Document
THE F-12 SERIES AIRCRAFT APPROACH TO DESIGN FOR CONTROL SYSTEM RELIABILITY F . L . Schenk and J . R . McMaster Lockheed -California Company S U MMA RY This paper presents a review of the F-12’-series aircraft control system design philosophy as i t pertains to functional reliability. The basic control system, i. e . , cables, mixer, feel system, t r i m devices, and hydraulic systems a r e described and discussed. In addition, the implementation of the redundant stability augmentation system in the F- 12 type aircraft i s described. Finally, the functional reliability record that has been achieved is presented.
INTRODUCTION The F-12 series aircraft were designed more than a decade ago, yet they included concepts which have only recently become popular and even acceptable. One of these is the fact that, to a certain extent, the F-12 aircraft a r e control configured vehicles (CCV). They were designed with the objective of minimizing trim drag to enhance the range capabilities. This, of course, immediately implies either very low or no static stability requiring the full time services of a pitch stability augmentation system (SAS). At high Mach numbers, the Mach effects reduce the directional stability. Since an engine failure o r inlet unstart can produce a violent transient, i t i s rather obvious that the services of a full time yaw stability augmentation system is also important, both from the standpoint of pilot comfort and prevention of structural damage to the aircraft. These factors dictate a full time stability augmentation system in both the pitch and yaw axes and with a functional reliability comparable with that of the basic vehicle itself. This paper presents descriptions of the basic aircraft control system and the redundant sta- bility augmentation systems that permitted us to achieve the necessary functional reliability .
MANUAL CONTROL SYSTEM The configuration of the F-12 series aircraft is illustrated in Figure 1. The shaded areas show the hydraulically actuated aerodynamic control surfaces. The large inboard and outboard elevons a r e utilized for pitch and roll control. Pilot control stick motion is separated into pitch and roll commands by the elevon mixer assembly located in the a i r - craft’s tail cone. The outboard elevon is slaved to the inboard elevon through a crossover linkage system which transmits commands across the hot aft nacelle. The crossover linkage contains a preloaded spring cart- ridge to avoid structural damage should the outboard surface jam. The rudders a r e really all-movable vertical tails to provide the necessary controllability during engine failure o r inlet unstart.
of these a r e The aircraft contains four hydraulic supply systems; two dedicated to the control system. The two control system hydraulic supplies a r e designated a s System A and System B. The elevon surface actuators a r e arranged such that alternating cylinders a r e supplied by Systems A and f Thus, i f either hydraulic system is lost, the remaining system will con- tinue to provide power f o r the actuation of all of the surfaces. The verticals have a similar load sharing arrangement.
Since the A and 3 3 valves porting hydraulic oil to the surface actuators a r e on a common shaft and in close proximity to each other, it is necessary to protect against intersystem leakage in the event of the loss of one of the hydraulic supplies. This is done by providing ltscavenger” jet pumps in the return area for both systems. This results in the return of any leakage oil back to the reservoir of the appropriate supply instead of loss into the failed supply.
The roll/pitch elevon mixer is a relatively simple device containing the roll and pitch feel springs and trim actuators. No complexities such a s bobweights o r q-bellows a r e employed, and a s a result, has proven to be quite reliable. The feel springs f o r the verticals a r e located in the stub fin and a r e incorporated into the yaw trim actuators.
Transmission of pilot stick commands to the elevon control surfaces is achieved by dual cable systems to the mixer and from thence to the summing levers of the inboard servo elevon valves. The rudder pedal motion is also transmitted via a dual cable-pushrod system to the sum- ming levers of the vertical servos. The variations in required cable length due to temperature effects and flexure of the relatively long fuse- lage is compensated f o r by the use of tension regulators.
Electrical power is provided by two identical generators, each driven by one of the engines. The generators a r e synchronized and in normal If either generator fails, an autdFatic relay system operation share the load.
disconnects the failed system transferring the total load to, %e remaining generator. If both engines quit, causing loss of both geneqitors, a battery/inverter supplies power to the essential bus until iye engines a r e restarted.
' i
AUTOMATIC FLIGHT CONTROL SYSTEM ( A F ~ S ) The design goal of the automatic flight control system f o r the F - 1 2 series aircraft was to provide optimum handling qualities in the primary flight regimes of the aircraft. However, another consideration was to provide as simple a system as possible in order to enhance reliability.
Since the vehicle was the first supersonic cruise vehicle, and thus would spend the greater portion of its flight time at high Mach number cruise, the h$ndling qualities had to be optimum at these conditions. In addition, it was also imperative to provide good response and controllability in the critical areas of the flight envelcpe consisting of takeoff, landing and refueling. All other flight conditions were considered transitional where handling qualities could be less than optimum in the interest of simplicity.
The automatic flight control system of the F-12 series aircraft con- sists of the stability augmentation system (SAS), the autopilot and the Mach trim system. The autopilot i s primarily to provide pilot relief modes, and although high reliability for this function is desirable, it is not essen- tial to safety of flight. Thus, the only protective measures taken in the implementation of the autopilot is the provision of duplex fixed authority limits set to prevent excessive transients for hardover failures. The pilot can also disengage the autopilot by depressing a trigger switch on the control stick.
\ , The Mach trim system i s also not a safety of flight parameter. Its function is to provide speed stability in the subsonk and low supersonic speed regime during manual flight. Loss of this function, however, re- quires increased pilot attention and workload in maintaining airspeed.
To protect against runaway trim failures, a trim power switch is located directly ahead of the pilot's left knee f o r easy access. This is necessary for two reasons; loss of pilot mobility due to the pressure suit and the multiplicity of circuit breakers. This switch cuts power to all trim systems before a runaway trim can cause the requirement of exces- sive forces to hold the aircraft in trim. Once the runaway condition is stopped, the pilot can locate and pull the proper circuit breakers and then reengage the trim power switch to restore power to the unfailed systems.
STABILITY AUGMENTATION SYSTEM (SAS) As was stated earlier, the F-12 series aircraft have very low pitch static stability and yaw directional stability at design flight conditions.
This requires a greater dependence on stability augmentation during maneuvers and during engine-out transients. This, of co significant percentages of full manual authority. The co ities a r e shown i n Table I. The magnitude of these authorities is such that pitch o r yaw hardover failures could be catastrophic at certain flight conditions. This, combined with the fact that the pitch and yaw SAS functions a r e essential to safety of flight, dictates they be implemented with a functional reliability comparable to that of the basic aircraft or that of a fly-by-wire system.
SAS REDUNDANCY AND LOGIC Because of the importance of the yaw and pitch SAS's, they a r e implemented with triple- redundancy in sensors, electronics and gain scheduling. The roll SAS is not critical, both from the standpoint of handling qualities and transients due to hardover failures. However, is the inner loop for all of the lateral autopilot modes.
the roll SAS Thus, to ensure the desired pilot relief and comfort, the roll SAS has a du a1 me ch ani z ati o n.
two dual tandem series servos, The servos for the pitch axis a r e each dual servo driving an inboard elevon. The tandem pair a r e coupled to each other by a stiff spring such that both servos will track even i f one i s disengaged. If either servo were to jam, the other will still This does mean that if perform its function by distorting the spring.
the "downstream" servo of a tandem pair were jammed, the pitch SAS function would only appear on the other elevon resulting i n half gain and is exercised i n providing coupling into roll. However, 'great c a r e a.dequate filtering of the hydraulic fluid and in addition all main metering spool valves a r e designed to shear any metal chips that might get by.
Tlitis, the probability of jamming i s minimal. The yaw axis employs four ' s e r i e s servos, whiffle tree summed i n pairs, with each pair driving a separate vertical. The roll SAS uses two series servos, one for each inboard elevon.
The gain scheduling is obtained f r o m triple-redundant differential pressure sensors and altitude switches. These a r e not part of the Central Data Computer, and comprise an entirely separate but simple sensing Air package. Because of the high reliance placed on the pitch SAS to provide static stability, an additional backup pitch damper (BUPD) i s mechanized.
This consists of a separate pitch rate gyro and electronics located i n a controlled environment that can be switched into either the A o r B servos.
This system has a fixed gain and i s to be used only below 50, 0 0 0 f e e t and at subsonic speeds. To date, there is no record of the BUPD ever having been used. The purpose of the BUPD was only to provide adequate handling qualities for refueling and landing i n the event that the basic pitch SAS failed due to overheating of the normal pitch gyros.
Simple block diagrams of the pitch, yaw and roll SAS mechanization a r e shown i n Figures 2, 3 and 4. It is seen that the triplex systems shown for the pitch and yaw axes employ a monitor channel whose only is to provide a reference for voting. The interceptor version function was modified i n that all three channels of both the yaw and pitch SAS a r e active contributing one-third of the total command. This is illustrated in Figure 5 showing the yaw SAS. In that configuration, when the voting logic removes a failed channel, the gain of the remaining two channels i s increased by a factor of 1.5. Override provides full control gain f r o m a single channel. On the surface, i t would appear that the availability of the additional functional channel would enhance the overall reliability.
However, the additional mechanization complexity tends to offset the r e - liability advantage.
The sensor and electronic circuits of the yaw and pitch SAS utilize triple redundancy i n such a manner that a single failure i s fail- operational with no change i n system performance. This is achieved by a voting scheme which selects the "disagreeing" channel and disengages it as shown i n Figures 2 and 3. A second o r third failure depending on failure sequence results i n total disengagement of that axis. The use of tandem servos i n the pitch axis eliminates the need to double the gain in the rernaining operational channel in order to maintain full system per- formance. However, the yaw axis electronic gain i n the remaining operational channel is automatically doubled to maintain performance because of the whiffle tree summing mechanization of the series servos.
Only two channels, A and By are functional; the M channel is used as a reference model. After total disengagement of an axis, if either the A o r B channels a r e still functional, the pilot can exercise a logic override switch and obtain single channel performance.
The siervos i n both the yaw and pitch channels a r e essentially quad- ruple, but with dual hydraulic supplies. The A hydraulic supply powers \ a right and a left servo that a r e both being driven by the A electronics.
The B supplflpowers the remaining two servos which a r e driven by the B electqonics. The\/left and right servos for each hydraulic supply are compared and ff they fail to track, that channel is immediately disengaged.
The remaining channel with its associated electronics then properly con- trols both the left and right surfaces with a gain equivalent to that of the complete system.
The failure monitoring logic is dual redundant, i. e . , each compari- son i s independently duplicated. Since a system failure upstream of the servos produces two disagreements in the voting scheme, a single dis- agreement does not cause a channel disengage, but turns on the M channel warning light. A single indicated failure of servo logic will cause the related servo channel to disengage and turn on the associated warning light.
The.rol1 SAS is mechanized a s a simple dual system with one channel and servo for each side. A cross-monitor is employed in the servo feedback loops that disengages both channels in the event of dis- agreement. The disengagement is indicated by a failure light between the two channel switches. Disengaging and reengaging both switches recycles the failure logic to verify the failure. The pilot then exercises logic override by switching off both channels and manually engaging one channel a t a time to test and select the operational channel. The gain of this channel is automatically doubled.
Certain types of servo position pickoff failures would result in limit cycle oscillations which would not be detected by the servo logic. There- fore, a separate monitor circuit is provided in each servo channel to detect open and short circuits in the pickoff primaries and secondaries.
In order for the pilot to evaluate his situation in the event of failure in the pitch and yaw SAS, a display of lights is presented to him on the Function Select Panel located on the right console as shown in Figure 6.
If any of the lights a r e on, the pilot pushes the illuminated buttons to recycle the logic. Should this fail to reinstate the channels, the pilot can then assess his situation in pitch and yaw a s shown in Table 2 on the assumption that t light indication represents the first failure. Sub- sequent failures use ..same lighting sequence and as a result, the particular type failure cannot necessarily be isolated.
One of the major contributors to the maintenance of the F - 1 2 flight control system reliability i s the Mission Recording System (MRS).
Each essential parameter of the various vehicle subsystems is monitored and properly signal conditioned for use in a magnetic tape recorder.
The sampling rate for each parameter is once very three seconds.
During the interval between samples, certain of the more signifi- cant parameters a r e monitored by peak-hold circuits which a r e reset when sampled. In the SAS each active element is monitored. This includes all sensors, gain scheduling devices, amplifiers, servos, and logic. This i s then made use of i n two ways. The first is obviously fault isolation; the second is the evaluation of logic performance during sys_tem checkout. For the latter, the pilot exercises the SAS logic prior to each flight and then again as soon as the flight is terminated. This is done j by activating the logic checkout switch shown adjacent to the function 6. This initiates a preprogramed, built-in selector 'panel in Figure test sequence interrogating all SAS logic and AFCS disengage functions.
Careful perusal of the resultant data tape then reveals the status of SAS system and the disengage logic. MRS utilization has also shown that it is possible to detect incipient failures. Although it is possible to achieve this through use of special software in the data processing, this has not been done. Thus, to date, this type of examination is performed visually by the data reduction technician.
RELIABILITY EXPERIENCE The Honeywell Corp. was subcontracted to provide the automatic flight control system and the a i r data computer (ADC). The design requirements were established by Lockheed. Extremely close coordina- tion and teamwork between Lockheed and Honeywell was maintained in order to meet the design goals for the system. How well these design goals were attained can be illustrated by the experience with the SAS.
Yoneywell designed and built the nation's first triple-redundant, fail- operational SAS f o r the F-12 series aircraft in the pitch and yaw axes.
In the thousands of operational flight hours since the inception of the program, the pitch and yaw SAS has suffered only two functional failures.
One was a maintenance e r r o r where incomplete installation of the rate gyro packages exposed the electrical connectors to high Mach r a m air temperatures resulting i n loss of the pitch axis. The second incident occurred when both the pitch A and B servos failed i n the same flight.
There were other instances where all three channels were simultaneously disengaged due to power transients during generator failures and sub- _ _ sequent switchover to the remaining generator. However, the channel, disengage logic was immediately recycled and the system functioned normally. The one hardware failure during operational usage can be equated to a mean time between failure (MTBF) approaching 150,000 hours vs. a predicted MTBF of 19,000 hou.rs. These numbers a r e based on total system operating ground and flight hours i n an operational environment and exclude Category I and Category I1 flight testing since initial testing always involves some problem areas and system modifica- tion.
CONCLUSIONS The functional reliability of the F-12 aircraft control systems has met and exceeded all expectations. This has been accomplished even though the aircraft and many of the control system components must operate i n the mas$ adverse sustained thermal environment experienced by any aircraft in’the world. It must be noted, however, that the system design stres sed’reliability through simplicity. This resulted i n minor compromise of handling qualities during what a r e considered transitional flight conditions. This would probably not be acceptable for commercial vehicles Thus, for such applications, more elaborate scheduling and controf laws would be required placing additional burdens on functional reliability. Although the F- 12 flight control system was not specifically designed as a fly-by-wire system, it has demonstrated all the attributes that a r e required, and has provided a basis for the development of pilot acceptance of such systems.
Table I - Manual Versus SAS Authority
PERCENTAGE
Table I1 - Failure Indications
LIGHTS - (YAW OR PITCH) FAILURE
A AND M I CS A ELECTRON B AND M B ELECTRON I CS M M ELECTRON I CS A A SERVO B B SERVO
r
DUAL YAW COCKPIT CONTROLS C F R V n TER BACK-UP PITCH & YAW RATE GYROS MACH TRIM & A / P AUTOTRIM MOTOR PITCH SERVO
Figure 1 - AFCS Component Locations
O’RIDE B-M COMPARE B CHANNEL PITCH SERVOST O F -
Figure 2 - Flight Controls - Pitch SAS
Q’RIDE B-M C O M P A R E
Figure 3 - Flight Controls - Y a w SAS
B C H A N N E L ~- - - - - - -----.
i RESET I
ELECT.
U
GYRO GYRO A C H A N N E L
Figure 4 - Flight Controls - Roll SAS
f Y A W SERVOS LOGIC Yaw SAS (Interceptor) PRESS TO RECYCLE 4 - LIGHTS ~ - +