Sample Selection
From Chapter 4 Flight Control Systems
by William S. Greenwell and J. Graham Alsbrooks
Digital Flight Control Systems
Digital flight control systems are made possible by replacing the traditional mechanical or hydraulic linkages between the pilot’s controls and aircraft control surfaces with electrical signal connections, a technology known as fly-by-wire flight control. In the realm of commercial aircraft, digital fly-by-wire FCSs were pioneered by Airbus and debuted in 1984 with the A320 passenger jet. Each subsequent Airbus model has featured fly-by-wire control, and the current A380 jetliner is no exception. In 1990, Boeing responded with the 777 jetliner featuring its own digital FCS, and the 787, Boeing’s next commercial aircraft, will use a similar system. With both of the major commercial aircraft manufacturers committed to fly-by-wire flight control for the foreseeable future, a careful examination of the merits and drawbacks of this technology is warranted.
In a fly-by-wire FCS, pilot commands are relayed to control surfaces by electrical signals. As the pilot deflects the control column or moves the rudder pedals, his commands are translated into digital signals that pass through wiring to actuators affixed to each control surface. The actuators then deflect the appropriate control surfaces to execute the pilot’s commands according to the signals they received. If tactile feedback is provided to the pilot, sensors mounted on the exterior of the aircraft pass aerodynamic data such as airspeed back to the flight deck, where dampers or servo motors attached to the control column then simulate the aerodynamic forces the pilot would feel through a traditional FCS.
Fly-by-wire systems offer significant advantages over mechanical and hydraulic FCSs. From the design perspective, the fact that fly-by-wire systems use copper wiring to convey pilot commands to control surfaces means that engineers are free to route the wires through the aircraft wherever they choose without increasing cost or degrading the performance of the controls. For airlines, the reduced weight of a fly-by-wire FCS translates into lower operational costs and higher profit margins.
Digital flight control systems offer additional design benefits. In a typical digital flight control system, control column deflections are measured by analog sensors and then converted into digital signals by an analog-to-digital converter. These digital signals represent the control objectives, which are processed by a flight computer and converted into surface actuator signals. The actuator signals travel through the wiring in the aircraft to the control surfaces, where they are converted into analog signals that drive the surface actuators. Representing control signals digitally allows designers to build simpler interfaces to the autopilot (described in Chapter 5) and the flight management system (FMS, described in Chapter 6). The autopilot and FMS are already digital, and digital representation of control signals eliminates the need for separate control infrastructures for the pilot and copilot. Digital flight control systems also facilitate the introduction of computer-based technology to monitor pilot input to ensure that the aircraft does not stall or otherwise depart from its flight envelope.
Considerations in Digital Flight Control
Digital flight control and fly-by-wire technology involve a variety of engineering considerations. While they provide benefits in terms of line maintainability, digital FCSs introduce new concerns, including the use of software in a flight control system, the susceptibility of electrical wiring to electromagnetic interference (EMI), and the difficulty in modeling the possible flight conditions a FCS might encounter. Each of these considerations is discussed below.
Line Maintainability
From a maintenance perspective, fly-by-wire systems offer three main benefits [1]. As previously noted, digital fly-by-wire technology weighs significantly less than alternatives. Compared to conventional hydraulic or mechanical systems that utilize long fluid-filled tubes or heavy rods/cables, a fly-by-wire control system requires only very lightweight wires to connect the pilot to the control actuators. In fly-by-wire systems the hydraulic pump/reservoir/actuator assembly or electromotor actuator is self-contained and, as with other forms of FCS, usually triplicated. The weight savings afforded by fly-by-wire technology are translated directly into operating cost savings and reduced fatigue on the airframe.
Next, digital fly-by-wire systems are often able to self-diagnose a problem. This feature enables the aircrew to accurately troubleshoot a problem in flight and take the appropriate corrective action. Additionally, maintenance crews are able to quickly get to the root of a problem without having to perform extensive diagnostics to trace a malfunction. The result is much safer flights and greatly reduced turn-around times when a problem is identified on the ground.
Finally, with the reduction of mechanical systems onboard the aircraft, maintenance tasks are further simplified. Regular maintenance items such as cable tension adjustment and setting trim tabs are all but eliminated.
Software Reliability
Digital flight control systems mark the entry of software-based avionics into one of the most safety-critical aspects of flight. Ensuring that the software is safe is an immense challenge for avionics system developers because it is difficult to predict where faults in such systems might arise and what their likely consequences will be. Moreover, large software systems often incorporate several subsystems that interact with each other, which could lead to unanticipated system behavior if one subsystem fails and interacts with others in an undesired way.
Hardware designers typically address the problem of system reliability by replicating critical components. If one component in an array of redundant components fails, the others will likely remain operational and thus mask the failure. The notion that reliability may be enhanced through redundancy relies on the assumption that failures are independent—that is, the failure of one component in the array does not affect the likelihood that another will fail. Because most hardware failures are due to physically-induced degradation faults (e.g., lightning strikes, circuit damage, and normal aging), this assumption largely holds. It does not necessarily hold, however, when failures are due to design faults—defects introduced when the systems were designed—because the redundant components share the same design and with it the same set of design defects.
Software is intangible, so it cannot exhibit degradation faults. Rather, software failures are necessarily due to design faults that cannot be masked through simple replication due to the lack of failure independence. Design diversity is a popular technique that attempts to overcome this difficulty by employing arrays of redundant components, each with a dissimilar design or implementation. Airbus and Boeing both use design diversity in their flight control systems but in different ways.
Airbus employs a design diversity technique called multiversion programming or N-version programming [3]. In multiversion programming, several system implementations are prepared from the same set of requirements by different developers under the presumption that the designs prepared by each developer will be independent—that is, the probability that one implementation will fail on a particular set of inputs given that another implementation has failed on those inputs is equal to the probably of the implementation’s failing alone. The various implementations are then assembled into a classical redundancy architecture in which they are run in parallel on the same inputs and their outputs are passed into a voter to check agreement. If a design fault is activated in one of the implementations, then, according to the theory, it is unlikely that the other implementations will also possess the fault and should continue to function. Clearly, the assurance that can be placed on multiversion programming rests on the assumption of design independence, and evidence exists that this assumption does not hold for all types of software systems [7].
The Boeing 777 FCS was not developed through multiversion programming but rather by employing diversity in the microprocessor architecture. Boeing compiled the software for the 777 FCS for multiple machine architectures and runs each version in tandem during system operation. This approach allows the 777 FCS to tolerate design faults in a specific microprocessor well as those introduced during compilation. It does not, however, provide any resilience to faults resulting from errors in the common source code from which the versions were built [13].
Electromagnetic Interference
All electrical systems are vulnerable to electromagnetic interference (EMI), which at minimum can cause transient communication failures and, if more severe, damage wiring and circuitry. For aircraft, the primary source of potentially disruptive EMI is lightning, and because aircraft must be able to operate in thunderstorms, the avionics systems onboard are required to be built to withstand a direct lightning strike on the aircraft. Lightning is not the only source, however, and wires themselves may sometimes generate interference that might induce current in nearby cabling. Fly-by-wire flight control systems are much more sensitive to EMI than mechanical and hydraulic systems because of their reliance on electrical connections between the control column and the control surfaces. In order to prevent EMI from causing uncommanded control surface actuations, the cabling between the cockpit and the control surfaces must be electrically shielded, adding to the cost and weight of fly-by-wire systems. In addition to lightning and emissions from other wires, however, malicious individuals might attempt to detonate devices that generate EMI inside the cabin, which, unlike explosives, are not detected by conventional airport security measures. Thus, fly-by-wire systems must be shielded from EMI originating both from within and outside of the aircraft.
Flight Condition Modeling
To ensure the safety of a flight control system, one must show that it will perform according to its specification under a variety of possible flight conditions. With traditional FCS, the mathematical functions modeling the behavior of the system are continuous, which means that the behavior of the system under one set of conditions will likely be similar to its behavior under similar conditions. When a digital FCS is used, however, these functions become discrete and lose their continuity. Consequently, flight tests carry less meaning because there is no guarantee that system performance under the test conditions will correspond to its performance under similar, but not identical, conditions when it is operational. Thus, aircraft designers must conceive of more possible flight conditions and conduct additional flight testing to validate the safety of a digital FCS.