High Plains Engineering

HPE-TR-1999-05-01a

Actuator Ground Testing with the Model 610 Test Stand

Ralph H. Smith

May 1999

High Plains Engineering

PO Box N
Mojave, CA 93502
USA

 Copyright 1999 Ralph H. Smith, All rights reserved

www.piofree.com +1-661-824-1023 [email protected]

High Plains Engineering

Introduction; Actuator Fundamentals

Ground testing the modern flight control system is a challenging task. Even with all the computer-
aided design and simulation tools available for modern flight control system design, there is still
no substitute for on-aircraft ground testing of the finished product.

Actuators are the heart of any flight control system (FCS). They provide the muscle that moves
the aerodynamic control surfaces. They may be hydraulic, with an electro-hydraulic servovalve.
They may be hydraulic with a direct-drive servovalve. They may also be electromechanical or, in
the case of missile flight control, pneumatic. The possibilities are endless.

Most aircraft actuators are hydraulic. The remainder of this report will specifically discuss the on-
aircraft testing of hydraulic actuators. The application to other actuator technologies will generally
be self-evident.

Master Control Valve

A hydraulic actuator is essentially just a piston moving inside a cylinder, with a control valve that
directs the fluid flow.

The control valve is a high-precision device of great complexity. Although it looks very simple,
even the smallest detailed design feature, such as the chamfer angle on a land, has significant
effect on actuator performance. In Figure 1, a typical “master” control valve is shown. This is a
spool valve, consisting of a piston with multiple “lands” (show as green in the figure) on a
common shaft. The master control valve controls the direction and amount of hydraulic fluid flow.
This causes the actuator to extend or retract. Flow control is accomplished by moving the spool
valve off the center position. The positioning system for the master control valve is not shown for
clarity. There are several typical ways to control the master control valve. Some of these are
discussed later in this section.

Hydraulic

P Pump

R
Hydraulic Fluid
Return to Reservoir

Xv Master Control
Valve

Aerodynamic Control
Surface

A B

Main Ram
X

Figure 1 – Typical Hydraulic Actuator Schematic

www.piofree.com +1-661-824-1023 [email protected]

High Plains Engineering

Main Ram

The piston is part of a shaft, extending from the actuator body. The assembly, called the main
ram, is attached to an aerodynamic control surface.

Each actuator’s main ram extends or retracts following deflection of the master control valve
(MCV), Xv. If the MCV moves to the left, hydraulic pressure is supplied to the A-side of the main
ram. It also opens the B-side ports to the hydraulic return. This allows the main ram to extend –
otherwise the main ram would be hydraulically locked.

In Figure 1, the spool valve is centered. This traps the fluid in the A & B sides of the main ram,
locking it in position. The only way the main ram can move is for the spool valve to move off-
center.

Hydraulic

P Pump

R
Hydraulic Fluid
Return to Reservoir

Xv Master Control
Valve

Aerodynamic Control
Surface

A B

Main Ram
X

Figure 2 – Control Valve Displacement for Main Ram Extension

Figure 2 shows the actuator in the trailing edge up configuration. In this case the spool valve has
moved to the left, creating a path for fluid under pressure to fill cylinder A. Cylinder B is, at the
same time, opened to the return circuit, allowing fluid to be directed to the oil reservoir. The result
is that the main ram will extend.

In order for the aerodynamic control surface to maintain a fixed angle, the master control valve
must be centered. Thus, the spool valve is a rate control device.

A constant spool valve displacement will produce a constant rate of flow of hydraulic fluid. Since
hydraulic fluid is, for practical purposes, incompressible, the main ram will extend or retract at a
constant rate with constant valve deflection.

www.piofree.com +1-661-824-1023 [email protected]

High Plains Engineering

Figure 3 shows the actuator in the trailing edge down configuration. This is the result of spool
valve movement to the right, opening Cylinder B to the pressure side of the hydraulic system.
Cylinder A is now open to the hydraulic return. The main ram is forced to move in the retract
direction.

The rate at which the main ram moves is proportional to spool valve deflection. There is a
physical limit to actuator rate.

Hydraulic

P Pump

R
Hydraulic Fluid
Return to Reservoir

Xv

Master Control
Valve

Aerodynamic Control
Surface

A B

Main Ram
X

Figure 3 – Control Valve Displacement for Main Ram Retraction

Actuator Rate Limiting

The analytical tools, commonly used for flight control system design, are mostly restricted to
linear systems. It tends to be true that most aircraft system dynamics are approximately linear
when motion amplitudes are small. But actuators are not well-defined by linear models. Simple
frequency response tests on a hydraulic bench will show that the dynamics are generally
sensitive to amplitudes and frequencies of command.

All actuators have rate limits – the maximum rate at which they can extend or retract. This is a
critical design specification. Rate limiting has a direct effect on overall flight control system
performance. Rate limiting is often cited as a contributing factor to the pilot-in-the-loop oscillation
(PIO) phenomenon, in which the pilot plus airplane closed loop system dynamics become
unstable.

[Within the handling qualities community there is a misguided philosophy that handling qualities
can be improved, and PIO eliminated, through the use of high rate limit actuators. It simply isn’t
true. When actuator rate limits are encountered during a PIO, for example, increasing the rate
limits will probably result in a PIO of larger (and therefore more dangerous) amplitude. The
essential problem lies elsewhere and it is important to understand this. After all, increases in rate
limits can only be achieved with actuator redesign; the resulting actuator package will be bigger,
heavier, and more expensive – all without solving the PIO problem.]

www.piofree.com +1-661-824-1023 [email protected]

High Plains Engineering

Rate limiting is due to a flow restriction in the hydraulic system. In theory, the restriction may be
anywhere. In modern practice, it is almost always due to flow limits of the master control valve.
This was not true in the early days of hydraulic actuator technology when the master control valve
and the main ram were sometimes physically separated and connected with small diameter
hydraulic lines. In such configurations, the flow rate can be limited by the connecting hydraulic
line.

I once watched the Princeton University Variable Stability Automobile almost jump off the garage
floor due to flow rate limiting induced by hydraulic lines that were too small. This was in 1969,
during early development tests of the variable stability system. The rate limiting, coupled with the
spring and mass characteristics, produced an unstable positional control system at the wheels.
The result was a large amplitude limit cycle.

Such problems with hydraulic system instability were resolved in aircraft technology with the
introduction of the integrated servoactuator package. The integrated servoactuator combines the
electrohydraulic servovalve, the master control valve and the main ram within one physical
package. All modern military or commercial transport aircraft have used integrated servoactuators
since the early 1970’s.

Rate limiting is also a function of supply pressure. When the system pressure decreases below
some value (dependent on detailed system design), the pump can no longer meet the rate
demands of all the actuators, even when these rates are less than the nominal actuator rate
limits. In that case, the actuators are rate limited at less than their design values. But the flow
restriction is the hydraulic pump, not the master control valve.

Rate Limiting & Redundancy Management Logic Design

Typical hydraulic system design does not have sufficient pump capacity to drive all actuators at
their full rate limits. This should be considered during development of failure detection and
redundancy management logic design. Otherwise, flight safety can be compromised.

During a departure from controlled flight, and possibly in a subsequent spin with a fighter
airplane, control law design may result in all actuators being commanded at their full rates. If the
hydraulic pump is not capable of meeting the demanded total flow (in gallons per minute or liters
per second), the actuators may no longer closely follow commands, EHSV coil currents may be
wildly different between monitor channels, and dual redundant hydraulic system pressures may
miscompare. In a redundant flight control system, with cross-channel voting, such behavior may
look like one or more hydraulic system faults, when in fact it is only a nuisance condition. If simple
cross-channel comparisons are done as part of redundancy management logic, this can lead to
branch failures, following miscompares across all FCS computers at the actuator level. If not
carefully accounted for in system design, and if not fully tested, the consequences can impair
system operation and safety of flight. For example, two computers that do compare within failure
detection tolerances may “vote” a perfectly good computer off-line. The subsequent effects are
unpredictable. It is not difficult to imagine the flight control system reverting to a primitive manual
backup mode, following such nuisance failures, and leaving the plane in an unrecoverable state.

Regardless of the system design for failure detection and redundancy management, the system,
including the actuators, must be subjected to rigorous ground tests before first flight and following
flight control system modifications, especially software changes in a digital flight control system.

www.piofree.com +1-661-824-1023 [email protected]

High Plains Engineering

Effect of Control Surface Airloads

Figure 4 shows the actuator model with airload acting on the aerodynamic control surface.

P0
R
L
AIRLOAD

A B

Main Ram

Figure 4 – Actuator with Airload

The airload L produces a control surface hinge moment. This is reacted through the actuator’s
connecting linkage to produce a pressure at the main ram piston. The pressure due to load is
shown on Figure 4 as PL. When PL = P0 the airload has effectively overpowered the hydraulic
system, and the actuator is no longer an effective control. Further increases in airload would
result in hydraulic fluid being pumped backward through the master control valve.

The situation where airload overpowers the hydraulics should never happen. However, load
effects are always present, and are always considered during actuator design.

In general, master control valve performance degrades as actuator load increases. To some
extent, the effects are predictable – via application of Bernoulli’s Law, for example. However, the
effects of flow turning as hydraulic fluid passes through the valve, separation effects, orifice
effects, and the effects of other design details are important, and can only be approximated with
engineering rules during actuator design. It is left to component test to verify design suitability and
to accurately characterize the effects of load.

Master Control Valve (MCV) Controller Types

In figures 1-4 the control mechanism for the master control valve is not shown. In fact, there are
many ways to control deflection of the master control valve (MCV), the most common of which
are:

1. Conventional EHSV: A small spool valve, lying upstream of the MCV, serves as a
hydraulic amplifier. A small electric torque motor controls deflections of this
secondary spool valve. The combination of torque motor and spool valve is called an
electrohydraulic servovalve (EHSV). Typically, 8-50 milliamps of current applied
across the torque motor’s coil will move the EHSV’s spool valve to full deflection.

www.piofree.com +1-661-824-1023 [email protected]

High Plains Engineering

Deflection of the spool valve will port fluid to the master control valve, causing it to
move exactly like the piston in the main ram; this hydraulic circuitry is not shown on
Figures 1-4. The current source is specialized electronics, controlled by commands
from the flight control computers. This is the typical method for actuator control in a
fly-by-wire FCS.
2. Intermediate Stages of Hydraulic Amplification: Multiple spool valves, upstream of
the MCV, are cascaded to give additional hydraulic amplification. The first valve in
the chain is controlled by an EHSV, as described in item 1. The purpose of the
hydraulic amplification is to isolate the control system from the effects of loads on the
main ram. This is only necessary when the loads are very large and have significant
degrading effect on actuator performance without the added amplification.
3. Direct Drive: The MCV is controlled directly with a powerful electric torque motor
(typically of the rare earth variety). No additional stages of hydraulic amplification are
required. This is called a “direct drive”servovalve. It is comparatively new technology,
introduced only in the early 1980’s. Direct drive actuators are used on the B-2, the F-
22, the F-15 S/MTD, and the Saab Gripen. Their advantage is simplicity and near-
immunity from fluid contamination.
4. Manual Control: The MVC is directly controlled by mechanical linkage, connected to
the pilot’s control stick. This is the way early hydraulically assisted flight controls were
mechanized for non-FBW flight controls.

In a pneumatic control system, such as used on some missiles, the operating system fluid is high
pressure gas such as nitrogen. For such systems, there is often no master control valve. Instead,
pulse width modulation control of a solenoid valves is used to control main ram motion.

Actuator Ground Testing

Actuator design and development involves considerable modeling, simulation and bench testing.
By the time an actuator is installed on an airplane, it is very well understood and its performance
characterized as a standalone unit. However, its performance as an imbedded part of the
integrated flight control system, may not be well known. The new actuator may have been
subjected to testing on an “iron bird”prior to installation on the aircraft. However, not all
manufacturers build iron bird simulators. Even when they do, the actuator must still be rigorously
tested on-aircraft.

This is particularly true for digital fly-by-wire flight control systems, where systems-level
performance is directly affected by flight control system software – which may change frequently
during developmental flight test. It is important to ensure that software changes do not create
actuator-related problems. It is not the actuator that is the concern; it is the integration of the
actuator within the totality of the flight control system.

During the first years of AFTI/F-16 flight tests, the flight control systems engineers conducted
many non-automated tests on the airplane using crude equipment - mostly to verify that the FCS
software had been properly installed and was operating correctly. Test coverage could have been
much broader with proper ground test equipment. Safety of flight assurance would have also
been improved.

In one instance, a special software test version of the flight software was accidentally loaded onto
the AFTI/F-16 airplane. One flight was actually made with this erroneous software installed.
During the flight, control room engineers recognized that there was a problem and the flight was
aborted without incident. But this is how aircraft are lost. Good ground testing, if only to verify
each software load, is essential with digital flight control systems. In this case, the software
verification consisted only of checksums and other specification items; systems level verification
tests were not done, nor did the ground test equipment exist to support such tests.

www.piofree.com +1-661-824-1023 [email protected]

High Plains Engineering

The required test configuration is shown in Figure 5 in the next section. Soft suspension of the
airplane is not required for actuator ground testing.

Actuator Characterization Testing

The actuator should be tested on-aircraft to verify mathematical models used for flight control
system design and simulation. Basically, characterization testing entails applying commands to
the actuator, recording the responses, then extracting actuator dynamics, in some appropriate
form (a Bode plot, for example), or determining design specification compliance. A few
recommended tests are discussed below.

Frequency Response Testing

This is an open loop test. Only the actuator hardware are required. The actuator will have been
bench tested extensively. However, on-aircraft testing is required to evaluate the effects of
mechanical linkage between each actuator and the aerodynamic control surfaces. There is
always structural compliance, which becomes more significant at high aerodynamic loads. It is
recommended that frequency response tests be done with unloaded and loaded surfaces. The
loaded actuator tests will generally require special test fixtures. This point is discussed later in this
report.

In a frequency response test, a command is applied to the actuator and the actuator response is
recorded. The command can be anything. In practice, a swept sine wave is useful. Doublets may
also yield satisfactory results. The swept sine wave test is recommended, since this allows
nonlinear effects to be more easily characterized. From these data, the actuator’s frequency
response may be estimated using standard frequency response analysis software (e.g. the High
Plains Engineering frequency response analysis program PCFRA, written for this purpose).

Static Gain Testing

Static gain tests are very simple tests, and probably the first tests that should be done. A constant
(step) command is applied to the actuator, and the actuator response measured. After the
transients have decayed, the actuator’s static gain is simply the steady state actuator deflection
divided by the commanded deflection. The command can be varied throughout the actuator’s
range of motion.

The actuator command can be generated by applying test signals, using the pilot’s command
path. They can (and should) also be generated using each signal feedback to the control laws
that compute the actuator command. The resulting static gains then represent actuator or surface
deflection – to - pilot or feedback inputs to the flight control computers.

Since the actuator has been extensively tested in the hydraulic laboratory, prior to its installation
on-aircraft, one might question the need for a static gain test. There are two essential reasons:

1. Prior to installation on the airplane, the actuator response has probably been
characterized by extension or retraction of the main ram. But on the airplane, it is
generally aerodynamic surface deflection (trailing edge up or down) that is important,
since this is how the aerodynamics are characterized and the mathematical models
constructed. The relation between main ram extension and surface deflection is, in
general, nonlinear due to the mechanical linkages involved. There is always a certain
amount of mechanical freeplay in the connecting linkage – although this will generally
be small, it may not be negligible. It is important that the relation between main ram
and surface deflections be confirmed with a simple static gain test.
2. In a digital flight control system, there is always the possibility that the software has
introduced gain errors. This almost always happens during control law development.
It is extremely difficult to properly account for all the signal conversions involved in

www.piofree.com +1-661-824-1023 [email protected]

High Plains Engineering

control law implementation. There is also the possibility that the software has
introduced sign errors. This can easily happen when more than one company, or
even several departments within the same company, have contributed to software
development.

The AFTI/F-111 Mission Adaptive Wing airplane spent approximately 7 years in development.
When it was first flown in the critical advanced mode (the one it was designed for), the airplane
system was unstable. The accelerometer feedback signal had been inadvertently inverted in
software, effectively destabilizing the airplane plus flight control system. This happened because
the software developers and the aircraft systems staff each used a different definition for normal
acceleration (positive in the z-axis direction or positive “up”). This was a simple, common error
that the paperwork process, endless program meetings, and component testing had overlooked.

In this example, the instability was low frequency. The test pilot immediately recognized that a
problem existed and disengaged the advanced flight control mode. But in another context, an
error of this sort could be disastrous.

The message is that even a simple, on-aircraft test is valuable.

Resolution Test

In a resolution test, the objective is to identify the smallest actuator command that will produce a
detectable response. There is a specification value, generally, for actuator design, and this will
have already been verified in component testing. However, this specification will probably be for
main ram deflection – not control surface deflection. On the airplane, it is important that the test
be performed to determine the minimum actuator command that will produce a detectable surface
deflection. The results should then be incorporated into the simulation of the airplane plus flight
control system.

Digital Controller Induced “Dither”

The control laws create actuator commands. In a digital flight control system, the commands are
converted into an actuator command voltage. This is done by a digital-to-analog converter.

A typical D/A converter is a 12-bit device. With a 12-bit converter, there are only 4096 distinct
voltage levels possible (2**12). In a +/-10 volt system, this corresponds to a quantization of
4.88mv (20/4096). When the control laws should compute a constant actuator command, the
actual actuator command may be almost constant, but with a constant chatter or dither about the
average value. This dither will be of frequency equal to the control law computation rate. It will
probably be essentially noise, of low amplitude, and almost like a square wave, with amplitude
equal to the least one or two bits of the D/A converter – i.e. from 1-4 times the quantization level.

What this means is that the actuator is constantly commanded with a small amplitude square
wave superimposed on the desired actuator command. This is a digital system effect that has no
counterpart in analog flight control. It amounts to a small amplitude, high frequency nuisance
oscillation of the actuator’s main ram.

For early digital flight control systems, this dither effect produced rapid wear of the actuator seals.
The seals were work-hardened by the constant high frequency motion. They leaked long before
their useful lifetime, if the flight control system had been analog.

One way to eliminate the dither effect is to insert an analog filter between the D/A converter and
the actuator. This is not a very good solution, however, unless done with careful consideration for
the system-level effects on handling qualities or servoelastic modes.

www.piofree.com +1-661-824-1023 [email protected]

High Plains Engineering

A better solution is to incorporate logic within the control law software implementation to allow
changes in actuator command only when these are valid changes.

In any case, the spectral characteristics of actuator commands, and resulting actuator responses,
should be subjected to on-aircraft ground tests. If typical command and feedback signal profiles
are used as flight control computer inputs, the dither properties can be characterized.

The Model 610 Flight Control System Test Stand can be used for this test. A representative flight
data file of all the parameters used for control law computations can be used to drive the flight
control computers. These data might, for example, be obtained from a simulator or they might be
actual flight data from an airplane similar to the one in test. The Test Stand can also be used with
the aero model simulation, and with pilot inputs or simulated turbulence, to create actual on-
aircraft actuator responses. In either case, the actuator responses can be measured and their
spectral response properties determined, using the Test Stand.

System Level Actuator Tests

Prior to installation on the airplane, each actuator will have been completely tested for
specification compliance and dynamic performance. The actuators may also have been tested on
an iron-bird simulator. But there is no substitute for on-aircraft testing. This is particularly true for
digital flight control systems, where the control laws software may change significantly and
frequently during developmental flight testing.

On-aircraft testing presents the first real opportunity to evaluate actuator performance as an
element in the integrated system, consisting of flight control logic (hardware or software), flight
control sensors, hydraulic system components such as pumps, lines, and fitting, redundant flight
control computers, failure detection logic and its software implementation, and redundancy
management logic and software implementation.

There is no single, recommended ground test suite for systems-level actuator testing. The
appropriate tests should be determined to verify specific design goals and detailed objectives.
These are unique to each airplane development. In the following sections, we offer some
suggested tests. These are examples, only, for your consideration. The list is by no means
complete. Again, only hydraulic actuator technology is considered.

Limit Cycle Testing

This test is a basic FCS test. It exercises all elements of the flight control system.

A limit cycle test is a closed loop, airframe plus flight control system (FCS), plus aerodynamic
model test. The purpose is to verify FCS mathematical models and predicted stability margins.
This includes verification of actuator dynamic models and control laws (implemented in software
in a digital FCS).

Only the rigid body modes are tested. The on-aircraft gyros and accelerometers are not used;
these are disconnected from the flight control computers. Because there is no structural feedback
in the limit cycle test, it is not required that the airplane be soft-suspended.

The limit cycle test should verify that stability margins are not compromised by nonlinearities in
the actuator, control linkage hardware, or control law logic. Examples of control law nonlinearities
that must be considered include nonlinear gain scheduling with feedback signal amplitude, or
nonlinear filter dynamics. The use of adaptive filters (e.g. Kalman filters, such as often found in
integrated fire and flight control) should also be considered in design of validation tests for
nonlinear system stability.

www.piofree.com +1-661-824-1023 [email protected]

High Plains Engineering

A good example of why rigorous, actuator-centered limit cycle testing is necessary is provided by
the F-16XL flight test experience. At certain flight conditions, small amplitude pitch oscillations
were observed. At first, it was thought that these were PIO (pilot-in-the-loop oscillations).
However, handling quality analyses (as embedded in High Plains Engineering’s RSMITH
handling quality software) did not support the conclusion that the problem was PIO. Analyses of
ground test data suggested that the oscillation was actually a limit cycle, caused by some
unknown nonlinearity in the flight control system. Qualitative analysis concluded that it was an
amplitude-sensitive nonlinearity – probably in the actuator’s internal feedback. The flight control
system engineers confirmed this after analysis. They identified the nonlinearity element as a
feedback spring with nonlinear rate. Until flight tests proved otherwise, this was not considered
important, since there had been no such problems with the F-16A/B airplanes, from which the
integrated servoactuator was derived.

In the case of the F-16XL, the limit cycle was unknown until encountered in flight test. The limit
cycle was benign and caused no safety of flight problem (in fact, the problem was never fixed –
there was no need to for a research airplane). But, in general, a problem of this sort must always
be treated as a potential safety of flight hazard until proven otherwise by ground and flight tests.

In a limit cycle ground test, the aerodynamic control surface deflections are measured and used
as inputs into the aero model, simulation. The aero model simulates the responses of the FCS
sensors. These are fed back to the flight control computers (the actual sensor inputs are
disabled) to close the flight control loops, similar to actual flight. The FCS feedback loops must all
be stable and satisfy specified stability margin criteria. One purpose of the limit cycle test is to
verify system stability. Another purpose is to validate that system stability is not degraded by
nonlinearities.

For the limit cycle test, aerodynamics control surface sensors are required. For most military
airplanes, these are built in (LVTD's or string-pots are used on AFTI/F-16 and VISTA F-16). It is
also possible to use external sensors for this purpose, and this is described in the Operations
Manual for our Model 610 Test Stand.

The limit cycle test is a critical path element (or should be) in the FCS development process. It is
crucial that it be done carefully, so as not to introduce errors into the simulation of the aero model.
One error in aero model simulation that has occurred in the past has been to data link the
airplane and the aero model simulation computer via a pair of digital computers. This introduces a
time delay in the aero model feedbacks to the flight control system computers. If time delay is
introduced during the limit cycle test, when none is present in the actual FCS, the test results may
be unreliable. If the delay is excessive, It may not even be possible to simulate a stable system.
This was the case at NASA during early ground tests of a developmental F-18 flight control
system. The aero model simulation was digital, and the data link was also digital.

When a digital computer is used for simulation of the aero model, added time delay is
unavoidable; the digital simulation process introduces computational time delay, which may be
significant, and analog/digital delays, which generally are not significant. In addition, numerical
integration algorithms, such as those typically used for aero model simulation, introduce
dynamics that are not part of the physical FCS-airplane loop. That is, numerical integration is a
dynamic, parasitic component of the simulation loop.

It is recommended that:

1. No digital data linking be used between the airplane and the aero model simulation
computer – therefore, there will be no added time delay.
2. The aero model should be simulated with an analog computer – no computational
delay and no added dynamics due to numerical integration algorithms.

This is the way the Model 610 Flight Control System Test Stand is designed and mechanized.

www.piofree.com +1-661-824-1023 [email protected]

High Plains Engineering

During the limit cycle test, the actual FCS computers and hydraulic system are used, so almost all
of the FCS is exercised. The only parts of the FCS hardware that are not used are the FCS
sensors.

In addition to stability margin measurement for the FCS, the limit cycle test also attempts to
characterize the various small and large amplitude limit cycles that may be experienced in the
FCS. Limit cycles are nonlinear oscillations of constant amplitude and frequency. They are
affected by FCS gains and system nonlinearities. Typical FCS nonlinearities of importance to limit
cycle behavior include actuator rate limits, nonlinear gearing (or nonlinear gain schedules in a
FBW system), and wear or free-play in mechanical elements of the FCS.

Failure Detection

On-aircraft tests should be done to confirm failure detection logic at the actuator level. These
tests are unique to each airplane and it’s failure detection logic. The tests should verify system-
level response for hydraulic faults, command faults and failures of cross-linking between flight
control system computers, in a redundant flight control system.

In all such tests, the aircraft state (Mach number, altitude, configuration, center of gravity, and
loads) must be considered to determine that there are no hidden failure paths that could degrade
safety of flight.

Redundancy Management

On-aircraft tests should be done to verify redundancy management logic mechanization and
performance following failure insertions at the actuator level. For example, the A-side hydraulic
system can be “failed” and the system monitored for correct response.

In all such tests, the aircraft state (Mach number, altitude, configuration, center of gravity, and
loads) must be considered to determine that there are no hidden failure paths that could degrade
safety of flight.

Actuator Performance in Off-Nominal Flight Conditions

Unusual flight conditions should be simulated during ground tests to verify mathematical models,
to explore nonlinear effects on system operation, and to identify potential safety of flight issues.
The specific test requirements are probably airplane and mission specific. However, there are
some tests that apply, and should be done, for all aircraft:

Departure from Controlled Flight

Simulate sensor feedback signals to the flight control computers during a departure from
controlled flight. This can be done with the Model 610 Test Stand. Verify/characterize actuator
performance in the departure condition. Verify failure detection and redundancy management
logic design. Validate its mission suitability. For example, does system performance compromise
the pilot’s ability to recover from the departure? Are special procedures required that are not
apparent from the normal system design process?

Pilot-in-the-Loop Oscillations (PIO)

Despite the best efforts of many within the handling quality community, flight control system
design always seems to proceed under the assumption of a perfect pilot, applying smooth
controls, logically related to a benign task – if, indeed, realistic pilot inputs are considered at all.
But during a PIO, the pilot’s inputs may severely stress the flight control system. It is not
uncommon for pilot inputs to be bang-bang & stop-to-stop. In fact, this is the typical PIO case. It is
recommended that any comprehensive ground test simulate conditions during a PIO. It is further

www.piofree.com +1-661-824-1023 [email protected]

High Plains Engineering

recommended that actuator dynamic performance, especially phase lag added by rate limiting, be
characterized during the simulated PIO, for comparison with mathematical models. It is
suggested that a simulation of the HQDT (Handling Qualities During Tracking) maneuver be used
for this ground test.

Aerodynamic load effects

On-aircraft actuator test under load requires special test setup – not easily done on the real
airplane. It is probably done more easily on an iron-bird simulator. Repeat the above tests, where
warranted, at critical envelope points. Confirm that actuator/system performance is acceptable
with airloads. Loads testing is discussed in detail later in this report.

Aero Model Validity

What is an “Aero Model”

Ground testing of the flight control system will eventually require simulation of the aerodynamic
response of the airplane to control. This must be done in real-time. The simulation of the
aerodynamic response is called the “aero model”. Only the 6-degree of freedom, rigid body,
equations of motion are required for creation of the aero model for ground test support. The
elastic modes of aircraft structural dynamics are not simulated – they are measured directly and
coupled into the FCS, so that a model for structural response is not required.

The aero model simulation is done with a special test computer. Custom interface hardware is
generally required to connect the airplane and the test equipment. The aero model simulation is a
substitution for actual airframe response to control, including the dynamics of the various sensors,
which feed back to the flight control computers.

A requirement for aero model simulation is that it mimic actual flight, at selected test conditions,
as closely as the defining data permit. The “defining data”includes the aircraft aerodynamics, the
aircraft mass and center of gravity, the inertias and products of inertias, and the reference areas
and dimensions. The “selected test conditions” correspond to Mach number, altitude, center of
gravity location, gross weight, aerodynamics configuration, stores loading, and all other
parameters relevant to aircraft dynamic response. Test setup of the target flight condition is often
the most difficult part of aero model simulation using an actual airplane. This involves bypassing
weight-on-wheels switches, tricking the air data computer into believing it is at the desired Mach
and altitude point, and overriding various other airplane-specific discrete switches.

Aerodynamic Model Validity & Actuator Testing

The fact is, the actual aerodynamics will not be known until flight testing, followed by extensive
post-test parameter identification to estimate aerodynamic coefficients. It is true, more often than
not, that the best predictions of aerodynamics are not always sufficiently accurate to allow precise
estimates of system stability margins.

Hinge moment predictions may be wildly inaccurate. The fact is, control surface airloads won’t be
accurately known until flight test measurements are accomplished. So it is important to repeat
actuator loads testing as new aerodynamic loads data are obtained.

The conclusion is that, even when extensive iron-bird testing is done, much retesting should be
done on the airplane in the hangar environment. This is necessary to verify system suitability and
flight safety, as updates and improvements in the aero model are made during flight tests. If
possible, the effects of control surface airloads on actuator performance should be tested on-
aircraft. This is just to be certain that nothing has been overlooked. After all, aircraft flight control
is enormously complex, with many dimensions.

www.piofree.com +1-661-824-1023 [email protected]

High Plains Engineering

Typical Ground Test Setup

FCS
accelerometers &
rate gyros

Flight Control
Computers

Control surface
transducers
To FCS δa,δe,δr
Computers:
Soft
P,Q,R Suspension
Nz,Nx, Ny
β,α
…
Aero Model Simulation &
FCS sensor feedback
gain control

Test Console, Data

Acquisition, Post-Test
Data Processing &
Display of Results

Test Stand

Figure 5 – Typical Ground Test Setup

• The aircraft FCS is electrically and hydraulically powered

• The aero model is simulated off-aircraft
• The aerodynamic control surfaces are transduced and used to excite the aero model
• The sensor responses predicted by the aero model are fed back to the flight control
computers to simulate flight
• Feedback gains can be applied to FCS on-board sensors, then pass signals to flight
control computers
• Tests are setup, run and monitored from Test Console
• Test data are acquired, archived, processed and displayed at the test console

Hydraulic Power Requirement for Actuator Ground Test

A hydraulic cart is used to supply hydraulic power to the flight control system during hangar tests.
The hydraulic cart will often have less capacity (gallons/minute, liters/second) than the airplane’s
pump. This is a potentially serious limitation for validity of actuator test results.

Testing for total flight control system performance, including failure detection and redundancy
management, should be done with the same capacity as the actual airplane. This may require
that some actuator tests be done on the ramp with engines running.

www.piofree.com +1-661-824-1023 [email protected]

High Plains Engineering

On-Aircraft Loaded Actuator Testing

Philosophy

Some aircraft manufacturer’s policy is to not build iron-bird simulators in the belief that they are
an unnecessary expense. We do not agree with this philosophy. There is much to be learned
from ground tests, carefully done. When an iron-bird simulation is not used, then the actuators,
with airloads simulation, should be done in hangar tests, such as described here. This is the last
opportunity to verify system stability due to airloads, prior to flight. When servoelastic modes are
critical, this is an essential milestone on the path to first flight readiness review.

New Actuator Technology

If the actuator design is based on new technology, on-aircraft ground tests are particularly
important. As an industry, we have accumulated approximately 50 years experience with
hydraulic actuators. If that experience is lost, then it must be replaced with something else –
extensive ground testing.

A good example of actuator evolution is the self-contained hydraulic-electric actuator. This

technology integrates an electrically driven hydraulic pump with fluid supply and actuator – all in
one package. There are no external hydraulic lines. This design offers much promise, but it also
entails additional risks – just because it is new. The integration of this design concept with
multiply redundant flight control software, and its mechanization at the software level, is possibly
the area of greatest risk, especially for those flight conditions where actuator loads are high and
the actuator commands are near its rate capability.

Software Rate Limits

The use of software rate limits is common in digital flight control. But, generally, the software rate
limits are a single number reflecting the unloaded actuator’s capability. The intent is to prevent
commands that would drive the actuator into rate limiting.

But, when the actuator loads are high, commanded rates can exceed the loaded actuator rate
capability, when the effect of load is not accounted for by the software rate limiter. The actuator
can be driven into rate limiting due to the effect of load on rate capability of the actuator. This can
affect stability of servoelastic modes or limit cycle characteristics, and do so in unexpected ways.

This situation is most likely to occur following departure from controlled flight, where actuator
malfunctions or flight control system faults can be most serious to safety of flight. It is
recommended that validation testing be done on-aircraft in the hangar to certify the effects of
software rate limits on actuator and system performance at such flight conditions.

www.piofree.com +1-661-824-1023 [email protected]

High Plains Engineering

Test Configuration

The same basic test configuration as shown in Figure 5 can also support on-aircraft actuator
loads tests. Some additional hardware is required if airload effects on the actuators are to be
tested.

Figure 6 illustrates a possible configuration for actuator loads testing. It is a simplification of

Figure 5. Only the changes are shown for clarity.

Actuator for loads

Simulation Commanded
Load

Measured
Load

Airloads simulation
and Force Servo
Controller

Figure 6 – On-Aircraft Actuator Loads Test Setup

As airloads (or inertial loads) on the actuators increase, the maximum rate limit for each control
surface is reduced. This may have a significant effect on flight control system limit cycle or
servoelastic system stability. The effects of actuator load on system stability margins or limit cycle
characteristics should be ground tested.

Four Preliminary Requirements

To test the effects of actuator loads in the hangar environment, there are four preliminary
requirements:

1. Attach an (external) actuator to each control surface, as shown in figure 6. This actuator
will be used to apply simulated airload to the control surface. But it may not be a simple
matter to attach an external actuator to the control surface. An on-aircraft actuator test as
shown in Figure 6 cannot generally be done unless the aerodynamic control surface is
designed to support such a test. Specifically, a point load must be applied to simulate
airload. Control surfaces are designed to support distributed airloads. While a test fixture
could be designed for this purpose, it might be simpler to perform on-aircraft tests without
the control surface. A test fixture could be installed in place of the control surface, and
provide the necessary load path for actuator testing.

2. Build a servo system for control of the external actuator. This servo must force the load
applied by the external actuator to follow a load commanded by the ground test
computer, such as the one in our Test Stand. This is not difficult to do. This is the “force
servo controller”shown in figure 6.

3. Create a mathematical model for each control surface’s airloads as a function of (for
example) Mach number, pressure altitude, angle of attack, angle of sideslip, pitch rate,
leading edge flap deflection, control surface deflection, armament configuration, and any
other parameter that will affect airflow over the surfaces. This can be wind tunnel data,

www.piofree.com +1-661-824-1023 [email protected]

High Plains Engineering

computational fluid dynamic model prediction, or flight test data. The final model should
probably be placed in look-up table format. This is the “airloads simulation”model shown
in figure 6. Note that for highly flexible structures, actuator loads will cause elastic
deformation of the structure at the attachment points. The airloads model should include
this effect. This means that the structures and aerodynamics groups must work closely
with the ground test team to develop the airloads model.

4. Store the airloads model (step 2) in the ground test computer. In our Test Stand, this
would be the PC, used for control of system operations.

The Ground Test Configuration & Power Requirement

Run ground simulations using a test configuration such as shown in figure 5. The limit cycle or
frequency response tests would be appropriate for evaluation of the effects of control surface
loading (see HPE-TR-1999-04-01). In these tests, the external actuator test configuration of figure
6 must also be used. During the test, apply simulated airloads to each control surface with the
external actuators. This can be done with the ground test computer, using the airloads table look-
up for each surface.

During loaded actuator ground tests, the correct hydraulic power supply must be used for. This is
a hard requirement. The pump capacity (in gallons per minute, liters per second, etc.) must be the
same as that available during aircraft flight. Ground test carts do not typically satisfy this
requirement. It may be necessary to conduct these tests on the ramp with the engines running. In
any case, it is advisable that at least one test be made using on-board hydraulic power.

Coupling of the Aero & Airloads Models

Note that the control surface airloads and the airframe aero model are coupled. For example, as
angle of attack, predicted by the aero model, changes, the position in the table look-up changes.
As a result, the predicted control surface loads will also change.

www.piofree.com +1-661-824-1023 [email protected]

High Plains Engineering

Model 610 High Plains Engineering FCS Test Stand

The general problem of aircraft flight control system testing was considered during the design of
the Model 610 High Plains Engineering FCS Test Stand described on our web site. The Test
Stand was specifically designed to support almost any conceivable ground test of the FCS for fly-
by-wire systems.

Operational Overview

• The physical control surfaces on the airplane are transduced – either with on-board
instrumentation or with external potentiometers. The result is a voltage proportional to control
deflection for each control surface.

• The control surface voltages are used as inputs into the analog simulation of the airplane's
aero model. This is all done in the Test Stand. This simulates moving the controls on the
actual airplane.

• The aero model responses to the measured controls are computed by the Test Stand's
analog computer. The outputs are simulated airframe responses, including rate gyro and
linear accelerometer dynamics. However, if the physical control surfaces are not loaded to
simulate airloads, then the resulting closed loop dynamics are applicable only to the unloaded
actuator condition.

• The aero model responses, used by the flight control computers, are input into the flight
control computers. The aero model outputs are substituted for the on-board sensor outputs.
For example, if the airplane in test uses pitch rate, Q, and angle of attack to stabilize an
unstable airframe, these two signals would be connected back to the flight control computers.

• The flight control software processes the aero model responses and generates commands to
each on-board actuator. Note that this is done independently of the Test Stand; the actual
flight software is used.

• Each actuator responds to the flight control computer commands and moves just as it would
in actual flight - except there is no airload, unless this is part of the test configuration, as
described elsewhere in this report. The actuator responses are those of the actual, on-aircraft
actuator hardware.

• The actuator responses are transduced, used to excite the analog aero model simulation,
and the loop is closed.

The Airplane Interface

The Test Stand is, in practice, connected to an airplane exactly as shown in Figure 1, above.
Interface hardware between the Test Stand and the airplane is required, and this is unique to
each aircraft. However, the Test Stand does have an interface section, consisting of differential
line drivers and receivers that simplify the interface task. In many cases, little or no additional
hardware is required.

Graphical User Interface

Test Stand operations are controlled from a central console via a PC, acting as the system
controller. The user interface is entirely graphical and is very intuitive.

www.piofree.com +1-661-824-1023 [email protected]

High Plains Engineering

Aero Model Simulation

The Model 610 Test Stand allows an aero model to be inserted into the FCS loop to support
hangar tests. This can be done without programming or specialized knowledge of the inner
workings of the Test Stand.

The aero model is entered by either selecting it from a library of aero models (user supplied) or by
creating one by entering the data into a simple dialog window. Once an aero model has been
created, it can be stored in a library of aero models.

Supported Tests

The Test Stand was designed to directly support FCS static gain tests, limit cycle tests, structural
coupling tests, integrated limit cycle – structural coupling tests, and ASE tests. The FCS is
excited using programmed inputs, including steps, pulses, doublets, sine waves, and swept sine
waves. In all cases, the excitation parameters are under operator control.

The Test Stand also provides the capability for almost any conceivable, ad hoc, FCS test,
including FCS failure detection and redundancy management functions. Non-built-in, ad hoc tests
are possible; they will, however, require additional programming. The built-in tests do not require
programming for their use.

On-Aircraft Actuator Loads Test Requirements

Actuator tests can be done using the Test Stand. This would require:

1. An aerodynamic model for hinge moments (or equivalent) for each actuator as a
function of control deflection, as well as any additional parameters, at the flight
conditions to be tested
2. External actuators for applying simulated airloads - one for each surface
3. Mechanization of a load control servo system for each actuator
4. A user interface for test setup, control, monitoring and data processing

Why Not Use Commercially Available Hardware?

It is, to some extent, true that commercially available hardware can be assembled, and software
written, to accomplish the functions built into the Model 610. However, the creation of proprietary
solutions to FCS ground test problems is an expensive undertaking – both in money, engineering
talent, and time. The Model 610 was built as an off-the-shelf, cost-effective solution to ground test
requirements. The difficult problems of creating the aero model, and setup and control of on-
aircraft tests, have been solved in the Test Stand design.

The Aerodynamically Unstable Airframe

For aircraft that are aerodynamically unstable, the airplane plus FCS is conditionally stable. The
FCS stability margins are therefore less than normal. This complicates ground testing to
determine stability margins. For such aircraft, the aero model simulation must be done without
adding significant time delay – e.g. computational delay due to digital computer simulation. But if
the available phase margin is only 10-15 degrees, any added time delay will have significant
effect on measurements of stability margin.

Analog Computer Simulation of the Aero Model

For many aircraft, especially those with digital flight control systems, the best solution for ground
testing is to simulate the aero model with an analog computer. For the unstable airframe, it may

www.piofree.com +1-661-824-1023 [email protected]

High Plains Engineering

even be a necessity. Analog simulation of the aero model is the approach used with the Model
610 FCS Test Stand. It is an expensive solution when compared with inexpensive PC-based
digital computer technology.

However, the analog computer hardware is only part of the overall ground test suite costs.
Further, the cost for use of analog technology is offset by the reliability of the ground test results.
When the aero model is simulated using an analog computer, there is no chance that sampling
effects, which can be insidious, will inadvertently contaminate test results. The resulting
simulation is as close to reality as possible, limited only by fidelity of the aero model itself.

The analog aero model used in the Model 610 Test Stand is a proprietary design based on state-
of-the-art integrated circuit technology. Analog computation is not widely used anymore, due to
the widespread introduction of digital computation, beginning in the mid-1960’s, and the current
availability of inexpensive, powerful PC’s. Analog computers were historically difficult to program
and not very versatile. With the Model 610, we have re-invented analog computation technology.
The result is a special-purpose analog computer that operates under PC control and is
programmed using proprietary software that automates the process, including parameter scaling,
given only the aero model’s defining data. The process is transparent to the operator.

www.piofree.com +1-661-824-1023 [email protected]