al Digital Flight Control System Redundancy Study AFFDL TR 74 83 July 1974 Schenk F L and McMaster J R The F 12 Series Aircraft Approach to Design for Control System Reliability Lockheed California Co San Diego 1976 Szalai K J Flight Tust Experience
55. e recommended 11 PRECEDI NG PAGE BLANK NOT FILMED TABLE OF CONTENTS continued Page QUALITY ASSURANCE e s 6 eor oon on os n on on 71 4 1 1 Methods for demonstration of compliance 71 4 1 1 1 Analysis 2 4 4 e ww ww ww om o we ww ng 71 4 1 1 2 Inspection e ew we e n ww we ew n o 72 411337 Test 6 45 575 1 X deck lee NIE je 72 4 2 Analysis requirements 00000000008 on n 73 4 2 1 Piloted simulations ee 0 0 ee we eee 73 4 3 1 2 Acceptance tests eeso 00 es www n 74 4 3 2 1 Component tests 0 00000 00 0 ee oe we ww n n 75 4 3 2 2 Functional mockup and simulator tests 75 4 3 3 Aircraft ground tests 0 0 000 0 ee we woes 75 4 4 1 Flight control system development plan 77 4 4 3 1 FCS analysis report ee a 0 0 es we eo n 78 4 4 3 3 FCS test report 0 n n n sS 78 NOTES e 9 9 0 s 9 e e e 9 9 e s e a e s o e 80 6 6 Definitions eee e 9 ese 9 9 9 e es oe 9 s 9 9 o 80 1 I i i DE d e i f A T ER caravan ne a a ten Ae ANE cati cre ee cimici ine i ui ll ii i RM nt lr NN PRECEDING PAGE BLANK NOT FILMED ae TE masa t 2 APPLICABLE DOCUMENTS pr 2 1 Under line 9 MIL F 3541 insert MIL S 3950 Switches Toggle Environmentally Sealed General Specification for Under line 34 MIL G 6641 insert MIL S 6
56. e the system is able to control Mach but at the expense of altitude For example for stem which controls Mach by pitch if a Mach upset requires a desccrt in order to maintain Mach an ever increasing rate of descent will occur as the aircraft descends to lower altitude The pilot is responsible for maintaining safe flight under these or similar conditions 3 1 2 7 Airspeed hold Line 1 Before the first sentence insert The requirements of this paragraph shall be met in straight steady flight including climb or descent Line 6 After the last sentence add Adjustment capability of at least 10 knots shall be available to allow the pilot to vary the reference airspeed around the engaged airspeed Discussion This requirement is applicable to an airspeed hold mode using either the autopilot pitch axis or an automatic throttle system The RFP and the FCS specification should define which is to be used Experience on installing automatic throttle systems on the QB 47 C 141 and C 5A has shown that some adjustment capability must be available for the pilot It is very difficult to engage the mode at the control airspeed required in adverse weather i E S0 ee gt e y 1 A eats yy rade va Toast Gigli e EN E E creo are ARINC Characteristic No 558 Air Transport Automatic Throttle System Indi cates a full range of adjustment for their system reference l 3 1 2 8 Automatic navigation
57. ection and efficient effective normal operation while maximizing mis sion reliability and flight safety 8 To this end redundancv management must be employed at various levels i within the flight control system architecture to perform such tasks as 1 failure detection 2 failure isolation 3 system reconfig ration i 4 channel recovery update 5 cross channel data transmission 6 cross channel synchronization for synchronous computers i 7 input signal management 8 actuator management l In performing these tasks in particular failure detection and isola y tion the redundancy management approach will influence and be influenced by l 31 rt RI ee ce 7 rie Mb et RIST ERI Toi a ans Na z 2 Vc Dae M bci M MITI lie fus FIR ze Maa Mid Lb s i BEP ei iet a Tol oit st the 3 1 3 9 specification requirement and the inflight monitoring techniques discussed in this document and the MIL F 9490D User Guide The comprehen sivenass of any redundancy management approach will be based on its utili zation ot voter planes and inline or self test monitoring It has been shown that for long missions systems employing interunit selection at the LRU level can be more reliable than systems employing one higher level of redundancy and using midvalue signal voting as the o ly means of fault detection and isolation Thus application of advanced redundancy management techniques to meet a given reliability requirement can resu
58. ed However its existence shows that these kinds of interactions must be studied very carefully The F 8 Digital Fly by Wire system has three primary digital channels There is a back up system which is also electronic The critical input sensors are triplex and data from each of the redundant sensors are supplied to all three computers Identical signal selection programs are performed in each computer This signal selection identifies and removes the effects of failed sensors and produces identical input signals for each of the three computers These identical inputs are used by the computers to produce three control surface command outputs The midvalue of the three commands is selected by three different servo control electronics channels These three channels drive the three sections of triplex force summed secondary actuators which in turn command the primary power actuators The selection logic in the analog drive channels will identify and eliminate a failed digital channel if its command signals deviate significantly from the other two The system will continue operating using the two remaining good channels Many of the faults detected are transient and the system has the capability of restarting the failed channel and returning to full three channel operation If the fault is permanent so that only two channels remain and they do not agree the system 33 sop ee Pepa 8 coco drop eI Ee A reverts to a triplex direct analog c
59. ed for failure isolation Software driven self tests include memory cum checks which are accomplished in background and event driven tests which are activated when failures are discovered A second like processor failure if isolated by self test will cause control shift to the last remaining good processor If the failure is not isolated then for AFTI F 16 development safety purposes the independent backup unit IBU two fail operate capability is engaged The IBU is also automatically engaged whenever all three processors indicate that they have failed et ME PE d 1 M mM CIN H 4 k i In the AFTI program the projected coverage of a flight control computer 16 to isolate its own failure through self test is 0 950 3 1 3 3 4 Failure transients Line 3 Delete the second sentence and substitute A realistic time delay between the failure and initiation of pilot corrective action shall be incorporated when determining compliance This time delay should include an interval between the occurrence of the failure and the occurrence of a cue such as acceleration rate displacement or sound that will definitely indicate to the pilot that a failure has occurred plus an additional interval which represents the time required for the pilot to diagnose the situation and initiate corrective action Line 5 Delete the third and fourth sentences and substitute The fo
60. ed on the production version however all F 18 aircraft will have a manual over ride capability of the flight phase essential leading and trailing edge flaps The production over ride switch is a three position device which allows normal automatic operation and two fixed flap settings for take off and landing 3 2 1 4 1 FCS annunciation Line 1 Delete panel or associated panels and substitute panel associ ted panels or integrated displays K Discussion The intent of this change is to recognize the trend toward use of inte grated displays by ucluding these as acceptable means for display of flight i control information 3 2 1 4 2 2 Failure status Line 4 After crew insert of systems not necessary for flight safety Discussion The last sentence of the Requirement is too restrictive in that it prohi bits warning annunciation of accidental or inadvertent disengageuent of systems affecting safety of flight Future aircraft may require SAS operation to assure at least level III flying qualities 60 gt O e n snai hu mm Fe 3 s hs Hanh ma stus gl ssa e IT not Miano Wi M os Vlt hag te eun mm IA UR T TR e rn trem tmt TIPA di TONO da AS MEE 3 2 1 4 2 3 Control authority annunciation Line 3 After augmentation insert or manual series trim Discussion The requirement needs to include manual series trim as a failure of such trim function can also reduce available c
61. employed shall be defined in the FCS development plan in accordance with 4 4 1 Discussion The analysis required for the design of flight control systems today goes beyond the methods normally associated with linear and nonlinear enalyses In order to imply the wider range of analytical techniques that may be required the words deterministic and probabilistic were added The intent of the change was to encompass not only the usual l near and nonlinear analytical control techniques vhich may or may not be stochastic in nature but also a 2as of analysis which may fall partially or completely outside the realm of mathematics such as failure mode effect analysis and software verification and validation It is the intent of the change in the requirement to point out that the analytical methods to be used as prescribed by the FCS development plan should be appropriate for the problems to which they are to be applied 71 X ra ee ata EVERTI TERNI ANTI y A e E nti E al ai po A ma A Men A nerak eg ad ET EE EE S NS S oa M Sy PN LECT TE di EE EE 4 1 1 2 Inspection Line 7 After the second sentence insert Where applicable flight control system software specifications documentation and analyses shall be inspected or reviewed as part of the verification process Discussion Without the amendment the requirement is not up to date in that it addresses inspection only in terms of hardware with
62. ence on the pitot system and on any vanes or other sensors must be considered a In normal operation Operational State I in the turbulence environment the FCS shall provide a safe level of operation and maintain mission accomplish ment capability b With the essential and flight phase essential controls engaged and active the FCS performance must permit safe termination of precision tracking or maneuver tasks and safe cruise descent and landing at the destination of original intent or alternate The pilot s workload may be excessive or the mission effectiveness inadequate The performance must be possible while operating in the turbulence levels of 3 1 3 7 1 c The noncritical controls shall provide at least a level of performance which results in a moderate increase in crew workload and degradation in mission effectiveness however the intended mission may be accomplished This performance must be possible while operating in the turbulence levels of 3 1 3 7 1 d When operating in turbulence intensities greater than those of 3 1 3 7 1 the operation of the noncritical controls shall uot degrade flight safety or mission effectiveaess below what exists with the contrcis inactive Either manual or automatic means may be used to inactivate the noncritical controls in heavy turbulence when required Discussion The primary point of ambiguity in this requirement as stated in 9490D is the reference to Operational States The definitions o
63. er landing system Line l Change the title to Automatic landing system Line l Delete all weather and substitute automatic Line 4 Delete the second sentence and substitute Automatic landing system shall be designed to be compatible to operations in C tegory III weather minimums and comply with the following landing accuracies and operational requirements Line 15 Delete normally used during ICAO Category IIIb or IIIc visibility conditions After line 24 add the following paragraphs d Automatic landing system malfunction should not cause significant dis placement of the aircraft from its approach path including altitude loss or cause any action of the flight control system that is not readily apparent to the pilot either by control movement or advisory display Upon system dis connection the automatic landing system shall not cause any out of trim condition not easily controlled by the pilot e Means should be provided to inform the pilot continuously of the mode of operation of the automatic landing system Indication of system malfunction should be conspicuous and unmistakable Positive indication should be provided that the flare has been initiated at the minimum normal flare engage heights f The automatic landing system design shall meet the criteria for approval of Category III landing weathe minimums defined in paragraph 6 6 Discussion n automatic landing system ALS includes specifically all
64. estigation for Advanced Flight Control Actuation Systems All Electric Concepts AFCAS Z Z NADC 76160 30 March 1976 Demarchi J N and Haning R K Flight Verification of the Advanced Flight Control Actuation System AFCAS in the T 2C Aircraft NAVAIRDEVCEN 75287 60 June 1978 Air Force Flight Dynamics Laboratory General Design Criteria for Hydraulic Power Operated Aircraft Flight Control Actuators AFFDL FGL 1M 78 73 June 1978 Peloubet R P Jr et al Ground Vibration Testing of Fighter Aircraft with Active Control Systems Technical Report AFFDL TR 76 110 Air Fotce Flight Dynamics Laboratory Wright Patterson AFB Ohio July 1976 84 U S Governmont Printing Office 1980 757 002 288 DETENER KER UAS C AB M 1 1 A en E ite ii rn MERE ADM Ee aca Vni ARI eo ella E A
65. event of loss of the electronic control augmentation system a hydromechanical computational device was engaged to provide dissimilar backup insuring level 2 flying qualities References 33 and 34 discuss studies relative to the implementation of fluidics as a dissimilar backup system The approach on the F 18 program was to implement a backup mechanical control system in the pitch and roll axes The backup system which is in addition to backup direct electrical links engages automatically in the event of loss of fly by wire control to the horizontal rolling tail While the system achieves complete dissimilarity with no reliance on electrical power it has not been without penalties The design implementation of a command select mechanism within an integrated servoactuator which transfers control from electrical to mechanical is very complex and because of the number of cycles it experiences during preflight BIT its transition time has a significant impact on the time required for preflight BIT Non production programs such as the AFTI F 16 the DIGIVAC and the F 8DFBW have implemented analog backup systems for their digital computation channels 2 5 6 35 36 While their backups are dissimilar in terms of electrical signal computation they are vulnerable in the event of electrical power loss However the ability to minimize or eliminate the threat of electrical power loss must be accepted in view of the success of nm ae the
66. f Operational States in 1 2 2 include three considerations 1 system operation failure state 2 corresponding pilot mission performance 3 corresponding 8785 flying 40 LA nimii tfc AIN lube aon VL PO ERA ata a Data T PO e rito ci c e tr aic Fl c ai 1 SS a ati nos i a ath cim Al RR ZIE E PAZ i i Ze AAA A ae A N LAIA ATA qualities level In paragraph 3 1 3 7 of 9490D with regard to essential flight phase essential and noncritical controls the Operational States are intended to call out the required pilot mission performance However because of the ambiguity concerning failure states associated with Operational States II and III 3 1 3 7 becomes unclear This is avoided by using the pilot mission performance statement directly 3 1 3 7 1 Random turbulence Second paragraph Line 6 delete the sentence At the maximum level flight airspeed Va these intensity levels are reduced to 38 percent of the specified levels Discussion This change was made due to a lack of justification for its inclusion within the specification 3 1 3 9 System test and monitoring provisions Discussion Since AFFDL TR 74 116 was issued there has been a considerable amount of work in system test and monitoring The F 16 system is now in production the F A 18A is in full scale development and the AFTI F 16 program is completing its final design phase With respect to digital flight control Systems the topic
67. fiber optics possess the obvious advantages of electrical isolation and minimize the risk of external sources of electromagnetic interference cor rupting critical cross channel signals The use of the words program and workspace provides a more accurate des cription of the use of storage in digital computation Since the D version of this specification was issued there has been con gidereble discussion about the required growth capability for digital computa tionl 4 Apart from the Air Force the discussion was typically one sided in vor of eliminating this requirement Our recommendation is to retain the requirement as it now stands It is recognized that at the time of alrcrafi acceptance the need for growth is not only desirable but necessary It is also realized that at the time of acceptance the percentage growth figures are subject to compromise when traded off against desired aircraft performance Therefore the requirement for growth is pertinent and desirable and should be retained The percent values could be modified but there appears to be no basis for replacing one somewhat arbitrary value with another 65 POCO i E i EECH ci ab ci ll inn EN MIRTO o E VE a E E ee e i i a o For the AFTI F 16 program the FCS operational flight program is designed to execute within 70 percent allocated memory and 75 percent duty cycles this is sufficient to permit growth In the DIGITAC program which
68. formalized and released Two documents CE AEN AN a MAR RR which discuss lightning effects and have been released are references 14 and 18 There is still much unknown about the impact of lightning strikes on fly by wire aircraft While the HIMAT remotely piloted vehicle has successfully undergone preliminary lightning strike evaluation and the F 184 has undergone manda ccm Scale model testing to define potentially vulnerable lightning attach points Dm much remains to be done At this time there are no published results or recommendations from the F 16 Full Scale Lightning Strike Test which was scheduled for June 1979 and no iightning strike evaluation has been per formed on a full scale F 18 to evaluate the effect of lightning strikes on Pepe ee eee aircraft subsystems porc A cme A nondestructive scaled down lightning current pulse test conducted on pong TAR EE YF 16 No 1 in 1975 indicated that additional protection would be required for the F 16 reference 3 The direction of the F 16 design effort for lightning strike protection was to 1 keep lightning strike current flowing through the ipo tee 9e 1 Skin and 2 protect circuitry and components from induced voltage damage Protection from damage caused by induced voltage in the circuitry is a function M mem Pza N ni a A i of the interface circuit characteristics and the input impedance of the compo
69. g of the development activity the structure and responsibility of EGIT li M L A RER vm software orgenization the engineering development test requirements the overall coftware verification and validation process the documents required aad their format the methods for controlling changes during the development process ana other factors significant in the development effort The develop ment plan can be organized into several sections that describe the particular aspects of the development cycle such as se shown in Figure 3 an example of a Software system development cycle lt is necessary for the software support package to address specifically the software maintenance requirement because of the importance of the software support package relative to proper software maintenance References 40 47 48 49 50 and 51 pertain to planning for software quality and software verification validation and control procedures 3 2 4 3 2 3 After this paragraph add the following as a new paragraph 3 2 4 3 3 Corputational input output growth capability In the implementa tion of an analog or digital computer for electrical signal computation the input output growth capability stall be consistent with the growth capability of the computer aud the computer connector reserve capacity Discussion This requirement is consistent with the reserve for growth that is speci filed for analog and digital compitation and the conne
70. hat insures sur vivability in the event of loss of the aircraft For the AFTI F 16 program nonvolatile memory is required to retain stored data for a minimum of one year under any combination of presence and absence of power The application of EPROM s for flight testing is becoming more widespread They have been used successfully on the YC 14 program and are planned for ML eo asd Sr SE T A E n implementation in the AFTI F 16 program in which the memory protection require ments are in complete compliance with this specification The use of EPROM s is addressed in the discussion of software maintenance A SN Doone a a A ij t TEE NEEN EHM UTI dar gebr In the initial phase of flight testing for the F 18 plug in PROM s were employed in the flight control computers They were replaced by PROM s hard wired to the boards when it became apparent that the plug in PROM s did not provide adequate reliability in an operational environment Program scaling is necessary in fixed point computers for protection against overflows in digital computation Computers are now being developed e g in the AFTI F 16 program which have the ability to limit automatically the results of addition subtraction multiplication division and arith metic shift operations that would otherwise have overflowed 3 2 4 3 2 3 Software support Line l Change the title to Software devel opment and support Line
71. he overall software procedures as outlined in the Computer Program Configuration Item CPCI and defined by the software verification validation test plan Due to the large portion of the FCS Operational Flight Program software that built in test requires the BIT software should be modularized in its utilization of the hardware so that in providing for changes and growth potential the verification and validation activity required is minimized In the design aud implementation of electrical signal computation for flight control systems a key area of concern with respect to flight safety and mission reliabilitv is the systems inflight monitoring capability This inflizht monitoring includes cross channel monitoring the use of data reasonavleness and computer self test The level o self test a computer can competently perform will influence the level of redundancy required to satisfy the system flight safety and mission reliability requirements For digital flight control systems self test is the aspect of inflight monitoring which monitors the integrity of the processor memory and input output interfaces of the digital flight control computer For two channel digital flight control system operation in line monitoring must be used to resolve any channel differences When in line monitoring is used the computer must first perform self test prior to checking the other elements of the digital flight control system Self testing will encoupas
72. hould be considered nelther unusual nor unexpected in light of the complexity of the system and the level of fault isolation per formed by the BIT The F 16 performs an automatic preflight BIT in approximately two minutes and can perform an alert BIT within 45 seconds and a complete maintenance and fault isolation test in less than 5 minutes 45 iab p rs MOS atb Hoz ra di a dell Ab bic iet i Ineta EN ES Ha IN o cr alu a att etai dad le aee nadie PR ea TEE E EE TEE ET leo It may well be that the answer to obtaining acceptable preflight BIT times particularly for complex systems lies not in a compromise of flight safety and mission reliability but rather in a reduction of the fault isolation capability of preflight BIT The argument for this is that if the aim of preflight BIT is to determine a GO or NO GO condition based on any one failure why isolate the failure with no intent to alleviate the failure at that time If the CO NO GO was conditional on the type of failure present then some level of fault isolation would be required but not necessarily in depth as is found in current aircraft 3 1 6 Mission accomplishment reliability 3 1 7 Quantitative flight safety Discussion The reliability of software is presumed to reach 1004 whenever the system matures to the operational deployment stage This is attained through trials and tests during development which wil insure that all of the
73. ht and space within the envelope of the other performance parameters of the design 3 2 7 3 3 Burn in Line 1 After 50 insert power on Discussion This amendment provides a definitive approach to electronic LRU burn in to insure reliability and acceptability ERE e lr PE dia ARM a j 1 1 n 4 d A Warm e 4 QUALITY ASSURANCE 4 1 1 Methods for demonstration of compliance Line 6 After the last sentence add As applicable soft ware shall conform to MIL S 52779 and MIL STD 1521 Discussion MIL S 52779 Software Quality Assurance Requirements and MIL STD 1521 Technical Reviews and Audits for Systems Equipment and Computer Programs are DOD documents approved for use by all departments and agencies of the Air Force and are therefore referenced in this specification The standard ization of software procedures and documentation and the goal of a common DOD software language provide the greatest opportunity for increased efficiency in system acquisition 4 1 1 1 Analysis Line 3 After linear or nonlinear insert deterministic or probabilistic n nature Line 4 Delete as defined by the FCS development plan and substitute as best suited and adequate for the application Where test verification is limited by test sample considerations or is clearly inadequate compliance shall be verified by the appropriate analytical techniques The analytical methods to be
74. ilar back up systems is reviewed a clc atlas soi PRAE ate NP m ba E Haa geben e a A mi ee A 3 1 3 1 After this paragraph insert the following as a new paragraph 3 1 3 1 i1 Redundancy management In the design of a redundant flight con trol system the redundancy management approach determined by the contrac tor shall be a based on meeting the flight safcty and mission reliability require ments of this specification b consistent with the use of the system test and monitoring provi i sions of requirements 3 1 3 9 and associated subparagraphs c validated by appropriate analyses d d addressed in the software requirements definition when applicable Discussion With the utilization of redundant channels for the implementation of active control technology in present and future aircraft redundancy manage ment has become a major flight control system design erea and thus needs to be addressed by this specification Without this requirement the specifica tion is deficient As shown in references 2 through 14 numerous flight control system speci TT M 2l fications and studies addressing the implementation of fly by wire control systems have major sections addressing redundancy management Currently the F 18A uses an estimated minimum of 25 of its software for redundancy manage ment The purpose of redundancy management is to provide failure transient prot
75. ion sensing devices In any case the allowable tolerances on the interchangeable elements shall be such that failure to readjust to overall system tolerances shall not create a hazardous condition 3 2 4 3 Electrical signal computation Discussion Since the MIL F 9490D User Guide was issued much literature pertaining to fly by wire flight control systems has appeared References 2 6 9 14 16 40 41 42 43 and 44 are some of the sources which were used in the preparation of this report n increasingly important aspect of fly by wire flight control system technology is microprocessors Within the past few years microprocessors have grown from four bit controllers to 16 bit m ni computers in performance The advantage of using microprocessors is that the inexpensive hardware allows high levels of redundancy at reasonable prices Some are becoming military rated and where a task can be isolated a dedicated processor le well suited The processor can do a reasonable job of self testing without an outside reference 63 a A n 4 EN ESL spud i lii uji alc cadis A a ce i mb oie e e es aL AK e ch PE le TIRE CIPUE ee AN SRI nil d The basic limitation of microprocessors is the high cost of customizing While most of the comparisons can be done by software occasionally there is a need for hardware voting This must be added or performed with discrete hardware A necessary and useful de
76. light control system simulation will be required to evaluate such areas ag integration techniques filter implementations iteration intervals and failure isolation and switching Emulation can serve in the early stages of design to evaluate the effect of interrupts and the implementation of background tasks i AR RE i o mm 4 2 1 Piloted simulations Line 2 Delete the period at the end of the first sentence and insert to define and verify required functional characteristics and to evaluate degraded mode effects The piloted simulation plan shall be defined in the FCS development plan Under line 5 Add the following c Piloted simulations for digital flight control systems prior to each flight preceded by major software modifications Discussion For definition and clarity it is necessary for this rcquirement to i i i i discuss the two critical areas of PCS development which utilize piloted simulation Further it should be noted that the simulation plan will be 1 defined in the FCS development as was done in the AFTI F 16 FCS development plan The requirement for piloted simulations following major software modifications places the same emphasis on major software modifications as on FCS hardware before its first inflight operation Software modifications in general will introduce some unknowns into the computer structure Rather than proceed through a complete reverification following software
77. llowing limits apply to transients due to failures within the FCS as a function of the Operational State of the system after the failure Operational 0 5g incremental normal or lateral acceleration at State I or II the pilot s station and 10 degrees per second roll after failure rate except that neither stall angle of attack nor structural limits shall be exceeded In addition for Category vertical or lateral excursions of 5 feet 2 degrees bank angle Operational No dangerous attitude or structural limit is reached State III and no dangerous alteration of the flight path results after failure from which recovery is impossible Discussion Both 8785 and 9490 MIL specs cover the transient response following a failure and pilot corrective action This duplication of coverage is sup ported because of the essential involvement of these two disciplines ir this very important issue Because of this duplication however it is important to correlate the requirements as closely as possible to minimize the analysis and tests necessary to demonstrate compliance 36 p e ege y 4 d d 8785 discusses transients due to failures in two locations In the Miscell aneous Flying Qualities section paragraph 3 4 8 in 8785C the considerations by vhich one determines the pilot reaction time delay are given Specific numbers are not given but rather guidance is given for each specifi
78. lt iu significant equipment BaVingB li Some caveats for redundancy management are 1 for electrical signal computation no computer shall interfere with the operat on of another and 2 pilot intervention should not be required for system reconfiguration in the event of a failure In the implementation of redundancy and redundancy management methods to satisfy flight safety and mission reliability requirements it is necessary that the design address not only what is required for the flight control system per se but also what is required for any supporting system 2 g mission computer and air data system which is flight safety critical or flight phase essential The success criterion by which a redundancy management approach is typi cally measured is its coverage Although the term coverage has been given slightly different interpretations in the literature available today the most encompassing one defines coverage as the conditional probability that gi na failurn he system continues to perform the required function While some studies references 7 9 and ll have specified that a probability cf coverage as high as 1 0 can be obtained for a first failure and a probability of 94 or better for a second failure in order to achieve an ecceptable flight safety value in practice attempts to achieve the required flight safety goal typically utilize lower failure coverages references 2 4 5 6 and 15 The critical criteria for the determin
79. n It is simply not feasible in all aircraft configurations to isolate the electrical signal computation channels in such a way that only one channel is lost in the event of a cooling air supply failure as recommended in the User Guide Rather than attempt to impose a potentially impractical constraint on the FCS design a more realistic contingeacy approach is recommended This recommendation is similar to a design requirement for the AFTI F 16 program which states that in the event of the loss of forced cooling air to the flight control computers the equipment shall withstand the loss of cooling air without degradation of performance for a minimum of two 2 hours i i Io Ko corda Exch AA REN TTE eg pud a nati il RT A a rl Ar RP SH CETTE CAC PERI Tann TC OTT EE n m DVD aa apad sit Mb t Unfortunately all current fly by wire aircraft require forced air cooling 1 of the flight control computers If this trend is to change it is apparent that it will be as a result of a design change in the electronic components themselves and not the thermal environment of the aircraft itself 3 1 9 5 Invulnerability to maintenance error Line 5 After major overhaul insert software modification Discussion The potential impact of a software maintenance error warrants its specific inclusion in this requirement and provides a logical connection to the sub oos e L ana
80. n into account when deciding on the extent of testing required When such a case arises an effective application of analysis is required for the interpretation of test results so that a required confidence level of per formance s achieved p w rU A OE 2A A aia ee e ci AI di RM A CN NEC n pow Ab d WW The secorid modification to the requirement is to recognize the fact that software verification and validation is a test and that this requirement needs to address specifically the issue of software 4 2 Analysis requirements Line 6 After the second sentence insert In cases of digital flight control applications validation shall require comparison to simulation or emulation results obtained through the use of a general purpose machine Where digital mechanizatiou is involved in the cues eS gt mtt cei flight control system the simulation or both pre analysis of the simulation mechanization is required to assess its validity The artifacts introduced att a le by the simulation mechanization used shall be investigated to assess and minimize their effects on the simulation results Discussion 10 malini aas The inclusion of digital flight control verification and validation analysis requirements in this section maintains the comprehensive intent of this paragraph In an operational flight program for a digital f
81. nce Mach number around the engaged Mach number Discussion This requirement is applicable to a Mach hold moae using either the autopilot pitch axis or an automatic throttle system The RFP and the FCS specification should define which is to be used Experience on installing automatic throttle systems on the QB 47 C 141 and C 5A has shown that some adjustment capability must be made available for the pilot EUNT HU AN SA Anise RR EE nen PR O O e e A IA Mac cati EI pu ATT IE I onc nm EE m A om It is very difficult to engage the mode at the control airspeed required in adverse weather ARINC Characteristic No 558 Air Transport Automatic Throttle System indicates a full range of adjustment for their system reference l The basic purpose of the Mach hold mode is to provide a Mach hold capability in straight and level cruise flight where optimum range or time will result or in cliab out where the best rate or angie of climb Mach will be maintained The requirement is applicable to a Mach hold mode using either the autopilot pitch axis or an automatic throttle system This makes possible two degrees of freedom control simultaneously selecting two control modes e g altitude control through pitch and Mach through autothrottle This enables Mach hold to be engaged during maneuvering flight where the system is unable to control Mach within the requirements or under conditions wher
82. nents The length of the circuit its position with respect to the air frame and the position of the circuit with respect to known lightning attachment points were considered in determining the general shielding requirements for the FCS For the AFTI F 16 program preliminary design requirements specify that each input and output line of the DFCS must survive not degrade or malfunction conducted transients greater than those produced within an aircraft by a 200 K Amp lightning strike to the aircraft Furthermore the fully operating DFCS must survive no malfunction beyond safe recovery a magnetic field spike equivalent to that which produced the conducted transient At present the effects of the magnetic field spike on circuit components is unknown On the subject of lightning in general there has been a recent FAA report regarding a workshop on grounding and lightning technology 3 1 9 4 Invulnerability to onboard failures of other systems and equipment Under line 25 Add the following d In the event of a failure such as loss of required cooling for electrical signal computation or a series of such failures not extremely remote which will unavoidably lead to degraded FCS operation undegraded operation shall be provided for a period specified by the procuring agency Discussion The intent of this amendment is to address the very real potential of a failure or series of failures that could lead to degraded FCS operatio
83. no mention of the very real need for inspection of software Where digital implementation is employed visual inspections and walk throughs need to be performed at appropriate points during the development cycle Various types of documentation in addition to the actual flight code of the operational program can benefit from these walk throughs which are usually done by multidisciplinary teams which can bring varied perspec tives to assess the emerging software Such inspections have proven to be effective in the timely elimination of many types of software problems 4 1 1 3 Test Line l Delete maximum extent feasible and substitute extent required Line 3 After shail include insert hardware tests and where applicable software verification tests in Discussion The initial phase of this requirement was modified to point out a The need to consider program objectives in deciding the level of testing required Because of the differerces in prototype development full scale development and pilot production programs the extent of testing feasible may be beyond the scope of testing required b Following some system modifications the retesting required can be significantly less than the retesting feasible C A test may be feasible but not necessarily desirable when taken to the maximum extent For example the practical limitations of cost and time on the realizability of thorough or exhaustive testing of software must be take
84. ntrol components It is essential that the effect of these environments on the flight control system be known particularly as they affect the reliability and performance of digital flight control systems aud redundant systems in general 4 3 3 Aircraft ground tests Line 3 Delete 6 db Line 8 After the last sentence of item a insert For redundant and multiple loop systems the stability requirement in degraded configurations shall also be demonstrated Under line 19 Add the following paragraphs n e Ground vibration tests with active controls using soft suspension System to simulate free free condition Flight control sensor outputs and open loop frequency response data shall be recorded for correlation with analytical results used in predicting servoelastic and aeroservoelastic stability f Taxi tests with increasing speed and all feedback loops closed to f examine servoelastic stability above zero airspeed Flight control sensor outputs and control surface deflections shall be recorded ae At D HEEGDE D L gea an A AE a Eelere aat Lo a cad AE Cs de 1 7 deci e it ame eoe o E A i e Discussion The requirement for 6 db stability margin at zero airspeed is removed to e cma achieve consistency with the flexibility afforded by the requirements of 3 1 3 6 and in response to the concerns expressed in reference 23 For first flight of an aircraft type different gain margins may be applied for rigid bo
85. ontrol authority 3 2 3 1 General requirements Line 1 After the title add the following Signal transmission between control system elements or components shall be accomplished by direct mechanical hydraulic pneumatic or electrical connec tions as appropriate The use of fiber optic technology or other nonconven tional transmission media requires specific approval of the procuring agency Discussion This requirement is equivalent to the requirement of 3 2 4 1 3 1 referring to signal transmission between computer components The intent of this recom mendation is to make the requirement applicable to all flight control signal paths As stated in the Background Information and User Guide the requirement is not intended to prohibit the use of nonconventional transmission paths but rather to easure that the contractor has fully investigated their ability to perform essential functions reliably and can present substantiating evidence for approval b fore committing designs 3 2 3 1 4 Rig ing provisions After the second sentence add Rigging positions shall have a built in method of travel measurement such as pro tractors or scales applied to an external surface bellcrank or pulley Whenever possible rigging positions shall be independent of each other Added to provide easy more rapid and repeatable maintenance method 3 2 3 2 4 1 Control cable Change paragraph c to read Non flexible corrosion resisting steel cable in straigh
86. or fly by wire fl ght control Systems by the need of the flight control computer vendor to have integrated servoactuator packages or sensors on the premises during development to verify that acceptable interfacing is achieved z de ow P DEET SACHEN doses de t ae aad Tue wies o b ua arra ANUAL Eegiel p iila t sao c cata aal it ORT cit catal m os RZ a e Sa AA 4 3 2 1 Component tests Line 11 After the last sentence add Component modifications to the original configuration shall be requalified by using the appropriate verification method from those listed above Discussion The area of requalification of components following modification needs to be addressed within the specification 4 3 2 2 Functicnal mockup and simulator tests Under line 34 Add the following g Temperature variation tests duplicating normal operation or failure of temperature regulating elements shall be performed on components whose performance is determined to be sensitive to variations in temperature Discussion While the application of item g is relevant to the overall fligh control Bystem it is a consequence of the potential thermal effects on electrical Signal computation AS MVP d AS aircraft designs continue to place more capability power and performance into smaller integrated packages with space at a premium the thermal environments within these packages become ever more hostile for electrical flight co
87. osed by requirements and equipuent over which he has no control The contractor should therefore be responsible for installing equipment to meet specific performance requirements which are measurable and for which he has control Requirement 3 1 2 10b implies that rollout guidance should be designed to accommodate Category IIIb and IIIc visibility conditions This requirement could require sophisticated ground equipment to be installed at the landing area The type of ground guidance used would dictate the equipment to be installed in the aircraft It is felt that this is not feasible since each government organization aircraft manufacturer equipment manufacturer and related organization would have different approaches on proper ground guidance to achieve Category IIIb and IIIc control In addition 1t is believed that there are no commercial or military airfields that have ground equip ment that is capable of guiding an aircraft under the stated weather minima This requirement should require equipment installed which could be used in meeting the Category IIla Landing Weather Minima Any further requirements beyond Category IIIa should be contained in the RFP with an explanation of the ground equipment to be used 3 1 2 10 1 All weather landing performance standards variations of aircraft and airborne equipment configurations Line l Change the title to Auto 29 zma Le matic landing performance standards vari
88. oupling between the pilot commands and the servo drives The YC 14 system uses triple redundant set of electronics and multiple 3 aerodynamic surfaces to achieve fail operational fail safe performance The system provides automatic signal selection failure detection failure E TO isolation failure warning and failure isolation confirmation during flight critical operations The input signal selection guarantees that all computers will use the same numbers and thus produce identical outputs The output is selected as the nidvalue of the three values The system continues to operate after the first failure by taking the average of the two remaining DA A lee systems When the two remaining systems disagree they are both disabled and the aircraft is flown manually For the quadruplex analog flight control system of the F 16 failure detection and isolation performed by inflight monitoring consist primarily of a middle value signal selection following electrical signai computation and FCC servo amplificr failure detection and b integrated servo actuator ISA failure detection le VI a The ISA failure detection incorporates differential ressure sensing of aa the servovalves hydromechanical failure detection and TSA position versus computer model position A A The F 16 is no less than one fail operate overall and a minimum of two fail operate if one failure is electrical An mp
89. program aus Tae SF The renedy for these nuisance disconnects was typically an opening of the trip monitor levels This increase in the levels was to account for the 43 ee transients associated with the FCS hardware performance and not the actual aircraft dynamics Some monitor trip levels on the DIGITAC program were increased up to a factor of 10 from their original design values While on prutotype and experimental projects programs such as the YF 17 and DIGITAC there appears to be little desire or need to specify an acceptable nuisance disconnect level it may be very desirable in a production type program The trade off concern not unexpectedly with nuisance disconnects is flight safety It was a comment of some flight test personnel interviewed whether some of the trip levels of the DIGITAC among other aircraft were even meaningful once an acceptable nuisance disconnect level was attained The allowable frequency for nuisance disconnects and false alarms has been addressed in at least two separate ways In the Advanced Fighter Digital Flight Control Study comes the following recommendation Nuisance disconnects of an axis or channel if specified should be in terms of a maximum number of occurrences per flight hour not as a ratio of nuisance to actual failures Tying nuisance disconnects to actual failures implies that a percentage of disconnects will be actual failures From the AFTI program comes the requi
90. programming errors coding logic hardware interface system requirements deficiencies are eliminated To attain the near perfect reliability necessary requires a very comprehensive technical development procedure management control and configuration control Northrop Document NOR 78 85 Weapon System Computer Software Management contains an extensive format of procedures and controls that aid the design development and verification of software programs in a manner that enhances the reliability of the software by minimizing the probability of software errors The document constructs each aspect of the software development program in its most fundamental form and provides for detailed definition of software documentation and development as well as the organizational structure assignments and respensibilitles The software documentation and development definition includes the nature of the schedule critical milestones design reviews and the means of development 46 m a a M a d A TEE ERES Ter AE AAA lm er The documentation and verification procedures require thorough docu mentation of program modifications and problems and the implementation of family trees which simplify the methods for software changes by prcviding an understandable program flow chart The establishment of preliminary and critical design reviews insures that the design criteria are being p
91. redundancy approach for the Advanced Fighter Technology Integration program i e the AFTI F 16 will be based on a triplex digital flight control system which provides a dual fail operate capability The following excerpts taken from reference 2 are an overview of the preliminary AFTI F 16 redundancy management Previous system architectural studies have indicated that optimum failure survivability and failure isolation to the LRU level require that the flight control system have three voting monitoring planes Two of these planes are in software and are at the sensor controller interface and the output surface command interface The purpose of the input monitoring plane is to detect and isolate fallures associated with the sensors controllers and input circuitry from those associated with the processor and its memory The output voting monitoring plane is used to detect and isolate failures associated with the Flight Control Computer CPU and its memory It is located internally to the ISA s and can be used to isolate failures asso ciated with the computer output circuitry and ISA servovalve coils as well as internal 18A failures In addition to these voting planes there is also processor self test which is used to isolate certain first failures and majority of second like failures Hardware self test features e g the watchdog timer word count and parity checks on MUX bus receipts memory parity and wraparounds are always active and are us
92. rement for computer self test that the false alarm rate shall not exceed one percent of indicated faults With the advent of electrical signal computation in particular digital computation there is a potential for a failure to occur in flight which may be impossible to identify on the ground This is particularly true if the failure results in loss of the aircraft Consequently there has been a desire to implement a methodology and device to code and record computer states and failure transients as they occur in flight In the DIGITAC program there was a feature which coded and stored any failure in the scratch pad SPAN memory Thus the SPAD memory could be interrogated on the ground to reveal the causes of inflight or preflight fallures This ability was expanded after the initial flights to allow monitor words set on the ground to be distinguished from those set in flight Currently on the F 16 program there is an engineering change proposal that would implement a digital device in the aircraft which in addition to performing come maintenance BIT self test and other inflight monitoring would record in a 1 K 8 bit nonvolatile memory any failures which might occur in flight so that they could be traced on the ground 44 a pr S eoe ate att d A OTT e SG i MUI EET segni dei Alien mme IAT DET A similar capability exists in the F A 18 One of the ua jor contributions to the mainten
93. roperly implemented Figures 1 and 2 present typical examples of the software development process and software configuration control The controls presented in the Northrop document and similarly in references 28 through 32 should be fully implemented in any future flight control development programs In literature pertaining to flight control system design and aircraft flight safety and reliability the term extremely improbable is frequently used This term which should not be confused with the specification term extremely remote has been used in reference to the possibility that a system fallure in particular a flight control system failure could lead to loss of aircraft The ability of a flight control system to achleve an ex tremely low probabllity of catastrophic failure has a significant iupact on the levels of redundancy required to meet the FCS quantitative flight safety requirements i e that the probability of loss of aircraft per flight hour be extremely remote The following discussion taken from a Drapet Laboratory renger H on digital fly by wire control presents an interpretation and application of the term extremely improbable The commonly accepted numerical value for extremely impcobabie is ie There is considerabls controversy on the rc ie numerical analysis should play in demonstrating that this requirement ia met In some situations it appears that numerical analysis can have real significaucr and make a v
94. s both software and hardware The following is a list of recommended self tests from ref rences 8 9 14 and 18 l Instruction test sequence test for endless loops time deadline to exercise all instructions 2 Scratch pad read write test A number of locations in the scratch pad are dedicated to self testing On successive test iterations random patterns are written into these dedicated locations and then checked This tests the memory integrity and addressing structure of the scratch pad 3 Wrap around loop tests to verify the computer I O sections for both analog and discrete data i 1 1 i l d i a s ER ta A tnt und TS ZE 4 Use of hardware circuitry to monitor the computer power supnlies Power supply status signals will be exchanged between computers 5 Incorporation of a high priority power failure interrupt to effect an orderly computer shut down in the event of a power drop out Power off and power on status signals will be exchanged between computers 6 Incorporation of a deadman timer redundant if necessary to achieve required reliability to detect computer stoppages Failure of the software to reset the timer indicates a computer failure 7 Use of an internal timer to monitor the time required to complete i various portions of the self test program 8 Use of parity to monitor continuously the memory storage locations When bad parity is indicated an interrupt will
95. s of redundancy management coverage and self test have received considerable attention Self test is discussed below and the topics of redundancy management and coverage are addressed in the redundancy management section 3 1 3 1 1 In the development of design specifications for the procurement of advanced aircraft fighter aircraft in particular the detail that is given to the areas of comprehensive built in test is intense and far beyond that generality addressed through MIL F 9490 There was some thought given by advisory personnel on this project who had been involved with BIT Specifications for the F A 18 and F 5G programs that the MIL F 9490 8pecification should be revamped to address BIT on the design level rather than at the generic level However such a task was beyond the scope of the coatract and not desired for the 9490 update at this me However comprehensive procedures do need to be established relative to the demonstration and verification of BIT Two documents which address this area are an addendum to MIL STD 471A Demonstration and Evaluation of Equip ment System Built In Test External Test Fault Isolation Testability Attri 41 i i E i 3 m pun p i e TTT ere EE ge e a butes and Requirements and Report RADC TR 79 309 BIT External Test Figures of Merit and Demonstration Techniques The verification and validation of BIT software will have to be in accordance with t
96. sefulness of ground tests remains undeni able as a necessary ingredient of the overall process Reference 23 provides an excellent synopsis of stability margin tests i conducted on a variety of research prototype and production aircraft with appropriate conclusions and recommendations added i With the increasing use of digital flight control systems and redundant i system implementations both analog and digital several new considerations came into focus and need to be addressed as part of the overall stability A ii EA o been ht A RR Dn problem Redundant actuation loops with input equalization of multiple feed backs may lead to non aerodynamic loop instability due to beat frequencies PERETI ale dai HR eH mem e n TR E A iaia ta A due iem resulting from feedback sensor excitation differences and equalization network characteristics The presence of digitizing in the actuation driver acts as a high frequency excitation in digital flight control implementations and may also result in a buzz or non aerodynamic loop instability Redundant and multiple loop systems where any control law or computational reconfiguration occurs following specific failures must be evaluated in the degraded states to insure the required minimum stability Finally the importance of analytical modeling techniques relative to actual flight control system implementation is highlighted in reference 24 the report on the DIGITAC development
97. select we we ww we 18 3 1 2 4 Lateral acceleration and sideslip limits 18 3 1 2 4 1 Coordination in steady banked turns 19 E 3 1 2 4 2 Lateral acceleration limits rolling 19 3 1 2 4 3 Coordination in straight and level flight 20 3 1 2 6 Mach hod e s 4 4 we we ww ww we 0 20 y 3 1 2 7 Airspeed hold s es esd ss esas zl 3 1 2 8 Automatic navigation e e ee e s e 22 ol BL VOR TACAN o e uw 9 X RS YU x WX 40v pe 22 3 1 2 8 1 1 VOR capture and tracking e ew 23 3 1 2 8 1 2 TACAN capture and tracking 0 23 3 1 2 8 1 3 Overstaticn see 6 oo o 24 3 1 2 9 Automatic instrument low approach system 24 i 3 1 2 9 1 Localizer mde 2 5 24 i 3 1 2 9 2 Glide slope mode ess osoo oo 26 3 1 2 9 3 Go around mode e we ee ec ow 27 3 1 2 9 3 2 Laterel heading AFCS go around performance standerds s we wo we ow ww 27 3 1 2 9 3 3 Minimum go around altitude e e e gt 27 3 1 2 10 All weather landing system e e s e soso 28 3 1 2 10 1 All weather landing performance standards variations of aircraft and airborne equipment i i configurations 0 0 0 0 os 29 A i 3 1 2 10 2 Performance standards ground based equipment variations e 0 see eee 0 s s 30 3 1 3 1 Redundancy eo gt wo ew
98. sion of the flying qualities specification MIL F 8785C Following a literature search and meetings with members of industry the resulting data were catalogued according to the key areas Subsequently the specifications and assimilated data were reviewed and recommended amendments and discussions were prepared B ee EE Ceo ditemi MERI ml it LE PPP O a a geen aat a E eine die e is Li SUMMARY OF RESULTS In the preparation of this report it became more apparent than ever that flight control system design requires a multi disciplinary approach incorporat ing various aspects of electrical and mechanical engineering and the system computer and management sciences As a result there is a significant amount of overlapping and intertwining of various requirement areas The state of the art has advanced rapidly in the last five years particularly in the area of electronics for digital flight controls This report attempts to accommodate the current state of the art while providing for the implementation of future advances i The bulk of this report addresses the interrelated topics of digital flight controls fly by wire controls and self test and monitoring These topics are addressed in many requirement areas In addition to being addressed in the obvious areas of system test and monitoring and electrical signal computation and transmission they are also referred to in the redundancy reliabilit
99. smission media for the multiplex bus shall require specific approval of the procuring activity Discussion i The recommended changes are intended to emphasize three points concerning the use of multiplexing for flight control signals 1 A distinction is made between electrical signal multiplexing for which MIL STD 1553 was designed and other techniques such as optical mul tiplexing where 1553 would be inappropriate 2 The statement regarding compliance with MIL STD 1553 is broadened to ensure full compliance with the military standard The require ment as stated in 9490D could be narrowly interpreted to apply only to the electrical hardware 3 The statement regarding installation of multiplex bus cables is added to emphasize the importance of isolating and protecting data buses when used to transmit essential and flight phase essential siguals 62 vada ote teas DALIA dl 3 2 4 1 2 Interchangeability Line 3 Change LRU to SRU Shop repalrable unit Liscussion This amendment recognizes that an SRU and not an LRU is the appropriate term for this requirement Readjustment of the internal parameters following repiacement of an SRU is permissible since it is performed in a controlled environment by the appropriate skill level Replacement of an LRU should not require any internal resetting of parameters except some adjustment in the aircraft rigging for certain types of LRU such as posit
100. software Discussion The rationale for the first amendment to this section is covered in the discussion of section 4 4 With the importance of software for digital flight control applications it is essential that there be specific provisions which call for particular VAN methodology results in the FCS analysis report These results would include software analyses documentation backup data etc along with descriptions of their nature origins and significance 4 4 3 3 FCS test report Under line 18 Add the following d Where applicable a summary of flight software testing over the range of conditions addressed on a system level Discussion Similar to the reasons stated in the discussion of section 4 4 3 1 the FCS test report needs to include the test data related to the verification and validation methodology applied to the flight control software In the 78 a o Tama atar ie AC ii e tl a ll e eut amisi mA report thc significance and completeness of these data shall be addressed along with test confirmation of prior software analysis acilia Pt a EE E AAA i en TE ie qe loi a dz TT AR i MER re ET al de Lisa 6 NOTES 6 6 After the definition of Extremely remote insert the following Fail operational The capability of the FCS for continued operation without degradation following a single failure and to fail passive in the event of a relate
101. substitute position Discuss on It is felt that this is a good requirement but some changes are required Capture performance requirements are only given for captures from below the beam At the present time more and more approaches are being made at a Steeper angle due to environmental noise considerations therefore the performance requirements for capture should be given for above and below the beam This requirement also limits the capture performance requirements to an altitude greater than 800 feet above the glideslope transmitter datum altitude The capture requirements should be met at any point of capture The damping ratio requirement of 0 085 or greater after the first over shoot is not acceptable A damping ratio this low would be just as bad as neutral stability and could induce PIO pilot induced oscillation The damp ing ratio after the first overshoot should be similar to the localizer mode The transient error that could occur during beam tracking should be covered in this requirement The transient error should never exceed the error allowed for the first overshoot 1 i D A EE E A EP The 2 sigma tracking requirements of 0 16 degrees 35ja or within 12 feet of beam center are felt to be reasonable This tracking accuracy is the same as that required in Advisory Circular AC 120 29 3 1 2 9 3 Go around mode Discussion The use of an automatic go around mode
102. t runs or Lockclad aluminum tubing swaged over cable with corrosion resisting cable in long straight runs only Discussion Added to allow use of Lockclad 61 EE ZHENG BOAT ANT EUR RE SINE TN mo or c SEO RR Da RITI eee EE 3 2 3 2 4 12 Fairleads and rubbing strips Change last sentence to Fairlcads shall have provisions to allow cables with swaged terminals to be threaded through them with a minimum of effort and adjustments Discussion Provides general method rather than single design solution called out previously 3 2 3 3 1 2 Wire terminations Line 1 Delete spade lug or connector Discussion Words in parenthesis disagree with previous paragraph which forbids use of terminal boards 3 2 3 3 2 Multiplexing Delete the entire paragraph and substitute the fol lowing d EE tag E Electrical multiplexed signal transmission shall utilize digital time division multiplexing techniques and a twisted shielded pair cable as the multiplex bus transmission media The multiplex bus line its interface electronics and all aspects of information transfer via the data bus shall comply with requirements of MIL STD 1553 The installation of multiplex bus cables shall be according to the requirements for other electrical flight control EFC interconnections as specified in 3 2 3 3 1 and subparagraphs The use of fiber optics or other A E e SA M A YEN nonconventional tran
103. t states that a damping ratio of 0 2 or greater shali be exhibited during the tracking mode at a distance of 40 000 feet from the transmitter This does not give the required damping before and after the 40 000 foot point This damping ratio should be required throughout the tracking mode The tracking accuracy of r Rc EO the requirement is more stringent than the FAA Category II approach re gt Ria quirement of Advisory Circular AC 120 29 It is felt that the FAA requirements should be used since these requirements are considered applicable to military aircraft reference l aa Ten ca hale O Y AA SE a im a RENI ae TA ere Lu TDT A D ET IAE 3 1 2 9 2 Glide slope node Line 5 After satisfied insert the first Line 7 Delete from below the beam in level flight at an altitude greater than 800 feet above the glide slope transmitter datum altitude in a no wind condition and substitute in a no wind condition from above or below the beam under normal approach configurations Line 9 Delete 0 085 and substitute 0 20 Line 10 Delete for the conditions defined and substitute aud the transient errors encountered during the tracking mode shall not exceed 0 16 degrees 3548 of radial error from glide slope beam center Line 10 Delete On and substitute When using Line 11 Delete including 10 000 foot runway as defined in ICAO Annex 10 Line 13 Delete opposition and
104. tem characteristics To this end it must account for all antici pated nonlinearities prediction uncertainties and in the case of digital flight controls sampling effects These considerations are emphasized by the revision proposed for the stability requirement paragraphs Aeroservoelastic instability the one manifestation of flight control structural dynamics interaction that defies detection by traditional ground tests has been addressed in detail in papers authored by Barfield and Felt reference 21 and Felt et al reference 22 These papers concluded that a fully integrated analytical approach involving the disciplines of aero dynamics structural dynamics and flight controls is required to insure the required stability The analytical model of the aircraft aerodynamic cheracteristics used to evaluate limit cycle margins may use rigid body representations adjusted for flexibility effects with sufficient allowance for uncertainties in predicting aerodynamic damping and flexible to rigid ratios To evaluate stability margins relative to zero airspeed servoelastic instability and in flight aeroservoelastic instability the analytical model must account for the 38 A e nay ite A IEEE rei A E LAZ AL Ms dls 27 a al A Sn aa G ii iA ia E at o HIA AZIO DE TT PRENSA AO effects of aerodynamic and inertial coupling between axes airframe struc i H tural modes and
105. th frequency dependent nature of the aerodynamic deriva f tives as pointed out in reference 25 Reference 25 also provides an example of successfully applying the characteristic diagram technique with the oscillatory aerodynamic forces i calculated by the doublet lattice method to analyze aeroservoelastic stability Reference 26 describes a wethodology for synthesizing aeroelastic airframe transfer functions that allows the examination of stability by classical stability analysis techniques The transfer function synthesis method holds the promise of a truly unified and integrated analysis approach to the stability problem an cr i ie ME ad a o With digital flight controls coming of age characteristics peculiar to digital implementation need to be considered and appropriately modeled For example sampling effects may introduce significant phase shift in the flight control ioop closure with an attendant reduction in stability margins as described in references 23 and 24 As the stability margins need to be satisfied regardless of system implementation the analysis model of a digital system must be sufficiently representative of the real time charac teristics As pointed out in reference 1 the variations in gain and phase margins as a fuuction of relative mode frequencies e g Table III of AFFDL TR 74 116 are somewhat cumbersome to apply However existing data do not provide sufficlent basis to revise these requirements
106. these specifically address any of the aspects of digital implementation This may serve to maintain the generality of the stated provisions nonetheless the section seems to be Tee ae ce Pme mm mot where the overall integrated V amp V methodology should be specified b V The FCS development plan needs to address the software verification and validation procedures for digital flight control implementations These procedures in turn will be detailed further in the computer program development plan Where flight critical or flight phase critical functions are involved the V amp V plans should reflect an integrated methodology An example of this methodology is described in AFFDL TR 79 307639 Vol I Management of Computer Resources in Systems and Vol II Acquisition and Support Procedures for Computer Resources in Systems of AFR 800 14 specifically address policies required for the development of computer programs and requirements that apply throughout a system s life cycle 4 4 3 1 FCS analysis report Line l Delete the first sentence and sub stitute The contractor shall prepare a report describing FCS analysis Under line 43 Add the following j Where applicable a comprehensive system oriented description of the flight software with regard to its design implementation and analytical evaluation Representations shall be oriented toward understandability of various types aspects or functions of the
107. to be desirable by the contractor 22 E SEH Ae A e aal A Mee IF ES PARITA ELA A A AS i i i FI j A e dr a Aa Tee Gg T 3 1 2 8 1 1 VOR capture and tracking Delete the entire paragraph and substitute the following Overshoot shall not exceed 1 1 3 degrees 20ya beyond the desired VOR radial beam center in a no wind condition for captures 50 nautical miles or more from the station with intercept angles up to 45 degrees Following capture at 50 nautical miles or more the aircraft shall remain vithin a root mean square RMS 1 1 3 degrees 204aj from the VOR radial beam center RMS tracking error shall be measured over a 5 minute period between 50 and 10 nautical miles from the station or averaged over the nominal aircraft flight time between the same distance limits whichever time is shorter Discussion The use of the term average error is objectionable since large hunting errors could occur to right and left of the beam and still result in a small average error reference l 3 1 2 8 1 2 TACAN capture and tracking Delete the entire paragraph and substitute the following Overshoot shall not exceed 0 5 degrees beyond the desired TACAN radial beam cencer in a no wind condition for captures 100 nautical miles or more from the station with intercept angles up to 45 degrees Following capture at 100 nautical miles or more the aircraft shall remain vithin a root mean square RMS 0 5 degrees
108. trol for Boeing YC 14 Aircraft Engineering January 1977 Dobos Bubno S and Hartsook L B Validation of MIL F 9490D General Specifi Lich for jon for Flight Control S System m for Piloted Military Aircraft Military Aircraft Volume II YF 17 Lightweight Fighter Validation AFFDL TR 77 7 Volume II April 1977 White B B Planning for Software Quality TRW Defense and Space Systems Group CH1336 7 78 0000 0230 IEE 1978 Engel J S and Heffran W G A Plan for Validation and Verification of Apollo Computer Software TR 65 209 6 July 1 1965 Bairnsfather Robert R Man Rated Flight Software for the F 8 DFBW Program The Charles Stark Draper Laboratory Inc 1976 Bailey D G Folkesson K Software Control Procedures for the JA 37 Digital Automatic Flight Control System Guidance and Control Conference Proceedings August 16 18 1976 Boebert W E Kamrad J M and Rang E R The Analytical Verifica tion of Flight Software A Case Study Proceedings of the National Aerospace and Electronics Conference May 16 18 1978 Earley B H Objectives for the Design of Improved Actuation Systems AGARD AG 224 April 1977 Jenney G D Research and Development of Aircraft Control Actuation Systems AFFDL TR 7 91 September 1977 Hogan D and Rinde J E Development of Direct Drive Control Valve for Fly By Wire Flight Control System Actuators AFFDL TR 78 32 March 1978 Graw R Feasibility Inv
109. tween maintainability and weapon system operational readiness the requirement is changed from a qualitative consideration to a quantitative goal implied by the reference to the allocated ma ntenance budget 3 1 10 2 1 Use of cockpit instrumentation Line 5 Delete for nonelectrical and nonelectronic components Discussion The last sentence of this requirement references portable test equipment for nonelectrical and nonelectronic components This statement indicates that portable test equipment can be used only for MFCS yet requirement 3 1 10 2 2 allows the use of portable test equipment under specific conditions 3 1 10 2 2 After this paragraph add the following as new paragraphs 56 3 1 10 2 2 1 Provision for portable test equipment growth Any special test equipment shall be designed to provide for growth consistent with the FCS growth capability 3 1 10 2 2 2 Provision for portable test equipment software Where software is utilized within FCS portable test equipment its design verification validation aid maintenance shall be consistent with the software requirements contained within this specification Discussion The first requirement addresses the possibility that growth in the flight control system may require similar growth in the portable test equipment asso ciated with it Without this provision for growth the costly and potentially untimely replacement of equipment may be necessary
110. vice is a component with built in voters We could utilize a hardwired device to create a voter signal and apply that signal to a particular device However if that one signal to the device failed we would consider it a common point failure If on the other hand the or and and voting logic was built into the device memory chip and the votinp logic failed it would be considered a memory failure not a common point failure The single device would indeed have higher reliability than the separate devices but the main point is that the perspective changed to consider the failure to be of a different type The critical failure modes can occur in the bus lines These require bus guardians which then become the critical failure points For these reasons serial lines become attractive The architecture of these systems is in an experimental stage of develop ment In a few years there will undoubtably be some established preferences of architecture 3 2 4 3 1 Analog computation Line 3 After the first sentence insert At the time of aircraft acceptance by the procuring agency a 25 percent growth capability for computation shall exist within the flight control system Line 5 After the last sentence add Analog signals shall be scaled to provide satisfactory resolution and sensitivity to ensure continuous safe operation for all possible combinations of maneuvering demand and gust or other plausible disturbances and to prevent unacceptable
111. with the F 8 Digital Fly By Wire System National Aeronautics and Space Administration 1976 Barfield A F and Felt L R Aeroservoelasticity A Merging of of Technologies Society of Flight Test Engineers eers th Annual Symposium Zugust 1976 Felt L R et al Aerrservoelastic Encounters AIAA Guidance and Control Conference August 1978 Kirsten P W Fligh Control System Structural Resonance and Limit Cycle Results ACARD Flight Control Panel Germany October 1975 Damman L et al Flight Test Development and Evaluation of a Multimode Digital Flight Cont Control System Implemented i an ASI Digitac s Technical Report AFFIC IR 76 15 May 1976 Arthurs V et al Interaction Between Control Auguentation System and Airf ame Dynamics on YF 17 AIAA Symposium Denver Colorado May 1975 Arthurs T D et al Aeroelastic Airframe Transfer Function Synthesis AIAA ASME SAE 17th Structures Structural Dynamics and Materials Conference Proceedings Valley Forge PA May 1976 Weaver R E Weapon System Computer Software Management Northrop Corp Report NOR 78 85 March 1978 Holey P P Jr Software Quality Assurance for Reliability Software Proceedings of Annual Reliability and Maintainability Syuposium IEEE 1978 32 ATA siae O E nto EE mc 4 cd rese hes tM tit CHE j mi Er Se Lt E I AI I bassin aint i ii o Mi A Lm perc vo e e n aE Sl a a me
112. y survivability invulnerability and maintenance requirements Of particular note are the additions of a redundancy management requirement and discussion which were absent in the D revision and the integration of software requirements for FCS design and documentation into the specification Where the D revision gave little consideration to FCS software this document attempts to coordinate DOD software requirements and recommended approaches in the specification and User Guide without restricting FCS software design Both d of these modifications have been made with the goai of more efficient system acquisition in mind Other subjects covered in this report include updates of the requirements for stability Automatic Flight Control Systems AFCS and cockpit controls displays and modification of the quality assurance and actuation requirements In addition an effort was male to make MIL F 9490D compatible with the latest TUTA So uM eee revision of the specification for flying qualities of piloted aircraft MIL F 8785C In preparing the amendments for the AFCS and the cockpit controls displays requirements Volumes II and III of AFFDL TR 77 7 the Northrop Lockheed Georg a h r t E d t Tere eM gite E a Ee Le TAMEN Rl NNNM uL AS SEXT rs E OS o a es i validation of MiL F 9490D were the ma n reference sources coupled with the current experience of our advisory personnel
113. y to transfer to and from the backup system Reference 35 has a thorough discussion of synchronization problems in the F 8 BW program and reference 37 discusses backup flight control design procedures for increased survivability With the increased emphasis on CCV conceptr digital computation and multiple control surfaces another area of survivability worthy of attention is control law control surface reconfiguration If an aircraft that had a horizontal tail and flaperons for example lost control of the horizontal tail then the control laws would be modified so that the flaperons would provide primary pitch control This type of approach has been implemented in the HiMAT program and also discussed in reference 38 A final point relative to survivability in the design of flight control systems in general and fly by wire control systems in particular is the potential for batch failures The possibility exists that each of the redundant flight control computers contains a defective board from the same manufacturing batch Y Y rene e ITUNES OU which causes nearly simultaneous fallures in all channels as a result of some severe physical or environmental conditions which do not exceed the design requirements Although an unlikely occurrence it needs to be addressed and co ERE foe provided for 1 3 1 8 1 All engines out control Line 5 After flight insert airframe inlet flow

Appendix to 9490 User Manual

Contents

Download Pdf Manuals

Related Search

Related Contents