Document
B-52 STABILITY AUGMENTATION SYSTEM RELIABILITY T . C . Bowling and L . W . Key The Boeing Company, Wichita Division SUMMARY The B-52 SAS ( S t a b i l i t y Augmentation System) was developed and r e t r o f i t t e d t o n e a r l y 300 a i r c r a f t . It actively c o n t r o l s B-52 s t r u c t u r a l bending, p r o v i d e s improved yaw and p i t c h damping through s e n s o r s and e l e c t r o n i c c o n t r o l c h a n n e l s , and p u t s complete r e l i a n c e on h y d r a u l i c c o n t r o l power f o r rudder and e l e v a t o r s .
The system h a s now experienced o v e r 300,000 f l i g h t h o u r s and h a s e x h i b i t e d ser- v i c e r e l i a b i l i t y comparable t o t h e r e s u l t s of t h e r e l i a b i l i t y t e s t program.
Development e x p e r i e n c e p o i n t s o u t numerous l e s s o n s w i t h p o t e n t i a l a p p l i c a t i o n i n t h e mechanization and development o f advanced technology c o n t r o l systems of h i g h r e l i a b i l i t y .
INTRODUCTION !
The B-52 SAS ( S t a b i l i t y Augmentation System) w a s developed and r e t r o f i t t e d on n e a r l y 300 a i r c r a f t i n o r d e r t o a c h i e v e t h e f o l l o w i n g o b j e c t i v e s : a. Minimize f a t i g u e damage due t o s t r u c t u r e d e f l e c t i o n i n t u r b u l e n c e .
b. Improve c a p a b i l i t y of w i t h s t a n d i n g extremely h i g h v e l o c i t y g u s t s .
c. Improve yaw and p i t c h damping d . I n c r e a s e rudder and e l e v a t o r a u t h o r i t y .
e. Improve crew r i d e . ' It w a s necessary t o p l a c e unusual emphasis on system r e l i a b i l i t y , f o r two p r i n c i p a l reasons: a . On t h e yaw and p i t c h a x e s , replacement of t h e o r i g i n a l mechanical ( s e r v o t a b ) s y s t e m by a h y d r a u l i c a c t u a t o r system i n t r o d u c e s t h e p o s s i b i l i t y of t o t a l l o s s of rudder and e l e v a t o r c o n t r o l i n f l i g h t due t o h y d r a u l i c f a i l u r e s .
b , The use of an e l e c t r o n i c system w i t h r e l a t i v e l y high rudder and e l e v a t o r a u t h o r i t y i n t r o d u c e s t h e p o s s i b i l i t y of sudden unscheduled displacements o r "hardovers" of t h e c o n t r o l s u r f a c e s due t o e l e c t r i c a l f a u l t s , w i t h obvious f l i g h t s a f e t y i m p l i c a t i o n s .
REDUNDANCY M A N A G E M E N T F i g u r e 1 i s a s i m p l i f i e d schematic diagram of t h e SAS. Yaw damping and e l a s t i c mode s u p p r e s s i o n s i g n a l s are g e n e r a t e d by combining rate gyro o u t p u t s w i t h lateral a c c e l e r o m e t e r o u t p u t s , and t h e g a i n s are scheduled a c c o r d i n g t o air- speed ( h i g h g a i n a t low a i r s p e e d and vice v e r s a ) . For t h e p i t c h a x i s , o n l y rate gyro s i g n a l s are used; t h e g a i n i s f i x e d and independent of a i r s p e e d . There a r e two e s s e n t i a l l y independent h y d r a u l i c power s u p p l i e s , each having a main pump and an emergency pump. The main pumps are e l e c t r i c a l l y powered; t h e emergency pumps a r e simply h y d r a u l i c t r a n s f o r m e r s (motor-pump packages), d r i v e n by s e p a r a t e e x i s t i n g u t i l i t y h y d r a u l i c systems and provided w i t h flow limiters t o avoid c r i p p l - i n g t h e u t i l i t y systems i n t h e e v e n t of l o s s of f l u i d from a SAS system.
The c o n t r o l s u r f a c e a c t u a t o r s are of tandem t y p e , normally powered by both h y d r a u l i c s u p p l i e s .
T h e system i s b a s i c a l l y FO-FS ( f a i l o p e r a t i o n a l on f i r s t f a i l u r e , f a i l s o f t on second), w i t h t h e f o l l o w i n g e x c e p t i o n s : a . I f two l a t e r a l a c c e l e r o m e t e r channels f a i l , a l l t h r e e a c c e l e r o m e t e r channels drop o u t , w h i l e t h e yaw a x i s c o n t i n u e s t o o p e r a t e on t h e yaw rate gyro s i g n a l s o n l y .
b. I f two g a i n s c h e d u l i n g c h a n n e l s f a i l , a l l t h r e e channels r e v e r t t o a l o w g a i n t h a t i s s a f e a t a l l a i r s p e e d s .
These two f e a t u r e s provide a s u b s t a n t i a l d e c r e a s e i n t h e number of t w o - f a i l u r e combinations t h a t can cause yaw a x i s disengagement o r l o s s of f u n c t i o n .
The b a s i c redundancy management concept i s r e l a t i v e l y s t r a i g h t f o r w a r d . A t v a r i o u s p o i n t s i n t h e three-channel s e n s o r - e l e c t r o n i c s subsystem, v o t e r s and comparators a r e used, as shown on F i g u r e 2 . For example, t h e t h r e e i n p u t s a t t h e l e f t of t h e diagram may r e p r e s e n t t h r e e r a t e gyro o u t p u t s , w h i l e t h e t h r e e out- p u t s a t t h e r i g h t may r e p r e s e n t t h r e e channels of a n e l e c t r o n i c c o n t r o l u n i t .
I f any i n p u t d i s a g r e e s w i t h t h e median s i g n a l by more than t h e p r e s e l e c t e d e r r o r t h r e s h o l d , t h e comparator t r i p s and l a t c h e s i t s e l f i n t h e t r i p p e d mode. I n t h i s mode, t h e comparator swamps t h e d i s c r e p a n t i n p u t so t h a t i t w i l l n o t be s e l e c t e d by any v o t e r as a median s i g n a l . I n some cases t h e swamping s i g n a l i s a hard- o v e r ; i n o t h e r cases, i t is a 400 Hz s q u a r e wave. Also, t h e comparator s h u t s o f f i t s normal "O.K." s i g n a l t o t h e l o g i c c i r c u i t r y , t h u s p r e p a r i n g t h e l o g i c t o t a k e proper a c t i o n i n t h e e v e n t of a subsequent second f a i l u r e . On t h e yaw a x i s , t h e f a i l u r e of one channel a l s o sends a "channel f a i l e d " s i g n a l t o t h e p i l o t , warning him t h a t redundancy h a s been l o s t and t h a t yaw damping w i l l be a u t o m a t i c a l l y disengaged i n t h e e v e n t of a second s i m i l a r f a i l u r e . Loss of yaw damping i s n o t a h i g h l y c r i t i c a l f a i l u r e mode, b u t i t poses a s l i g h t t h r e a t t o f l i g h t s a f e t y by r e q u i r i n g manual damping of Dutch ro1.1, which may b e d i f f i c u l t w i t h c e r t a i n ad- v e r s e combinations of h i g h g r o s s w e i g h t , h i g h a l t i t u d e , poor v i s i b i l i t y , and turbulence. N o such warning t o t h e p i l o t i s r e q u i r e d f o r s i n g l e channel f a i l u r e s i n a c c e l e r o m e t e r , g a i n s c h e d u l i n g , o r p i t c h a x i s channels, as t h e s e pose no t h r e a t t o f l i g h t s a f e t y and r e q u i r e no special crew a c t i o n .
FLIGHT SAFETY RELIABILITY I n e a r l y d i s c u s s i o n s , A i r Force r e p r e s e n t a t i v e s expressed a clear d e s i r e t o state t h e system r e l i a b i l i t y o b j e c t i v e i n terms of a i r c r a f t l o s s rate. T h i s r e q u i r e d a n a l y s i s i n c o n s i d e r a b l y g r e a t e r d e p t h t h a n o r d i n a r y r e l i a b i l i t y calcu- l a t i o n s f o r a redundant system. It w a s n e c e s s a r y t o : a.
Define each p o t e n t i a l l y c r i t i c a l f a i l u r e mode of t h e system i n t e r m s of t h e e f f e c t on c o n t r o l s u r f a c e motions.
b.
Compute t h e p r o b a b i l i t i e s of occurrence s e p a r a t e l y f o r each of t h e s e modes d u r i n g each phase of a s t a n d a r d i z e d mission p r o f i l e .
C . Compute t h e p r o b a b i l i t y of a i r c r a f t l o s s f o r each mode i n a v a r i e t y of f l i g h t c o n d i t i o n s ( a l t i t u d e , a i r s p e e d , and presence of nearby a i r c r a f t such as i n aerial r e f u e l i n g ) w i t h proper allowance f o r p r o b a b i l i t i e s of v a r i o u s t u r b u l e n c e i n t e n s i t i e s and v i s i b i l i t y c o n d i t i o n s .
d.
Combine t h e above t o o b t a i n a t o t a l p r e d i c t e d B-52 l o s s rate a t t r i b u - t a b l e t o SAS f a i l u r e .
CRITICALITIES During t h e p r o t o t y p e program, hundreds of SAS f a i l u r e s w e r e simulated i n p i l o t e d f l i g h t s i m u l a t o r s and t h e r e s u l t i n g a i r c r a f t motions w e r e r e c o r d e d . Five o r more d i f f e r e n t p i l o t s were used f o r each combination of SAS f a i l u r e mode and f l i g h t c o n d i t i o n . A f t e r each s i m u l a t i o n , t h e p i l o t w a s asked t o estimate t h e percentage of SAC p i l o t s t h a t would have been unable t o avoid l o s s of t h e air- c r a f t .
The r e s u l t s were averaged t o a r r i v e a t a p r o b a b i l i t y of a i r c r a f t l o s s f o r each combination. These r e s u l t s were combined w i t h t h e p r o b a b i l i t i e s of given t u r b u l e n c e c o n d i t i o n s , v i s i b i l i t y c o n d i t i o n s , and a u t o p i l o t s t a t u s t o y i e l d a c r i t i c a l i t y m a t r i x s u i t a b l e f o r u s e i n t h e a i r c r a f t l o s s p r e d i c t i o n program.
C r i t i c a l i t y , as used h e r e , is d e f i n e d as t h e p r o b a b i l i t y of a i r c r a f t l o s s - i f t h e given system f a i l u r e mode o c c u r s d u r i n g given f l i g h t c o n d i t i o n s .
I n t h e p a s t , t h e r e h a s been a widespread tendency t o treat c r i t i c a l i t y as a To l a b e l a f a i l u r e mode as "critical" meant t h a t i t would i n v a r i a b l y dichotomy.
cause l o s s of t h e a i r c r a f t , and t o l a b e l it as " n o n - c r i t i c a l " meant t h a t i t would never cause l o s s of a i r c r a f t . I n o t h e r words, c r i t i c a l i t y w a s a s s i g n e d o n l y two p o s s i b l e v a l u e s : z e r o and 100 p e r c e n t . It i s t r u e , of c o u r s e , t h a t many f a i l u r e modes have c r i t i c a l i t i e s of z e r o , and some f a i l u r e modes, such as g r o s s f a i l u r e of a primary s t r u c t u r e , have c r i t i c a l i t i e s of 100 p e r c e n t . But i n any a t t e m p t t o make a r e a l i s t i c p r e d i c t i o n of t h e f l i g h t s a f e t y r e l i a b i l i t y of a c o n t r o l s y s t e m , i t must be recognized t h a t many of t h e f a i l u r e modes w i l l have c r i t i c a l i t i e s . They may approach 100 p e r c e n t w i t h unfavorable i n t e r m e d i a t e combinations of f l i g h t c o n d i t i o n s , and may b e e s s e n t i a l l y z e r o w i t h f a v o r a b l e combinations of f l i g h t c o n d i t i o n s .
_ _ The p r o b a b i l i t y of occurrence of each p o t e n t i a l l y c r i t i c a l system f a i l u r e mode d u r i n g each phase of t h e m i s s i o n w a s computed u s i n g c o n v e n t i o n a l methods, but'wifh- c e r t a i n r e f i n e m e n t s as subsequently d i s c u s s e d . These p r o b a b i l i t i e s of o c c u r r e n c e were compiled i n t o a f a i l u r e mode o c c u r r e n c e p r o b a b i l i t y m a t r i x .
F i g u r e 3 is a s i m p l i f i e d diagram showing t h e p r i n c i p a l f a c t o r s e n t e r i n g i n t o the c o n s t r u c t i o n of t h e s e two matrices. The two matrices are c o n s t r u c t e d and combined i n a computer program t o p r e d i c t a i r c r a f t l o s s e s .
I n many cases i t w a s found t h a t t h e c r i t i c a l i t y of a given system f a i l u r e mode w a s n o t n e c e s s a r i l y determined by t h e mission phase o r f l i g h t c o n d i t i o n s i n which t h e f a i l u r e o c c u r r e d , b u t by subsequent c o n d i t i o n s . Many f a i l u r e modes are r e l a t i v e l y n o n c r i t i c a l i n h i g h a l t i t u d e c r u i s e , f o r i n s t a n c e , b u t leave t h e s y s t e m i.n a degraded state t h a t may have a much g r e a t e r c r i t i c a l i t y i n subsequent mission phases such as low l e v e l p e n e t r a t i o n o r l a n d i n g . S i n c e h i g h a l t i t u d e c r u i s e a c c o u n t s f o r a l a r g e p o r t i o n of t h e m i s s i o n d u r a t i o n , most of t h e f a i l u r e s w i l l tend t o occur d u r i n g c r u i s e , b u t many of t h e r e s u l t i n g a i r c r a f t l o s s e s w i l l occur ciuring a subsequent m i s s i o n phase. For o t h e r f a i l u r e modes, t h e s u r p r i s e f a c t o r i s predominant; t h e p r o b a b i l i t y of a i r c r a f t l o s s i s c h i e f l y dependent on t h e p i l o t ' s s k i l l and c o r r e c t i v e a c t i o n s immediately a f t e r t h e f a i l u r e . These c o n s i d e r a t i o n s were t a k e n i n t o account i n t h e computerized program.
BITE The system i n c l u d e s BITE ( B u i l t - I n T e s t Equipment) which s e r v e s two main purposes: a. I t p e r m i t s a q u i c k p r e f l i g h t checkout t o determine, as f a r as p r a c t i c a b l e , t h a t a l l components i n a l l channels are u n f a i l e d b e f o r e t a k e o f f .
b. It f a c i l i t a t e s d i a g n o s i s by i d e n t i f y i n g t h e f a i l e d LRU.
N e i t h e r of t h e above BITE f u n c t i o n s is achieved w i t h 100 p e r c e n t c e r t a i n t y .
A c a r e f u l a n a l y s i s w a s made t o determine which f a i l u r e modes of which components could n o t b e d e t e c t e d by BITE o r by any f e a s i b l e p r e f l i g h t check. For each such Where- "hidden" f a i l u r e mode, s u i t a b l e ground check i n t e r v a l s w e r e e s t a b l i s h e d .
e v e r a hidden mode, i n combination w i t h o t h e r component f a i l u r e modes, could produce a p o t e n t i a l l y c r i t i c a l system f a i l u r e mode, t h e computation of t h e p r o b a b i l i t y of system f a i l u r e mode o c c u r r e n c e w a s based on t h e e s t a b l i s h e d ground check i n t e r v a l and n o t merely t h e t i m e s i n c e t a k e o f f . T h i s makes a s i g n i f i c a n t d i f f e r e n c e i n t h e p r o b a b i l i t y of a given two-failure o r t h r e e - f a i l u r e combina- t i o n , as compared t o t h e c o n v e n t i o n a l method of computing redundant system r e l i a b i l i t y , which i s based on t h e i m p l i c i t assumption t h a t a l l p a r t s are u n f a i l e d a t t a k e o f f .
SNEAK FAILURE M O D E S I n a d d i t i o n t o t h i s "hidden" f a i l u r e mode problem, w e a l s o encountered s e v e r a l "sneak" f a i l u r e modes. A sneak f a i l u r e mode may b e roughly d e f i n e d as one which produces unexpected e f f e c t s t h a t tend t o n e g a t e p a r t of t h e redundancy.
Such modes e x i s t c h i e f l y because of i n a d e q u a t e F M E A ( F a i l u r e Mode and E f f e c t A n a l y s i s ) . For example, t h e v o t e r s used i n t h e p r o t o t y p e d e s i g n contained two sneak f a i l u r e modes. I n one of them, a s i n g l e v o t e r f a u l t would produce a .
hardover s i g n a l on a l l t h r e e c h a n n e l s simultaneously. I n t h e o t h e r , a s i n g l e v o t e r f a u l t would cause a s i n g l e hardover o r i g i n a t i n g upstream t o b e propagated downstream on a l l t h r e e c h a n n e l s . These problems were c o r r e c t e d i n t h e produc- t i o n d e s i g n .
Another f e r t i l e f i e l d i n which sneak f a i l u r e modes t y p i c a l l y abound i s i n t h e a r e a of e l e c t r o n i c module power s u p p l i e s . N a t u r a l l y , t h e three-channel redundant c o n f i g u r a t i o n of t h e e l e c t r o n i c s and s e n s o r s employed separate power supply modules t o power t h e e l e c t r o n i c s on each channel. Here a g a i n sneak f a i l u r e modes were found. For example, one power supply module f a i l u r e could a channel and a t t h e same t i m e p r e v e n t t h e l o g i c c i r c u i t r y from t a k i n g d i s a b l e proper a c t i o n . Such modes were "designed out" wherever they appeared. : FAILURE MODE AND EFFECT ANALYSIS A s might b e s u s p e c t e d from t h e above remarks, t h e t a s k of a n a l y z i n g f a i l u r e modes and t h e i r e f f e c t s w a s of paramount importance i n making a realistic f l i g h t s a f e t y r e l i a b i l i t y a n a l y s i s f o r t h e SAS. The FMEA is a t r a d i t i o n a l t a s k t h a t is u s u a l l y c a l l e d € o r i n r e l i a b i l i t y programs, b u t t h e o u t p u t , i n many c a s e s , i s of l i t t l e v a l u e i n r e a l i s t i c computation of t h e r e l i a b i l i t y of a redundant system.
Among the t y p i c a l shortcomings are: a. Excessive e m p h a s i s on what f a i l s r a t h e r t h a n - how i t f a i l s ; i n s u f f i c i e n t r e c o g n i t i o n of f a i l u r e modes o t h e r than open c i r c u i t and s h o r t c i r c u i t .
Inadequate d e f i n i t i o n of e f f e c t s on t h e system; use of c a t c h - a l l p h r a s e s b.
such as " l o s s o r d e g r a d a t i o n of output"; p h r a s e s such as 'ILoss of +5 VDC power" w i t h o u t any a t t e m p t t o d e s c r i b e what happens t o the system when t h e +5 VDC power i s l o s t .
Endless r e p e t i t i o n of t h e obvious and n e g l e c t of t h e nonobvious.
C .
d. F a i l u r e t o e x p l a i n t h e f u n c t i o n i n g of t h e system o r assembly and i t s components s o t h a t t h e F M E A w i l l b e meaningful t o p e r s o n n e l n o t h i g h l y f a m i l i a r w i t h t h e d e s i g n .
e. Inadequate e x p l a n a t i o n of redundancies, where a p p l i c a b l e ; f a i l u r e t o recognize t h a t w h i l e two assemblies may be i n p a r a l l e l w i t h respect t o t h e more common o r obvious f a i l u r e modes, they may b e e f f e c t i v e l y i n series w i t h r e s p e c t t o less obvious f a i l u r e modes.
AlthougJi formal FMEA r e p o r t s a t t h e assembly l e v e l were generated i n t h e SAS r e l i a b i l i t y program, t h e r e w a s no a t t e m p t t o compile a system-level FMEA i n t h e u s u a l format which i s n o t w e l l s u i t e d f o r d e l i n e a t i n g t h e e f f e c t s of redundancies-. I n s t e a d , t h e FMEA w a s e f f e c t i v e l y combined w i t h t h e q u a n t i t a t i v e f l i g h t s a f e t y r e l i a b i l i t y a n a l y s i s a s i l l u s t r a t e d by F i g u r e s 4 and 5. These f i g u r e s r e p r e s e n t two of t h e s y s t e m f a i l u r e modes. The n o t a t i o n s f etc.
49' f70' r e p r e s e n t h o a r l y f a i l u r e rates of t h e v a r i o u s subassemblies i n t h e a p p l i c a b l e a series- subassembly f a i l u r e modes. I n o t h e r words, they r e p r e s e n t b l o c k s on p a r a l l e l block diagram o r a f a u l t tree. Each c r i t i c a l system f a i l u r e mode h a s a s e p a r a t e diagram o r a s e p a r a t e branch on a f a u l t tree, w i t h b l o c k s r e p r e s e n t i n g o n l y t h o s e f a i l u r e modes of s u b a s s e m b l i e s o r components t h a t c o n t r i b u t e t o t h e c r i t i c a l system f a i l u r e mode. N o t a t i o n s s u c h as h 7 , , g67, etc. are t h e g i v e n a p p l i c a b l e mode f a i l u r e r a t e s o f s u b a s s e m b l i e s i n a n o f f - l i n e o r s t a n d b y s t a t u s .
W r e p r e s e n t s t h e p r o b a b i l i t y o f i c i n g c o n d i t i o n s t h a t would i n c a p a c i t a t e a p i t o t head w i t h a f a i l e d h e a t e r . The symbol H refers t o f h e 300-hour p e r i o d i c check for- p i t o t system l e a k a g e , which is t h e f a i l u r e mode denoted by f81. The n o t a t i o n s T1 and T2 r e f e r t o t i m e s i n c e t a k e o f f ; f o r example, i f a m i s s i o n p h a s e s t a r t s 5.52 h o u r s a f t e r t a k e o f f and e n d s 7.52 h o u r s a f t e r t a k e o f f , TI = 5.52 and T2 = 7.52. I n s o f a r as p o t e n t i a l l y c r i t i c a l modes a r e concerned, t h e FMEA is t h u s r e p r e s e n t e d by a c o l l e c t i o n of c r i t i c a l s y s t e m , f a i l u r e mode f o r m u l a t i o n s similar t o F i g u r e s 4 and 5. W e have a t t e m p t e d t h e t a s k o f modifying t h e u s u a l FMEA format t o make i t u s e f u l i n r e d u n d a n t system a n a l y s i s , b u t are n o t s a t i s f i e d w i t h r e s u l t s t o d a t e .
Many component f a i l u r e modes were s i m u l a t e d i n l a b o r a t 6 r y tests, i n o r d e r t o e v a l u a t e f a i l u r e mods e f f e c t s t h a t were n o t c l e a r l y p r e d i c t a b l e .
BLOCK DIAGRAMS AND FAULT TREES S e r i e s - p a r a l l e l bl-ock diagrams and f a u l t trees are sometimes t h o u g h t of as t w o d i f f e r e n t t e c h n i q u e s f o r redundant system r e l i a b i l i t y a n a l y s i s , a l t h o u g h when p r o p e r l y used t h e y convey i d e n t i c a l i n f o r m a t i o n . The c h i e f d i f f e r e n c e s between t h e s e two a p p r o a c h e s , as t r a d i t i o n a l l y u s e d , a r e : a. Blocks on t h e f a u l t t r e e g e n e r a l l y r e p r e s e n t e v e n t s o r s p e c i f i c f a i l u r e modes of components, w h i l e b l o c k s on t h e s e r i e s - p a r a l l e l diagram have sometimes been used t o r e p r e s e n t t h e t o t a l f a i l u r e rates o f components.
c b . The f a u l t tree is g e n e r a l l y c o n s t r u c t e d b e g i n n i n g a t t h e t o p o r system l e v e l and working down t o t h e d e t a i l o r f u n c t i o n a l module l e v e l ; w i t h t h e b l o c k diagram, t h e r e i s a tendency t o s t a r t a t t h e component l e v e l and work up t o t h e system level.
Ln t h e B-52 SAS a n a l y s i s , w e used two teams, one s t a r t i n g a t t h e t o p and working down, and t h e o t h e r s t a r t i n g a t t h e bottom and working upward. Comparison of p r o v i d e d a u s e f u l cross-check and h e l p e d t o minimize %he chance o f t h e r e s u l t s o v e r l o o k i n g c r i t i c a l combinations. A s l o n g as t h e b l o c k s r e p r e s e n t s p e c i f i c f a i l u r e modes of t h e modules o r components, t h e r e i s no s i g n i f i c a n t d i f f e r e n c e between t h e two diagramming t e c h n i q u e s , and t h e c h o i c e between them i s reduced t o a mat%er o f p e r s o n a l p r e f e r e n c e .
RELIABILITY TESTS The r e l i a b i l i t y programs € o r b o t h t h e p r o t o t y p e and p r o d u c t i o n c o n t r a c t s i n c l u d e d e x t e n s i v e system r e l i a b i l i t y t e s t i n g i n g e n e r a l accordance w i t h MLL-STD-781. O r d i n a r i l y , system r e l i a b i l i t y t e s t s a r e conducted p r i m a r i l y f o r compliance w i t h MTBF t h e purpose of MTBF measurement o r v e r i f i c a t i o n o f requirements. For t h e SAS, t h e s y s t e m t e s t s were regarded p r i m a r i l y as oppor- t u n i t i e s f o r f a i l u r e cause a n a l y s i s i n o r d e r t h a t c o r r e c t i v e a c t i o n s could b e i n i t i a t e d a t t h e e a r l i e s t p o s s i b l e d a t e . I t is almost a x i o m a t i c i n t h e i n d u s t r y t h a t t h e f i r s t MTBF test w i l l show a n MTBF of about one t e n t h of t h e p r e d i c t e d v a l u e . (Maybe w e were j u s t lucky; o u r f i r s t p r o t o t y p e MTBF test on t h e SAS i n d i c a t e d an MTBF of about one f o u r t h of t h e p r e d i c t i o n , i n s t e a d of one t e n t h . ) Most of t h e f a i l u r e s i n t h e MTBF tests, as w e l l as i n t h e f l i g h t test program and o p e r a t i o n a l mockup ("Iron Bird") tests, showed clear causes i n a c a r e f u l f a i l u r e a n a l y s i s , and c o r r e c t i v e a c t i o n s were i n i t i a t e d f o r t h e subsequent p r o d u c t i o n a r t i c l e s .
MTBF t e s t i n g under t h e p r o d u c t i o n c o n t r a c t w a s d i v i d e d i n t o f o u r phases: P h a s e A c o n s i s t e d of a b o u t 1800 hours of o p e r a t i o n on an incomplete s y s t e m - p a r t l y w i t h p r o t o t y p e hardware and p a r t l y w i t h e a r l y production (unquali- f i e d ) hardware.
Phase B involved 2000 hours of o p e r a t i o n on e a r l y p r o d u c t i o n hardware.
P h a s e s C and D involved 515 hours each, u s i n g f u l l y q u a l i f i e d p r o d u c t i o n hardware.
The purposes of Phases A and B w a s t o determine where r e l i a b i l i t y improve- ments were needed, a t t h e e a r l i e s t p r a c t i c a b l e d a t e . The purpose of Phases C and D w a s t o demonstrate a t t a i n m e n t of t h e r e q u i r e d MTBF.
The r e l i a b i l i t y test environments, both p r o t o t y p e and production, included c o l d soaks and o p e r a t i o n a t ambient t e m p e r a t u r e s up t o 71°C (160OF). I n i t i a l l y , t h e p r o t o t y p e test included p e r i o d s of a p p l i e d v i b r a t i o n a t 33 Hz and 2g amplitude. V i b r a t i o n a t t e m p t s w e r e f i n a l l y abandoned f o r t h e f o l l o w i n g r e a s o n s : a. T h i s Low frequency w a s n o t found t o produce any s i g n i f i c a n t e f f e c t s on equipment f a i l u r e rates.
b. T h i s t y p e of v i b r a t i o n b e a r s p r a c t i c a l l y no r e l a t i o n t o t h e v i b r a t i o n encountered i n j e t a i r c r a f t .
c. Any s i g n i f i c a n t i n c r e a s e i n frequency would r e q u i r e a t o t a l l y new test s e t u p . The s u p p o r t i n g j i g w a s marginal even a t 33 Hz.
EFFECTS OF WEAROUT It i s widely assumed t h a t scheduled replacements i n s e r v i c e w i l l avoid t h e o c c u r r e n c e of normal wearout f a i l u r e s . MTBF is consequently o f t e n considered as a f u n c t i o n of random f a i l u r e rates o n l y ; and s i n c e MTRF i s c u s t o m a r i l y demon- s t r a t e d by tests t h a t t y p i c a l l y o p e r a t e each specimen f o r 500 h o u r s o r less, normal wearout i s seldom s i g n i f i c a n t i n MTBF demonstrations. A s a r e s u l t , w e s e e s o - c a l l e d MTBF v a l u e s of 10,000 o r even 50,000 hours quoted f o r mechanical and hydraul i c equipment items, based only on t h e i r "random" f a i l u r e r a t e s under t h e assumption t h a t scheduled replacement w i l l avoid normal wearout problems.
NTBF i n s e r v i c e , however, i s a d i s t i n c t l y d i f f e r e n t problem. Scheduled replacements a r e seldom s p e c i f i e d o r p r a c t i c e d except where t h e r e is a clear-cut s a f e t y i m p l i c a t i o n . A s a r e s u l t , t h e e f f e c t i v e MTBF on such equipment i s o f t e n f a r less t h a n a p u r e "random f a i l u r e " c o n s i d e r a t i o n would i n d i c a t e .
SERVICE EXPERIENCE
For t h i s r e a s o n , w e k e p t two sets of books on t h e SAS MTBF -- one s e t
based on random f a i l u r e rates o n l y , and t h e o t h e r i n c l u d i n g e s t i m a t e d normal wearout e f f e c t s . Table I shows t h e r e s u l t i n g d i f f e r e n c e i n p r e d i c t e d s y s t e m MTBF, and a l s o shows t h e f a i l u r e e x p e r i e n c e i n s e r v i c e €or c a l e n d a r y e a r s 1972 and 1973. The f o l l o w i n g c o n c l u s i o n s may be noted from t h i s t a b l e : a. The h y d r a u l i c s subsystem shows a d i s t i n c t rise i n f a i l u r e rates from 1972 t o 1973. The 1973 rates a g r e e c l o s e l y w i t h t h e p r e d i c t i o n t h a t i n c l u d e s wearout e f f e c t s .
b . The s e n s o r - e l e c t r o n i c s subsystem shows a d e c r e a s e i n f a i l u r e rates from 1972 t o 1973, i n s p i t e of expected wearout e f f e c t s i n t h e s i x g y r o s . This i n d i c a t e s a mixture o f ' t w o d i f f e r e n t k i n d s of a p p a r e n t i n f a n t m o r t a l i t y e f f e c t s : (1) The u s u a l i n f a n t m o r t a l i t y experienced i n e l e c t r o n i c equipment, i n s p i t e of burn-in p r i o r t o d e l i v e r y .
( 2 ) An improvement i n t h e maintenance o r g a n i z a t i o n s ' f a m i l i a r i t y w i t h t h e equipment, r e s u l t i n g i n b e t t e r repairs and fewer unnecessary replacements.
c. F i e l d e x p e r i e n c e on t h e system as a whole a g r e e s c l o s e l y w i t h t h e p r e d i c t i o n t h a t included e s t i m a t e d e f f e c t s of normal wearout.
The l a s t two columns a t t h e r i g h t of Table I are based on d e t a i l e d a n a l y s i s of two f i e l d d a t a samples which b o t h i n d i c a t e d t h a t about one t h i r d of t h e r e p o r t e d e l e c t r o n . i c f a i l u r e s might b e a t t r i b u t e d t o t r i a l - a n d - e r r o r trouble- s h o o t i n g o r o t h e r d i a g n o s t i c e r r o r s . T h i s s i t u a t i o n i s b e l i e v e d t o be improv- i n g w i t h t i m e and e x p e r i e n c e gained i n t h e f i e l d .
Table I1 shows t h e v a r i o u s t y p e s of mission r e l i a b i l i t i e s experienced i n were no corresponding q u a n t i t a t i v e s e r v i c e i n t h e 1972-1973 p e r i o d . There requirements o r p r e d i c t i o n s .
Table 111 shows t h e SAS f l i g h t s a f e t y r e l i a b i l i t y requirements and p r e - d i c t i o n s . The p r e d i c t i o n s were c a l c u l a t e d b o t h w i t h and w i t h o u t normal wearout e f f e c t s . There have been no l o s s e s to d a t e a t t r i b u t a b l e t o t h e SAS. There w e r e s e v e r a l e a r l y o c c a s i o n s of l o s s of one h y d r a u l i c power supply i n s e r v i c e , due t o - f s t i g u e f a i l u r e s of main pump r i g i d d i s c h a r g e l i n e s which happened t o b e i n resonance w i t h t h e pump p u l s a t i o n frequency. A c t u a l l y , a s i m i l a r f a i l u r e had p r e v i o u s l y occurred i n system r e l i a b i l i t y t e s t i n g , b u t no importance was a t t a c h e d t o i t , s i n c e t h e t e s t chamber space l i m i t a t i o n s r e q u i r e d t h e u s e of plumbing c o n f i g u r a t i o n s somewhat d i f f e r e n t from t h o s e of t h e a i r c r a f t . The l e s s o n l e a r n e d from t h i s e x p e r i e n c e i s t h a t every e f f o r t should be made t o u s e a i r c r a f t plumbing c o n f i g u r a t i o n s i n system r e l i a b i l i t y tests, p a r t i c u l a r l y where t h e r e are conceivable resonance o r f a t i g u e problems.
The system MTBF tests i n d i c a t e d s u r p r i s i n g l y low r e l i a b i l i t y f o r c e r t a i n simple widely used s t a n d a r d o r semistandard h y d r a u l i c components such as accum- u l a t o r s and p r e s s u r e s w i t c h e s . Although c o r r e c t i v e a c t i o n s were i n i t i a t e d , t h e .
f i e l d r e l i a b i l i t y e x p e r i e n c e on t h e s e components is s t i l l d i s a p p o i n t i n g .
CONCLUDING REFARKS The n e x t few y e a r s w i l l see e x t e n s i v e development of e l e c t r o n i c - h y d r a u l i c f l i g h t c o n t r o l systems of fly-by-wire and controls-configured-vehicle t y p e s , performing h i g h l y e s s e n t i a l f u n c t i o n s and w i t h extremely h i g h r e l i a b i l i t y requirements. The B-52 SAS program h a s provided u s e f u l e x p e r i e n c e f o r t h e development of such systems, and has demonstrated t h e need f o r c l o s e a t t e n t i o n t o t h e f o l l o w i n g c o n s i d e r a t i o n s : e Optimization of redundancy management. .
0 Meaningful F a i l u r e ModeIEffects a n a l y s e s w i t h p a r t i c u l a r emphasis on e f f e c t s of redundancy and redundancy management and on e a r l y d e t e c t i o n of p o s s i b l e sneak f a i l u r e modes. References 1, 2 , and 3 a l l p r o v i d e u s e f u l g u i d e s f o r f a i l u r e mode e f f e c t a n a l y s i s .
e Laboratory s i m u l a t i o n of f a i l u r e modes t o v e r i f y e f f e c t s and s e r v e as an added guard a g a i n s t sneak f a i l u r e mode e f f e c t s .
a P i l o t e d s i m u l a t o r programs t o measure p i l o t r e a c t i o n t o f a i l u r e modes where a p p l i c a b l e , under v a r i o u s v i s i b i l i t y and t u r b u l e n c e c o n d i t i o n s .
a Adequate c o n s i d e r a t i o n of wearout e f f e c t s i n mechanical/hydraulic components.
I) Q u a n t i f i c a t i o n of system f a i l u r e mode c r i t i c a l i t i e s t o p e r m i t b e t t e r a l l o c a t i o n of e f f o r t and redundancy.
e Adequate B I T E t o a v o i d t a k e o f f w i t h p o s s i b l e hidden f a i l u r e modes.
e S u i t a b l e p e r i o d i c checks f o r d e t e c t i o n of p o s s i h l e hidden f a i l u r e modes n o t f e a s i b l y d e t e c t a b l e by B I T E .
e Proper r e f l e c t i o n of p e r i o d i c check i n t e r v a l i n r e l i a b i l i t y p r e d i c t i o n s , f o r modes n o t d e t e c t e d by BITE.
i - a Adequate B I T E f a u l t i s o l a t i o n c a p a b i l i t y t o f a c i l i t a t e proper s y s t e m r e p a i r .
a D e f i n i t i o n o f r e l i a b i l i t y requirements f o r supplier-designed components i n terms of f a i l u r e mode e f f e c t s and redundancy management as w e l l as t h e customary MTBF r e q u i r e m e n t s .
e E s t a b l i s h m e n t o f s c h e d u l e t h a t p e r m i t s a d e q u a t e r e l i a b i l i t y t e s t i n g t o f i n d areas f o r r e l i a b i l i t y improvement a t earliest p o s s i b l e t i m e b e f o r e f i n a l d e s i g n f r e e z e .
e Vigorous f a i l u r e a n a l y s i s and r e l i a b i l i t y c o r r e c t i v e a c t i o n program, n o t o n l y i n r e l i a b i l i t y tests b u t a l s o i n o t h e r t e s t areas ( q u a l i f i c a - t i o n , i r o n b i r d , f l i g h t tests, e t c . ) REFERENCES 1 . G o t t f r i e d , P . , Midlam, K., Weiss, D . , B a r n h a r t , P . , and J e t t n e r , E.: R e l i a b i l i t y P r e d i c t i o n Techniques f o r F l i g h t C o n t r o l Systems.
AFFDL-TR-67-20, A p r i l 1967.
2. Crown, Peter L . : Design E f f e c t i v e F a i l u r e Mode and E f f e c t A n a l y s i s .
on R e l i a b i l i t y , Chicago, J a n u a r y 1969.
P r o c e e d i n g s , 1969 Annual Symposium 3 . Greene, K . , and Cunningham, T . J.: F a i l u r e Mode, E f f e c t s , and C r i t i c a l i t y A n a l y s i s . P r o c e e d i n g s , 1968 Annual Symposium on R e l i a b i l i t y , Boston, J a n u a r y 1968.
77 1 _7 "INPUT 1 0,K." SIGNAL T O LOGIC c 1 INPUT 1
-+--
v 1 b CHANNEL 1
U
-
"INPUT 2 O.K." SIGNAL T O LOGIC INPUT 2
--c.---
I c3 r "INPUT 3 O.K." SIGNAL TO LOGIC
INPUT 3 VOTERS (MEDIAN SIGNAL SELECTORS) Figure 2. - T y p i c a l Voter-Comparator Diagram.
W m m G I
7-
a c cd I m
'r
,i.
U W Y- co
+
CO U W N - ;5 W r + Y- a
I - a , +
U Q, I a W N cn Q N E I-
-
+ N O N
k +
I- c o t 0 ‘ W E Y- L D N k Y - N
+
+
cc r Q w k h d t . c Y- m
+ + +
LL 0 L n ‘ LL Ln , d Y - I - Y-
0 -
r + I- I- W Y-
+
I- Y-
+
U Q, d Y- Y ! - (0 W Y- O -I W N
+
Y-
>
I-
I- +
-
W W W U k d 0 0 Y- z n
+
I
+
W W I- I- W d !is Y- d U Y- L O a
+ W
n
+ O J
v) I n N d d r cc Y- e Y- I- W
+
w
+ I
I I- m a ,
N - d
Y- N N Ln W Y-
Y - N
I -
+
v) W U W N -’ N D \ Y- W
-
r Y
0 z
z h E
+
W z Y- LL I- a
-
W
+
r Y-
r
+
+
I- Y- 0 v - A I-
+
>
c Q, cc W
W Y- +
v)
+
I n
03 Y- r
-?- W I- Y-
+ LL
I-
% +
W W 0 W Y-
z
CO W Y- t
+
Y- 0 I-
+
-
+
cn -’ W
-
a W m rn
+
v) k
+
+
h co
- W
uj m U W I- 01
- Y-
n
+
+
W n II n 2 0 0 5 0
-
N r I- I W N N
-
n I-
- r
I- vi m Q I W Y- N
>
+
v) 1 I-
t - co -
- I- N
- co
F
-
F \c O N T-
- I-
--.
I-
z
m ! - I Y
I * 8 43
Y- I 0 N a 0 w
Y +
I- N 0 N
1 0 - -
O I- m r T- I- F co
- C
c c
-
-4- CO I- O F a N
- Y- +
I * O co I Y- M I d Y Y- N N
+ 0
-
I- I- - co
-- Y Y
Y- T- Y T- I- M 3 0
a3 Y - ! ? %
N Y - 4 - Y- W N l W I - N a n t v) cc
z -
-
* 8
4 h T - m N I- I - - F Q I-
z %
I v) w r CT n w Y - ! ?
u1 N 5 - N i-
+
I- t-
-
L -
I m
a F
U m 03
-
Y- m I
+
z
-
co Y- t-
Q +
co co Y- Q
+
>
z co
- r
M Y- c c v ) M I-
z
W Q d Y- Y
z
T- v) co (3 Y Y- v
z
a
+
W I -J T- I- I N I-
-
..
m
-
+ M 11 U T- T- F W
Y 1 -
It II n N Y E TABLE I MTBF COMPARISONS PR EQlCTl ONS AFM-66-1 SERVICE DATA BASED O N ITEM TEST EXPERIENCE COUNTING A L L COUNTING 2/3 REPORTED OF REPORTED ELECTRONIC ELECTRONIG ' N O WITH FA1LURES FA1LURES P I WEAROUT WEAROUT I 1973 1972 1973 SENSOR/ELECTRONICS SUBSYSTEM 5.077 7.459 9.756 8.705 6.504 5.803 I HYDRAULICS 2.553 7.271 5.306 7.564 5.306 7.564 0.857 IVllSCELLANEOUS 1.69'7 1.697 0.601 0.601 0.857 SYSTEM 9.327 16.427 15.663 17.126 12.411 14.224 MTBF, HOURS 107 61 64 58 81 70
-
- -
MTBF GOAL I TABLE I1 SAS MISSION RELIABILITY COMPARISONS BASIS: SAC AIR VEHICLE PERFORMANCE REPORTS, 1972 AND 1973 ITEM LI AB1 L I TY RE FLIGHT RELIABILITY: PROBABILITY OF NO FLIGHT ABORT DUE TO SAS 99.96% PROBABILITY OF NO SAS FLIGHT ABORT OR MAJOR 99.58% DEGRADATION* I N FLIGHT DISPATCH R E L I A 61 L I TY : PROBABILITY OF NO LATE TAKEOFF OR CANCELLATION 99.73% DUE TO SAS COMBINED RELlABl LlTY: PROBABILITY OF NO SAS FLIGHT ABORT, MAJOR 99.31% DEGRADATION, LATE TAKEOFF, OR CANCELLATION ~ ~~~ i *INCLUDES LOSS OF PRESSURE FROM ANY OF THE FOUR PUMPS.
TABLE 111 SAS FLIGHT SAFETY RELIABILITY FLIGHT SAFETY AIRCRAFT LOSS RATE DUE R EL I AB1 L I TY TO SAS, PER lo6 FLIGHTS GOAL 99.999182% 8.18 PREDICTION (NO WEAROUT) 99.999798% 2.02 PREDICTION (WITH WEAROUT) 99.999508% 4.92 EXPERIENCE TO DATE N O LOSSES NO LOSSES