Document
NASA-TM-88271
/1F6tJ2J~D:311
NASA Technical Memorandum 88271
Experience With Synchronous
and Asynchronous Digital
Conltrol Systems
Victoriia A. I~egenie, Claude V. Chacon, and Wilton P. Lock
LIBRARY COpy
FEB 2 2 3lO6
NASA LANGLEY RESEARCH CENTER HAMPTON, VA August 1986
ruM;1\
National Aeronautics and Space Administration 1111111111111 1111 11111 11111111111111111111111 NF00965
· \\\\~'\'\I~~~lnl\\\\~\\\\1
3 117601497 1932 NASA Tc~chnical Memorandum 88271
EXI~erience With Synchronous
and Asynchronous Digital
Control Systems
Victoria A. Regenie, Claude V. Chacon, and Wilton P. Lock Ames RElsearch Clmter, Dryden Flight Research Facility, Edwards, California
NI\S/\
National Aeronautics and Space Aclministration Ames Re:search Center Dryden Flight Research Facility Edwards, California 93523·5000 EXPERIENCE WITH SYNCHRONOUS AND ASYNCHRONOUS DIGITAL CONTROL SYSTEMS Victoria A. Regenie,* Claude V. Chacon,** and Wilton P. Lock** NASA Ames Research Center Dryden F"' i ght Research Facil ity Edwards, California Abstract controlling unstable aircraft. To allow the most flexibility in aerodynamic design, both Fl ight control systems have undergone a military and commercial aviation programs are incorporating digital flight control systems revo' ut i on s i nc:e the days of s; mp 1 e mechani ca 1 linkages; presently the most advanced systems in aircraft design. With the use of advanced control systems, the aerodynamic design can are full-authority, full~time digital systems controlling unstable aircraft. With the use incorporate features that allow greater per- of advanced control systems, the aerodynami c formance and fuel savings, as can be seen on design can incorporate features that allow the new Airbus design and advanced tactical greater performance and fuel savings, as can fighter concepts. These advanced aircraft be seen on the new Airbus design and advanced designs will be and are relying on the flight tactical fighter concepts. These advanced control systems to provide the stability and aircraft will be and are relying on the flight handling qualities required for safe flight control system to provide the stability and and to allow the pilot to control the air- handling qualities required for safe flight and craft. As the criticality and number of to allow the pilot to control the aircraft. these control systems increase, it becomes Various design philosophies have been proposed increasingly important to understand issues and followed to investigate system architectur'es related to the development of a system that for these advanced flight control systems. One will provide maximum protection with minimum major area of discussion is whether a multichannel cost and minimum maintenance. Various design digitill control system should be synchronous or philosophies have been followed and proposed asynchronous. This paper addresses the flight related to system architectures for these exper"ience at the Dryden Fl i ght Research Faci 1 ity advanced flight control systems.
of NASA's Ames Research Center with both synchro- nous and asynchronous digital flight control One major area of discussion is whether a systems. Four different fl1ght control systems multichannel digital control system should be are evaluated against criteria such as software synchronous or asynchronous. Asynchronous sys- reliability, cost increases, and schedule delays. tems are propounded to provide greater protec- tion against lightning and electromagnetic Nomenclature compatibility interference. These systems are also expected to provide greater battle damage AFTI advanced fighter technology integration protection. Synchronous systems are said to be more reliable and to provide lower design and CAS control augmentation system test costs. A majority of the digital flight control systems that have been flown are syn~ CBS computer bypass system chronous; only a few are asynchronous. Examples of synchronous digital .fl fght cOr'Itrol Systems DFBW digital fly-by~wire include the F-8 digital fly-by~wire (DFBW), F~18, F-15 digital electronic flight control system DEFCS digital electronic flight control system (DEFeS), and forward~swept-wing X~29A. Asynchro~ nous systems include the advanced fighter tech- HiMAT highly maneuverable aircraft technology nologyintegration (AFTI) F-16 and thl'! resident backup software (REBUS) system, an experimental 1/0 input-output backup system for the F-8 DFBW aircraft. Both the United Kingdom and Sweden have flown asyn- IPCS integrated propulsion control system chronous digital flight control systems as well as the more conventional synchronous systems.
LVDT linear variable differential transducer The Dryden Flight Research Facility of NASA's REBUS resident backup software Ames Research Center (Ames-Dryden) has experience with both synchronous and asynchronous digital RPRV remote"'y pi loted research vehicle control systems on advanced high-performance air- craft. The first digital fly-by-wirl'! aircraft, SAS stabi 1 Hy augmentat ion system the F-8 DFBW, developed and flown at Ames~Dryden in the mid-1970s and still in use as a research Introduction vehicle, includes a triplex synchronous digital flight control system. The REBUS system, an Fl i ght contl'ol systems have undergone a experimental dissimilar backup system incorpor- revolution since the days of simple mechanical ated in the F-8 DFBW primary flight control linkages; presently the most advanced systems system, consists of three asynchronous elements.
are full-authorHy, full-time digital systems The h19hly maneuverable aircraft technology (Hit1AT) vehicles (subscale, remotely piloted research vehicles (RPRV) flown at Ames-Dryden *Aerospace engineer. Member AIAA.
in the late 19705 and early 1980s) included **Aerospace engineer.
advanced derodynamic configuration and advanced asynchronous impacts the design of the control technological concepts (such as digital engine laws and redundancy management functions. Con- versely, the requirements for the redundancy and fl ight control) and used synchronous and asyn·· chronous :systems combi ni ng ground and onboard com- management functions and control laws impact the system architecture decision. The types of input- puters. The AFTI/F-16 aircraft, currently flying output (I/O) selection and monitoring and the at Ames-Dryden, is an F-16 airframe with a dorsal fairing (to house instrumentation) and vertical tolerance windows (the amount a signal can vary from other like Signals and the length of time it canards (for advanced flight control application) added; it Is contro'lled by a triplex asynchronous can remain different before it is declared failed) for failure detection depend on whether the system di gita I f'Ji ght control system. These represent a range of digital flight control systems, from is synchronous or asynchrounous. The tolerance very simple to highly complex. The systems have windows for failure detection must be larger for employed '/arious levels of redundancy, ranging asynchronous systems to account for skew differ- from one sensor to six identical sensors. systems can use the synchronization signal, but asynchronous systems must use a different method, Thi s paper desc,"i bes fl i ght experi ence at such as tolerance windows or number of output Ames-Dryden with both synchronous and asynchronous failures. The type of data to be transferred and digital flight cont,"ol systems. The unusual how often they will be transferred also need to architectlJres of thl! F-8 DFBW, HiMAT, AFTl/F-16, be considered in the system architectural design.
and REBUS systems are discussed and evaluated. The capability of a system to reset or restart can Benefits and deficiencies for both types of archi- also impact and be impacted by the system design.
tectures are discussed, and any conclusions that The control laws will rely on the system architec- can be made from thl~ flight data are included. ture in terms of the accuracy of the data they will be using.
The authors wou'ld like to thank Kenneth J.
Szalai, Robert W. KI!mple, Dwain A. Deets, Each of the two system design concepts, Stephen D .. Ishmael, and Capt. Mark L. Joyner asynchronous and synchronous, has advantages and disadvantages. For synchronous systems, for their previous work in this area.
advantages include ease of verification and Issues of Asynchronous validation, ease of failure detection, and ~nchronous Systems predictability; disadvantages include reliance on other channels and additional software and hardware requirements for synchronization. For The majority of digital flight control systems currently operating are synchronous. The systems asynchronous systems, advantages l~clude channel are synchronized through a combination of hardware independence and reduced hardware; disadvantages and software. At specific points in the software include unpredictability, difficulty in verifi- an instruction triggers a hardware circuit to send cation and validation, and more complex soft- ware for failure detection. These advantages a discrete signal to other identical computers, ca 11 ed ch,~nne 1 s. Each channel recei ves thi s syn- and disadvantages can be evaluated in terms of chronization signal and begins to process speci- reliability, costs, and schedule delays.
fied software. Thus, each channel is operating Reliability, which can be defined as the at the same poi nt in the software cycle at any given tim.!. If the synchronization signal is not inverse of the number of in-flight nonnuisance received within predetermined time constraints, fa 11 ures, is a cri t i ca 1 parameter in fl i.ght the chann.! 1 transmi tt i ng the synchroni zat ion si g- safety or mission completion and can also have considerable effect on cost and schedule. Cost nal is declared failed, as are all the data it transmits. The system can be synchronized at and schedule can be evaluated through the devel~ different levels, such as once each frame or at opment cycle for the digital flight control sys- any subfr;!me. Data in synchronous systems are tem, including verification and validation time passed during specHic time periods, and the othe," and flight operation. Delays in the schedule channe 1s ,expect to recei ve these data at the caused by design problems discovered during pre- proper time. If the data are not received when liminary testing increase the cost of the program, expected, the transmitting channel is' declared as do verification and validation testing prob- fail ed. The synchronizat i on peri od is determi ned lems. Any problems discovered in flight during by the digital flight control system requirements, the flight test portion of the program, especially those connected to flight-critical functions, have Asynchronous systems operate without a syn- considerable impact on reliability, cost, and schedule for the program. Any problems requiring chronization Signal. Even though each digital flight control system channel is identical, with extensive redesign discovered during the verifica- the same clock rates and initialization point, tion and validation or flight test portion of a small differences between channels occur because program have major impacts on the program. Prob- of hardware tolerances. The skew (or timing lems discovered in the operational environment dHferenc.!s between channels) varies, and each have a major impact on the cost of the system, channel c,ln be operating at any point in its often causing the aircraft to be grounded until software cycle at any given time. In asynchro- the problem is fixed. However, operational prob- nous systl!ms, data are passed when available, and lems are not discussed in this paper, because the the other channels access the data when they are experience at Ames-Dryden is with experimental ready. The health Ilf other channels is determined aircraft, not operational aircraft.
by data cllmparisons and other information from the other channels.
Aircraft Systems Descriptions The dl!cision concerning whether the digital Short descriptions of the F-8 DFBW, REBUS, fl ight control systl~m will be synchronous or HiMAT, and AFTI/F-16 flight control systems are presentl!d to provide a background for the results is also provided, as well as an autopilot for and conclusions. The F-B DFBloI, REBUS, and AFTI/ altitude hold, Mach hold, and heading and turn F-16 di!Jltal flight control systems are described control. The inner-loop control law functions in more detail in Refs. 1 to 4. A detailed des- are computed at a 20-msec frame rate, while cription of the HiMAT system is to be included gain updating and autopilot functions operate I n a NASA report, "Flight Control Systems Deve 1- at a rate of 80 msec per frame. The pitch CAS opment alnd Flight Test Experience With the HiMAT and the lateral-directional SAS contain sched- Vehicles," by Robert W. Kempel and Michael R. uled rate gain and accelerometer feedbacks Earls (in preparation). The effects of the with forward-loop integrators. The control system's architecture (synchronous or asynchro- laws were designed to be complicated enough nous) are included with the descriptions to pro- to investigate the interactions between the vide a greater understanding of the test results control laws and the redundancy management and thus the evaluation of the two architectures. functions in a synchronous system.
The software cycle, frame time, and' control law complexity are described. Other major elements The redundancy management and fault detection of the digital flight control system. such as I/O portion of the F-B DFBW software selects the mid- selection and monitoring, self-test capability, value of three good sensors or the average of two reset-restart capability, and control law modes, good sensors after a single failure. If two like are also described. sensors have failed. a default value is used, and the function or mode requiring the failed-sensor F-B DFBW information is inhibited, resulting in the loss of capability or mode. This function Is performed An F-B aircraft (Fig. I) was modified to on all vital input sensors, such as motion sensors include a fail-operate. fail-safe, fly-by-wire and control inputs. The CBS monitors output com- flight control system that consists of a full- mands using a midvalue selection technique and authority, triplex" frame-synchronized digital also compares the midvalue to the channels' actual system with a trip"lex analog computer bypass values. If a failure is detected in the output, system (CBS) as badup. The fl I ght control sys- the analog channel is switched in to replace the tem (Fig. 2) encompasses triply redundant Input failed digital channel. A second failure of a motion sensors and controllers, triple interface digital channel transfers all channels to the units, cockpit controls and displays, and sec- analog system. As a synchronous system, the F-B ondary actuators. The flight control computers DFBW computer system uses its sync discrete and operate the basic loop in 20 msec. The input the channel's data transfer capabilities, the and output signals for this synchronous system data transmitted at the correct time, to verify are processed through the interface units (one the health of the digital channel. A self-test for each digital channel). The channels do not capability is included in the system to allow transfer data directly to the other channels, the computers to determine their own health and which avoids timin9 problems associated with status. An automatic restart capability is transmitting and receiving data Simultaneously. Included in the system deSign to initialize the The interface units provide signal conditioning channels 'at initial power up and in the event of and buffl!r memory for all Input data, process pow~r disruptions, crosslink failures, or self- output 5'Ignals, provide interchannel communica- test failure detection.
tion, and participate in the failure detection and redundancy management functions. The buffer memory in the Interface units consists of data from each channel, one buffer per channel per An experimental dissimilar backup system, InterfaCE! unit, which allows each computer to REBUS (Fig. 3), was incorporated into the F-B have aCCE!SS to the other channels' data. The DFBW system to investigate the concept of dis- synchronous operation of the system assures that similar software as backup for the primary sys- each channell 5 ope rat i ng on the same data at the tem. To include software dissimilar from the same timE!. The pilot control panels allow the synchronous F-8 DFBW system, the REBUS system pilot to select control modes for each axis and to is asynchronous, operating at a 20-msec frame select autopilot capabilities, while the display rate. Each of the triplex REBUS channels pane 1s armunci ate s'ystem status and fa 11 ure infor- operates on dedicated sensors, with the channel- mation. The CBS provides actuator controls for sensor unit Independent of the operation of the backup control, selection logic. and output fail- other units to avoid asynchronous data cross- ure detection and provides an analog link from strapping problems; each channel operates on the pilot controls. The secondary actuators on slightly different input due to computer skew.
the F-B DFBW aircraft are triply redundant and The control laws provide minimal augmentation, contain three Independent electrohydraulic chan- little more than the capability to return to nels with independent hydraulic fluid, differen~ base and safely land. Three-axis fixed-gain tlal pressure sensors, and linear variable dif- rate damping with some nonlinear stick shaping ferential transducer (LVDT) position sensing.
and deadbands comprise the control law design.
The REBUS system does modify the gains for The F-8 DFBW aircraft does not require a landing and approach, but the up-and-away gains complicated control system for stability augmen- are constant throughout the flight envelope.
tation, but for experimental purposes, pitch and Transfer to the REBUS system from the primary lateral-directional stability augmentation system system occurs as a result of channel failures.
(SAS) modes were developed. The pitch axis mode The REBUS software is initialized using a full also includes a more complicated control augmen- complement of sensor inputs and existing control tation system (CAS) mode. A direct mode, which surface commands.
dup I i cates the unau!lmented F -B system for pi tch, In the relaxed-stability operation, a fixed- .!:!..iMAT gain pitch rate feedback loop was included in the onboard primary control system to reduce excessive The HiMAT vehicles were air launched from a B·,52 aircraft and remotely controlled by a pilot system time delays. As in the stable condition, located in a ground cockpit (Fig. 4). Tne primary the primary control system included it launch mode and a degraded primary mode. The backup control control laws were resident in a ground-based com- system for the relaxed-stability operation con- puter with the backup control system included in the onboard backup computer. Tne onboard com- tained seven modes (listed in Table I) and was puters operated asynchronously with the ground a full-authority, three-axis, multirate system.
system and each other. The backup system coul d The backup control system was always initialized be controlled from either the ground or a TF -104 through the recovery mode, which brought the air- craft to a straight-and-level flight condition.
chase ai rcral't.
Once the HiMAT vehicle was in a straight-and- The advanced concept s inc I uded in the H1I1AT level flight condition, the backup control sys- tem would transition to heading hold mode and e~periment were composite and metallic structures, close-coupled canards, aeroelastic tailoring, altitude hold mode, If no other comm~nd was digital integrated propulsion control system received by the heading hold mOde or altitude (IPCS), relaxed static stability, and ground hold mode within 25 sec, the backup control sys- and airborne digital fly-by-wire controls. The tem W01Jld transition to the orbit mode. Airspeed design maneuverability goal, a sustained 8-g turn hold mode and landing mode were also included in at Mach 0.9 and an altitude of 25,000 ft, was the backup control system.
achieved during flight test along with sustained supersonic flight. Dual onboard computers, The asynchronous interactions of the airborne opc!rat i ng asynchronous ly, provi ded the i nter- system with the ground system and the ground rule faces with the ground and various vehicle sub- that no single failure would result in loss of sy:;tems, and each provided independent capabi lay the ve~icle resulted in a complex design for the fOl' a safe return. The system also included dual HiMAT f1 i ght systems management funct ions. Data ell!ctrical, hydraulic, and flight control systems transfer was minimized by allowing each computer (dl!S i gnated as primary control system and backup to operate independent functions that required control system) as well as triplex angular rate little or no dnta exchange. The faults detected by the onboard computer system included those that sensors for all three axes, triplex lateral and nor-mal accelerometers, and duplex air data sensors caused automatiC transfer to backup mode, those (Fig. 5). A single sensor of each variety was that prevented automatic transfer to baCKUp mode, designated as backup sensor, and only it was used those that indicated mission abort conditions, by the backup control system; the primary system and thc)se that indicated caution conditions. The USE!d a 11 the sensors. The servo actuators were onboar,j computer faul t detection incl uded actuator int.erfaced to the onboard computers through a monito,-ing, hydrauliC system monitoring, electri- ser'vo actuator electronics box, which translated cal sy';tem monitoring, uplink system monitoring, downl1nk system monitoring, and computer self-test thE~ servo COlllnands, fed back the actuator data, anel prov1ded failure detection for the elevon diagnostics operating in the primary computer.
seno actuator system. The uplink system monitoring and computer self- test diagnostics were duplicated as independent The HiMAT vehicles were tested in two con- functions in the backup computer. The ground figurations, one with relaxed static stability failure detection and management for the single- and one with Ilositive stability margins. The string ground system included downlink integrity testing, uplink integrity testing, real-time loop stable configuration control laws were full- authority rate-damper systems. The control integrity testing, computer heartbeat monitoring, system includE!d a launch mode to assure separa- stick input checks, I/O testing, air data testing, tion from the carrier aircraft and a degraded and an9Ie~of-attack testing.
primary mode, which was selectable by the ground pflot and allowed the pilot to maintain conven- AFTI/F .. 16 tional control for conditions such as loss of power in an engine-out situation. The pilot was The F~16 airframe is statically unstable in given the option of choosing the degraded primary the pitch axis, necessitating a full-time, full- mode or the backup control system. authority fight control system. The AFTI/F-16 aircraft (Fig. 6) was developed with a triplex, The backup control system for the stable asynchronous flight control system. Goals of aircraft contained a variety of automatic modes to this system included dual-fail operate capability enSIJre recovery of the HiMAT vehicle from unusual and thl! development of advanced control modes for or I~xtreme conditions and to provide a safe return decoup;ed motion. The flight control system capilbil1ty. The backup control system was also consists of three computers, an actuator inter- capable of orbiting at a specified altitude when face Uflit, integrated servo actuators, a fli ght ther'e was a loss of uplink or downlink signal. control panel, and associated sensors, control- The backup control system was a multi rate system lers, ~nd pilot displays (Fig. 7). The system opel'ating at 10-, 20-, and 100-msec frame rates. also includes a limited triplex analog inde- The onboard computer system also provided total pendent backup unit. The asynchronous flight control of the H1MAT engine with the primary IPCS ,control computers are identical and operate res vdent in the backup computer and the backup , at a frame rate of approximately 16 msec, with IPCS included in the primary computer. The IPCS some functions operating at about 31 and 25 msec.
included a normal operation mode, it combat mode, The primary sensors (pitch rate gyros, roll rate and a high-stability mode. gyros, and yaw rate gyros) are triply redundant.
command failures are used to identify a failed Thl! primary c.ontrollers (pitch stick, roll stick, and rudder pedals) operate on three active and computer; two surface command failures in a given one backup transducer. An additional triply channel indicate a defective channel, and all sur- face commands are assumed failed in that channel.
redundant controller was added to the throttle A detected failure is reported to the failure (ali a throttle twist grip) to provide decoupled pit.ch control. The primary pilot-vehicle inter- manager, which then takes the appropriate action.
fa(:e consists of two multipurpose displays that The preflight monitoring uses both passive and provide dual-redundant digital flight control active testing to determine the status of the system mode and control status as well as weapons flight control computers, actuators, various management. The integrated servo actuators con- input sensors and controllers, and the analog ba(.kup system. A reset capabll ity is included tain three electrohydraulic valves operating with to allow the processor to reset a transient two independent hydraulic fluid sources, differ- ential pressure sensing, and lVDT pOSition feed- failure or for nuisance failures caused by asyn- chronous data transfer in any of the flight con- back sensors.
trol system input sensors, controllers, actuators, The AFTI/F-16 system contains eight complex or processors. An independent I/O capability is modes (Table 2) with multiple submodes controlled included in the redundancy management design of by internal switching within the primary modes. the AFTI/F-16 flight control system to allow the These submode switches. in combination with the loss of only the processor, not the I/O infor- asynchronous operation of the system generated mation, in the event of a digital channel failure.
difficulties in both ground and flight test. The tranSition to the analog independent backup Because of the static instability of the pitch unit occurs only if the system cannot determine axis, all the longitudinal modes require pitch which of the two remaining channels is good after feedback, in cruise conditions as well as takeoff an output failure or self-test failure detection.
and landing. The standard normal mode is used for Test Experience takeoff and landing as well as cruise and is the primary digital mode for all failure conditions.
Within this standard normal mode are conditions All the flight control systems described in that allow the control laws to reconfigure for this paper experienced extensive verification sensor and controller failures, which were never and validation and ground testing prior to being flight tested. In this section, the results flight tested, as well as for landing and takeoff conditions. Along with the primary standard normal of testing for each flight control system (after mode, three other standard modes are implemented the elimination of coding errors, which are not to provide task-tailored control, air-to-air gun discussed here) are compared and evaluated against mode, air-to-surface gun mode, and air-to-surface the criteria discussed previously: reliability, bomb mode. Each of these modes, including the costs, and schedule delays. The results of for- mal verification and validation testing, on- standard normal mode, have decoupled counterparts that can be selected through a switch on the side- aircraft ground testing, and flight testing are stick controller. These modes, with the exception included. Short descriptions of the actual of the no-fail condition of the standijrd normal testing are included as background to the test res~lts themselves.
mode, contain multiple conditions for submode switching. The various modes and their command options are shown in Table 2. The decoupled modes F-8 DFBW allow independent control of specific aerodynamic parameters, such as angle of attack, angle of As a new and untried experiment, the F-8 DFBW sideslip, pitch attitude, and yaw attitude, as fli1ht control system went through extensive anal- shown in Fig. 8. ysis (described in detail in Ref. 1) before and during the design process in order to validate the To deal with the asynchronous interactions and design: this level of analysis greatly facilit~ted the dual-fail operate goal using a triplex system, the testing. The actual system testing was broken the redundancy management software design for the intI) two areas, subsystem testing and integrated AFTI/F-16 fli!lht control system is as complex as sys~em testing, both of which included breadboard, the control law design. Software input voting iron bird, and flight testing. The verification for the redundant sensors, output voting for and validation testing consisted of independent actuator commands and status, health checking system testing, stress testing, and fdilure modes of computer hardware, and preflight systems and effects testing. The majority of the indepen- monitoring ar,! the major elements of the fail- dent system testing for the F-B DFBW design at ure management system. The input sensors, Ames-Dryden was done on the iron bird and covered controllers, dnd discretes are hardwired into control laws, executive, computer I/O, computer each computer channel and then digitally trans- redundancy management, sensor redundancy manage- mitted between each asynchronous channel. The ment, in-flight self-test, preflight test, channels then independently seler.t the appro- displays and controls, primary-bypass system pri,lte input by averaging the nonfailed like transfer laws, and downlink system. Because sensors. The output commandS for all surfaces the synchronization was critical to the system are transmitted to each channel and selected, operation, extensive synchronization testing much like the input sensor signals. Unlike the was done, including tests of the time required input sensor algorithm, the output command selec- for all channels to acquire sync and tests of tion chooses a single channel's output as deter- skew between channels as they exited the sync mined by internal logic. This output selection routine. Occasionally during early testing, method was developed to maintain reasonable trip a channel sporadically lost sync, or all three lev(!ls in the asynchronous system with reduced channels failed to achieve sync upon power up: nuisance failures at the actuator level. Output consequently, the software was modified. The HiMAT failures were due to synchronization being sched- uled at a point that was subject to timing varia" The HiMAT flight control system went through tions. The skew measurements indicated that a several levels of tests (to be described in detail value of less then 10 ~sec was typical. Another in the Kempel and Earls report, in preparation) anomaly diSCOvered during the early stages of to qualify the system for flight. Each sub- testing was a fai"lure of the system to downmode to the computer bypass system after a dual failure system, each subsystem interface, and the of the input data line. The early detection of integrated system were tested utilizing test these anomalies minimized their impact on costs configurations that varied from an all-software simulation to an iron bird simulation. The iron and schl~dule.
bird simulation included all the actual hardware and software used duri ng a f1i ght and the Hi MAT The next level of testing involved stress test i ng I a sequenc:e of ope rat ions often not con- vehicle. The testing included verification and sidered in the design phase and one that exposes validation (consisting of subsystem functional problems not readily apparent In previous tests. tests, failure modes and effects tests, and time The majority of the problems found by stress test- delay tests), on-aircraft ground tests (consisting ing wer(: related to the restart recovery process of 'closed-loop control system tests, limit cycle tests, ground resonance tests, and preflight of the 1'-8 DFBW system. The anomalies discovered through stress testing had a greater impa~t on tests), and flight test.
cost a nil schedul e than those di scovered duri ng i ndepen(Jent system tests, but they were di scovered Problems in both hardware and software were revealed during the testing. Two major anom- early enough in t.he cycle to minimize the impact.
The minor anOmaliE!S from the piloted failure modes alies were discovered during the on-aircraft and eff(!cts testing (such as the slow detection ground testing: First, asynchronous operation of open failures Clf stick and rudder inputs and in combination with the high data rate from the runaway rudder trim) had little impact on both ground-based uplink caused a failure of the costs and schedule!. All the software errors dis- onbOArd computer. The onboard computer spent covered during the verification and validation too much time servicing the uplink and did not testing were corrected and retested satisfactorily accomplish other critical tasks. Second, hard failures in the uplink system were interpreted prior to the on-aircraft ground testing. Table 3 as intermittent failures by the onboard com- summari l:es the anoma 1i es discovered duri ng veri fi- puters because the persistence counter was being cation clnd validation testing and their impact on cos ts arid schedu Ie. incremented after the maximum persistence count had been reached. The counter in the onboard computer would eventually wrap around, and the Frequent Channel fai I ures were caused by com- puter h~rdware problems during the on-aircraft failure would be reset to be declared failed integration test and continued for the duration again when the counter reached the maximum per- of the program. The flight test results for the sistence count again. Both of these anomalies program were excellent, with very few problems. were corrected prior to flight test, the first Anomalies discovered during flight test included through a hardware modification and the second three single-channel hard failures due to hardware through a software modification. Both anomalies faults and one transient channel fault. No soft- were discovered after verification and validation ware anomalies were discovered in flight. but but prior to flight test, thus requiring time to several were discovered in either ground operation modify and retest.
or postflight analysis of the F-8 DFBW flight test Flight test of the HiMAT system revealed data. None of the errors discovered invalidated the fail-operate requirements of the digital three anomalies, one with major impact to the flight control system, and no nuisance faults, program. Transient failures occurring in flight aside from hardware-related problems, occurred. would reset faster than coUld be detected by the The software anomalies detected in the approxi- monitoring engineer. A latch was added on the mately 1750 hr of flight time and postflight ground to keep the transient failures displayed analysis are shown in Table 3 along with their long enough for the failure to be detected by impact on costs and schedule. Testing on the the responsible engineer. Another minor anomaly F-8 DFBW. both prior to and during flight test, involved round-off errors in the onboard comput~r; did not reveal a large number of anomalies, indi- the pilot had to advance the throttle past the cating high software reliability and low cost and minimum afterburner position to get the after- schedule impacts. burner to light. A software change was imple- mented in the onboard computer, allowing normal operation of the throttle. Both of these anom- alies were nuisance problems and did not prevent In both ground and flight testing of the operation of the system. However, a timing prob- REBUS sy:stem, no anomalies occurred. Prior to lem was discovered in flight that resulted in a f1 ight, an eva I uat 'Ion of the trans i ent response gear-up landing, having major impact on the pro- of the a'i rcra ft on revers i on to REBUS was made; ject. One of the uplink decoders failed, and the no transients were considered to be severe, which onboard computer would not accept the automatic was veri'fied in flight. The two pilots who eval- sequence of commands required to lower the landing uated REBUS felt tllat it was acceptable for emer- gear. This failure condition was caused by the gency opl!rations arid that it was an improvement change in filtering applied to the uplink signals on the computer bypass mode. Table 4 summarizes when that decoder failed'. If the other decoder the impal:ts on reliability, costs, and schedule had been the one to fail, the filtering would not of the RI,BUS fl1 ght: control system.
have been affected, and the problem could possibly the flight control system. The avionics system have gone undetected. Again, the onboard computer failure induced random mode changes in the flight software was changed to correct the problem.
control system at very high rates; consequently, the flight was discontinued, and the aircraft The majority of these anomalies discovered returned and landed. A software modification was during testing were related to the interfaces between different components of the asynchronous made to the digital flight control system (rather system" These types of problems can be detected than to the avionics) to prevent a reoccurrence only in an integrated environment that exercises because the failure could not be duplicated and the system in the same way it will be used during did not reoccur. One major result of the first phase of the AFTI/F-16 program was that through- flight.. Table 5 summarizes the HiMAT anomalies and their impact on reliability, costs, and sched- out the flight test program no failure caused a reversion to the independent backup mode. The ule delays.
failures discovered during the testing of the AFTI/F-16 system are summarized in Table 6 along AFTI/F··16 with their impact on the software reliability, costs, and schedule.
The AFTI/F-16 system began verification and validation testing prior to completion of the software integration and debug stage; however, Digital Flight Control Systems Evaluation testing did not officially begin until all the A 11 four ai rc'raft completed successful f1 i ght coding errors in the system had been tested and corrected. Early in the testing process it was test programs with the number of anomalies occur- di s tovElred that the hi gh-ga i n cont 1'01 1 aws were ring varying from one program to another. The i ntera(:t 1 ng adversely with the redundancy man- four digital flight control systems, F-8 DFBW, agement software. This interaction magnified REBUS, HiMAT, and AFTI/F-16, are evaluated in the differences in input values resulting from relationship to software reliability, increased asynchronous skew to create output and channel costs, and SChedule delays. Software reliability, failurE~. After the gains were reduced, output defined as the inverse of the number of in~f1ight and ch~nnel failures still occurred. The gain nonnuisance failures, was high on all the flight magnification of input differences exceeded control systems, and all systems were proven safe the out.put tolerance during dynamic maneuvers, throughout their flight envelopes. The F-8 DFBW resulting in the addition of a rate-of-chaRge aircraft experienced no software-related problems factor to adjust the output tolerance. Both in flight, though some were discovered in post- condftlons were discovered prior to the actual flight analysis. The REBUS system exhibited no verification and validation and had minor impacts anomalies during ground or flight test. The on both costs and schedule. Major anomalies HiMAT system had one major in-flight anomaly, disLovered during the verification and valida- Which resulted in a gear-up landing on the lake- tion testing jnc1uded air data and bus conten- bed, and two minor anomalies. 1he AFTI/F-16 tlo~ anomalies. An undetected bias failure 1n aircraft experienced nine in-flight anomalies air data below the IS-percent trip level would during the first phase of the program. In terms cause channel failures; a bus ,ontro11er conten- of reliability, the two highly complex, asyn- tion problem could cause loss of the digital chronous systems. the HiHAT and AFTI/F-16, had flight control system. Both anomalies required the most in-flight anomalies.
soft~lare modi fi Cilt ions but were di scovered early enough in the project development to have only Seven of the nine AFTI/F-16 anomalies were moderate effects on costs and schedule. due to a comb; nat; on of asynchronous operation, complex control laws, and complex redundancy Greater cost!; and schedule delays were management design. These problems were related incurred from thE! results of the ground gunf; re to the procedure of crosslinking data between tests. The V'ibrCltion in the lateral accelera- channels and then USing a good-channel average; tions and yaw rate from the gun firing caused the skew between channels was often just suf- output and channEll failures because of the high- ficient to cause the channels to use inputs dif- gain magnificatic)O. The time required to modify fering enough that output failures or channel and ret,est the software pri or to flight test failures, or both, resulted. The asynchronous generahd a delay in the schedule. Flight test operation of the AFTI/F-16 system increased the results of the AFTl/F·16 system included nine complexity of 1ts flight control system. The flight .control system failures in 177.2 flight deSign of the REBUS system intentionally avoided hours. All these failures resulted in either' many of the problems associated with the asynchro- an interruption of the miSSion, with some points nous effect on crosslinked data. The REBUS sys- not flown, or a return and land requirement. tem was able to avoid these effects by not cross- Seven of the in-night errors were the result linking any data and allowing ea,h channel to of asynchronous skew effects on submode switching; operate independently on independent inputs. with each channel would trigger a change in a submode the commands evaluated in the actuators instead switch I~t different times, resulting in output of in the flight control software. The REBUS was failure!! and channel fallures. Several of the also developed as a simple system to remove extra failure conditions delayed the next flight by complexity that could adversely affect the asyn- one or more days and reduced the all owab 1e f11 ght chronous operation. The synchronous operation envelopl! or eliminated a mode. Two of the in- of the F-8 DFBW flight control system assured flight failures were transient failures that that each channel operated on the same data at could not be dupl icated and did not reoccur; con- the same time, therefore output failures due to siderable engineering time was lost in the dupli- data crosslinking and skew conditions could not cation Iittempt. Another in-flight fal1ure was the occur. The HHIAT system's major in-flight anom- result of an avionics failure, not a failure of aly was due to a timing problem when the upl'ink decoder failed. The complexity of the AFTI/F-16 all the interfaces were developed along with the and Hi/MT systems made it di fficult to predi ct and flight control system. With this integrated design. the problems associated with interfaces test an the conditions prior to flight. Two assessmlmts that can be made from these results and interactions were greatly reduced. This is are that complexHy is a major factor in flight reflected in the low anomaly rate during flight control system so1'tl'lare reI iability and that syn- and ground tests of these systems. The AFTI/F-16 chronization and ilsynchronization do not. by them- f,l i ght cont ro 1 system was developed sepa rate ly se 1ves. determine rel1abil ity. ' from many of its interfaces. and consequently.
the testing process revealed a number of anom- Inc,"eased costs and schedule delays (related alies that resulted from the interactions between in that schedule delays increase the cost of a systems. The integration-related anomalies con- tinued through ground test. as evidenced by the system) were encountered by all the systems to differing degrees. The AFTI/F-16 testing did ground gunfire failures. and in flight. as in the multiple-mode switching anomaly. While the not ori!linally allow variation of skew condi- t ions nor were thE! skew condi t ions measured asynchronous operation of the AFTI/F-16 system duri ng the early tests. Consequently. there impacted these anomalies. the integrated environ- was no method for determining or setting the ment had a larger effect. The integrated design exact tl!st condition. which varied from one process was especially helpful for the HiMAT test point to another. Additional testing was vehicle. A tightly knit group of people devel- then reClu i red to ,"epeat and correct anoma 1i es. oped the HiMAT systems together. which allowed incurring schedulE! delays and increased costs. close communication and problem resolution early As the program progressed and several anomalies in the development cycle. The HiMAT systems occurred in flight. the capability of adjusting were viewed as a large system with many sub- the ske~1 conditions was included into the test systems. and an effort was made to insure that facllity for the J\FTI/F-16 system. A related all the interfaces were properly integrated.
factor involved in the schedule delays and The early integration in an environment that inCreaSE!d costs WetS the difficulty with the exercised the system in the same way as it would asynchronous opercttion in determining which be in flight allowed the resolution of anomalies skew conditions were actually worst case for prior to flight and minimized schedule delays and which flight conditions. The AFTI/F-16 system, cost increases.
with its. compl icat-ed gain structure. had varying ga ins at each f1 i 9ht condit i on. whi ch presented Concluding Remarks difficulties in de!termining worst-case conditions.
Skew effects were eval uated early to determi ne The AFTI/F-16 system was very complex in its the to 1 E!ranCe val LIes. not to determi ne worst-case control laws and redundancy management deSign.
skew at different flight conditions and different Its asynchronous operation coupled with a goal modes. The very large matrix that would need to of dual-fail operate for a triplex system and the De evaluated disc(luraged the evaluation. The dif- multimoded. complicated control structure resulted ficulty connected with worst-case skew prediction in a series of both in-flight and ground test resu 1ted 1 n cont i nuous ly repeating a test condi- anomalies. The HiMAT system. also complex, was tion untll the anomaly reoccurred. With a simpler tested in an integrated environment that closely system. a thorough evaluation of different skew simulated the flight environment, thus allowing conditic,ns would have been poss1ble. allowing early detection of potential problems and mini- the elimination of problems early in the design mizing in-flight anomalies. The REBUS system process, thus reducing schedule delays and cost had a very simple control structure and limited increasE!s. The REBUS program avoided these dif- the data crosslink to avoid proDlems associated ficultiE!s by usin~1 a simple system. The skew on with asynchronous operation. The F-8 DFBW system.
the REBliS system ~Ias monitored. and the results while not extremely complex, had sufficient com- of Doth f1 i ght anel ground tests indi cated very plications to show that for some situations a 1 ittle variation. which when combined with the synchronous system may be better for complex simple design resulted in no difficulties with systems. As an integrated design. the F-8 DFBW the asynchronous system. The F-8 DFBW flight system avoided problems that could have occurred control system testing was fairly straight- and resulted in a highly successful and relatively fUI'ward •. with an E!asily defined test matr;x. trOUble-free test pro9ram.
The test matrix did not need to be expanded to account for differ'ent skew conditions. Some The evaluation of the F-8 OFBW. RE8US. HiMAT, design problems were addressed early in the and AFTI/F-16 flight control systems lead to some F-8 DFBW flight control system verification interesting conclusions: and validation stage, but they had minimal impact (In both cost and schedule. The syn- 1. The asynchronous or synchronous operation chronization of the computers for the system of the systems was not 1n itself a determining created some difficulties, DUt once the timing factor in the number of anomalies and difficulties problems, were corr'ected. no further anomal ies encountered during testing.
arose. One inference is that asynchronous systems need to De' simple to avoid increased 2. The complexity of the system ca~ cause testing and protect against in-flight anomalies.
major impacts in terms of anomalies during both ground and flight testing.
Another factor to be considered in minimizing schedule! delays and cost increases is the system 3. A simple asynchronous system without development of the digital flight control system a complicated data crosslink structure may be as an integrated system. The F-8 OFBW and HiMAT easier to develop than a synchronous system of systems were developed as integrated systems; the same magnitude.
4. A system designed as an integrated sys- 20 ts, D~lai n A., Lock, Wil ton P., and ee tem, including all interactions and interfaces, Megna, Vincent A., "Flight Test of a Resident has a reduced level of difficulties in testing Backup Softwar'e System," NASA TM-86807, 1986.
and opl!rat ion.
3l s hmael, Stephen D., Regenie, Victoria A., References and. Mackall, Dale A., "Design Implications From AFTI/F-16 Flight Test," NASA TM-86026, 1984.
lSlalai, Kenneth J., Jarvis, Calvin R., Krier, Gary E", Megna, Vincent A., Brock, Larry D., and 4Joyner, Capt. Mark L., and Heimple, Lt. Col.
O'Donnull, Robert N., "Digital Fly-By-Wire Flight Harry H., "AFTI/F-16 Digital Flight Control Sys- Contro1 Validation Experience," NASA TM-72860, tem Evaluation," AFFTC-TR-83-48, Dec. 1983.
1978.
Table 1 HiMAT backup flight control system modes and functional characteristics Mode Mode function Recovery Backup control system initialized in this mode
Brings the vuhicle to level flight (~ = 0 ft/min)
Orbit Orbit mode will be entered at expiration of 25-sec timer following transfer to backup control system (unless exit orbit has been selected) Vehicle will climb to one of three orbit altitudes or dive to 25,000 ft if backup control system is entered above this altitude Orbit altitudes are 25,000 ft, 10,000 ft, and 5000 ft Straight and level Altitude, quasi-heading, and speed or Mach hold Turn 1 Attitude command roll rate Roll rate command roll rate Turn 2 All cl imbs at 100 ft/sec Dives above 10,000 ft at 100 ft/sec Dives below 10,000 ft at 60 ft/sec Land Scheduled air'speed and altitude rate command as a function of radar altitude Pilot is able to modulate airspeed and altitude rate within limits; minimum airspeed is 185 knots Alternative land mode provided in the event of radar altimeter failure Engine-out glide Commanded air'speed of 215 knots with modulation clnd fl are capability Flare initiated at 550 ft radar altitude with elevon control transfers from afrspeed command to altitude rate command Table 2 AFTI/F-16 system modes and command options Control I er Pitch stiCK Roll stick Rudder pedal Throttle twist Mode Command opt ion Standard normal Normal acceleration Roll rate Rudder deflection None Standard air-to-surface Normal acceleration Roll rate Flat turn None bombing Standard air-to-surface Pitch rate Roll rate Flat turn None gun Standard ai r-'to-ai r gun Pitch rate Roll rate Flat turn None Decoupled normal Flightpath maneuver Roll rate Translation Translation enhancement Decclupled ai r,-to-surface Fl i ghtpath maneuver' rate Roll Flat turn Direct lift bombing enhancement Decllup led ai r,·to-surface Pitch rate maneuver' Roll rate Pointing Poi nt i ng gun enhancement POinting Dec()up led ai r··to-a i r gun Pitch rate maneuver Roll rate Pointing enhancement and f1 i ghtpath maneu·, ver enhancement Table 3 Major F-8 DFBW system test anomalies Impact Test type Anomalies Reliability Costs Schedule Verification and Continued operation for' some Low Low va I idat ion sync faul ts No CBS downmode for dual input Low Low data line failure Software problem in power Low low recovery process Ground test and Sensor fault logic errors t~derate Moderate operation Incorrect internal interrupt ~loderate Moderate handling Flight tl~st None Pos it ive None None Analysis of ground and Fault detection logiC des'lgn error' Moderately negative Moderate Moderate flight test data Fault recovery logic deficiency Moderately negative Moderate Moderate Table 4 REBUS system test results Impact Test type Anomalies Reliability Costs Schedule Verification and validation Minor Low Low Ground test and operation None None None Flf ght test None None Positive None Table 5 HiMAT system major test anomalies Impact Test type AnOmi!ll es ReI iabil ity Costs Schedule Low Low Verification and validation Onboard computer failure at too high uplink data rate Ground test and operation Hard upl ink fail ures appeared Moderate Moderate transient to ollboard computer High FI i ght test Uplink decoder timing problem Highly negative High Moderate Transient failures reset faster Moderately negative Iloderate than could be monitored Excess throttle to get 110derately negat i ve Moderate MoMrau afterburner Table 6 AFTI/F-lli system major test anomalies Impact Test type Anoma lies Reliability Costs Schedule Vf!rffication and Output and channel failures due Low Low validation to high gains low output tolerances in dynamic Low Low maneuvers Channel failure dUE! to air data bias Low low Bus contention caused.channel failure Low Low Ground test and operat ion Output and channel failure during Moderate Moderate gunfire test Flight test Leading edge flap ()utput command Highly negative High High failure Channel failure due to three output Highly negative High High command failures in one channel Left and right canard output failures Highly negative High High Oual channel failur'e due to dual Highly negat! ve High High output command fili lure left and right flaperon output Highly negati ve High High command failures Left and right canard output failures Highly negative High High Channel failure due to three output Highly negathe High High command failures in one channel Multiple-mode switc:hing due to Highly negati ve High High avionics fault ECN 3312 Fig. 1 P-8 DFBW airocmft.
Primary II
digital computers
Aircraft II
motion sensors Secondary actuator
Interlace II
units j-ooI._>----------J ----, -- - - ----, I
r------- ------------- --------- -----, I I
I II I I III
I III
I Computer Midvalue I I
I bypass select Servo I
I system voter electronics I
, I L. _________________ "o ___________________ J
"---Bypass and servo electronics Fig. 2 F-8 DFBW ~ight controot system.
Primary II
digital compute,. REBUS memory
Aircraft II
"'-REBUS motion trigger Secondary device actuator
'. 0
Interface II
units ~--- REBUS awltchlrtg networlc
- :::-'1
u--·--Il
,...------- -----------_.- --------- ---,.
I II,
: d
: Computer Mldvalue Servo II
L- __ -l, ... -.l bypass "Ieet electroniCs I
,Iystem Yoter I
I - -, '----------------~=B;;a~;;;-;.;.;;;i;~t;;~ Fig. 3 REBUS imptementation on the F-8 DFBW aircraft.
Mlcroprocelaor· baled computer Backup control- IYltem~ chase aircraft
/-...::: <=<-00 9-
", ,,' ::7 ~' -::s; Downlink HIMAT Uplink vehicle Uplink dlacrtt" ..... ,.....,L:::;:;::;:~..J, Stick data Telemetry Control Surface Uplink lew commands deeommutatlon encoder computer station Cockpit Aircraft ,"pon" parameters Fig. 4 HiMAT JrPRV control. system.
Sensor data Position and discrete commands Primary prlmar v] Position feedbacks actuators sensors
! I
Control dlscretes
•
Downlink data Test control 1-1 Flight tent Umbilical instrumentation Computer data Proportional uplink Primary (test) system Uplink discrete. onboard Power and conlrol computer Proportional uplink Position feedbacks .~ Primary Recelverl Sensor data I-- power decoder 1 Intercom L- Position and Backup Recelverl Uplink dlacretas discrete commands actuators
Ii decoder 2
Backup Throttle command onboard Backup Sensor data IPCS Position and discrete commands.
computer actuators sensors Posilion feedbacks Backup IPCS ]
Sensor data t t Power and control
power sensors • Fig. 5 HiMAT airborne computer-aircraft systems interface diagram.
ECN 20425 Fig. 6 AFTI/F-16 airoraft.
Flight Integrated Leadi ng -edge control r--' servoactuatDrs flap system panel Side-sticl( ,I controller Actuator interface ~ unit Throttle Angle-of-attack f-- controiler
- sensors
t
Sideslip pedal sensors
'""" ]
-- 10--
, Flight
I I
Pneumatic Roll rate control sensor gyros computers assembly
m
r-----
~p sideslip :----
I l
,- senSDr
gyros assembly
"" '"J
: YIWI rate Aircraft '----
-
gyros switches Normal accelerometers
''''''''"J
Avionics Lateral multiplex accelerometers bus Fig.? AFTI/F-16 flight oontrot system.
(d) Latel'ClL tranelation: lateral velocity (a) Vel'ti"al tl'Clnslation: vel'tical veloc- ity cont~ol at constant pitch attitude. control at constant yaw attitude.
(b) Di~ect lift: vBl'tica1. fUghtpath con- (e) D1.r8ct 8idefo~ce: directional. f1.ight- t~L at constant angle of attack. path cont~ol. at lIero sideslip angl.e ..
(c) Pitch pointing: pitch attitude control (f) Yaw pointing: directionaL attitude at constant j1ightpath ang1. •• control at constant j1ightpath angle.
Fig. 8 AFTI/}>'-16 decwuptfld controZ.
2. Government Acceuion No. 3. Recipient's Calliog No.
1. Report No.
NASA TlI-S8271
I
5. Report Dlte 4. T,tle and Subtitle August 1986 EXPERIENCE WITH SYNCHRONOUS ANO 6. Performing Orlll'nization Code ASYNCHRONOUS DIGITAL CONTROL SYSTEMS 8. Performing Orlll'nlZl1lon Report No.
7. Authorl.1 Victoria A. Regenle, Claude V. Chacon. H-1372 and Wilton P. Lock 10. Work Unit No.
Perlo< ming Organization Name and Addr ..
9. RTOP 505-66-02 NASA Ames Research Center 11. Contrlet or Grant No.
Dryden Fl'j ght Research Fac1lity P.O. Box 273 Edwards, CA 93523-5000 13. Type of Report lind Period Covered 12. Sponsoring Agnncy Name lind Address Technical Memorandum National Aeronautics and Space Administration 14. Sponsoring Agency Code Washington. D.C. 20546 15. Supplementary Notes Prepared ilS AIAA-86-2239-CP for presentation at the AIAA Guidance.
Navigation, and Control ConferenCE!, Williamsburg, Virginia, August 18-20, 1986.
t 6. Abstract Flight control systems have undergone a revolution since the days of simfle mechanical linkages; presently the most advanced systems are fu I-authority. full-time digital 'systems controlling unstable aircraft.
With the use of advanced control systems. the aerOdynamiC design can incorporate features that allow greater performance and fuel savings, as can be seen on the new Airbus design and advanced tactical fighter concepts.
These advanced aircraft will be and are relying on the flight control system to provide the stability and handling qualities required for safe flight and to allow the pilot to control the aircraft, Various design philosophies have been proposed and followed to investigate system architectures for these advanced flight control systems. One major area of discussion is whether a mu 1t ichanne I di gita I control system shoul d be synchronous or asynchro~ nous. This paper addresses the flight experience at the Dryden Flight Research Facility of NASA's Ames Research Center with both synchronous and asynchronous digital flight control systems. Four different flight control systems are evaluated against criteria such as software reli- ability. cost increases, and schedule delays.
17. "ey Words lSullllllted by Authorl_" 18. Distribution Statement Asynchronous systems Unclassified -- Unlimited Digital f1"lght control systems Flight control system architecture Synchronou!; systems STAR category 08 19. !«urity aallif. (of this repon, /20. Stcurity Oolllf. lot this PlIIII 22.
/21. No. of Pages 1 Price' Unclassifh!d Unclassified 17 AD2