U.S.

DEPARTMENT OF COMMERCE
National Technical Information Seruic,

AD-A029 074

Background Information
and User's Guide
for M!L-F-9490
Boeing Co.

January 1975

- - -
 247099
AFFDL-T-74-116

SBACKGROUND INFORMAPION AND USER

SWEUIDF FOR MIL-F-9490D

Flighi Control Systems- Design,

SInstallation and Test of Plloted
Aircraft,
ۥ Gencrrd Specrncatlon for

THE BOEING COMPANY

WI('IIITA DIVISION
WICH1IA. KANSAS 67210

JANUARY 19t75

TECHNICAL REPORT AFFDL-TR-74-116

NATIONAL TECHNICAL
INFORMATION SERVICE
rtillC,| lIL .& 2ID

AIR FORCE FLIGHT DYNAMICS LABORATORY

AIR FORCE SYSTEMS COMMAND
WRIGHT PATTERSON AIR FORCE BASE. OHIO 45433
 II

NOTICE

Whbs Government drawrngs, specificatikms., or oLhbe data are usd foir

any purpase other than In connection with a definitely related Governmet
procuresent operation, the United States Governmwnt thereby incurs no
responsibility nor any obligation whatsoever, and the fact that the govern-
ment way have formulated, furnisbed, or in an,: way supplied the said
drawings, specifications, or other data. is no.t to be regarded by impli-
carton or otherwise as in any manner licensing the holder or any other
person or zorporation, or conveying any rights or permsaioe to manufac-
ture. use, or sell any patented invention that my in any way be related
tnC'rOc.

11aix report ha3 been reviewed and cleared for open publication and/or
publit reiesse by zhe appropriate Office of Informntion (01), in accordance
with ALYR I••-17 ind MD 5230.9. There is no objection to unlimited dis-
tribution of' this report to the public at large, or by DDC to the National
Technicai Intormation Service.

This technical report ha, been revieued and is approved for publication.

THOMAS b. LEVIS
Project Engineer/Technical Honitor

FOR THE COMtANDER.

PAUL E. BLATT
Chief, Control Systems Development Branch
Flight Control tivigion

Ccop.;es of this report should not be returned unless rettrn is required

by security considerations, contractual obligations, or notice on a
spccific documeat.
5(CUM'V CLA8S.PC*ION oP ?u5*a't066 011te b'we

AIWai 00WUMTATMO PAWf mDIAII14TVUcTIOW

1
AFFDL-T14h- 1-6
4 Ti~
V6 4 m~e.
WW 6 UtorRPORT a 01001:
OP"Ot :o0Iqftf
~AC1(U1~iN7'2~4ACW
A I inai Report
"SER'"! 7-F lv ___________

Jass . Tmaend
Eugene -. RaymondF

Pls eo OANUza"oUt "Mae Aft &OOI

A001$ mOQAM ~I.*Ot*.

~'lS. 'l~ver rProject 'io. -2ý

Wichita. FV~nsaa t721' __

ý'0TOS.?UO&.G !)FPC!E -04MI 4%0 400*gI& '2 *t"Oft DA-f

Air Force Flight Zrynwics i!abrfttory January 1975

Wright Patt *rson AFFI, -,hio ~4'-4 '1 NUM91 or SAGES

'4 wohol1684aAGE1,
s. t -&.smea AcaOOr$Isu f l.w t C,..I'. ' 'S SECUR11. Z:.ASS -f hlieNp.

",ncl&3s i fied

Approved for pub1tc release: distrihution unlimited.

if SUPPLEMENTARY 'j0YPS

It KEY WORDS '~~g. q A~weo etdS it - eew, M~d 84qi~th bv bl.s.& ,..,Sb.

Specif icat'ion
Flight Control System
Requ~irements

20 A§STFIACT (Camff ai,.nte.,m.. aide #f n~ece...v a..d idem. 6vbl ock n.b~r)

This doe-'imnt is published in support of Military Specification

MIL-F-949(I), "Flight Control Systemsa - Design, Installation and Test of,
Piloted Aircraft, General Specification For". It was written to aid the
MIL-F-9490D user in interpretation and use of the specification.

The philosophy adopted by the Air Force for thiot revision of

MIL-P'-9490 is discussed and, where pertinent, the limitations of the

JAN 73 1473 EDITION Of I No0V 0 S OSSOLETE f~ j~ OU IG

SECCLJITY CLASSIFICATION OF THIS PAGE (UWue Dafe Inltord,
ucLUtY CL A*.PICATMW OF THIS PAO~ema ~as

2.A'ITRCT (Cen.t.)

data jr argumients used to support indi-,idual requirements are stated.

fertinent literature has also bI-en referencee In con.Yuitiofl withi
irulivi-icmli requiremnt~s, where recent suppcrting reseurach nd 'awicip-
mint has been %ccmtylished.

Unclassified
SgCItRgYv CLASSIFICATION OP THIS PAGC(W*" "0. Enetmud)
 PREFACE~

Thus technical report was prepared for the Air For-x' Fi~tt Dynamics Laboratori~ nd
the Aeronautical Systems Dwsvawn as an tnterdijvutonal effort by The Roeing Coinpaki i' n
fuifidiment of AFFIX Contract F33615-7 2-C-l1090.

Pntncapal authors of this repc~l are lames L. Townsend. Boeung-Widuta and Eugene T.
Raymond, Boeing-Seattle. SeveraI other ~Oeing ezwa.leers aut'1 ored fabsecetKnS of the draft
MIL-F-94900. which is mincuded as a part of this techn zal m~pon. Included are J. McWh~a. J Botne.
D. Martin and K. Mitchel., 14ttic, F. Moffeti Wichiu and H. McCafferty ind W L ason,
PhI~adelpho.

This effort was guided by a joint AFFDL-ASUr- steering committee. Pauil U- BLattr
AFFDL- and Joieph A. Farris. ASD, were the rtecring committee co-chairmen. Thomas !) Lewis
was the project monitor. Other committee members included .Ron Anaderson, Bob Wood~ock Bill
Brovin and Frank George of the AFFDL and Don Sovine of ASD
 TABLE OF CONTENTS

PAGE

I !NTROPIUCT!ION . .

Ii \TA
I MI'NI' MNI D1SCI'SSION OIF RE0UIRERE2"TS 8

1.0 S MIOPF'
. . . . . . . . . . . .. . 8
1 I scope . . . . . . . . . . . . . 8
1 2 Classification ............... 8
I 2.1 Flight ConLrol Svytem (FCS) claasilications * 8
1.2 1 1 Mn,,+al flight control systems (MFCS) . 8
1 2 1 2 Automatic flight control systems (AFCS) 9
L.2.2 FCS operational state classifications ... . 9
1 2 2 1 Operational State I (Normal operation) . 9
S.2.2.2 •)perational State 11 (Restricted operati'.-.) 9
1.2.2.3 Operational State III (Minimum sale operation) . 9
1.2.2.., Uperational State IV (Controllable to an imsediate
emergencv landing) . . ... ........ I..)
1.2.2.. ~oper.ationil State V (Contrlldble to an
cvacuable tlight condition ..... ...... . . . 10
il FCS criticality classificatiobs .... ............ .. 11
1:3 1 Essential .... .................. ......... 11
1 2 3 2 Flight phase essential ....... ........... 11
2 1.3 Noncritical . ................ . 11

APPLICABI.E iDOCUMENNTS . . . .. . 12

I J REQU11RF.MENTS .. ... . 16
ii N'stem require=.-nts . . lb
1
3.t.1 MFCS performance requirements lb
1 1.2 AFCS performance requirt uents . . . 19
3.1.2.., Attitude hold (pitci. and roll) 20
3.1.2.2 heading hold . . ... 20
3.1.2.3 Heaning select .... .20
3.1.2.4 LaLeral acceleration and sideslip limits ... 21
3.1.2.4.1 Coordination in steady banked turns .... 21
3.1.2.4.2 Lateral acceleration limits, rolling ....... . 21
3.1.2.4.3 Coordination in straieht and level flight 21
3.1.2.5 idtitude hold ........................... 21
3.1.2.6 Mach hold ............. ..................... 22
3.1.2.7 Airspeed hold. . ............. . 22
3.1.2.8 Automatic navigation ... ........ . . . . . 23
3.1.2.8.1 VOR/TACAN ............................. . 23
3.1.2.9 Automatic instrument low approach system . . 24
3.1.2.9.i Localizer mode .. . . . . . . . . . 24
3.1.2.9.2 Glide slope mode .......... . . . ......... 25
3.1.2.9.3 Go-around mode ........ ...... 25
3.%2.10 All weather landing sysLem . . . .................. 27
3.1.2.10.1 All weather landing performance standa ,i -
variations of aircraft and airborne equipment
configurations................... 27
31, 2.10,2 Performance standards-ground based equipment
variations ................. . . 28

ii
 TABLE OF CLt*TENTS (COlT'D)

PAt.E

3.1.2.11 Flight load fatigue alleviation . .

3.1.2.12 Ride smoothing ...... .

3.1.2.12.1 Rite discomfort index .. ...

3.1.2.13 Active flutter suppression ..... ih
3.1.2.14 Gust and maneuv.r load alleviation
1.1.2.15 Automatic terrain following .... . . . .
3.1.2.16 Control atick (or wheel) steering , .t
3.1.3 General FCS design ...... .
.'
3.1.3.1 Redundancy ...... .... . .7

3.1.3,2 Failure Immunity; and iiatety .......

3 1-32.1 Autos-tl,: tvrrain following failure immiunity v0
3,.1,3.3 System operation and interface ... .40
3.1.3.3,1 Warmup ....... .. ................. 40
3 13.3.2 Disengagement .... . 41
3•1.3A 3.3 Mode cor4)atibilitv . ..... 41
3.1.3 3 4 Failure transients .1
3,1, 3,4 System arrangement ...... ........... 41
3-1.3.5 Trim controls 4
3.1.36 Stabijity ......... . -4

3.1.,3.6.1 Stability margins .. ....... .. 43

3.1.3..b.2 Sensitivity analysis . 44
3.1.3.7 Operation in turbulence ... 48
3.1.3.7.1 Random turbulence .. .... 48
3.1.3.7.2 DisLrete gusts ....... . 49
3.1.3.7.3 Wini model for landing and takeoff . 53
3.1,3.8 Residual oscillations ..... tO
31.3.9 System test and monitoring ptovisions . tI
3.1.3.9.1 Built-in-test equipment (BIT) .......... 61
3.1.3.9.2 Inflight monitoring .................. 61
3.1.4 P4FCS design ......................... 65
3.1.4,1 Mechanical MFCS design ......... 67
b...
3.1.4.1.. Reversion - boosted systems .?
3.1.4.2 Electrical MFCS desigt .. .. t'
3.1.4.2.1 Use of mechanical linkages .4.6. .8

3.1.5 AFCS design .. ............... .... 69

3.1.5.1 System requirements ()9
3.1.5.1.1 Control stick (or wheel) steering 9......
3.1.5.1.2 Flight director subsystem............. 70
3.1.5.2 AFCS interface .... ...... ... . 70
3.1.5.2.1 Tie-in with external guidance ......... . 70
3.1 5.2.2 Servo engage interlocks . 70
3.1.5.2.3 Engage-Disengage transients .. ....... 70
3,A.5.3 AFCS emergency provisiens .......... 70
3.1.5.3J'. Manual override capability .. .. .. .. . 70
3.1.5.3.2 Emergency disengagement .............. 71
3.1.6 Mission accomplishment reliability . . 72
3.1.7 Quantitative flighc safety ............... .72
3.1.7.1 Quantitative flight safety - all weather landinb
syst:.m (AWLS) .... ........ . . .
,..,. 79

iii.
 TABLE OF CONTENTS (COT'D)

PAGE

3.1.7.1.1 Assessment of dverale risk of a hazard ....... sO

3.1.7.1.: Assessment of specific risk ............ so
3.1.8 Survivability. ................. .................... 87
3.1.8.1 All-enginem-ovt control . . . ............ 87
3.1.9 Invulterabilitv . . . . . . . . . *. . . . . . 92
3.1.9.1 Invulnerability to natural wnvironments . ...... 92
3.1.9..2 Inviltner~bility to lightning strikes and static
atmospheric electricity ........ ............... ... 93
3.1.9.3 Invulnerability to induced environments .. ....... 94
3.1.9.4 Invulnerability to onboard failures of other
systems and/or eqpment ................... 95
3.1.9.5 Invulnerahilitv to maintenance error ............. 9.
J.1.4.6 lvulnerahilitV to pilot and flight crew inaction
and error .................................. 97
).1.4.7 Invulnerability to enemy action. ......... .......... 99
3.1.10 Maintenance provisions . . . . ............. 99
3.1.10.1 Operational checkout provisions . . ......... 99
3.1.10.2 Malfuviction detection and fault isolation
provisions .................................. 99
3.1.10.2.1 Use of cockpit instrumentation ........ .......... 100
3.1.10.2._ Provisions for checkout with portable
test equipment . . . . . . . . . .......... 100
3.1.10.3 Accessibility and serviceability .... .......... .. 100
i.1.10.4 Naititenance personnel safety provisions .... ....... 100
3.1.11 Structural integrity ... ................... 102
3.1.11.1 Strength . . . . . . . . . . . . . . .. .. .. .. . 102
3.1.11.1.1 0•ige tolerance .............................. ... 102
3.1.11.1.2 Load capability of dual-load-path elements . . . . 102
3.1.11.2 Stiffness ............... ..................... . 103
3.1.11.3 Durability .................. .................... 105
3.1.12 Wear life . . . . . . . . . . . . . . . . . . . . . . . 106
3.2 Subsystem and component design requirements .. ....... .. 107
3.2.1 Pilot controls and displays . . . . . . . . . . . . . . 107
3 2.1.1 Pilot controls for CTOL aircraft .... ............. 107
3.2.1.1.1 tJditional requirements for control sticks ... ..... 107
3.2.1.1.2 Additional requirements for rudder pedals ... ..... 107
3.2.1.1.3 Alternate cr unconventional controls ..... ........ i08
3.2.1.1.4 Variable geometry cockpit controls .. ... .. 10•
3.2.1.1.5 Trim switches .......... ................... 108
3.2.1.1.6 No-Speed trim actuators ....... .............. ... 108
3.2.1.1.7 FCS control panel .................... .... .. 108
3.2.1.1.8 Normal disengagement means ............ . 108
3.2.1.1.9 Preflight ttst controls . . . . ............... .. 108
3.2.1.2 Pilot controls for rotary-wing aircraft ....... . 110
3.2.1.2.1 Interconnection of collective pitch control
and throttle(s) for helicopters powered by
reciprocating engine(s) . ..... .. . . . . . . . 110

iv
I

TASI. Oý COWTErTS (COlr'D)

PAGF

32.1.2.2 Interconnection of collective pitch ct'ntrul

and engine power controls for helicopters
powered by turbin. engines ..... . . . 10
3 2 1 2 3 Alternate or umconavent oJaia ccntrols .*0.... . 110
3.2.1.3 Pilot controls for VTOL air-raft . . . . .!1
3 ý 1 4 Pilot displays . . . . . ..
3.2' 1 4.1 FCS annunciation. ................... 113
3.2.1.4 2 FCS warning and statue annunciation * . . . 114
3.2,I.4.3 Lift and drag device position indicators .... . 114
3.2.1.4.4 Trim indicators . . . .......... . . 114
3..1.4.5 Control surface posu.tion indication ... 115
1...
I...2 Sensors ........................ 1It
3.2.3 Signal transmission . .... ............ 11
3.2 3.1 General requiremnts . .............. 117
3 2.3.1 1 Control element routing . . . . . . . 117
3.2 3.1.2 System separation, protection, and clearance 11$
3.2.3.1. 3 Fouling prevention . . ... . . . . . 118
3.2.3.1.4 Rigging provisions . . . ............. 119
3.2.3.2 MechA~nical signal transmission .. ........- - . . 119
3.2.3.2.1 Load, capability.... . . . . . . . . 119
3.2.3.2.2 Strength to clear or override jameed
hydraulic valves .. ........ . . ... 120
3.2.3."1.3 Power cotatrol override provisions ..... . %O
3.2.3.2.4 Control cable installations . *1-i
. . ...
3.2.3.2.5 Push-u•ul rod installations . . . 133
3.2. .4.2.6 Gontrol chain . .. . .. . . . . ... i3s
3.2. 1.2.7 Push-pull flexible controls . . . . . . . 135
3.2.3.3 Clectrical signal transmission . . . . . . . . 130,
3.2.3.3.1 Electrical flight control (ElC) interconnections. 137
3.2.3.3.2 Multiplexing . ..... .. ...... . 139
3.2.4 Signal computation . . .. a . . . . . . . . . 140
3.2.4.1 rieneral requirements ... ...... . 140
3.2.4.1.1 Traisieot power effects . . . . . . . ... .140

3.2.4.1.2 Interchangeability . . . . . .......... 140

3.2.4.1.3 Computer signals ......... . . 140
3.2.4.2 Mechanical signal computation . . . . . ...
. . 141
3.2.4.2.1 Element loads .. .............. 1I1
3.2.4,2.2 Geared machaninims. ................ 141
3.2.4.2.3 Hydraulic elements ........... ..... 141
3.2.4.2.4 Pneumatic elements ........... . . . . . 142
3.2.4.3 Electrical signal computations . ..... . 142
3.2.4.3.1 Analog computation .. . . . . . .. . 143
3.2.4.3.2 Digital computation ............... 143
3.2.5 Control power . . ............ .. .. . . 145
3.2.5.1 Power capacity . . . . . ................ 145
3.2.5.2 Priority . . . . . . . . . . . . . * . ....... 146
3.2.5.3 Hydraulic power subsystems ....... ................ 146
3.2.5.4 Electrical power subsystems . . . . . ........ 147

v
p

TAi.& OF CTINTENMs (aCmritD)

PA(U

3.2'.5...l &.letromagnetic intetlerlr?,ve limits .... .. l.8

3.2.5.4.2 Overload protection ....... . 148
i.2.5...i Phasc' separation and p•wlaritN reversal
protection .. . . . . . . . . . . . . . .. 148
1.2.5.5 Pneumatic power subsystems .............. 151
. b Ac t uat ion . . . . . . . . . . . . . . . . . . . . . . . 151
I Load capabtlityv
t:.2. . . . . . . . . . . . . . . . . . . . 151
3.2.6.1.1 Laad capabiliti tit elemwnts hub etLtd L.o
pilot loads . . . . . . . . . . . . . . . . . . . . 151
J.2.•...1. Lad capability ot vlements driven by
power actuators . ................ 151
3.,,. .. Mechanical force transmitting Atuttl n ...... 152
3F2.0.2,1 force transmitting powerscrews ........... 15is
3.2.6.3 Mechanical torque transmitting actuation ...... 153
i.2.6.3.I Torque tub,' systvm& . . . . ... 153
1.2.6.3.2 Gearing . . . . . . . . . . . . . . . . . . . . 154
J.2. .3.3 Flexible shafting ................. 154
helical splines ..........
h.2.6.3... .................. 154
3.2.b.3.5 Rotary mechanical actuators ...... ........ .. .. 154
3.2..6.3.b Torque' limiters .......... .................. .. 154
3.2.S.3.7 No-back trakes . . . . . . . ............ 155
3.2.b.,4 Hydraulic actuation.. .......... .................. 155
3.2.6.4.1. Hydriul iL scrvoactuators ........... .............. 155

1.2.6... Motor-pump--servoactuator (W'PS) packages ...... .. 157

3..tu...i Actuating cylinders ........ ............... .. 157
3.2.b..,.4 Force synchronization ot multiple hvdraulic
servoacLuators...... . ........ .................. 157
3.2..4..5 Hydraulic motors ......... .................. .. 158
3.2.'.5 Llectromechanical actuation ...... ............. .. 153
3.2.b.6 P.i.!.matic actuation .... ...... .......... 158
3.2.b.6.1 high-pressure pneumatic actuation provisions .... 158
3.2.b.6.2 Pneumatic drive turbines . . . . . . . ....... 158
3.2.t. 7 Interfaces between actuation systems, support
structure, and control surfaces . ......... . 159
3.2.6.7.1 Control surface stops ........ .............. .. 159
3,2.6.7.2 Control surface ground gust protection ............ 150
3.2.6.7.3 Control surface flutter and buzz protection .... 1bO
3.2.7 Component design ............... .................... . 165
3.2.7.1 Common requirements ..... ................. 165
3.2.7.1.1 Standardization ........ ............ . . . 165
3.2.7.1.2 Interchangeability ............ 165
3.2.7.1.3 Selection of specifications and standards ..... .. 165
3.2.7.1.4 Identification ot product . . . ....... . 165
3.2.7.1.5 inspection seals ..... ... ......... ..... . l6
3.2.7.1.6 Moisture pockets ..... ................ lbs
3.2.7.2 Mechanicai components ................ 166
.. 2.7.2.1 Bearings ............ . ... ........... 166
3.2.7.2.2 Controls and knobs . . . . . . ............ 16

vi
 FABU.. OF .2ON. tSI'S (CON I'* D)

PAG;E

2... .. .2. . . . .,.,. . ............... . . IN)

3.',1.2,4 SLructur- l it{ tiig .• . . . . . . . . . . . . . . . . Itbb
3.2. 7.2.5 Lxoric.ation . . . . . . . . . . . . . . . . . . . . 167
3. 1. L L,.ctricaI and v Ie~ tronic- componetits ... . . . it7
.2. 7. 1
I. )i. e'Lritr1c ,L 1t l1.gth .1.. . . . . . . . . . . . . 167
3.2.. ,'. Microc Llctir,,ics . . . . . . . . . . . . . . 167
3.2.7. . I durn-in . . . . . . . . . . . . .. . . . . 107
3 2. 7. .4 Switcli:s . . . . . . . . . . . . . . . . . . . . 1b7
3.2 . 7. 3.5 thernmal debign ot el%!ctrical and electronic
equipment . . . . . . . . . . . . . . . . . . .. . 1b7
3.2, 7..3• , ')tent tometeIs . . . . . . . . . . . . . . . . . . . 1b8
3..!.8 Component ta. cati..o ... ... ... . . . 169
3 S2.8.
I
aterials . . . . . . . . . . . . . . . . . 0 .169
3.2.8.1.1 Meta. s . . . . . . . . . . . . . . . . . . . . . . . 1b9
3.2.8.1.2 Nonmetal I ic ,mate,
L taI s . . . . . . .,.
. . .
..
3-2.6.1.3 FIect ric wire anid cahk.... ..... . ............. 19
3.2.8.2 Procets se..s............. ...................... 169
3.2.8.2.1 L'is truct ion processes . . . . ............ 19
3.2.8.2.2 Corrosion protection .............. ............... 169
3.2.8.2.3 Fabrication ot electrica l and electronic
components .................... .................... 1(9
3.2.8.3 Assembling ................... ...................... 169
3.2.8.3.1 Mechanical joining .............. ................. 169
3.2.8.3,2 Joint retention ................. .................. 169
3.2.8.3,3 Assembly of electronic compotents ... ......... .. 171
3.2.9 Compo ent installation .......... ........... . . . . 173
3.2.9.1 Basic requirements .......... .................. .. 173
3.2.9.2 Locating components ........... ............... .. 173
1.2.9.3 Installation in fuel system areas . . . . . . . . 173
3.2.9.4 Electrical and electronic component installations . 173
3.2.9.5 Electrical and electronic equipment cooling ..... 173
3.3 Rotary wing pe-forinance and design ...... ........... .. 174
3.3.1 Special manual FCS performance requirements ..... 174
3.3.2 Special automatic FCS performan'e requirements . . . .. 174
3.3.2.1 Attitude hoLd (pitch, roll, and yaw) .... ....... .. 174
3.3.2.2 Heading hold and heading select ..... ........... .. 174
3.3.2.3 Altitude hold ............. ................... .. 174
3.3.2.3.1 BarometrL altitude stabili.tation ... ......... .. 174
3.3.2.3.2 Stabilization of altitude above the terrain .... 174
3.3.2.4 Hover hold .............. ...................... .. 174
3.3.2.5 Vernier control tor hovering ...... ............. .. 175
3.3.2.b Groundspeed hold ................ ................... 175
3.3.3 Special design requir .aients... ...... ........... .. 5
3.3.3.1 Manual FCS design ................ . . . . . . 175
3.3.3.1.1 Control feedback ....... ............... . 175
3,3.3.1.2 Feel augmentation ............... ................. 7IR
3.3.3.2 AFCS design ................................ ... 176
3.3.3.3 Swashplate power actuators ...... ............. .. 176

vii
 I.
TALLE OF CONTENTS (CONT'D)

PAGE

3.3.3.3.1 Redundancy .............. . . . . . 176

3.3.3.3.2 Jamming . . .......... . ........ 176
3.3.3.3.3 Frequency response . ........... .... 176
3.3.3.4 Actuation stiffness . . . . ......... 177
3.3.3.5 Fatigue life design ........ . ....... 17
3.3.3.5,1 Fail-safe 177
3.3.3.5.2 Display .................... . ........ . 177
3.3.3.6 Built-in test . . ................. 178

4.0 QUALITY ASSURANCE . ............ . . ...... . 179

4.1 General requirements . . . ........... . .... 179
4.1.1 Methods for demonstration of compliance . . .. . 179
4.1.1.1 Analysis . ................. . ... 179
4.1.1.2 Inspectiol, ................. . . . . . . . 179
4.1.1.3 Test . . . . . ............... . ... 179
4.2 Analysis requirements . . . . . . . . . .......... 179
4.2.1 Piloted simulations . . . . . . . . . . ........ 179
4.3 Test requirements.................... . ........ 182
4.3.1 General test requirements . . . . . . . ........ 182
4.3.1.1 Test witness ................. . . . . .
4.3.1.2 Acceptance tests . . ................. 182
4.3.1.3 Instrumentation .............. .. . . . ... .. 182
4.3.1.4 Test conditions ......... ....... .. 183
4.3.2 Laboratory tests ... ......... . . ......... 183
4.3.2.1 Component tests ............. . . . . . . 183
4.3.2.2 Functional ?3ockup and simulator tests . ... .... 186
4.3.2.3 Safety-of-flgght tests . . . . . . . . . . . . . . . . 188
4.3.2.3.1 Component safety-of-flight tests . .. .. .. . .. 188J
4.3.2.3.2 S,,._em safety-of-flight tests .. .. .. .. . .. 188
4.3.3 Airrl ,he ground tests . . . . . . . .. 188
4.3.4 Flight tests . . . ........... . .. 199
4.4 Documentation .. ............ .. .. . . . . . . 199
4.4.1 Flight control system development plan . . . . . . . 199
4.4.2 Flight control system specification . ......... 200
4.4.3 Design and test data requirements . . ......... 201
4.4.3.1 FCS analysis report .... . . . . . . . . . . .. 20.
4.4.3.2 FCS qualification and inspection report .. ....... .. 202
4.4.3.3 FCS test report ...... ................... . 202

5.0 PREPARATION FOR DELIVERY ... .......... . . ........ . 205

5.1 Packaging requirements . . . ........... .. 205

6.0 NOTES ... .............. . . . ................ 205

6.1 Intended use .................. .. .. ....... . 205
6.2 Procedure for requesting deviations . . . . ........ 205
6.3 Reordered e.uipment or second source procurement ... ..... 205
6.4 User's guide ....... ............. . .......... 205
6.5 Abbreviations . ..................... .205
6.6 Definitions . . . . . . . . . ....... . . . . . 205

viii
 TABLE OF CONTENTS (CONT'D)

PAGE

6.7 Use of limited coordination specifications . . ........ 210

6.8 Identification of changes . . . . . . ......... . . 210

REFERENCES ........ . . . . . . . . . . . . . . . . . . . . . 211

APPENDIX A DERIVATION OF RELIABILITY REQUIREMENTS FROM ACTUAL

FIELD SAFETY EXPERIENCE DATA . . ............ 217

APPENDIX B METHODS Or- DETERMINING COMPONENT OR SUbSY STEM

RELIABILITY INCREASES REnUIRED TO COMPENSATE FOR
BLIND REDUNDANCIES . . . . . . . . . . . . . . . . . . 231

ix
 LIST OF FIGURES

FIGURE PAGE

ID AF/Contractor inte-action during development process . 3

1 Acceleration weighing functions .............. . 32
2D Effect of combined accelera ion on pilot rating .. . 34
3D Typical FCS block dlagrma .. ............ 46
4D Exceedance probability vs. altitude and RMS Gust
Amplitude . . . . . . . . . . . . ............. 54
2 Cumulative probability of reported mean wind and
cross wind when landing . .*. .0. .. . .. . .. . 55

5D Mean smoothed spectrum at 100 ft height compared

with model spectra having the same KS and various
values of scale lengths ................ 58
6D Mean smoothed spectra for six one-hour runs, fitted
to give same spectral density at short wave lengths . . . 59
7D Typical division of overall aircraft ailowable
loss rate . . . *.... %.. *...... *.... ... 77

8D Simplified version of approach outcome "tree" . . . . 82

9D Longitudinal approach outcome "tree" .. . . . . . . . 83
1OD Lateral approach outcome "tree" ...... ... 84
1lD Longitudinal approach and landing performance "tree" . 85
12D Lateral approach and landing performance "tree" .. ,. 86
13D Effects of p'Llley dimension on cable life 3/16" 7 x 19
preformed stainless steel cable .............. 127
14D Rigging load and operating deflection . ........ 130
15D Actuator stiffness determination ............ 161
16D Actuator stiffness vs frequency .............. 162
17D Typical limit cycle ground test characteristics .. . 191
18D Typical. limit cycle ground test characteristics of
the pitch SAS of the M.-10 lifting body at various
points within the system ........ .... 192
19D 5-52 CCV ground test mechanization. ......... 194
Al Aircraft major accidents - material failure
primary cause - per 100,000 horre ............ 225
A2 Aircraft major accidents - material failure
primary cause - per 100,000 flights ........... 226
A3 Potenti.al and actual material failure :.ircraft
loss rates (fighter aircraft) ................ 227

-~
- - --.- -~ - - - - - - - - ---- - -
 LIST OF FIGUREFIS ((ONT'D)

FIGURE PACE

A4 Potential and actual material failure aircraft

loss rates (Helicopter aircraft) . . . . .......... 228

A5 Potential and actual mattrial failure aircraft loss

rates (bomber/transport aircraft) .. ........... . 229
A6 Potential and actual material failure aircraft loss
rates (F-Ill aircraft) . . . . . . . . . ......... 230

xi
 LIST (F TABLES

TABLE PAGE

I Minimum acceptable cointrol accuracy . . . . . . . . . . . 22

II Ride discomfort lisaex limits . . . . . . . .. . . .. 30
ID Minimum redundancy levels for nonmechanical
implementations . . . . . . . . . . . . . . . . . . 38
III Gain and phase margin requirements . . .......... 43
IV Turbulence intensity exceedance probability ........ 49
V RMS gust intensities for selected cuaulative
exceedance probabilities . . . . . . . . . . . . . . . 50
VI RMS turbulence level and scale length by axis . . . . . . 56
VII FCS quantitative flight safety requirements . . ..... 73
IID Flight control system ground test experience . . .... 198
IXID Recommended verification means ....... . . . . . . . . 201
BI Solution of single-blind redundancy . . . . . . . . . . . 232
BII Solution of double-blind redundancy .... . . . . .. 233

xii
 SECTION I

INTRODUCTION

.nis document is published in support of Military Specification MIL-

F--,49OD, "Flight Control Systems - Deqign, Installation and Test of Piloted
Aircraft, General Specification For". The Air Force Flight Dynamics Lab-
oratory, with the contricted help of The Booing Company, has conducted a
two year revision effo'- to update MIL-F-9490. The purpose of this document
is to explain the philosophy and data used to update the specification and
to aid the MIL-F-9490 user in intetpreting the requirements. The current
Military Specification shall apply in the event of conflict with this
document.

Discuzssion sections are included in this document for each requirement

or sequence of related requirements, following the organization and outline
of MIL-F-9490D. Where pertinent, general discussions are included to
explain the philosophy behind major changes in MIL-F-9490C requirements.
Appendices are included which discusc detailed information on special sub-
Jects such as reliability.

The revision effort was initiated in early i972 with a series of meet-
ings between the Air Force and Boeing to establish an overall revision
philosophy. These meetings at Wright-Patterson Air Force Base were extended
in April 1972 to include the following members of industry.

11 April - General Dynamics (Fort Worr')

11 April - Honeywell
12 April - Sikorsky
13 April - Lockheed-Georgia
14 April - North American Rockwell
18 April - Sperry
18 April - General Electric
19 April - Bendix
20 April - 1cDonnell (St. Louis)
21 April -- Calspan Corporation
21 April - Vought Aeronautics

Fairchild Republic Division, although unable to attend the AF/Industry

Meetings, submitted written recommendations on 19 April. This series of
meetings, provided a cross-section of opinion from the industry on the def1.-
ciencies of the existing specification and provided a base for the initial
revision effort.

Visits to the General Dynamics (Fort Worth) and North American Rockwell
(Los Angeles) plants were made during May to follow-up on recoumendations
made during the AF/Industry meetings.

On June 6 and 7 a series of Boeing internal MIL-F-9490 meetings were

held in Seattle. The purpose of these meetings was to discuss the general
content to be included in major specification subsections and to identify
individuals responsible for initial drafts. Follow-on meetings between the
I
AFFDL steering committee and Boeing were held approximately quarterly for
the next two years as drafts of the U).r's Guide and Specification evolved.

A- the draft approached completion, the Air Force submitted it to

pertinent members of industry and government for rtview and corment. A
first review took place in the Fall of 1973 and the second and final review
vas accomplished during April and May of 1974. The comments received were
considered by the Air Force steering committee And irtegrated into the drafts
by the authors where pertinent.

From the initial planninv, the revision of MIL-F-9490 was based upon a
philosophy of the "LOGICAL oEVELOPMENT SEQUENCE" of sound engineering
practice from which most successful flight control systems evolve. Most air-
frame primes Already practice the prccedures outlined and will not have to
undertake additional tasks in MIL-F-9490 with which they are unfamiliar.
Once a contract is awarded for a new weapon system, the LOGICAL DEVELOPMENT
SEQUENCE as shown in Figure 1D consists of:

a. A detailed Flight Control System Specification prepared by the

contractor which establishes the flight control functions, performance,
reliability safety, maintainability, and survivability requirements to
satisfy mission requirements and performance established by the contract
work statement. It is intended that this be a viable document updated as
necessary throughout the design process to reflect changes which become
apparent as the system design matures.

b. Design phase to implement the detailed requirements established by

the Flight Control System Spercfication. Analysis is performed in conjunc-
tion with the design phase to satisfy stability, performance, reliability,
safety, maintainability, survivability and cost requirements. Component
designs are established. Pilot-in-the-loop simulations are conducted
employing math models of the control system to verify the flying quality and
human factor elements of the design under realistic mission task formulation.
Make or buy component and system hardware specifications are produced from
this phase of the development.

c. Fabrication and assembly of components accompanied by qualification

and/or flight-worthiness tests of equipment.

d. Repeat of pilot-in-the-loop simulation tests with flight hardware

interconnected to the computer simulation of the aircraft dynamics. Final
tests would be combined with an operational mockup (iron--bird) realistically
evaluating total flight control system operation under proper loading of
the actuators and electrical and hydraulic power supplies. Note that the
operational mockup can be the same test rig required by MIL-H-5440 Hydraulic
Systems Specification. Failure effects of the flight control system would
also be evaluated on this test rig.

e. installation of the FCS into the aircraft and ground tests to ve'tify
the operation. Ground testing would include frequency response, structural
effects, gain margin (limit cycle), and UMI tests in the aircraft prior to
test flight.

2
 IL

rEl

oI, *8

g
.....
 t. Flight tests throughout the specified flight envelope and mission
correlation should be maintained throughout the flight phase with analysis
and simulator results.

While the actual development sequence is rarely a clear-cut series of

events but most often results in an iterative redesign and redefine Asign
cycle with many phases going on simultaneouNly in parallel, this structure
serves as the framework for the ..IL-F-9490 revision and major documentation
sources. Also, the LOGICAL DEVELOPMENT SEQUENCE is based upon flight con-
trol requirements for major production aircraft developmients. For less
stringent progrýams such as advanced developments, prototype aircraft, experi-
mental aircraf., off-the-shelf aircraft buys, etc., the procuring agency
may elect tc bypass particular design requirements and some if the rigorous
steps in development or in documentation. In those cases, exception will be
taken in the contract designating those phases which will be exempted.

Freedor. is to be allowed to the flight control system designer to

select the mechanization techniques, redundancy requirements, and analysis
methods which best satisfy overall aircraft performance, mission tasks,
safety, m.iintainability, and cost constraints. Once the designer has
selected his technical approach, MlL-F-94Y) contains three sections consist-
ing of System, Subsystem, and Component requirements based on past experience
and recent flight control technology developments which are to govern the
final development and test effort.

ligure ID also defines the Air Force/contractor interactions desired

throughout the LOCICAL DEVELOPMENT SEQUENCE for the flight control system.
The objective is to establish key milestones throughout the development and
test cycle which will provide the Air Force assurance that the end design
will satisfy the requirements rather than discovering design deficiencies in
thie flight test or operational stages. ),cumentatiou has been identified
at key points th:'oughout the development cycle and nust be periodically
updated as the system design maLures. Documentation consists of:

a. FCS Develcpment Plan

b. FCS System Specification

c. Analysis Report (Including reliability, maintainabi2ity, safety,

survivability, and simulation results)

d. FCS Qualification and Inspection Report

C. Final Test Report (Includes 4round and flight rest results)

Only those documents specified in the DD 1423 Contract Data Requirements

List for the specific procurement are required deliverable items.

Factors relating to particular classifications and requirements of

NiL-F-9490 will be specified in advance by the Air Force for a specific pro-
curement. Typical factors to be provided by the government include:

a. Mission scenario which is relatable to control law performance for

specitic mission tasks. Total environment such as anticipated global

4
deploywent and enemy retaliation threat should also be included. Quantita-
tive mission tasks performance such as unguided weapon delivery criteria
may be specified which impact the design of the flight control system.

b. Flight Control System Operation States

c. AFSC Mcdt'j

d. Reliability, Ma•atainability, Safety, Survivability and Cost Con-

straints. (Normally these factors are presented in terms of entire weapon
system requirement. and tne contractor must budget each subsystem require-
ment acc rdingly.

The specification has been organized around the major topics of system
requirements, subsystem requirements and componenc requirements. The organi-
zation tree qhcwn below illustrates this general organization.

1.0 2.0 3.0 4.0 5.0 &6.0

Scof AND 2APPLICABLE RFOUIREMENj QUALTY PREPARATION
CLALISAFE
CATIONS L RDOCUMENTS
.. ASSURANCE
PROVISIONS FOR DELIVERY
ANDAo'rTS

SYSTEM SUBSYSTFM COwPONENT

REQt:1RJEEME:N7M]'S REQUIREMENTS REQUIR!-MENTS

The first tier breakdown is standard, including scope, classifications,

applicable documents, requirements, quality assurance provisions, preparation
for delivery and notes. Within the requirements section, those requirements
most important to) system designers have been separated from requirements
governing subsystem and component design. This was done in recognition that
many prime contractors use separate organizations for FCS synthesis and design
and for subsystem and component design. It must be recognized that the entire
specification contains interrelated requirements which must be considered by
each design team involved in the design process. One of the challenges of
modern complex FCS design is to insure that communication within the inter-
relating technologies exists and that formal organizational structure does not
prohibit or discourage interdisciplinary interaction at the working level.

System requirements include performance and design. One of the major

expansions made under this revision was a comprehensive coverage of the
"ilities" at the system level. System level failure immunity and other
design requirements also received considerable attention. The organization
tree shown below illustrates coverage included under system requirem.•nts.

5
 Many of theoe requirements are stated in terms of piobabilities and the
term "extremely remote" is often used. In ea,':h procurement, this term will
have a quantitative value as specified by the procuring activity. This and
oth&ir terms are defined in 6.b of the specificatJon.

SYSTEM
REQUIREMENTS

MANUAL
3113.1.2
F-S AFCS
1.. GENERAL MANUAL
IPFEORUiANCE PFRFORMANCE DFSLtSIGN FC3 DLSIGN

r. 1.
AIF'S DESIGN
r 3..
_
3..111
13
"ILITIS"

Subsystem requirements include pilot controls and displays, sensors,

signal transmission and comutation, control powev and actuation require-
ments. The organization tree shown below illustrates this coverage.

SUBSYSTEM

REQUIREMENTM

3.1.1 3.2.2 3.2.3 3.2.4

PiLOT CONTROLS SENSORS SIGNAL SIGNAL
AND DISPLAYS TRANSMISSION COMPUTATION

3,'.S 3.2.6
CONTROL ACTUATION
POWER

6
 Component design, fabrication and installation are included undvr c-em-
pontwnt requirements in 3.2.7 through 3.2.9. Frequent reference to spe(ift,
paragraphs of the AFCS Dosign Handb.,kas was made in thip aren and throughout
the spectffication where additional design guidance iq neeced.

Classifications umzd in MIL-F-9490D include VCS tvpes, FCS Opciptio.atl

States and FCS criticalitib.. FCS types are separated into Manual and Auto-
matic FCS based on whether or not active pilot inputs are involved.

Five FCS Operational States are used to sp,.ifv requirement. Thes..

states are illustrated below with key characteristics noted.

FE'S
OPILUATIONAL STATts

STATE I
(NORMAl OPMR4TION)

STAlT 11
(RkSTRK'T L)

ST.ATk III
tMINIMUM SAIE)

(C"ONTROLLANl. TO AN ,CONAIOLLAIN [0 AN
IMMEDIA7T LANDING) •LJ
,TVACDIAT.Ui ~ LK.HT CONDTK,.,

Three criticality classifications were adopted to organize requirmenuts.

Essential, flight phase essential and noncritical FCS functions are defined.
The key separation is whether the function is needed to insure flight safety
either full time, only during certain flight phases or not at all. These
cl•t'sifications are defined in Section 1.0 of the specification.

7
 SECTION I I

STATEXENT AND DISCUSSION OF RE.elRm4ENTS

I SC'OPE!_

1.1 Stop-. This spv'citi..ation ustablishvs general performanct, design,

devt.lopment and quality assurance requirements for the flight control sys-
tem•Vf 'SAF matined piloted 4ircraft. Flight control systems (FCS) iacWlue
all components used to transmit flight control commands from the pilot or
other surces to appropriate force and moment producers. Flight control
comands may result in coa:trol of aircraft !light path, attitude, airspeed,
aeroddynamlc configuration, ride. and structural modes, 4.mong components
included are the pilot', controls, dedicat.'x displays and logic switching,
transducers, system dynamic and air data sensorm, signal computation, t. st
devices, transmission devices, actuators, and signal transmission lines
dedicated tc. ilight control. Excluded are aerodynaLic surfaces, engines,
helicopter totor,.. fire control devices, crew displays and electronics not
dedicated to tlight control. The interfaces of flight control systems with
related subsysvtems are defined.

1'I1Sd' SS WON

The scope for ti-s MIL-F-Q490 revision remains essentially the same as
in MIL-F'-44QOC. Structural mode control and control of aerodynamic config-
ur.it ion haive been emphasized in the scope statement since there have been
advances in these areas in recent yeirs.

The key to the definition of a flight control system is the term "all
components used". The partial listing given is not meant to be complete.
In each procurement a decision on what cumponents are used to transmit
commands must be made. Definition of interfaces and their characteristics
must also he established.

Inttrtaces ot flight controls with other subsystems must be considered

by the contractor in meeting many of the requirements of AIL-F-9490. Relia-
bilitv and failure immunity requirements, for example, require that failure
effocts in nondedicated subsystems be co.,L-idered when such effects can impact
flight c.introls.

1,2 ( lss ficat ion

1.2.1 Flighth control system (FCS) classifications

1.2.1.1 Manual flitht control systems Q!FCS). Manual Flight Control Systems
consist of electrical, mechanical and hydraulic components which transmit
pilot control commands cr generate anu convey commands which augment pilot
control commands, and thereby accomplish flight control functions. This
classification includes the longitudinal, lateral-directional, lift, drat and
variable geometry control systems. In addition, their associated augmenta-
tion, performance limiting and control devices are Included.

S_ . n!8
1.2.1.2 ,utomatic flight control systems (AECS). Automatic Flight Control
Systems consist of electrical, mechanical and hydraulic components which
generate and transmit automatic control commands which provide pilot assist-
unce through automatic or semiautomatic flight path control or which auto-
matically control airframe response to disturbances. This classificati(.i
includbs automatic pilots, stick or wheel steering, autothrottles, struc-
tural mode control and similar control mechanizations.

DISCUSSION

FCS Classifications have been changed from the Primary, Secondary, Auto-
matic classifications of MIL-F-9490C to Manual and Automatic FCS. The change
from Primary/Secondary FCS to Manual FCS was made as a result of a serious
concern with the high percentage (up to 50 percent) of recent Air Force
incident/accident reports which are due to secondary flight control problemts.
To reduce the number of problems with Secondary Controls, the differentiation
betweta Primary/Secondary control requirements in areas such as failure
immunity has been dropped or sharply reduced.

Stability and Command Augmentation are included under Manual Flight

Controls in this revision due to the increasing reliance of manual controls
on augmentation. Structural Mode Control is included as an Autotmitit, FCS
tunction, with emphasis in this revision on ride smoothing and fatigue
alleviation. Semiautomatic control includes flight director functions when
the option of automatic or semiautomatic operatioT. is provided.

Systems are classified as Structure Mode Control Systems only when this
classification reflects their primary function. Most Dutch roll dampers
reduce loads and improve ride in turbulence, although this is not their
primary functikcn.

1.2.2 FCS Ojrational State classifications

1.2.2.1 Operational State I (Normal operation). Operational State I is the

normal state of flight control system performance, safety and reliability.
This state satisfies MIL-F-8785 or MIL-F-83300 Level I flying qualities
requirements within the operational flight envelope and Level 2 within the
service envelope and the stated requirements outside of these envelopes.

1.2.2.2 Operational State II (Restricted operation). OperationaL State TI

is the state of less than norval equipment operation or performance which
involves degradation or failure of only a noncritical portion of the overall
flight control system, A moderate increase in crew workload and degradation
in mission effectiveness may result from a limited selection or normally
operating FCS modes available for use; however, the intended mission may be
accomplished. This state satisfies at least MIL-i-3785 or MIL-F-83300
Level 2 flying qualities requirements within the operational flight envelope
and Level 3 within the service envelope.

1.2.2.3 Operational State III (minimum safe operation). Operational State

III is the state of degrcdie. flight control systei pe.rformance, safety or
reliability which permits safe termination of precision tracking or
maneuvering tasks, and safe cruise, descent, and landing at the destination

9
 of original intent or alternate but where pilot workload is excessive or
mission effectiveness is inadequate. Phases of the intended mission
involving precision tracking or maneuvering cannot be completed satis-
factorily. This state satisfies at least MIL-F-8785 or MIL-F-83300 Level
3 flying qualities requirements.

1.2.2.4 Operational State IV (controllable tc an immediate emergency

landing). Operational State IV is the state of degrdded FCS operation at
which continued safe flight is not possible; however, sufficient control
remains to allow engine restart attempt(s), a contrc'iled descent and
immediate emergency landing.

1.2.2.5 Operational State V (controllable to an evacuable flight

condition). Operational State V is the state of degraded FCS o'neration at
which the FCS capability is limite 4 to maneuvers required to reach a flight
condition at which crew evacuation . •y be seFely accomplished.

DISCUSSION

FCS operational state classifications define a general framework about

which FCS performance, in terms of FCS operational state, can be related to
FCS reliability and safety requirem*ents. These states parallel the MIL-F-
8785B flying qualities Levels 1, 2 and 3. For example, FCS Operational
State I may be equated with Level 1 flying qualities within the normal
flight envelope. However, the FCS Operational State II may correspond to
either Level 1 or Level 2 flying qualities. FCS Operational State TI may
result due to loss of a ride smoothing or automatic guidance function, for
example, while Level 1 flying qualities are maintained.

A State III FCS operational level may be reached through degradation of

any flight control function to a state which requires landing at the nearest
friendly base. A FCS failure mode leading to Level 3 flying qualities will
result in an Operational State III designation. In addition, single or
multiple channel failures resulting in a minimum safe configuration in a
redundant FCS required for safety-of-flight, may also result in FCS Opera-
tional State III even though the remaining FCS channel(s) may still provide
Level 1 flying qualities. Note that in some cases single thread mechanical
controls may meet reliability requirements. In t:hese cases, redundancy is
not required for Level 1 operation.

The Operational State IV classification is a new concept which recog-

nizes that a level of FCS performance is required for aircraft such as
MIL-F-8785 Class III following critical failures within the flight controls,
engines or other systems which prohibit continued safe flight. The intent
of this classification is to provide for those FCS minimum requirements
needed to escape a hostile a: =a or flight conditions to arrive at a safe
evacuable flight condition.

In each procurement the p, ocuring activity will specify whether State

IV or State V applies (See 3.1.8).

10

L-4-....... .....
.PO,

1 :.3 FCS criticality classification

1.2.3.1 Essential. A tunction is essential if loss of the function results

in an unsafe 'ondition or inability to maintain FCS Operational State Ill.

1.2.3.2 Flight phase essential. A function is flight phase essential it

loss of the function results in an unsafe condition or inability to maintain
FCS Operational State III only during specific flight phases.

1.2.3.3 N',ncritical. A function is nonctitical if loss of the iunction does

not affect flight safety or result in control capability belcw that required
for FCS Operational Stare III.

DISCUSSION

Claqsificatious of criticality are defined around which system ýmplemen-

tqtion requirements can be organized. MIL-F-9490C assumed that all Primary
FCS were flight essential and all Secondary FCS were noncritical. No general
criticality distinction is made in this specification among the FCS classi-
fications of Manual FCS and the zlassifications of Automatic FCS. For each
pr3curemeat, the contractor will evaluate the criticality of each flight
control function based on the mission requirements specified by the procuring
agency and design approach selected by the contractor. For example, in a
given procurement one contractor may choose to utilize an airplane configura-
tion utich requires an essential stability augmentation system, while a com-
peting contractor may select a different airplane configuration which
accomplishes the same misaion, but uses a noncritical stability augmentation
system.

11
2.0 APPLICABLE DOCUMENTS

2.1 The following documents, of the issue in effect on tha date of invita-
tion for bids or request for proposal, form a part of this suecification to
the extent specified herein. The iequirements of this specification shall
govern for flight control system design where conflicts exist between this
specification and other referenced specifications.

SPECIFICATIONS

Military

MIL-T-781 Terminal, Wire Rope, Swaging

MIL-F-3541 Fitting, Lubrication
MIL-U-3963 Universal Joint, Antifriction Bearings
MIL-B-5087 Bonding, Electrical and Lightning Protection, for
Aerospace SysL MS
MIL-W-5088 Wiring, Aircraft, Selection and Installation of
MIL-E-5400 Electronic Equipment, Airborne, General Specification for
MIL-H-5440 Hydraulic Systems, Aircraft Types I and II, Design,
Installation, and Data Requirements for
MIL-C-5503 Cylinder, Aeronautical, Hydraulic Actuating, General
Requirements for
MIL-P-5518 Pneumatic Systems, Airciaft, Design, Installation, and
Data Requirements for
MIL-T-5522 Test Procedure for Aircraft Hydraulic and Pneumatic
Systems, General
MIL-S-5676 Splicing Cable Terminal, Process for, Aircraft
MIL-T-5677 Thimble, Wire Cable, Aircraft
MIL-B-5687 Bearing, Sleeve, Washers, Thrust, Sintered, Metal Powder,
Oil-Impregnated
MIL-C-6021 Casting, Classification and Inspection of
MIL-B-6038 Bearing, Ball, Bellcrank, Antifriction, Airframe
MIL-B-6039 Bearing, Double Row, Ball, Sealed, Rod End, Antifriction,
Self-Aligning
MIL-E-6051 Electromagnetic Compatibility Requirements, Systems
MIL-T-6117 Terminal, Cable Assemblies, Swaged Type
MIL-J-6193 Joint, Universal, Plain, Light ,and Heavy Duty
MIL-G-6641 Gearbox, Aircraft Accessory Drive, General Specification
for
MIL-P-7034 Pulley, Groove, Antifriction-Bearing, Grease-Lubricated,
Aircraft
MIL-I-1064 Indicator, Position, Elevator Trim Tab
MIL-E-7080 Electric Equipment; Aircraft, Selection and Installation of
MIL-F-7190 Forging, Steel, for Aircraft and Special Ordnance
Applications
MIL-D-7602 Drive, Turbine, Air, Aircraft Accessory, General Specifi-
cation for
MIL-B-7949 Bearing, Ball, Airframe, Antifriction
MIL-C-7958 Control, Pubh-Pull, Flexible and Rigid
MIL-M-7969 Motor, AC, 400 Cycle, 115/200 Volt System, Aircraft,
General Specification for

12
MIL-M-7997 Motor, Aircraft Hydraulic, Constant Displacement, General
Specification for
MIL-I-8500 Interchangeability and Replaceability of Component Parts
for Aircraft and Missiles
MIL-P-8564 Pneumatic System Components, Aeronautical, General
Specification for
MIL-M-8609 Motor, DC, 28 Volt System, Aircraft, General Specification
for
MIL-S-8698 Structural Design Requirements, Helicopters
MIL-H-8775 Hydraulic System Components, Aircraft and Missiles, General
Specification for
MIL-F-8785 Flying Qualities of Piloted Airplanes
MIL-A-8860 Airplane Strength and Rigidity, General Specification for
MIL-A-8861 kirplane Strength and Rigidity, Flight Loads
MIL-A-8865 Airplane Strength anJ Rigidity; Miscellaneous Loads
MIL-A-8866 Airplane Strength and Rigidity - Reliability Requirements,
Repeated Loads, and Fatigue
MIL-A-8867 Airplane Strength and Rigidity, Ground Tests
MIL-A-8870 Airplane Strength and Rigidity Flutter; Divergence, and
Other Aeroelastic Instabilities
MIL-T-8878 Turnbuckle, Positive Safetying
MIL-S-8879 Screw Threads, Controlled Radius Root with Increased Minor
Diameter; General Specification for
MIL-H-8890 Hydraulic Components, Type II, -65* to +450*F, General
Specification for
MIL-H-8891 Hydraulic Systems, Manned Flight Vehicles, Type III, Design,
Installation, and 11.- Requirements for
MIL-A-8892 Airplane Strength igidity, Vibration
MIL-A-8893 Airplane Strength ana Rigidity, Sonic Fatigue
MIL-B-8976 Bearing, Plain, Self-Aligning, All-Metal
MIL-S-9419 Switch, Toggle, Momentary, Four-Position On, Center Off
MIL-C-18375 Cable, Steel (Corrosion-Resisting, Nonmagnetic) Flexible,
Preformed (for Aeronautical Use)
MIL-A-21180 Aluminum-Alloy Casting, High Strength
MIL-A-22771 Aluminum Alloy Forgings, Heat Treated
MIL-K-25049 Knob, Control, Equipment, Aircraft
MIL-G-25561 G-ip Assembly, Controller, Aircraft, Type MC-2
MIL-V-27162 Valve, Servocontrol, Electrohydraulic, General
Specification for
MIL-C-27500 Cable, Electrical, Shielded and Unshielded, Aircraft
and Missile
MIL-E-38453 Environmental Control, Environmental Protection, and Engine
bý.eed Air Systems, Aircraft, and Aircraft Launched Missiles,
General Specification for
MIL-M-38510 Microcircuit, General Specification for
MIL-B-81820 Bearing, Plain, Self-Lubricating, Self-Aligning, Low Speed
MIL-F-83142 Forging, Titanium Alloys, for Aircraft and Aerospace
Applications
MIL-F-83300 Flying Qualities of Piloted V/STOL Aircraft
MIL-W-83420 Wire Rope, Flexible, for Aircraft Control
MIL-A-83444 Airplane Damage Tolerance Requirements

13
STANDARDS

Military

MIL-STD-130 Identification Marking of U.S. Military Property

MIL-STD-143 Standards and Specifications, Order of Precedence for
the Selection of
MIL-STD-250 Aircraft Station Controls and Displays for Rotary Wing
Aircraft
MIL-STD-421 Chain Roller; Power Transmission and Conveyor, Flat Link
Plates, Single Pitch, Single and Multiple Strand, Con-
nective Links and Attachment Links
MIL-STD-454 Standard General Requirements for Electronic Equipment
MIL-STD-461 Electromagnetic Interference Characteristics Requirements
for Equipment
MIL-STD-480 Configuration Control - Engineering Changes, Deviations
and Waivers
MIL-STD-704 Electric Power, Aircraft, Characteristics and Utilization
of
MIL-STD-810 Environmental Test Methods
MIL-STD-838 Lubrication of Military Equipment
MIL-STD-1472 Human Engineering Design Criteria for Military Systems,
Equipment and Facilities
MIL-STD-1530 Aircraft Structural Integrity Program, Airplane Require-
ment s
MIL-STD-1553 Aircraft Internal Time Division Multiplex Data Bus
MS15002 Fittings, Lubrication (hydraulic) Surface Check, Straight
Threads, Steel, Type II
MS15981 Fasteners, Externally Threaded, Self-Locking, Design and
Usage Limitations for
MS24665 Pin, CotterI
MS33540 Safety Wiring and Cotter Pinning, General Practices for
MS33572 Instrument, Pilot, Flight, Basic, Standard Agreement for
MS33588 Nuts, Self-Locking, Aircraft Design and Usage Limita-
tions of
MS33602 Dolt, Self Retaining, Aircraft Reliability and Maintain-
ability Design and Usage, Requirements for
MS33736 Turnbuckle Assemblies, Clip Locking of

PUBL ICAT IONS

Military Handbooks

MIL-HDBK-5 Metallic Materials and Elements for Aerospace Vehicle

Structures
MIL-HDBK-1.7 Plastics for Flight Vehicles

Air Force Systems Command Design Handbooks

AFSC DH 1-2 General Design Factors

AFSC DH 1-4 Electromagnetic Compatibility
AFSC DH 1-5 Environmental Engineering

14
AFSC DH 1-6 System Safety
AFSC DH 2-1 Airframe
AFSC DH 2-2 Crew Stations and Pa3senger Accommodations

(Copies of specifications, standards, drawings, publications and handbooks

required by suppliers in connection with specific procurement functions
should be obtained from the procuring activity or as directed by the con-
tracting officer.)

2.2 Other Publications. The following documents form a part of this speci-
fication to the extent specified herein. Unless otherwise indicated, the
issue in effect on date of invitation for bids or request for proposal shall
apply.

National Aircraft Standard

NAS 516 Fitting, Lubrication - 1/8 Inch Drive, Flush Type

(Copies of National Aircraft Standards may be obtained from the Aircraft

Industries Association of America, Inc., Shoreham Building, Washington,
D. C.)

SAE Aerospace Recommended Practices

ARP 988 Electrohydraulic Mechanical Feedback Servoactuators

ARP 1281 Servoactuators: Aircraft Flight Controls, Power
Operated, Hydraulic, General Specification for

(Application for copies should be addressed to the American Society of

Automotive Engineers, Two Pennsylvania Plaza, New York, New York 10001.)

ICAO Practices

ICAO Annex 10 International Civil Aviation Organization Publication -

Aeronautical Telecommunications Vol. II, Communication
Procedures, International Standards, Recommended Prac-
tices and Procedures for Air Navigation Services

FAA Advisory Circular

FAA Advisory Criteria for Approving Category T and Category II Land-

Circular 120-29 ing Minima for FAR 121 Operators

Technical Reports

AFFDL-TR-74-116 Background Information and User Guide for MIL-F-9490D

(Technical society and technical association specifications and standards

are generally available for reference from libraries. They are also dis-
tributed among technical groups and using Federal agencies.

15
3.0 REQUIREMENTS

3.1 System requirements. The FCS shall comply with the following require-
ments.

DISCUSSION

The following sections specify general requirements for flight control

systems. Additional detail system requirements and the aerodynamic and
flight configurations, external stores configurations, and aircraft per-
formance range through which the flight control system will be required to
satisfy these requirements shall be as defined in the procurement detail
specification. Paragraph 3.2 defines subsystem and component requirements
and 3.3 defines special flight control system requirements for rotary wing
aircraft.

This section specifies system requirements in terms of performance and

design requirements. This specification does not place priorities on either
performance or design requirements, considering all requirements to be of
equal importance. Performance requirements specify what the system must
provide or do. Design requirements constrain the system design to insure
that system operation will be acceptable in service. The reader should be
fully aware that system development must include consideration of costs,
maintenance, complexity, and safety, as well as performance. Procuring
activity desires or requirements may be often in conflict in two or more of
these asset/liability areas. The contractor is expected to perform trade
studies to evaluate tradeoffs involved. Data from these trade studies will
normally be required to obtain deviations, as noted in 6.2.

3.1.1 MFCS Performance requirements. The MFCS shall comply with applicable
general flying quality requirements of MIL-F-8785 or MIL-F-83300 and the
special performance requirements of the procurement detail specification.

DISCUSSION

The sources for Manuoal FCS performance requirements are MIL-F-8785, MIL-
F-83300 and the procurement detailed specification. This specification
defines design requirements for all FCS and performance requirements for
Automatic FCS. Reference 1 provides background and user information support-
ing MIL-F-8785B.

Research has been pursued in recent years to identify analytical proce-

dures and techniques which provide an organized approach to satisfying Manual
FCS performance requirements. The weapons delivery requirements of indi-
vidual procurements can often be best approached through a paper pilot
(Reference 2) or simulation approach. Referenre 3 documents a series of Air
Force studies on piloted weapon delivery which T'ay be helpful in procurements
where strafing, dive bombing, or aerial gunnery is a mission requirement.
Reference 4 documents a similar study considering higher order controls
system dynamics. Reference 5 discusses multimode flight control for preci-
sion weapon delivery and concludes that a control system specifically
designed for gunnery is superior to a connventional SAS for weapons delivery
purposes. Reference 6 documents a study to develop improved design criteria
for command augmentation. The study consisted of eight parts, including a

16
ii

survey of operational prcblems, a review of system-gain changing requirements

and techniques, stabilization criteria for frequency modes, an analysis of
stall-spin maneuvers, an analysis of system/airframe compatibility testing,
definition of criteria for built-in-test equipment, and catalogs of flight
control actuator designs and of dominant performance characteristics ,hich
affect flying qualities.

References 7 and 8 document a flight test evaluation of a high gain

CAS in an F-4. One conclusion of this flight test was that MIL-F-8785B
(ASG) does not proptrly address the requirements for a stable, controllable
platform for accomp.lishing a tracking task. Reference 9 is an interesting
study titled "Outs-marting MIL-F-8785B (ASG), The Military Flying Qualities
Specification." Ibis study points out some of the weaknesses of MIL-F-8785B
and may aid the controls designer in understanding his complex task. Ref-
erence 10 describes the benefits of a Stall Inhibitor System developed for
the F-111.

Reference 11 documents a survey of classical and modern control analy-

sis methods for FCS design. This reference points cut that a very large
amount of published material exists relating to the design of flight control
sy .ems. Many methods are available for synthesis of controllers, ranging
fr ii classical cut-and-try methods to optimal techniques. Within the
1.4ustry control designers are making use of a spectrum of these techniques,
.Iather with a fair amount of intuition, simulation, and hard work, to
generate workable designs. No one technique has been shown to produce
consistently superior designs.

An important conclusion of Reference 11 is that: "There does not exist

any method or combination of methods which will permit a person not experi-
enced in control to generate a workable design."

Numerous "good practices" are recommended ýn these references which

are based on specific experience with individual airplanes or groups of
airplanes. Due to the unique demands of individual procurements, most of
these recommendations are not incorporated in this specification as require-
ments. However, for emphasis, the following recommended practices are
listed for consideration.

Selectable command modes. Pilots will select and adapt to special

augmer.tation modes during weapons delivery and other special flight phases
where special mission task requirements conflict with normal flying quali-
ties. The contractor should consider selectable command modes, where per-
tinent. But inconsistencies In display indications or the result of cockpit
control motions can be confusing to the pilot. For example, reversals of
e:eie must be avoided.

Stabilization axis. In control system designs in which the pilots

lateral controller operates both ailerons and rudder or their equivalent,
consideration should be given to the resultant effective axis of rotation.
If one of the prime weapons of the vehicle is a fixed body mounted gun,
the preferred effective axis of rotation should be coincident with the gun
axis, which itself should be aligned along a stability axis defined by the
anticipated angle-of-attack in firing mode. If the gun axis differs con-
siderably from a stability axis at delivery, rotation about the gun axis
17
.Pol

will cause angle-of-attack to translate into sideslip, possibly of

unacceptable amounts, and in this event the preferred axis should be
between the gun and stability axes at a point at which sideslip in normal
firing maneuvers is maintained at a satisfactorily small. value. These
considerations may conflict with the need to keep lateral acceleration in
bounds at the cockpit.

Direct flight path control. Control systems for vehicles having pure
uideforce generators should be designed bearing in mind the possible improve-
ments in weapon delivery accuracy achievable by unconventional response to
pilot controls. Control systems combining direct lift and sideforce gener-
ators, decoupling feedback and feed forward, and possibly a controller in
se'dition to the usual stick and pedals may be used if expected improvements
in weapon delivery accuracy can be demonstrated analytically or by simula-
tion to the satisfaction of the procuring agency. Consideration should be
give-a to control schemes in which the pedals or a separate controller give
direct lateral flight path control with zero bank or sideslip and in which
a column or a separate controller produces vertical flight path control with
zero or small pitch change. The pilot's ability to handle an additional
control, of course, is a factor.

Gust and external disturbance response. Designs where specific meas-

ures are taken to improve the gust and external disturbance response of the
aircraft are recommended. The maintenance of ground track despite turbulence
is of particular importance when high, level bombing is the probable vehicle
mission. Designs incorporating the decoupling of sideslip from lateral coii-
trol and bank angle from directional control should be examined particularly
careful~l: with respect to the bank angles generated by side gusts. Decoup-
ling techniques in current use can cause deterioration in gust response if
attention is not given specifically to preventing the deteriorat~on.

Limit cycles during weapons delivery. Adaptive or other automatic gain

changing systems relying on limit cycle detection for gain changing deci-
sions should be designed paying particular attention to the avoidance of
the limit cycle during flight conditions at which weapons will be delivered.
"2~ie limit cycle should be undetectable to the pilot. Similarly, if system
gain changing takes place during weapon delivery, while the servos are
moving, no thumping sensations should be experienced by the pilot and fly-
ing qualities must remain satisfactory throughout, despite the gain changes.

Trim changes. Apparent trim changes originating in the augmentation

or control systems should be avoided whether due to extended low frequency
response in the systems or to a normal accelerometer sensing less than lg
in a climb or dive. An automatic trim system reducing these apparent trim
changes to below pilot threshold will normally be acceptable. Where there
are directional trim changes with speed change during a weapon delivery run,
systems designed to minimize the trim change are desirable.

Constant stick forces. Systems incorporating washout filters on sen-

sor outputs or elsewhere in the system should be designed to avoid changes
in stick force wi~th time during sustained constant normal-acceleration turns.

13
 Symmetrical stick forces. Control systema incorporating models should
be designed to rrovide identical sensitivity for nose-down and nose-up
commands. Whatever the system design, the stick forces for a given magni-
tude response should be the name irrespective of the sign of the command.
This applies both laterally and longitudinally.

Aircraft flexibility. There can be effects beyond the impact of aero-

elasticity on aircraft handling and flight control systems. For example,
the design of a control-augmentation system to be used in part for weapon
delivery must address itself to the effects of aircraft flexibility on
weapon delivery accuracy. A reduction in amplitude of flexible body
oscillation may be necessary 11o reduce oscillatory boresight errors.
Static boresight errors due to loading in high-g maneuvers should also be
considered in estimating delivery accuracy degradation due to flexibility.

Hysteresis. Hysteresis or backlash at any point in the control-

augmentation system should be controlled either by ant ibacklash springs or
by other means, at least to the point that limit cycles existing anywhere
are imperceptible to the pilot at any flight c'ondition at which weapons may
be delivered.

Gun moments. The effect of firing high repetition rate small caliber
weapons or large projectiles from the aircraft on the stability of the
vehicle should be understood and compensated for in the control system
design.

Growth capability. A candidate system concept should be carefully

examined for growth capability before selection for design and development.
Reference 13 documents how the complexity of a system can escalate as
knowledge of aircraft dynamic characteristics are refined and the detail
problems of designing flight-critical controls become known.

3.1.2 AFCS Performance requirements. When the following AFCS functions

are use,, the following specified performance shall be provided. Unless
otherwise specified, these requirements apply in smooth air and include
sensor error. Except where otherwise specified, a damping ratio (6.6) of
at least 0.3 critical shall be provided for nonstructural AFCS controlled
mode responses. Specified damping requirements apply only to the response
characteristics for perturbations an order of magnitude greate-: than the
allowable residual oscillation.

DISCUSSION

The AFCS performance specified in this Section is intended to include

'not-to-exceed" parameters which are felt necessatry for proper fleet oper-
ation. Pilot relief functions are specified to reduce crew fatigue to a
level consistert with mission requirements. Automatic landing and terrain
following are specified to extend mission capabilities in applications
where the mission warrants the additional complexity. Performance is
generally specified with respect to sensor indicated values. In many cases,
sensor accuracy is set by manual control considerations. Where performance
is not specified with respect to an FCS sensor reference, sensor error must
be included in meeting the requirement.

19
 The concept of specifying performance to include sensor error may
lead to deviation requests where sensors are governmnt furnished and do
not permit meeting the stated performance. Where sensors are government
furnished, the procuring activity must accept the responsibility for
providing sensors oZ adequate accuracy.

3.1.2.1 Attitude hold (pitch and roll). Attitudes shall be maintained in

smooth air with a static accuracy of +0.5 degree in pitch attitude (with
wings level) and +1.0 degree in roll attitude with respect to the reference.
RMS attitude deviations shall not exceed 5 degrees in pitch or 10 degrees in
roll attitude in turbulence at the intensities specified in 3.1.3.7. When
using a flight controller (turn knob) the aircraft shall return to a wings
level attitude when the turn control is placed in the detent position.
Accuracy requirements shall be achieved and maintained within 3 seconds of
mode engagement for a 5 degree attitude disturbance for MIL-F-8785 Class IV
aircraft, and within 5 seconds for MIL-F-8785 Classes I, II and III aircraft.

3.1.2.2 Heading hold. In smooth air, heading shall be maintained within a

static accuracy of +0.5 degree with respect to the reference. In turbulence,
RMS deviations shall not exceed 5 degrees in heading at the intensities
specified in 3.1.3.7. When using a flight controller, heading hold shall
automatically engage as the controller is returned to the detent position.

3.1.2.3 Heading select. The aircraft shall automatically turn through the
smiallest angle to any heading selected or preselected by the pilot and main-
tami that heading to the tolerances specified for heading hold. The con-
tractor shall determine a bank angle limit which provides a satisfactory
turn rate and precludes impending stall. The heading selector shall have
360 degrees control. The aircraft shall not overshoot the selected heading
by more than 1.5 degrees with flaps up or 2.5 degrees with flaps down. The
roll rate shall not exceed 10 deg/sec and roll acceleration shall not exceed
5 deg/sec/sec for MIL-F-8785 Classes I, II and III aircraft, or double these
values for MIL-F-8785 Class IV aircraft.

DISCUSSION

Attitude hold maneuver limits are not included in this general require-
m01t due to the lack of agreement on maneuver limits. MIL-F-9490C set
maneuver limits for the attitude hold function +60 degrees in roll, +15
de~grees in pitch, and +7 degrees yaw angle for control stick steering appli-
cations. Maneuver limits will normally be specified in the detailed speci-
fication or will be established by the contractor for each procurement based
on requirements of that proLurement.

the accuracy requirement ot +0.5 degrees for attitude hold modes repre-
sent's a typical air transport requirement, Reference 13, and state-of-the-.art
capability. The accuracy requirement in turbulence applies only up to the
turbulence amplitude limits specified herein. Attitude hold and other pilot
assist AFC5ý modes will normally be classified as noncritical functions and,
as such, the turbulence iequirement stated will normally apply only in
light turbul unce.

02
 The 10 degrees bank, 5 degrees pitch angle and the 5 degrees heading
limit in turbulence is intended to provide the pilot with a reasonably
scable platform during flight in the turbulence environment to which the
attitude and heading hold loops will be designed. A system which is easily
saturated in turbulence will have trouble meeting these requirements, and
should be avoided.

The heading hold static accuracy requirement of 0.5 degree reflects

the current state-of-the-art. Reference 13 states typical air transport
heading hold requirements, which may be considered in pertinent applications,
as follows: when selection of this mode is made while the aircraft is turn-
ing, the airplane should return to wings-level at a roll rate not to exceed
6.0 deg/sec, a roll acceleration not to exceed 3.0 deg/sec/sec, and should
hnld the heading that exists at the time the airplane is within approximately
3 degrees of wings level.

The bank angle limit for Heading Select, to be determined by the con-
tractor, will probably be unique for each new procurement. The requirement
to preclude impending stall is meant to apply with normal power settings.
This pilot relief mode is not expected to normally result in steep banks or
operation near stall.

3.1.2.4 Lateral acceleration and sideslip limits. Except for flight phases
using direct side force control, the following performance shall be provided
whenever any lateral-directional AFCS function is engaged. Lateral accelera-
tion refers to apparent (measured, sensed) body axis acceleration at the
aircraft center of gravity.

3.1.2.4.1 Coordination in steady banked turns. Sideslip angle shall not be

greater than 2 degrees and lateral acceleration shall not exceed 0.03g, while
at steady bank angles up to the maneuver bank angle limit reached during
normal maneuvers with the AFCS engaged. For rotary wing aircraft, only the
lateral acceleration limit applies.

3.1.2.4.2 Lateral acceleration limits, rolling. Body axis lateral acczelera-

tion at the cg shall not exceed +O.lg for aircraft with roll rate capability
up to 30 deg/sec, +0.2g for aircraft with roll rate capability of 30 to 90
deg/sec, or +0.5g for aircraft with roll rates over 90 deg/sec. These limits
shall be satisfied for aircraft in essentially constant altitude flight while
rolling smoothly from one side to the other at bank rates up to the rmaximum
obtaiiable through AFCS modes.

3.1.2.4.3 Coordination in straight and level flight. The accuracy while the
aircraft Is in straight and level flight shall be maintained within a side-
slip angle of +1 degree and a lateral acceleration of +0.02g at the cg,
whichever is lower. For rotary wing aircraft, only the lateral acceleration
limit applies.

3.1.2.5 Altitude hold. Engagement of the altitude hold function at rates of

climb or de-cenc less than 2000 fpm shall select the existing indicated
barometric altitude and control the aircraft to this altitude as a reference.
The resulting normal acceleration shall not exceed 0.2g incremental for
MIL-F-8785 Classes I, II and III aircraft, or O.5g incremental for MIL-F-8785

21
C'la.z i\ airi'ratt. For engagement at rates above 2000 feet per minute the
A\C•'S h;hill not cause any unsafe maneuvers. Within the aircraft thrust-d'ag
cap,,blitty and at steady bank angles, the mode shall provide control accur-
.,c lei' shown in Table I.

TABI F I MINIMUM ACCEPTABLE CONTROL ACCURACY

0-1 1 -30 30-60

55,000 +--. 1%Iat 5S,000

to varying linearly
80,000 to ±0.2% at 80,000
±bO ft. t9O ft.
30,000 or or
to ±0. I, ±t10.3% ±0.4%
55,000 whichever whichever
is is
Urger larger
0
to t30 ft.
30,000

These accuracy requirements apply for airspeeds up to Mach 1.0. Double these
values are permitted above Mach 1.0 and triple these values apply above Mach
2.0. Following engagement or perturbation of this mode at 2000 feet per min-
ute or less, the specified accuracy shall be achicved within 30 seconds. Any
periodic residual oscillation within these limits shall have a period of at
least 20 seconds.

3.1.2.6 Mach hold. The Mach number existing at the engagement of Mach hold
shall be thc, reference. After engagement and stabilization on Mach hold,
the AFCS shall maintain indicated Mach number and the error shall not exceed
+0.01 Mach or +2 percent of indicated Mach, whichever is larger, with respect
to the reference. Any periodic oscillation within these limits shall have
a period of at least 20 seconds. The contractor shall establish a mode
response or maximum time to capture requirement which is suitable for the
mission phase.

3.1.2.7 Airspeed hold. The airspeed existing at the engagement of airspeed

hold shall be the reference. Indicated airspeed shall be maintained within
+ knots or +2 percent, whichever is greater, of the reference airspeed. Any
periodic oscillation within this limit shall have a period of at least 20
seconds. The contractor shall e,-:ablish a mode response or maximum time
to c•pture requirement which is suitable for the mission phase.

,) .)
 I=o

DISCUSSION

Altitude hold requirements include acceleration amplitude limits. For

reference, commercial transports normally limit normal acceleration for
altitude hold engagement to 0.15g incremental. Residual oscillations are
permitted within the amplitude limits specified herein. Response roquire-
ments are specified similar to those used ir.a recent commercial transport
AFCS development and in a recent USAF fighter AFCS development.

Provisions should normally be included to disengage altitude hold at

a given angle of attack. The F-Ill, for example, can get in a situation
where more thrust is required than is available and the altitude hold
feature will continue to increase angle of attack until stall.

In addition to the altitude hold accuracies specified for steady bank

angles, performance in maneuvering flight should also be considered by the
designer. Also the designer should not overlook the need to control alti-
tude excursions during airspeed changes, Altitude hold deviations during
normal airplane configuration changes should also be considered.

Airspeed hold requirements are specified which are similar to those

used in commercial applications. Minimum damping is specified in 3.1.2 for
the transient response following a disturbance; howt'ver, there is no damping
requirement for small oscillations within the performance tolerance bands.
The contractor is required to establish a maximum time for recaptuce of the
commanded airspeed or Mach following a disturbance which is suitable for the
mission phase. This value will be based on the control characteristics of
the individual aircraft being developed and should be included in the FCS
Specification (4.4.2).

Altitude hold and airspeed hold tolerance increase with airspeed.

YF-12 experience has shown that tolerances may need to bo. relaxed for flight
ivear Mach 3.0. Otherwise, the tight loops needed i.o hold Mach may result in
large altitude variations and degraded ride qualities.

The sideslip angle limits specified herein are not applicable for heli-
copters. Helicopters normally fly at varying small sideslip angles in
trimmed levn1 flight with zero lateral acceleration because of the varicitio,
of the inpl~ne rotor forces as a function of flight condition.

3.1.2.8 Auto 'atic navigation.

3.1.2.8.1 VOR/TACAN. When preconditions for radial capture are satisfied

the AFCS shall cause the aircraft to maneuver to acquire the radial bt.am
center. Maximum roll rate and attitrede commands shall be limited to provide
a smooth capture and subsequent tracking of the radial. The following per-
formance requirements for VOR are stated in terms of crosstrack error (teet)
and radial error (expressed in j amps; 1 degree - 15 iAamps) to provide for
systems using either ARINC 547 or 579 VOR receivers. For ARINC 547
receivers only the radial error applies. Crosstrack error applied to the
ARINC 579 receiver operating in the primary mode (co-located VOR/DME), and
radial error apolies in the reversionary mode (DM inoperative ol not avail-
able),

23
I
3.1.2.8.1.1 VOR capture and tracking. Overshoot shall not exceed 5,800
feet (20 14a) beyond the desired ground track line in a no-wind condition
for captures jO miles or more from the station with intercept angles up to
45 degrees. Following capture at 50 miles or more, the aircraft shall
remain within an average of 5,800 feet (20 H a) from the VOR radi.1 beam
center, with this error allowance decreasing proportional to the distance
from the VOR station. Average tracking error shall be measured over a 5
minute pcriod between 50 and 10 miles from the station or averaged over the
nominal aircraft flight time between the same distance limits, whichever
time is shorter.

3.1.2.8.1.2 TACAN capture and tracking. Overshoot shall not exceed 6,300
feet beyond the desired ground track line in a no-wind condition for captures
120 miles or more from the station with intercept angles up to 30 degrees.
The required 0.3 damping ratio shall be exhibited for continuous tracking
between 120 miles and 20 miles from the station.

3.1.2.8.1.3 Overstation. The VOR/TACAN mode shall include automatic means

for maintaining the aircraft within +1 degree of aircraft heading or ground
track existing at the inbound edge of the VOR zone of confusicn (ZOC). Dur-
ing overflight of the ZOC, adjustment of the preset course heading or its
equivalent shall cause the roll AFCS to mpneuver the aircraft to capture the
appropriate outbound radial upon exiting from the ZOC. The VOR/TACAN capture
maneuvering limits may be reinstated during overstation operation.

3.1.2.9 Automatic instrument low approach system. The approach mode of the
AFCS shall respond to localizer signals for lateral guidance and glide slope
signals for vertical guidance. The system shall be designed to automatically
steer the aircraft to a minimum decision height of 100 feet during ICAO
Category Il weather minimums. The system shall provide timely warning to per-
mit the pilot to complete the landing if runway visual cot tact is established
or to safely execute a go-around following any single failure or combination
of failures not shown to be extremely remote as defined in 6.6. The system
shall comply with the tracking requirements of 3.1.2.9.1 through 3.1.2.9.3
for probable comb'inations of headwinds to 25 knots, tailwinds to 10 knots,
and crosswinds to 15 knots, with the probability of occurrence of such winds
and associated turbulence and wind shears as defined in 3.1.3.7.3.

3.1.2.9.1 Localizer mode. The AFCS shall cause the aircraft to maneuver to
acquire the localizer beam. Heading or roll rate and attitude commands shall
be limited to provide a smooth capture and subsequent tracking of the local-
izer beam. Overshoot shall not exceed 0.5 degrees (37.5 M a) radial error
from localizer beam center for captures with initial intercept angles of 45
degrees at 8 miles from runway threshold and increasing linearly to 60
degrees at 18 miles from runway threshold in a no wind condition. During
localizer capture the system shall exhibit a damping ratio of at least 0.1
within the noted capture ranges, including the effects of system nonlinear-
ities. The system shall be considered to be tracking whenever the following
conditions are satisfied: localizer beam error is 1 degree (75 o a) or less,
localizer beam rate is 0.025 deg/sec (2 u a/sec) or less, and roll attitude
is 5 degrees or less. During beam tracking the system shall exhibit a damp-
ing ratio of 0.2 or greater at a distance of 40,000 feet from the localizer

24
transmitt.-r. The AFCS shall maintain the aircratt 2oaposition within 0.33
degrees (2 5 ,M a) of localizer beam center whenever the aircraft is between
(1) 40,000 feet horizontal distance from the localizer transmitter, and
(?) the point where 100 feet above the ground is reached; these criteria
shall be based on a Category II localizer ground installation and 10,000
foot runway is defined by ICAO Annex 10.

3.1.2.9.2 Glide slope mode The pitch UFCS shall cause the aircraft to
maneuver to acquire the glide slope beam. Neither the position of the air-
craft above or below the glide slope nor vertical speed of the aircraft at
time of mode selection shall be incorporated as a precondition for mode
engagement. When preconditions are satisfied, overshoot shall not exceed
0.16 degrees (35 &4 a) of radial error from glide slope beam center when
capr,,ring from below the beam in level flight at an altitude greater than
800 feet above the glide slope transmitter datum altitude in a no-wind
condition. The system shall exhibit a damping ratio of 0.085 or greater
subsequent to the first overshoot for -he conditions defined. On a Category
II ILS ground facility (including 10,000 foot runway) as defined in ICAO
Annex 10, the pitch AFCS shall maintain the aircraft glide slope antenna
2 c opposition within 0.16 degrees (35 p a) of beam center or within 12 feet
of beam center, whichever is greater, between the altitudes of 700 feet and
100 feet above the glide slope transmitter datum.

3.1.2.9.3 Go-around mode. The automatic go-around mode shall be manually

engaged only. The AFCS shall be designed such that no single failure, or
combination of failures not extremely remote, will cause the aircraft to
maneuver to increase the rate of descent upon engaging the go-around mode.
If the go-around mode is designed for concurrent operation with other auto-
matic control systems, a single switch location or pilot action shall engage
all systems into the appropriate mode for go-around. Should one or any
combination of concurrently operating automatic control systems be inopera-
tive at the time of AFCS go-around mode engagement, the AFCS shall compl.
with the performance requirements based on normal go-around procedures
including manual management of thrust, flaps, and landing gear.

3.1.2.9.3.1 Pitch AFCS go-around. The pitch AFCS shall cause the aircraft
to smoothly rotate sufficiently to establish a positive rate of climb such
that the aircraft will not intersect the obstacle clearance planes defined
in FAA Advisory Circular 120-29 more often than 1 in 106 events for the wind
conditions defined in 3.1.2.9, and including high altitude, hot day conditions
as defined by the procuring activity. In the event of inadvertent loss of an
engine just prior to or during automltic go-around, the system shall not cause
the aircraft to approach sta]l within 30 seconds of mode engagement, based on
design approach speed. If operating procedures require the mode to be disen-
gaged upon inadvertent loss of an engine, a timely warning shall be provided
for the pilot to initiate the disengage procedure. Disengagement under this
condition shall be accomplished manually.

3.1.2.9.3.2 Lateral-heading AFCS go-around performance standards. The

lateral-heading AFCS shall maintain the aircraft 4 a position within the
lateral boundaries of the obstacle clearance planes during wind conditions
as specified in 3.1.2.9. This capability shall be maintained in the event of
the most critical engine failure just prior to or during automatic go-around.

25
If normal procedure is to disengage the go-around mode after inadvertent
loss of one engine, under the wind conditions cited a pilot of normal skill
shall be able to recover airplane heading such that intersection with the
obstacle clearance planes will occur no more than 1 in 106 events during
recovery.

3.1.2.9.3.3 Minimum Go-around altitude. A minimum altitude for engaging

automatic go-around shall be established such that the probability of
incurring structural damage to the landing gear, wing tips, or control
surface is extremely remote. The minimum altitude shall include normal
performance under the wind conditions specified in 3.1.2.9 and the proba-
bility of inadvertent loss of an engine at any time within 12 secouds
preceding mode engagement.

DISCUSSION

The performance requirements established for VOR/TACAN operation are

based on current aviation industry practices and represent the cumulative
effect of evolution of airborne equipment capability and pilot acceptability.
The overstation mode requirements for VOR and TACAN defined in 3.1.8.1.3
include provisions for resetting the beam capture logic. One of the more
common zomplaints from military and commercial pilots relates to limited
capture performance for the outboard radial. Generally these complaints have
occurred because the AFCS remains in a tracking mode during station over-
flight. Consequently, outboard captures are hampered by extremely limited
bank angles, etc., designed to ensure good tracking performance. Future
configurations should provide for more favorable outbound capture performance
by development of more comprehensive control laws or providing capture logic
reset as a function of station overflight.
With the addition of inertial navigation systems and area navigation
systems to the airborne computer installation, substantial additional compu-
tational capability is established external to the traditional autopilot
computers. Thus, the location of specific control laws such as VOR,
localizer, and glide slope modes have become more flexible. Depending upon
the specific aircraft configuration, it may be practical to process the
control information for these modes externally to the autopilot computers
and to provide steering cowiand signals to the AFCS in lieu of raw data.

Specific requirements for Inertial Navigation, Area Navigation, or

Vertical Navigation contrnl are not included in this specification since
these requirements will depend on the aircraft mission. Normally these
requirements will be included in the procurement detailed specification,
when such functions are required.
Requirements for a Microwave Landing System (MLS) approach mode have
not been inciuded because of the lack of definitive information on MLS
ground facilities and contingent approach procedures.

The main point of the Automatic Instrument Low Approach System iequire-
ment is to emphasize that the purpose of an approach coupler is to position
the aircraft accurately at a point from which a landing may be safely com-
pleted. Critical failures in the system must be annunciated quickly enough
that the crew m y take effective corrective action.

26

_ _-
 The localizer mode and approach coupler mode requirements include the
environmr..ntal conditions under which the requirements shall be met. Minimum
damping is specified; however, these values will normally be exceeded since
the operation in turbulence requirements of 3.1.3.7 should dictate damping
levels.

The environmental conditions comprise probable combinations of head,

tail and crosswinds determined from itatistical combinations (i.e., mutual
convolution) of the wind distributý 'v: as illustrated in Figure 2.

If certain other automatic functions must be operable to meet the

requirements, e.g.,stability augmentation systems or autothrottles, this
must be clearly stated in the FCS Analysis Report.

The localizer mode and approach coupler mode requirements include the
environmental conditions under which the requirements shall be met. If
certain other automatic functions must be operable to meet the requirements,
e.g., stability augmentation systems or autothrottles, this must be clearly
stated in the FCS Analysis Report.

3.1.2.10 All weather landing system. The following all weath'ir landing
system requirements pertain to the latter stagas of the approach; i.e., that
portion of the approach below the decision height or the alect height, as
defined in 6.6. All weather landing system shall comply with the following
landing accuracies:

a. Longitudinal dispersion of the main landing gear" touchdown point

shall not exceed 1500 feet with a 2-sigma probability, with a mean touchdown
point beyond the glbdeslope intersection with the runway. The 1500 foot
dispersoon need not be symmetrically located about the nominal touchdown
point. The aircraft sink rate at touchdown shall not exceed the structural
limit of the landing gear except as an extremely remote (6.6) occurrence.

b. The lateral dispersion of the aircraft centerline at the main

landing gear at touchdown shall not exceed 27 feet on either side of the
runway centerline with a 2-sigma probability. The roll out guidance system
(normally used during ICAO Category II~b or IIIc visibility conditions)
shall cause the aircraft to track parallel to or convergent with the center-
line of the runway.

c. The systems shall meet these requirements considering reasonable

combinations of head winds to 25 knots, tail winds to 10 knots, and
crosswinds to 15 knots, according to the probability of encountering
these winds and their associated turbulence as specified in 3.1.3.7.3,
along with expected variations in aircraft configurations as specified in
3.1.2.10.1, and expected variations in ground facility performance as
specified in 3.1.2.10.2.

3.1.2.10.1 All weather landing performance standards - variations of

aircraft and airborne equipment configurations. All weather landing perform-
ance requirements shall be met while including the effects on performance of
the following aircraft and airborne equipment variations expected to occur
in normal service.

27

-- -
 a. Landing weight and center of gravity variations.

b. Landing flap setting variations.

c. Aircraft approach speed variations.

d. Glide Blope and localizer airborne receiver centering errors.

e. AFCS all weather landing system sensor, computer and servoactuator

tolerances.
f. Performance tolerances of automatic control systems operating con-
currently with the AFCS all weather landing system; e.g., stability
augmentation systems, load alleviation systems.
3.1.2.10.2 Performance standards - ground based equipment variations. Proof
of compliance with performance requirements for All Weather Landing systems
shall include the effects of expected variation in type and quality of the
ground based equipment. ILS beam structure, associated tolerances and align-
ment errors, monitoring, touchdown zone lighting, terrain clearances, and
controlled or critical taxi zones shall be considered to meet the require-
ments for Categories II or III operations as defined by ICAO Annex 10.

DISCUSSION

All weather landing refers to those approaches conducted in limited

visibility conditions such as those defined by ICAO as Category II or
Category III visibility conditions. Performance requirements for the
initial stages of the approach, i.e., from ILS capture to the decision
height, are defined in 3.1.2.9.1, Localizer Mode, and 3.1.2.9.2, Glide Slope
Mode. Performance requirements for the remainder of the approach, touchdown,
and roll out are defined in 3.1.2.10.
The requirements are intended to apply to conventional takeoff and land
aircraft. Dispersion requirements, for example, may be more stringent fof
STOL aircraft.
Because of the limitations of pilot perception and aircraft maneuver-
ability under the combined influence of limited visibility and operations
at extremely low altitudes, the primary emphasis of design for all weather
landing systems is in terms of assuritg safety of operation of the system.
Although all weather landing state Ltf-the-art has been generally established
through government and military programs, codification of all weather land-
ing requirements has occurred to a gr~ater degree in civil programs because
of their relationship with and obligations to various regulatory agencies
around the world. Thus it is rationil for MIL-F-9490 to draw upon the civil
codifying experience for not only tiht which is presently existing, but to
include trends which are obvious to the industry as additional experience
with various all weather landing systems' configurations is accrued. For
this reason, the requirements given herein are based on the performance
accuracies, reliability requirements, and methods of showing compliancee
with the requirements as defined in FAA advisory circulars 20-57A, 120-28A,
and 120-29, and in CAA paper number 367. See also the further discussion
of the closely related requirements on all weather landing system relia-
bility and hazard analyses, 3.1.7.1.

28
 In order to provide a baseline of normal performance to substantiate
system safety of operation during "no-fault" conditions, a statistical
analyses of touchdown performance must be provided which includes the
expected variation of performance-affecting parameters which are common to
all aircraft. Unusual modes of operation, or parameters which are peculiar
to certain aircraft are not included in the list of parameters provided in
3.1.2.10.1 and 3.1.2.10.2. It is expected that these will be specified by
the responsible procurement activity.

Normal performance (boundary conditions) have not been defined here.

These latter conditions must be established through analysis of associated
specific risks (as defined in 3.1.7.1.2). This analysis may lead to limit-
ing requirements such as those defined in FAA advisory circular 20-57A.

A statistical model must be derived to show the probability distribu-

tion of each parameter considered in the analysis. The dispersions due to
each of these parameters must be calculated and mutually convolved to pro-
vide a cumulative dispersion using the expression:

P(y> Y) = - , P(y >Y/dl,d 2 ,...dn)ddl,dd 2 ,...ddn

P(y > Y) - probability that dispersion y exceeds the given value Y

dl,d 2 ... dn are the disturbances

A discussion of the calculations involved is contained in References 14,

15, 16 and 17.

3.1.2.11 Flight load fatigue alleviation. A fatigue alleviation control

system may be used where it is advantageous to the weapon system. The
fatigue alleviation system shall comply with applicable requirements of
MIL-A-8866 in addition to the requirements of this specification.

DISCUSSION

The performance requirements for fatigue alleviation systems are

included in the struntures specifications. As the name implies, the primary
purpose of these systems is to reduce fatigue damage rate at critical loca-
tions and thereby extend airframe fatigue life. The B-52G and H fleet
currently includes a system which provides both a stability augmentation
function and a fatigue alleviation function, References 18 and 19.

Where a Structural Mode Control System is implemented as a noncritical

FCS, the interaction between the structural system and essential or flight
phase essential manual FCS augmentation functions should be minimized.
Separation is normally needed by bandpass or frequency of operation to avoid
changes in flying qualities with and without the Structural Mode Control
System. This separation may be attained through use of bandpass filters,
washout networks or multiple sensors.

Separation may also be needed in system implementation to prevent

failure propagation from structural systems into a system of higher criti-
cality. Use of dedicated surfaces should always be considered to obtain
failure immunity. Generally, the control surfaces used for manual control

29
 are not properly located to obtain best structural mode control performance
and an increment in performance may also be obtained through use of properly
located and dedicated control surfaces.

Fatigue alleviation systems normally operate at relatively high fre-

quencies and at relatively low forces. When control surfaces are used for
Fatigue Alleviation, which are also required to provide the relatively high
forces needed for manual control, low control surface amplitudes result.
Consequently the effects of hysteresis, backlash and similar nonlinearities
are more important and require a more detailed nonlinear analysis than is
needed for automatic. FCS operating at lower frequencies and higher ampli-
tudes. Where practical, force and moment producers should always be
selected to best provide the functions needed. Use of properly located
and sized control surfaces for Structural Mode Control will eliminate
problems of ,this type.

As part of a fatigue alleviation synthesis, some consideration should

be given to the effect on loads at all airframe locations and not just at the
fatigue critical location. Among loading sources normally considered when
evaluating the performance of fatigue alleviation systems are: flight in
turbulence, ground-air-ground cycles and maneuver loading.
L 3.1.2.12 Ride smoothing. With the Ride Smoothing AFCS and other FCS in
Operational State I, the followiing short term and applicable long term
vertical or lateral axis ride discomfort index levels shall not be exceeded
at any crew station during flight in the turbulence level specified in
Table II.

TABLE II
RIDE DISCOMFORT INDEX LIMITS

Ride Discomfort Flight Phase Duration Probability of Exceeding

Index, Di (Exposure Time) RMS Turbulence Intensity

Long Term 0.10 Over 3 Hours 0.20

Requirement 0.13 From 1.5 to 3 Hours 0.20
0.20 From 0.5 to 1.5 Hours 0.20

Short Term 0.28 Less than 0.5 Hour 0.01

Requirement

The requirements apply, separately, to each of the vertical and lateral

axes. For the lateral axis requirement only lateral gusts apply and for
vertical acceleration only vertical gusts apply. Effects of attitude hold
or other pertinent AFCS modes shall be included where used. This require-
menit normally applies only where a Ride Smoothing AFCS is specified by the
pr~cictring activity. However, where ride smoothing is not specified and
other AFCS modes degrade ride quality, the resulting ride shall not degrpie
to below the levels specified.

30
 -- -r

3.1.2.12.1 Ride discomfort index. Ride discomfort index is defined a@.

1/
Di If W(012ITt)I2 *uod

Di M Ride Discomfort Index, (vertical or lateral)

W(f) Acceleration weighting fun,-tion (vertical or lateral) 1/g

Tcs (f) = Transmissibility, at crew station, g/ft/sec

t• (f) - Von Karman gust power spectral density of intensity

specified in 3.1.2.12 and form specified in MIL-F-8785

f Frequency, Hz

f M Truncation frequency (frequency beyond which aeroelastic

t responses are no longer significant in turbulence
(1)
Acceleration weighting functions are defined for vertical and lateral
acceleration by figure 1. Probability of excnedance versus turbulence
intensity is specified in 3.1.3.7.

DISCUSSION

When used, rzde smoothing systems are required to provide a degree of

ride quality as defined by the Ride Discomfort Index. Ride requirements are
stated in terms of probabilities, since the ride discomfort addressed by
this requirement is generated by random turbulence. The exceedance proba-
bilities and correes 'ing Ride Discomfort Index values specified are based
on the recommendatli. of References 20 and 21. Generally these requirements
st.ould provide ride quality equal to or better than that existing in cur-
rently operating aircraft within the USAF inventory.

The ride requirement for the basic aircraft, without a ride smoothing
system, is included in MIL-A-8892. This requirement currently limits any
single frequency vibration to +0.1 g, zero to peak, at frequencies below
22 Hertz. This MIL-A-8892 requirement is currently being considered for
revision within the AFFDL to include coverage similar to that included here.
Consideration of multiple frequency aeroelastic responses and human
sensitivity weighting factors is considered mandatory for evaluation of ride
in turbulence.

There is disagreement in the literature on the proper approach for eval-

uating combined axis accelerations. Reference 20 recommends a method for
evaluating combined axis accelerations based on USAF experience. Reference 22,
the ISO standard, recommends that arcelerations in separate axes be considered
separately; and Reference 23, a commercial aircraft study, recommended a&other
method for combined axis acceleration evaluation.

31
.spool- .*- EEEU~m~I

_ _~~
0

_ _
_ _
4
OO

loo

D_ _ CUr~
M M O R
- J~ '

-
-2
 Due to the lack of agreement on method and limited test data available
on combined axis accelerations, this requirement follows the ISO recommenda-
tion and places retuirements only on vertical and lateriil axis accelerations,
separately. The reider should note that vertical ride discomfort is to be
evaluated due to vertical axis turbulence only and lateral ride evaluated due
to lateral turbulence only. No requirement is specified for roll gusts or
longitudinal gusts, although for some STOL applications longitudinal gusts
should be considered.

The turbulence intensities to be used are determined by the exceedance

probabilities specified for Ride Discomfort Index. Generally, the system is
required to reduce ride discomtnrt to the levels specified while flying in
turbulence with a cumulative excedance prcbability equal to or less than
the probability specified. System nonlinearities must be considered. Sys-
tem deadzone and nther nonlinearitio must not be so large that ride dis-
comfort exceeds the 0.10 or other pertinent long term limits in light
turbulence, System saturation must no, be so severe in turbulence at the
0.01 exceedance level that the 0.28 riga discomfort limit is exceeded. The
reliability requirements for implementing a ride smoothing system are speci-
fied, in terms of missien accomplishment piobability, in 3.1.6. The reader
should note that cumulative exceedance probaNilities for turbulence are
stated in terms of stationary probabilities r&ther than the nonstationary
probabilities used in reliability work.

Turbulence exceedance probabilities are tabulited in Table V of 3.1.3.7.

A stationary probability or cumulative probability of exceedance for

turbulence encounter means that at a randomly selected time during flight,
the probability of being in turbulence at or above the s'atod intensity is
of a given value. This does not define the probability of exceeding a
given level of turbulenc3 during a given flight or flight segment. On a
fleet lifetime basis, this probability can be interpreted as the portion of
total flight time to be spent above the stated intensity. Sint.e the statis-
tics upon which these probabilities are based were measured over extended
operating times, the temptation to convert these values to hours/hMur or
hours per individual flight should be resisted.

The levels of ride discomfort specified are based or short term tcler-
ance and long term tolerance. Data from References 20, 22 and 24, indicote
that below a Ride Diszomfort Index of 0.07, little or no degradation in crew
performance or ptossenger comfort is expected. Above a Ride Discomfort Index
of 0.28 the USAF references indicate crew action must be initiated to reduce
the acceleration environment by changing flight path, altitude and/or air-
speed. Figure 2D illustrates unpublished data from a commercial airplane
moving base simulator a;tudy In terms of incremental pilot ratings (Cooper
scale) due to accelerations which also indicate a limit near 0.28 for an
incremental pilot rating of 3. (Note that a satisfactory rating of 3.5 in
calm air plus an incremental :ating of 3 in turbulence yields a total rating
of 6.5.)

33
 NOTES: 1. UNPUBLIBHED BOEING DATA MOR
COMMERCIAL AMP LANES
2. DATA OBTAINED FROM MOVING
BASE SIMULATOR STUDY

"W 0.5

0.4
0.3•
4PIWOT RATING

S0.21

0.)

0 0.1 0.2 0.3 0.4 0.5

LATERAL ACCELERATION -An RMS g's

YCAB

Figure 2D. Effect of combined acceleration on pilot rating

34
 The only known production ride smoothing system designed to date, the
B-i system, used a vertical long term index near 0.10. The lateral B-1
requirement was more stringent. Commercial feasibility studies have used
much more conservative design goals. Reference 25, for example, used an
unweighted index of 0.03 in 0.01 turbulence. This is equivalent to an
unweighted index of 0.015 in 0.20 turbulence at low level and is roughly a
factor of 10 more stringent than che MIL-F-9490D criterion. The procuring
activity, of course, may redefine the required values of the ride discom-
fort index to be used for specific procurements, based on unique mission
requirements.

The B-52 is known for its marginal ride during low level penetratioits.
When compared to this long term criteria (3 hrs. - 0.10) the B-52 exceeds
the criterion for medium and light gross weights and satisfies the criterion
for heavier gross weights. Thus, for the initial penetration flight phase
the B-52 ride is acceptable.

For later phases the ride is unacceptable, if the remaining low level
flight phase exceeds three hours.

The Figure 1 acceleration weighting functions are based on the

MIL-SrD-1472 human sensitivity curves, Reference 22, as extrapolatedi to
lower frequencies by Reference 26. The extrapolations below 1.0 Hertz,
especially for lateral vibration, are supported by a minimum of data. How-
ever, the values defined represent the best current consensus of experts
within the 6750th Aerospace Medical Research Laboratory and reflect the
current U.S. recommendation to the International Organization for Standard-
ization for human exposure to vibration from 0.1 to 1.0 Hertz. The weighting
functions defined are truncated at 0.1 Hertz and at high frequencies.

The reason for weighting function truncation is the liwiitations of the

test equipment used to generate data upon which these curves are based.
Moving base simulators can be used to simulatA aircraft at low frequencies;
however, the data obtained below 0.1 to 0.2 Hertz is of questionable value
since continuous oscillations at these frequenciea do not normally occur in
flight. In many cases, the pilot or AFCS will control low freq,•ency motions,
effectively smoothing these oscillations and reducing the truncation error
repulting from this approach. (See Reference 27.) Note that attitude hold
or other pertinent modes are to be simulated to satisfy this requirement,
These modes should approximate pilot or AFCS suppression of low frequency
responses. Truncation at higher frequencies is permitted since the gust
spectrum has very little power beyond 30 Hertz. Since structural models
seldom extend to 30 Hertz, in practice integration i: normally stopped near
the frequency of the highest aeroelastic mode modeled. The requirement is
to include significant bffects to the truncation frequency. Due to gust
filter roll off, integration beyond 15 Hertz seldom affects the integral
value significantly.

The intent of this requirement is to specify th2 ride experienced by the

crew. Soft seats or other isolation techniques used should be considered in
meeting this requirement. Care must be taken that relative motion between
the crew member and his controls and instruments, resulting from isolation
techniques, does not degrade crew performance. Visual problems, for example,
can be aggravated by relative motion.

35
APO,,

There are several current sources of literature available on ride

smoothing systems. Reference 28 describes development of the B-I ride
smoothing system which was synthesized using the ILAF concept. References
29 through 33 describe the development of the ILAF concept. Reference 34
describes a study otf model suppression on the YF-12A airplane.

3.1.2.13 Active flutter suppression. An active flutter suppression control

system may be used where it is edvantageous to the weapon system. The flutter
suppression control system shall conform to the applicable requirements of
MIL-A-8870 in addition to the requirements of this specification.

3.1.2.14 Gust and maneuver load alleviation. An active gust and maneuver
load alleviation control system may be used where it is advantegeo -to the
weapon system. The active load alleviation control system shall co..form to
the applicable requirements of MIL-A-8861 in addition to the requirements of
this specification.

DISCUSSION

Active Flutter Suppression is an *merging technology and, as such, few

specific requirements have been suggested for such systems. References 35-43
record some of the recent development in flutter suppression.

Gust and maneuver load systems are also currently being developed.
Examples are the B-52 CCV program, Refere.'e 44, and the C-SA Structural
Improvement program. The L-lOll also relied on the yaw damper to reduce
design loads. (See Reference 27.)

3.1.2.15 Automatic terrain following. Performance requirements shall be as

specified by the procuring activity.

DISCUSSION
Although the concept of automatic terrain following is well founded, the
methodology of specifying performance is, as yet, unproven. Reference 45 pro-
vides a discussion of recommended criteria for the design of Manual and Auto-
matic Terrain Following Systems. This document describes recent Terrain
Following literature and the rationale used to establish terrain following
requirements. Criteria and design constraints are provided in the inter-
related areas of safety perfr•mance, reliability, stability, vulnerability,
structural fatigue, ride comi et and costs.

3.1.2.16 Control stick (or wheel) steering. The pilot shall retain full
capability to maneuver the airplane within the applicable control force and
maneuver limits of MIL-F-8785 or MIL-F-83300. Automatic disengagement of the
AFCS with reversion to manual control is permitted in meeting this requirement.

DISCUSSION

Control wheel (or stick) steering relies on the use of the control wheel
and/or column to introduce the pilot's manual inputs into the system when the
AFCS is engaged and controlling the aircraft. Many different types of steer-
ing systems exist and may be implemented in the futute. Two basic types
include the proportional type and the disconnect type.

36

Lj
 Two types of proportional type steering systems are "power steering"
and "controlled reference" systems. These systems allow the AFCS to react
in a proportional manner to pilot induced force on the control wheel/stick.

The "power steering" type system merely provides power boost and,
during the maneuver, there is no AFCS-provided stabilization.

The "controlled Reference" steering system is the most sophisticated of

the various steering syFtems. The AFCS remains engaged during maneuvers and
provides whatever stabil zation has been selected. The wheel or stick force
sensor provides a bias .i a function of pilot applied manual control force
to modify the stabilization of the AFCS. The controlled parameter ý3
normally airplane attitude; however, functions such as vertical speed, flight
path angle, Mach number or turn rate may also be implemented as the con-
trolled parameter. The datum for these references can be slewed as a func-
tion of force applied to the wheel/stick.

The disconnect type steering systems merely disconnect the AFCS tempor-
arily during a pilot comratanded maneuver and re-engages following completion.
Force switches may be used to control disconnect and re-engage logic.

The intent of this requirement is to ensure that the pilot retains full
maneuver capability. The disconnect type systems attain this capability by
temporarily disengaging the AFCS and relying on the MFCS. The "power
steering" and "c-introlled reference" type system may also be designed to
automatically disengage the AFCS prior to reaching design maneuver limits.
For example, the B-52 includes a "g limiter" which restricts the pilot to
less than design g's through the steering system. However, design maneuvers
can be obtained by increasing control forces, such that the AFCS automatically
reverts to manual control and design maneuvers can be obtained within reason-
able control force levels. The B-52 steering system is designed to minimize
the transients resulting from this reversion to manual control.

This requirement also includes consideration of stick force/g. With the

steering system functioning, stick force/g must remain within the ran.-e of
values cited in the flying quality specifications.

3.1.3 General FCS design. Flight control systems shall be as simple, direct,
and foolproof as Dossible, consistent with overall system requirements.
3.1.3.1 Redundancy. The contractor shall determine the redundancy approaches
and levels required to sitisfy the requirements of this specification.

DISCUSSION

Redundancy may be needed to satisfy the reliability, invulnerability,

failure immunity or other requirements of this specification. Recent fleet
histories have shown that even single thread mechanical flight control can
provide high reliability and failure immunity. However, mechanical redun-
dancy, electrical redundancy and redundancy obtained through mixing mechan-
ical and electrical controls is often used to obtain improved reliability,
invulnerability and failure immunity characteristics. Use of dissimilar
parts is a preferred approach for obtaining viable redundancy.

37
T
Opp",

For electrical flight controls, redundancy is easily obtained and is

commonly used to obtain single and dual fail operate systems. Table ID
illustrates minimum redundancy levels for the corresponding controls.

TABLE ID

MINIMUM REDUNDANCY LEVELS FOR NONMECHANICAL IMPLEMENTATIONS

FCS CRITICALITY MINIMUM REDUNDANCY

Essential Fail-Operational

Flight Phase Essential Fail-Passive

Noncritical Fail-Safe

In practice, these redundancy .2vels are normally exceeded by one level for
the flight phase essential and essential controls due to reliability,
flight safety or other considerations for the particular implementation.

3.1.3.2 Failure immunity and safety Within the permissible flight

envelope, no single failure or failure combination, which is not extremely
remote, in the FCS or related subsystems shall result in any of the following
effects before a pilot or safety device can be expected to take effective
corrective action. For this specification, extremely remote is defined as
numerically equal to the maximum aircraft loss rate due to relevant FCS
material failures specified in 3.1.7.

a. Flutter, divergence, or other aeroelastic instabilities within the

permissible flight envelope of the aircraft, or a structural damping coef-
ficient for any critical flutter mode below the fail-safe stability limit
of MIL-A-8870.

b. Uncontrollable motions of the aircraft or maneuvers which exceed

limit airframe loads.

c. Inability to safely land the aircraft.

d. Any asymmetric, unsynchronizJd, unusual oper:ition or lack of opera-

tion of flight controls that results in worse than FCS Operational State III.

e. Exceedance of the permissible flight envelope or inability to return

to the service flight envelope.

DISCUSSION

The intent of this requirement is to insure that no failure(s), not

extremely remote, can result in an inflight hazard. For noncritical controls
the pilot may be required to detect and counteract failures by either deactiv-
ating the controls or the failed porLion thereof, or by overriding. When
this occurs, use of the controls must not require exceptional pilot skill or
strength, and should allow use of the controls in the normal sense during
override.

38
 This requirement does not absolutely require redundancy. Recent fleet
history, References 46 and 47, shows that single thread mechanical controls
can provide failure immunity with high reliability. However, as control
technology evolves the trend is toward electrical implementations with
multiple redundancy. In each procurement, the procuring activity will
specify the numerical probability associated with the term "extremely
remote" (See definition in 6.6) and the contractor will establish failure
rate prediction needed to satisfy this requirement. The reader should note
that mechanizacions which satisfy these failure immunity requirements are
necessary, but may not be sufficient to meet reliability or flight safety
requirements. For example, most redundant systems provide at least a single
fail operate capability, where little or no degradation in performance
results from single failures.

Mechanical interconnection of flaps and other controls may be required

to provide the synchronization required by (d). If a mechanical flap inter-
connection is required to meet synchronization requirements, it must satisfy
the structural integrity requirements of 3.1.11. It should withstand
applicable unsymmetrical loads including those resulting from flight with
the engines on one side of the plane of symmetry inoperative and the remain-
ing engines at takeoff power. For airplanes with flaps that are not sub-
jected to propeller slipstream or engine exhaust conditions, the structure
should be designed for the loads imposed when the wing flaps on one side are
carrying the most severe load occurring in the prescribed symmetrical condi-
tions and those on the other side are carrying not more thart 80 percent of
that load. The flap interconnection should also be designed for the loads
resulting when the flap surfaces on one side of the plane of symmetry are
jammed and immovable while the surfaces on the other side are free to move
and the full power of the surface actuating system is applied.
In the event of a failure of the high lift control system actuators such
as a screwjack, hydraulic cylinder, etc., the high lift device should main-
t~ain synchronization, or remain synchronized without motion. There are
several methods -..f providing systems which will do this, such as providing
duplicate push'-pull rods, torque tube systems, cable systems, etc., duplicat-
ing the drive unit and installing separate actuators at each high lift
device segment and interconnecting the actuators, and providing an auto-
matic shutoff system which receives position signals from each of the
segments or from the outer ends of the torque tube system. Aircraft whose
landii'g roll becomes critical, with respect to normal runway lengths and
zero wind condition,-, if high lift devices are not available, should not use
automatic shutoffs which may deprive them of the use of these devices.

MLI..-F-9490C included specific failure immunity requirements in terms of

limits on control surface rates and authority and in terms of structural
protection means. To meet the more general failure immunity requirements of
this specification, these areas will also have to be considered.

For example for intermittent controls such as trim, high lift devices,
etc., maximum surface rates should not exceed the rate which can create a
maneuver generating limit airframe loads before the pilot or a safety device
can react. This applies at all flight conditions, both at the maximum air-
speed at which the control surface can be actuated and at the airspeed at
which control surface operation yields maximum structural loading.

39
 Inadvertent flap or control surface retraction or extension should be
considered and prevented if hazardous flight occurrences such as altitude
loss or stall during landing or aerial refueling can occur due to such
retraction or extension. Inadvertent surface displacements due to both
failure states and pilot error should be considered. In all cases, compen-
sating action by the pilot should be considered, when pertinent, following
the control surface movement. For large commercial aircraft in cruise, a
three to five second reaction time is commonly used to represent the time
required to react and regain positive control following failures. Such
time delays are discussed in MIL-F-8785B and associated backup document
AFFDL-TR-69-72, Reference 1.

Airplane structure should not be endangered by FCS or interfacing sub-

system malfunctions. All FCS failure states resulting in a hazardous sur-
face oscillation, hardover or other hazardous motion which cannot be
overcome by pilot action should be prevented either by authority limiting,
redundancy or other means.

3.1.3.2.1 Automatic terrain following failure immunity. The terrain f-l-

lowing system shall detect any potentially critical failure, not shown to
be extremely remoted, in the command generation scheme, sensors, (includ-
ing radar and radar altimeter) or terrain following AFCS and provide warn-
ing to the pilot. Any failure resulting in loss of the automatic terrain
following function or unsafe flying condition shall provide safe exit
(automatic fly-up) from the low altitude, higb speed environmenc. Take over
or injection of commands by the pilot while the system is operating shall
permit a smooth and positive transition without adverse transients. AFCS
function accuracy (heading and roll attitude hold) shall be maintained to
the degree specified in 3.1.2.

DISCUSSION

An automatic fly-up comnand mechanization should be provided for safe

exit while in the ATF mode. lionitoring of aircraft performance whether
by an external system (radar altimeter override) or integral Uith the
control law should utilize both altitude and altitude rate. Adequate dis-
play should be provided to allow pilot evaluation of the situation.

3.1.3.3 System operation and interface. Wherever a noncritical control

or any other aircraft subsystem is interfaced with essential or flight
phase essential flight control channels, separation and isolation shall be
provided to make the probability of propagated or common mode failures
extremely remote.

3.1.3.3.1 Warmup. After power is applied to the FCS, the warmup time
required to meet this specification shall not be more than 90 seconds for
MIL-F-8785 Class IV aircraft and not more than 3 minutes for other types of
aircraft.

DISCUSSION

This requirement applies to both electronic, hydraulic and other system

components. Specified system performance must be provided following this
warmup period. Note that 3.1.9 permits temporary State II performance fol-
lowing warmup under unusual conditions.

40
3.1.3.3.2 Disengagement. Provisions shall be made for positive inflight
disengagement of flight phase essential and noncritical electrical controls
under all load conditionL. No out of trim condition shall exist at disen-
gagement which cannot be easily controlled by the pilot. The pilot shall
be informed of automatic disengagement. Disengagement circuitry shall be
designed such that a failure of the circuitry itself does not prevent auto-
matic or manual disengagement.

3.1.3.3.3 Mode compatibility. Mode compatibility logic shall provide flexi-

bility of FCS operation and ease of mode selection. The mode selection logic
shall.

a. Make correct mode selection by the crew highly probable.

b. Prevent the engagement of incompatible modes that could create an

immediate undesirable situation or hazard.
c. Disconnect appropriate previously engaged modes upon selection of
higher priority modes.

d. Provide arming of appropriate modes while certain modes are engaged.

e. Provide for the engagement of a more basic FCS mode in the event of
a failure of a higher priority mode.

DISCUSSION

When a choice of FCS mode salections is made available it is necessary

to specify a mode hierarchy and to ensure that the mode selection logic can
handle all possible combinations of desirable and inadvertent selection.

3.1.3.3.4 Failure transients. Aircraft motions following sudden flight con-

trol system or component failureo shall be such that dangerous conditions can
be avoided by pilot corrective action. Time delays between the failure and
initiation of pilot corrective action shall be as established by MIL-F-8785.
Transients due to failures resulting in FCS Operational States I or II within
a redundant FCS shall not exceed +0.5g incremental normal or lateral acceler-
ation at the center-of-gravity or +10 deg/sec roll rate. Transients due to
failures within the FCS resulting in FCS Operational State III shall not
exceed 75 percent of limit load factor or +1.5 g's from the initial value,
whichever is less, at the most severe flight condition.

DISCUSSION

These failure transient requirements have been set considering safety

needs and characteristics of redundant systems. No specific limits are given
for sideslip angle, although the general requirement to avoid dangc-ous condi-
tions will lead to the contractor establishing limits on sideslip. MIL-F-8785
includes additional failure transient requirements.

3.1.3.4 System arrangement. Systems shall be arranged as required to satisfy

the reliability, invulnerability, failure immunity and other general require-
ments of this specification.

41
DISCUSSION

System arrangement is largely determined by the general requirements of

this specification s'4ch as reliability and flight safety. System separation,
protection and clearance is specified by 3.2.3.1.2 for signal transmission
elements.

3.1.3.5 Trim controls. Each of the principal control axes shall have trim
controls. Wherever worse than Operational State III would result from a
power-operated trim control failure that is not extremely remote, the pilot
shall be given override capability for the failed control. For series trim
control, no worse than Operational State III shall result from a trim control
becomitig inoperative in any position, except for extremely remote failures.
Engagement of the AFCS shall automatically initiate any needed pitch trim.
Aircraft subject to short alerts shall have the capability incorporated to
return all trim to the takeoff position automatically. Any automatically
controlled trim shall incorporate positive means to avoid potentially
hazardous adverse trim near stall. In multicrew aircraft with electrical
trim systems, interlocks in the circuitry shall prevent simultaneous commands
by two aircrew members from causing any operation in opposing directions at
the same time.

DISCUSSION

These controls should preclude inadvertent or abrupt operation and each

should operate in the plane and sense of aircraft motion it affec, Trim
system irreversibility is specified in MIL-F-8785 and is an important con-
sideration. Airplanes which have provisions for manual control of essential
or flight phase essential FCS in the event of power failure should also pro-
vide manual trim in the event of power failure.

Automatic trimming functions must operate at rates which allow the AFCS
to =eet AFCS transient performance requirements.

Inoperative trim is a particularly important consideration when series

trim is employed. With that type mechanization the stick position provides
no cue about the amount of control authority remaining to the pilot. For
other mechanizations, pilot override would normally be considered an appro-
priate way to provide Operational State III.

AFCS trim circuitry should be arranged to reduce the effect of a failure

in the AFCS on manual trim operation following AFCS disengagement. The
failure immunity requirements of this specification set limits on such effects.

Care should be taken in AFCS design to minimize friction and inertia con-
tributed by the disengaged AFCS to the MFCS. The flying qualities specifica-
tions set limits on the MFCS which must be satisfied with the AFCS disengaged.
The flying qualities specifications also specify trim rate, trim stall and
control force requirements related to trim.

42
 3.1.3.6 Stability. For FCS using feedback systems, the stability as
specified in 3.1.3.6.1 shall be provided. Alternatively, when approved by
the procuring activity, the stability defined by the contractor through the
sensitivity analyses of 3.1.3.6.2 shall be provided. Where analysis is used
to demonstrate compliance with these stability requirements, the effects of
major system nonlinearities shall be included.

3.1.3.6.1 Stability margins. Required gain and phase margins about nominal
are defined in Table III for all aerodynamically closed loop FCS. With
these gain or phase variations included, no oscillatory instabilities shall
exist with amplitudes greater than those allowed for residual oscillations
in 3.1.3.8, and any nonoscillatory divergence of the aircraft shall remain
within the applicable limits of MIL-F-8785 or MIL-F-83300. AFCS loops shall
be stable with these gain or phase variations included for any amplitudes
greater than those allowed for residual oscillations in 3.1.3.8. In multiple
loop systems, variations shall be made with all gain and phase values in the
feedback paths held at nominal values except for the path under investigation.
A path is defined to include those elements connecting a sensor to a force
or moment producer. For both aerodynamic and nonaerodynamic clrosed loops,
at least 6 db gain margin shall exist at zero airspeed. At the end of system
wear tests, at least 4.5 db gain margin shall exist for all loops at zero
airspeed. The margins specified by Table III shall be maintained ander
flight conditions of most adverse center-of-gravity, mass distribution, and
external store configuration throughout the operational envelope and during
ground operations.

TABLE, III
GAIN AND PHASE MARGIN REQUIREMENTS (dLi l)EGR|FS)

AVMIN
Mode Airspeed Below To At At
Frequency Hz VOMIN VOMAX Limit Airspeed (VL) 1.15 VL

GM = +4.5 GM = +3.0
fM <0.06 GM = 6 LIB GM 0.-

(No Phase PM = ±30 PM = +,20 PM = 0

Requtire- (Stable
0.06 <fM <First Aero- mert GM = *6.0 GM = +4.5 at
Elastic Below Nominal
Mode V IPM = +45 PM = +130 Phase and
_ MIN) _Gain)

fM >First Aero- GM = ±8.0 GM = ±0,0

Elastic
Mode PM = ±60 PM = ±45

43
where: VL - Limit Airopeed (MIL-A-8860).
V - Minimum Operational Airspeed k(TL-F-8785).
0°MIN

V0- Maximum Operational Airspeed (1IL-F-8785).

°MAX

Mode - A characteristic aeroelastic response of the air-

craft as described by an aeroelastic character-
istic root of the coupled aircraft/FCS dynamic
equation-of-motion.

GM Gain Margin - The minimum change in loop gain, at nominal

phase, which results in an instability beyond
that allowed as a residual oscillation.

PM = Phase Margin = The minim= change in phase at nominal loop gain

which results in an instability.

f = Mode frequency in Hz (FCS engaged).

M
Nominal Phase and = The contractor's best estimate or measurement
Gain of FCS and aircraft phase and gain character-
istics available at the time of requirement
verification. (2)

3.1.3.6.2 Sensitivity analysis. Tolerances on feedback gain and phase shall

be established at the system level based on the anticipated range of gair. and
phase errors which will exist between nominal test values or predictions and
in-service operation due to such factors as poorly defined nonlinear and
higher order dynamics, anticipated manufacturing tolerance9, aging, wear,
maintenance and noncritical material failures. Gain and phase margins shall
be defined, based on these tolerances, which will assure satisfactory opera-
tion in fleet usage. These gain and phase tolerauces shn!l be established
based on variations in system characteristics either anticipated or allowed
by ccmponent or suboystem specification. The contractor shall establish,
with the approval of the procuring agency, the range of variation to be con-
sidered based on a selected probability of exceedance for each type of
variation. The contractor shall select the exceedance probability based on
the criticality of the flight control function being provided. The stability
requirements established through this sensitivity analysis shall not be less
than 50 percent of the magnitude and phase requirements of 3.1.3.6.1.

DISCUSSION

The gain and phase margin definitions listed are commonly used within
flight control technology, and are not the clossical definitions found in
most textbooks. These margins are both positive and negative. A negative
gain variation (reduction) can lead to instability on a basically unstable
airframe which relies on the feedback system for dynamic stability. Positive
and negative phase margins denote the amount of lag and lead that may be
added, respectively, before instability occurs.

44
pIý
The margins 3peciL: 'd vitry with frequency. These margins can be deter-
mined using classical ra~nalysis techniques, adjusted for known non-
linearities. Nor'mw1 xy in test a lower frequency mode will set the test
margins, and 6ain margins at higher frequencies will be unobservable. Con-
sequently, compliance with these gain and phase margin requirements will
likely be demonstrated through analysis in most procurements.

Figure 3D illustrates a typical FCS block diagram. Several feedback

loops are shown; however, only one feedback path is shown, since only one
sensor and one moment producer are involved. Thus, only one control path
exists and only one stability requirement applies.

Stability margins are required for FCS to allow for variations in system
dynamics. Three basic types of variations exist:

Math modeling and data errors in defining the nominal system and
plant.

Variations in dynamic characteristics caused by changes in environ-

mental conditions, manufacturing tolerances, aging, wear, noncriti-
cal material failures, and off-nominal power supplies.

Maintenance induced errors in calibration, installation and adjust-

ment.

Most low frequency math modeling errors can be adjusted out during
ground or flight tests to obtain the desired nominal operating characteristics.
At high frequencies, math modeling errors are difficult to identify and com-
pensate for during testing due to the approximations used to implement opera-
tional mockups, the limited amount of flight test time available and/or the
limitations of instrumentation commonly used. In addition to the variations
caused by the factors listed above, variations may exist due to usage of an
inadequate number of flight conditions for a given analysis or flight test
program. Within the industry, flight control synthesis is normally accom-
plished using equations-of-motion defining aircraft and system characteristics
at selected points on the flight envelope in various aircraft configurations.
Flight testing is also normally concentrated at a limited number of points
within the flight envelope. Selection of the number and type of flight con-
ditions to be used is an individual decision in each procurement.

Another source of variations occurs following completion of the aircraft

development. Following initial fleet usage, most aircraft experience a series
of minor modifications to improve airplane operating characteristics. These
modifications, which typically result in quite minor configuration changes on
an individual basis, can result in significant changes in flight control
stability margins as modifications are accumulated through several years.
The original fll.ght control system design should allow for a degree of such
variations, such that FCS modification is not needed following all aircraft
modifications.

45
L0

IIc

P~1 _

P ~
p•

~4C)

46
 The intent of including effects of major nonlinearities in analyses
used to demonstrate compliance is to insure that adequate margins are
retained with the systems operating both in the linear and nonlinear range.
Most FCS exhibit rate limiting nonlinearities with large control surface
amplitudes at higher frequencies. Deadband or hysteresis is also usually
present. Where linear analysis techniques such as root locus are used,
phase and gain characteristics for the feedback elements operating at small
perturbations should be considered to evaluate nonlinearities such as break-
out deadzones or hysteresis and, separately, phase and gain characteristics
for feedback elements operating at medium and large control surface ampli-
tudes should be considerec. to evaluate the near linear case and the rate
limiting case. Where simulation is used, these nonlinearities can be
included directly and evaluated by measuring frequency responses at different
control surface amplitudes. The contractor my choose to use both linear
analyses and nonlinear simulation techniques to demonstrate compliance with
these requirements, since the linear analysis approach normally provides a
better representation of aeroelastic effects and the simulation approach
normally is superior for nonlinear evaluations.

The math models to be used for these stability analyses 4ill vary with
each procurement. The contractor will determine what math model complexity
is required for each procurement and should include this model description
in the FCS Development Plan (4.4.1).

The gain and phase margins specified ure in the range of values used in
previous successful procurements, and are considered the minimums which will
provide largely trouble free service during fleet usage. Reference 48 recom-
mends the 6 dB zero airspeed requirement and provides a discussion of NASA
ground and flight testing of stability augmentation systems. Reference 49
re'.ommends a 12 dB requirement.

Margins are specified for aerodynamically closed loops and nonaerody-

namic loops. An aerodynamic loop is one which relies on aerodynamics for
loop closure such as a stability augmentation or AFCS loop. Nonaerodynamic
loops do not rely on aerodynamics for loop closure. An example is a servo-
actuator loop.

A recommended practice for higher frequency modes is to gain stabilize

all modes (+180 degrees phase margin). A feedback signal attenuation of at
least second order beyond the actuator second order frequency is also
commonly used. Reference 50, for example, used a 180 degrees phase margin
criteria beyond 5 Hertz.

An example of problems encountered in the past with nonaerodynamic loop

stability is the B-52 stick steering AFCS. During ground testing of the A/A
42G-11 AFCS a 4.2 Hertz instability was encountered in the pitch control
system. This problem occurred the first time the equipment was installed in
B-52 60-002 and resulted in a 4.2 Hertz unstable oscillation of the control
column which would build up until an automatic disconnect occurred through
the overpower circuit. This problem was eliminated by attenuating the loop
gain near 4.2 Hertz through filter modification and relocation of the pitch
force transducer. To avoid such problems, a stability analysis of the

47
nonaerodynamic loops should be accomplished with column inertia, feel
system characteristics and other MFCS parameters properly modeled. In
some applications the pilot may couple with the system and pilot mass or
inertia may have to be included in the analysis. The full range of
excursions expected in service should be simulated or otherwise analyzed,
especially whete breakout dead zones, hysteresis, and rate limiting
result in significant nonlinear system characteristics.

Refer.ncc 6 documents a sensitivity analysir performed to establish

gain and rn.pe m-igin criteria required to accommodate tolerances in the
structur,:1 tk, :u ,&cies. Similar analyses can be used to determine stability
margins dr All frc-luencies for a given procurement based on the inaccuracies
anticipated in the parameters and modeling technique used and based on the
depth of analyses planned to investigate off-nominal conditions and the
effects of wear and aging.

The stability margins specified vary in size with mode frequency and
airspeed. The reduction in margin at VL, reflects a willingness to accept
reduced stability and/or performance while flying outside the operational
envelope. The increased margins at higher frequencies reflect needs based
upon the decreasing accuracy of state-of-the-art modeling and testing tech-
niques at higher frequencies.

3.1.3.7 Operation in turbulence. In Operctional State I, while flying in

the following applicable random and discrete turbulence environment, the FCS
shall provide a safe level of operation and maintain mission-accomplishment
capability. For essential and flight phase essential controls, at least
Operational State III shall be provided in the specified flight-safety turbu-
lence levels. Noncritical controls shall provide at least Operational State
I.: in turbulence up to the intensities specified in 3.1.3.7.1. Noncritical
controls operating in turbulence at intensities above the specified turbu-
lence level, shall not degrade flight safety or mission effectiveness below
the level that would exist with the control inactive. Either manual or
automatic means to inactivate the control for flight in heavy turbulence may
be used, when requireJ. The dynamic analysis or other means used to satisfy
this requirement shall include the effects of rigid body motion, significant
flexible degrees of freedom and the flight control system. Significant
nonlinear effects shall be represented by conservative nonlinear or equiva-
lent linear representations.

3.1.3.7.1 Random turbulence. The RMS turbulence intensity to be used for

normal flight and for terrain following snall have a cumulative probability
of exceedance as shown in Table IV. Table V defines RMS vertical gust ampli-
tude versus altitude for selected exceedance probabilities. The relation-
ship among vertical, lateral and longitudinal RMS intensities and scales as
specified in MIL-F-8785 shall be used to establish intensities for lateral
and longitudinal gusts. The listed turbulence intensity levels apply at the
turbulence penetration airspeed, VG. At the maximum level flight airspeed,
VH these intensity levels are reduced to 38 percent of the specificed levels.
The mathematical forms of continuous random turbulence to be used in con-
junction with the specified intensity levels are as specified in MIL-F-8785
and the airspeeds cited are as specified in MIL-A-8860.

48
 TABLI; IV
TURBULEINCE INTENSITY EXCEEDANCE PROBABILITY

Aircraft Class MIL-F-8785 MIL-F-8785

riticality Class III Class I, II & IV
Essential 10 .6 10 .5

Flight Phase Essential _1I0" Ioo

T" T

Noncritical 10.2 10-2

where: T - The longest time spent in essential flight phase

segmeat in any mission/total flight time per
mission. (3)

3.1.3.7.2 Discrete gusts. Discrete gust amplitudes to be used shall be

established using the relationship between random and discrete gust ampli-
tudes in accordance with MIL-F-8785, and the RMS amplitudes specified in
3.1.3.7.1. The 1-cosine discrete gusts definod by MIL-F-8785 shall be
applied with wavelengths tuned to provide maximum excitation.

DISCUSSION

Turbulence levels are specified in terms of exceedance probabilities

and FCS function criticality. Exceedance probabilities are stationary
probabilities as opposed to the nonstationary probabilities used in relia-
bility analyses. See the discussion under 3.1.2.11.2.2 for a discussion of
the difference. For essential controls, the airplane turbulence penetration
capability may be set by the structural length of the airframe, the augmen-
tation capability of control system, or a combination uf the two. Reference
51 describes recent incidents in large jet transport operation whera aomc
loss of longitudina, control occurred in heavy turbulence. The search for
the cause of these Lcidents has centered on possible effects of severe
turbulence, such as structural vibration of the pilot's cockpit which limit
the pilot's ability to read instruments or the possibility of pilot disorien-
tation due to apparently conflicting indications from his instruments, com-
bined with unusual motion sensations. Reference 52 also tabulated and
discussed recent accidents caused by severe turbulence. This paper concludes
that the main hazard is loss of control followed by structural breakup during
recovery attempts. The author pointed out that the cost of turbulence to
DOD operations is difficult to evaluate, but estimated costs for the three
year period of 1963-65 at $30,000,000 for DOD aircraft loss and damage.

Most noncritical controls do not affect turbulence penetration capabil-

ity and the noncritical controls designer is primarily concerned with main-
taining acceptable performance in terms of pilot relief or ride quality while
in turbulence. Noncritical systems such as ride smoothing systems may be
designed to permit saturation in moderate turbulence while maintaining a
reduced level of ride improvement. Many pilot relief AFCS modes are commonly

49
 *I'AiIltFV
RNIS (GUSI IN'rINSI I'llS IFOR SI'LI('III ('M I.AIIVr
I'X('I;'I)AN('I: IROBABILIIIFS, rT/S, '" TAS

FLIGHT ALTITUI) PROBiABILITY F01

I-X(I-II)AN('I'
SEGMENT (FT AG;L) 2 x I0"I 10-1 10" 1 10..5 10o

UP TO 1000
TERRAIN (LATE RAL) 4.0 5,1 8.0 10.2 12.1 14.0 23.1
FOLLOWING UP TO 1000
(VFRTI'AL) 3.5 4.A 7,0 8.) 10.5 12.1 17,5

500 3.2 4.2 (1.0 8,6 11,8 15.6 18.7

1,750 2.2 3.6 6.k) 9.6 13.0 17.0 21.5

3,750 1.5 3.3 7.4 10, 1,0 23,0 28.4

7,500 0 1.6 6.7 10,1 15A1 23,0 30.2

15,000 0 0 4.6 8.0 11.6 22.1 30,7

NORMAL
FLIGHT 25,000 0 0 2."7 ,6 9,7 20.0 31,0
CLIMB
CRUISE 35.000 0 0 0.4 5.0 8.1 16.0 25,2
AND
DESCENT 45,000 0 0 0 4.2 8.2 15.1 23.1

55,000 0 0 0 2,7 7.9 12,1 17.5

05,000 0 0 0 0 4. ) 7,9 10,7

75.000 0 0 0 0 3,2 o.2 8,4

OV FR
80,000 0 0 0 0 2.1 5.1 7.2

s0
disengaged when turbulence is encountered. Reference 53 describes a study
to determino the optimum AFCS mode configuration for flight in severe turbu-
lence. This study recotmmends engaging the roll and yaw attitude hold modes
with system gains considerably reduced for turbulence penetration. All
pitch modes and the Heading Hold mode should be disengaged, based on this
study. However,, it is important to avoid inadvertent automatic mode disen-
gagement in light turbulence.

Vie turbulence intensities for essential and flight phase essential

controls are intended to result in control systems capable of operating at
least a minimum safe (Operational State III) condition in thc maximumi turbu-
lence intensity which t~he structure can penetrate without exceeding limit
load. The turbulence intensities specified for noncritical controls art mnuch
lower than those defined for essential controls and are correlated with the
mission accomplishment probability specified for an individual procuremenit.

The Flutter Mode Control Systemu designed for the B-52 CCV flight demon-
stration (Reference 23) was requtired to operate in turbulence with an exceed-
ance probability of 10-6.

MIL-F-9490C required AFCS to be designed for a tuned discrete gust ot

40 ft/sec amplitude. The system function specified was limited to damping
only and no requirement was placed on manual FCS. This requirement is stated
in terms of minimum safe operation (Operational State III) for essential con-
trols and in terms of restricted operation (Operational State TI1) for non-
critical controls. Changes in system damping ratios, frequencies and other
characteristics caused by system saturation in turbulence are permitted
providing the specified operational states are maintained. Stability augmen-
tation systems can often tolerate substantial displacement saturation and
some rate saturation while maintaining a reduced level of performance.
Noncritical controls. which must be designed fail-safe (3.1.3.2), can often
tolerate severe displacement saturation.

Control system rate limiting must be emphasized for FCS controlling an

unstable airframe, since rate limiting as well as displacement can cause loss
of stability. The procedure used for the Amnerican SST design, see Reference
12, was to rely on simulation studies to establish the allowable actuator
minimum rate requirements. The design condition was piloted flight in heavy
turbulence at landing approach. These minimum rate requirements were less
than the common criterion of providing stop-to-stop surface travel in one
second. After the minimum rate requirements were established, it was veri-
fied that the system could provide these minimum rates under any combinations
of failures which would still allow at least minimum safe control.

Reference 54 describes a method for predicting the performance of the

total pilot-vehiicle system for command tracking and altitude hold tasks in
turbulence. This method is based on pilot model theory and prediction of
tracking errors. The validity and accuracy of this method has been ascer-
tained by means of moving base simulation and the contractor may want to useJ
a similar method to comply with this requirement.

Reference 55 includes an excellent discussion of the current state-of-the-

art in understanding the problem of flight safety in turbulence. The author
points out that control has been an important, and perhaps critical factor in

51
recent turbulence related aircraft losses. It was noted that co--mercial
transports have been estimated to spend between 0.01 and 0.1 percent of
their flight time in thunderstorms, despite the high priority given to
storm avoidance. Mountain waves are also a serious flight safety problem
and have resulted in aircraft loss. Clear air turbulence, although quite
common, is not generally considered a flight safety problem.

The Reference 55 study emphasized that turbulence normally occurs in

patches and recommends a five-mile wide patch for simulation. Reference 52
indicates an average patch duration of approximately one minute for moderate
to severe turbulence for world-wide civil aircraft operation. The turbulence
requirements of this specification should be evaluated using the turbulence
patch approach, although the length of the patch may be selected by the con-
tractor as either less or greater than five miles, depending on the mission
requirements of the procurement.

The specified turbulence intensity levels are r duced in magnitude as

airspeed is incre, ed beyond the turbulence penetra' i airspeed. This pro-
cedure is based on the precedent of the MIL-S-8861 gust load requirement and
similar FAA requirements which allow similar reductions at speeds above the
gust penetration airspeed.

The analytical form for turbulence mathematical models specified in

MIL-F-8785 are referenced for use in flight controls analyses. The major
diffe:.'ence between the turbulence requirements of MIL-F-9490 and MIL-F-8785
is in the required intensity levels. The requirements of MIL-F-8785 are
restricted to flying qualities and are generally more lenient than those
specified in this specification. The turbulence intensity requirements speci-
fied herein for essential and flight phase essential systems are based on
safety considerations with a prime objective to retain minimum safe operation
in any environment thL structure may be expected to penetrate.

The curves shown in Figure 4D, which illustrate the probabilities tabu-
lated in Table V, were established using the following relationship:

P(O7g) ( 019~~iT
2dgj
0 e 011 e(
where

P(9'. cumulative probability that 6 will equal or exceed

a given level. g

root mean square value of gust velocity relative to

the airplane body axis, ft/sec TAS.

P proportion of flight time spent in nonstorm turbu-

leaice at a given altitude.

P, proportion of flight time spent in storm turbulence

at a given altitude.

52

j
and

f(_ 2 - 2P72 4 (\ 2\ d a
0J V 7 ( b /A
) 7 Jb
0
1 :?l e 2b1

Values of PI, P2I b, and b were taken from MIL-A-008861A. Table V lists
values of RMS turbu ence intensities for various exceedance probabilities,
altitides and flight segments.

3.1.3.7.3 Wind model for landing and takeoff. The following wind model
form shall be used for automatic navigation and all weather landing system
design as required by 3.1.2.9 and 3.1.2.10. This model applies for low
altitude approach and landing flight phases at conventional airports and
shall not be applied at heights greater than 500 feet above mean runway
level.

3.1.3.7.3.1 Mean wind. The probability of occurrence of total mean wind and
mean crosswind components as shown on figure 2 as a function of wind speed
in knots as measured at a reference altitude of 20 feet above mean surface
level.

3.1.3.7.3.2 Wind shear. Wind shear shall be included in each simulated

approach and landing inless its effect can be accounted for separately. The
magnitude of the shear is defined by the expression

u = .46 U 1og 1 0 (Z) + .4 U

where u = mean wind at height Z feet in feet/sec(true)

U - mean wind at 20 feet in feet/sec (true)

Z M height above ground (feet) (4)

3.1.3.7.3.3 Wind model turbulence The longitudinal wind component (in the
direction of the mean wind) and vei.tical and lateral wind components shall
each be represented by a Gaussian process having a spectral density, f (l. )
of.

Q 2 2Li. RAI)
7r (i + )1 2 FT

where. =iRMS turbulence level in an axis in feet/sec

L Scale length in an axis, feet

= Spatial frequency in radians/ft. (5)

and the value for 41 and L is shown on Table VI.

53
 In

E-4

V-44

40

PC.

In"

r44

ISSI AO SQNYSflOHIL S~fLIJUJ'IV

 80

70- NOTE: DATA FOR 20 FOOT

M 6 REPORTING HEIGHT
S 60-

50-

40--

30-

20- TOTAL WIND

10

0
5.0- CROSSWIND

2.0-

1.0-

0.5

00 S0.1 10 20 30
WIND SPEED - (KNOTS, INDICATED)

Figure 2. Cumulative probability of reported mean wind

and cross wind when landing

55
 TABLE VI
RMS TURBULENCE LEVEL AND SCALE LENGTH BY AXIS

Vertical Lateral Longitudinal

0 0.1 U 0.2 U 0.2 U

L 15 Ft for Z !( 30 Ft 600 Ft 600 Ft

.5 Z Ft for 30 _OZ < 100 1000 Ft

DISCUSSION

The wind model currently adopted for MIL-F-9490D is based on the model
described ii British Civil Air Regulations (BCAR) paper 367, Issue 3, January
1970. The criteria leading to adoption of this model are:

It most nearly fits the spectral power density curve of observed

winds compared to any other analytical model presently in use.

Correlative data comparing in-service aircraft performance with

lab data is available.

The model is easily simulated by digital or analog equipment and

requires only a moderate amount of memory or analog equipment.

New more comprehensive wind models are currently under study, but it is
reasonable to expect that they will not be incorporated into MIL-F-9490 until
such time as they have been demonstrated to comply with the criteria stated
above. Incorporating untried models would only serve to destroy a consistent
baseline of comparison betweeu modern military and civil aviation systems
along with the benefits accruing from such comparisons.

The wind model defined is intended for use in approach, landing and take-
off simulation. It is specifically a low altitude model and should not be
relied on for altitudes above 500 feet above mean surface level. The model
has been modified from that in the referenced BCAR paper to reflect a wind-
reporting height of 20 feet above the surface. This modification brings the
model in line with American tower reporting procedures.

The wind shear defined in 3.1.3.7.3.2 is based on the consideration that

in neutrally stable air, the wind profile between 10 feet and 300 feet above
the surface may be given by
•o ~u*Z
Ku _ Z u~ Z
In
n oru= n ,

56
where

K a von Karman constant -0.4

u W wind velocity at height Z above the surface

-* friction velocity, considered to be a constant up to a

height of at least 300 feet above the surface

Z0 aerodynamic roughness height (0.15 feet for terrain

0 typical of airfields)

Larger wind shears can occur in convectionally stable conditions

(essentially laminar flow) which usually occur at night with mean wind speeds
less than 20 feet/second. However, the circumstances are less severe since
the associated turbulence will be less than the levels given in 3.1.3.7.3.3.

In conditions of roughly neutral atmospheric stability, the rms of the

horizontal wind speed fluctuations is close to 0.20 U ft/sec. (U is the
20-foot reported wind in feet/sec.) for terrain typical of airfields and it
can be taken as independent of height from 10 ft. up to at least 300 ft. In
unstable conditions the rms is likely to be relatively larger (up to 0.33 U),
while in stable conditions lower rms values occur, down to almost zero. For
mean wind speeds greater than 30 ft/sec., atmospheric stability is likely to
be nearly neutral.

In conditions of nearly neutral atmospheric stability, over a range of

wavelengths from 300 ft. to 3,000 ft.. the spectral densi'ty of the horizontal
gusts behaves as the kth power of wavelength, where k varies with height,
between above 1.4 at 100 ft. and 1.1 at 10 ft. At altitudes above 100 ft.,
k approaches 1.67 and is approximately equal to this value at wavelengths
shorter than 300 ft. at all heights. Adequate data is not available for
definite statements to be made about the behavior of the spectral density at
wavelengths longer than~ 3,000 ft. but it would be reasonable to assume that
it is constant. The model defined in 3.1.3.7.3.3 is chosen to give agreement
with the measured data for wavelengths between about 300 ft. and 5,000 ft.
(see Figures SD and 6D).

In the Gaussian process model, changes in longitudinal wind velocity over

an arbitrary distance have a Gaussian distribution. Although giving an ade-
quate description of measured wind decreases, the Gaussian model underesti-
mates the probability of large wind increases. In adopting the Gaussian model,
the consideration is made that critical aircraft performance parameters are
most significantly influenced by wind decreasing.

Data on vertical gusts below 300 ft. above the surface in strong winds
(in excess of 30 ft/sec) is much less extensive than it is for horizontal
gusts. Available information is that the rms of turbulence intensity is
about one-half that of the horizontal component. The spectral density appears
closer to the form given in 3.1.3.7.3.3 than that of the horizintal gusts.
However, the scale length varies significantly with height as indicated by
the table of parameters in 3.1.3.7.3.3.

57
 MEAN SMOOTHED SPECTRUM AT 100 FT. FOR SD[ 1 HR. RUNS

MODEL L L

"SPECTRUM I + (2 7 I +-92 L2

\ %

S%\ MODEL SPECTRUM

L = 100 FT.

.L - 300 FT.

...

10,000 1,000 100

WAVE LENGTH X (FT.)

Figure 5D. Mean smoothed spectrum at 100 ft. height compared with model
spectra having the same RMS and various values of scale lengths

58
 100 FT.
60 FT.
30 FT.
10 FT.
• • '\• :•4...".

U NOTE:
FOR COMPARISON THE MODEL SPECTRUM
IS SHOWN HAVING L = 600 FT. AND THE
SAME RMS AS THE 100 FT. MEASURED
SPECTRUM

MODE'•f\RM- ...
L.,
S~FOR T. ".

10,000 1,000 100

WAVE LEGTH(Fr.)

Figure 6 D. Mean smoothed spectra for six 1 hour runs, fitted to give same
spectral density at short wave lengths

59
 In unstable conditions, particularly in the presence of cumulo nimbus
or well developed cumulus clouds, large and rapid fluctuations in wind
speed and direction occur which are apparently unrelated to the mean speed
or direction of the wind before their occurrence, which is usually light
and seldom greater than 30 ft/sec. These large and rapid fluctuations are
not represented 4n the Sust model of 3.1.3.7.3.3. The model spectra provide
a good prediction of large gusts associated with winds stronger than 30 ft/
sec on an annual basis. But, the model significantly underestimates larg-
est annual gusts associated with lighter winds. For example, the probability
of large gusts associated with a mean wind speed of 15 ft/sec are predicted
to be about half of the observed value.

3.1.3.8 Residual oscillations. For normal operation and during steady

flight, FCS iaduced aircraft residual oscillations at all crew and passenger
stations shall not exceed 0.04g's vertical or 0.02g's lateral peak to peak
acceleration. Residual oscillations in pitch attitude angle shall satisfy
the longitudinal maneuvering characteristic requirements of MIL-F-8785.
Residual oscillations in roll and yaw attitude at the pilot's station shall
not exceed 0.6 degree peak to peak for flight phases requiring precision
control of attitude.

DISCUSSION

These residual oscillation requirements apply to both manual and auto-

matic FCS under normal ccnditions These limits do not apply to failure
states such as FCS Operational States below State 1. The amplitudes speci-
fied correspond roughly to the perceptiLile leVel. There is some disagreement
in the literature on the exact level of perception. Different researchers
have established slightly different perception levels based on using differ-
ent test environments and test subjecv-s. Perception level also varies with
frequency. Reference 24, for example, lists results of low frequency moving
base testing which suggests low frequency perception levels roughly 25
percent below those specified for normal acceleration. However, in general,
the amplitudes specified should prove acceptable in general military usage.

MIL-F-8785 includes pitch axis residual oscillation requirements in

general terms with a 0.10g maximum cited. These requirements are more
specific and include all axes. The intent of this requirement is to prohibit
FCS residual oscillations which can be detected by the crew.

The angular attitude oscillation requirement is based on tracking

accuracy concerns. Little or no data is available to substantiate the limits
specified, which are double the previous MIL-F-9490C limits. Roll residual
oscillations of 0.7 degree have been reported for the AWACS airplane without
crew complaint. Reference 13 recommends +0.5 degrees of 1.0 degree peak to
peak as the roll attitude limit for commercial transport design. Residual
oscillations in pitch attitude and heading are also limited to +0.25 degrcee
or 0.5 degree peak to peak. These higher values are acceptable for flight
phases not requiring precision control of attitudes. In procurements having
stringent tracking accuracy requirements, residual oscillations will likely
be reduced even below the limits specified to obtain desired performance.

60
 Residual oscillatory surface deflection limits of 0.5 degree peak to
peak to take care of equipment wear considerations, as well as crew dis-
comfort should be considered based on the conclusions of Reference 48.

3.1.3.9 System teat and monitoring provisions. Teat and monitoring means
shall be incorporated into the essential and flight phase essential FCS as
required to meet the following requirements of this specification:

Mission Reliability 3.1.6

Flight Safety 3.1.7 to 3.1.7.1
Fault Isolation 3.1.10.2 to 3.1.10.2.2
Failure Immunity & Safety 3.1.3.2 to 3.1.3.2.1
Survivability 3.1.8 to 3.1.8.1
Invulnerability 3.1.9 to 3.1.9.7

The effect of detected and undetected FCS failures taken with the probabil-
ity of occurrence of such failures shall comply with the system reliability
and safety requirements. This requirement shall include all failures, both
active and latent, and failures in all components of the system, including
mechanical, electrical and hydraulic components.

3.1.3.9.1 Built-In-Test equipment (BIT). The total maintenance aid testing,

including BIT, and inf light monitoring where used, shall provide an inte-
grated means of fault isolation to the LRU level with a confidence factor
of 90 percent or greater. BIT functions 3hall have multiple provisions to
ensure they cannot be engaged in flight. The test equipment shall not have
the capability of imposing signals which exceed operating limits on any
part of the Rystem or which reduces its endurance capability or fatigue life.
Ground test signals shall not be of sufficient magnitude to drive actuators
into hard-stop limits.

3.1.3.9.1.1 Preflight or pre-engage BIT. Preflight or pre-engage BIT may be

automatic or pilot-initiated, and includes any test sequence normally con-
ducted prior to takeoff or prior to engagement of a control to provide assur-
ance of subsequent system safety and operability. It should be demonstrated
that redundant MFCS electronic channels are operating normally without any
safety-critical latený failures prior to takeoff. This includes all backup
or normally disengaged channels, and fault monitoring and failure isolation
elements. The preflight tests shall not rely on special ground test equip-
ment for their successful completion. Any test sequence which could disturb
the normal activity of the aircraft in a given mode shall be inhibited when
that mode is engaged.

3.1.3.9.1.2 Maintenance BIT. Where required, BIT shall also be provided as

a postflight maintenance aid for the FCS BIT shall be designed to avoid
duplicating test features included as pc.rt of the preflight test or monitor-
ing functions.

3.1.3.9.2 Inflight monitoring. 'Continuous monitoring of equipment perform-

ance and critical flight conditions shall be active as a minimum, during
essential or flight phase essential modes of operation. False monitoring
warnings, including the automatic or normal pilot response thereto, shall not
consitute a specific hazard in excess of the system reliability requirements.

61
DISCUSSION

As flight control systems become more complex, system test takes on

greater importance as a means for improving safety, assuring mission success
and reducing maintenance costs. Reference 56 suggests methods for reducing
unscheduled and no-defect maintenance and inflight malfunctions of FCS used
in high performance aircraft such as the F-14. This work was based on the
finding that the actuators are the most troublesome FCS components to main-
tain and present methods of detectitig and isolating FCS malfunctions,
inflight and preflight, are inadequate.

The total test and monitoring capability necessary for essential and
flight phase essential FCS has been defined in terms of two broad categories,
inflight monitoring and ground functions (BIT). The rationale supporting
two cotegories lies in the objectives for each. Inflight and preflight
functions comprise those tests and monitoring systems necessary to assure
compliance with system safety, survivability, invulnerability and reliabi]
ity requiremenLs called out in 3.1.3.9. Assurance of operational compliance
with the ground rules used to determine reliability, safety, survivability,
and invulnerability may demand that ways be provided to check operational
states. The arrangement and implementation of test and Monitoring circuitry,
and the equipment or flight conditions checked by the inflight and preflight
functions should be selected to ensure compliance with these requirements.

Ground cest functions (BIT) are defined in order to achieve an acceptable

level of maintainability and may rely on special preconditions or ground
equipment to augment the tests. Consequently, in order to avoid significant
impact on system reliability through complexity, it is necessary to minimize
the equipment dedicated to B..0 before reaching the point of diminishing
returns where the majority of the BIT-identified faults are malfunctions of
the BIT equipment. For this reason, the most feasible comprehensive mainten-
ance aid phtlosophy is an integration of the capabilities of the inflight,
preflight and ground test functions with a prohibition against duplication
of functions.

The test and monitoring systems may comprise any one or combination of
the following functions:

Continuous In-Line Monitoring - Concerns monitoling. tcchnlques

incorporated in digital computer software to verify the integrity of that
computer.

Tracer Monitor - Used in analog computers to verify that an ampli-

fier or similar circuit will pass a particular test. It can also be used to
verify the presence of an a-c excitation voltage.

Status Monitor - Monitors the status signal from another channel

or other source.

Comparison Monitor - Commonly called a comparator. Can compare

across channels, across voters or a channel to a model.

Sequential Off-Line Monitor - Used to test in-air, off-line su,-

systems.

62
 II

Standard Comparator - A stimulus of known value inserted into

a unit under test and the response compared against a standard.

Logic Test - An interrogation or comparison of logic devices to

determine the actual state.

Preflight and Inflight testing and monitoring are essential to safe

-peration. The f:,nctions to be monitored and in part, the monitoring
methods, will be the result of analyses and studies to be made along with
the system design. Certain requirements or criteria may be established
as essentLal to a safe system. These should include the following:

All active, and most passive failure should be detected,

The comparator limits and trip times should be great enough to

prevent nuisance disconnects,

Failure transients should be less than a saa: specified g level,

see 3.1.3.3.4.,

Noncritical passive failures may be detected by BIT or ground

test, and

The system reliability should be high enough to make the proba-

bility of two similar critical passive failures virtually nil during one
flight.

The capability of the IFM to detect and disengage faults is directly

related to flight safety requirements and pilot confidence in the system.
An IFM should be capable of det'ecting

Any failure which degrades performance below the system specifi-

cation requirements,

Monitoring circuitry failures which could mask failures of

functional circuitry, and

Single failures which could cause loss of aircraft control if

combined with another subsequent failure.

Additionally, a low nuisance trip rate is desirable if pilot confi-

dence is to be maintained in failure indications. A nuisance trip rate
should be selected which,

Assures pilot confidence in the system by not crying "wolf"

frequently, or disengaging the system during critical phases of the
miss ion,

Requires selection of failure threshold settings which reflect

true primary failures as defined above,

Keeps failore transients from being excessive, i.e., too wide a

failure threshold setting, and

63
 Keeps the system from always being in a failed state, i.e., too
tight a failure threshold setting.

Preflight teats for essential and flight phase essential FCS should
be provided to enable the pilot to determine whether or not the safety*
critical portions of the FCS are functioning properly. It should be
demonstrated that redundant MFCS electronic channels are operating normally
without any safety-critical latent fnilures prior to takeoff. Depending
on the dispatch rules used in calculating flight safety reliability, the
pilot may need to know the operational/failure state channtl by channel
and axis by axis. This includes all backup or normally disaengaged chan-
nels. Pilot operated preflight check requirements should be integrated
into the FCS, and not require use of ground test equipment. It should
be possible to perform preflight tests by manipulation of the following
equipment:

The FCS preflight test means of activation.

The aircraft control stick or wheel.

The aircraft control pedals.

The controls on the FCS control console.

Flaps and speedbrake controls, etc.

Results of the preflight tests should indicate to the pilot the proper
functioning of the FCS as it may affect system safety. The test provisions
should include the capability for determining the integrity of the following:

The control paths between pilot's control input and the aircraft
power coutrol units.

MFCS feedback sensors and control paths.

MFCS fault monitoring and failure isolation systems for sensors,

electronics, and servosystems.

The manual trim systems.

They should also be able to determine the functional capability of the
following in their fail-operational modes:

Electronic computation and control paths to FCS secondary actu-

ators, excluding sensors.

Fault monitoring and failure isolation system for sensors, elec-

tronics, and servosystems.

Additional test capability for checking the conumand limiting and struc-
tural protection systems should be provided. The test provisions should be
mechanized to enable the pilot to complete all preflight tests in less than
two minutes after war aup time. 'rest equipment should not have the capa-
bility of imposing signals whi,-h exceed operating limits on any part of the
system or which reduce its wear capability or fatigue life.

64
 BIT is incorporated in the F('S as a maintenance aid and comprises two
major activities:

Maintenance Preflight - A crew chief activated test directed to

detection of faults without regard to location and run on internal APU or
battery power to avoid engine operation.

Maintenance Fault Isolation - A maintenance activated test dir-

ected specifically to maintenance troubleshooting.

Criteria for an operational BIT system should include:

Elimination of Aerospace Ground Equipment (AGE) required in

addition to normal flight line AGE to perform preflight and routine main-
tenance checks,

'Elimination of personnel in addition to normal ground crew

required in order to perform the BIT operation, and

Testing comprehensive enough to assure safe aircraft mission

completion..

Design to provide positive disengagement in flight and personnel

and equipment safety during ground operation.
In discussions with airlines maintenance managers, such as at the annual
Avionics Mairntenance Conference, they indicate mixed feelings about BIT. Many
have stated that, in gen~eral, BIT is ineffective and has caused more problems
than it has solved (too many false alarms); and, in inany cases, they are dis-
connecting the BIT circuits and painting over the bullseyes or removing them
to increase reliability. On the other hand, in the case of Category III
triple-redundant autoland systems, they find that they need BIT to maintain
the complex equipment.

This experience should be seriously considered. It should be recognized

that self-test capability will be required on many of the new systems which
are evolving, but that it should not be imposed across the board for all sys-
tems. In many cases, other methods are adequate, more reliable and more
economical. Some BIT systems require circuitry which equals or exceeds the
complexity of the circuits being tested and can degrade overall reliability,
or reduce effectiveness of the aircraft because of erroneous fault indica-
tions.

3.1.4 MFCS design. The following requirements apply. References to mech-

anical or electrical MFCS apply only when the mecL~anization is used:

a. Augmentation. When used, augmentation systems shall be compatible

with all control modes and airframe dynamic considerations. Single failures
in a gain scheduling system, not classed as extremely remote, shall not
degrade augmentation system performance below Operational State II. Pilot-
operated gain changing devices shall only be used as emergency backup equip-
ment. Specific approval shall be obtained from the procuring activity for
this feature. Positive mechanical or electrical stops shall be provided in
gain schedulers to preclude exceeding limiting gain values.

bS
 b. Ratio changing mechanisms Where ratio -hanging mechanisms are
used, monitors and emergency positioning means shall be provided if improper
positioning can result in a safety of flight hazard.

c. Control centering, breakout forces and free play. The corresponding

design requirements of MIL-F-8785 or MIL-F-83300 shall be met. Selected
sL .sitivity and breaMout forces shn]D not lead to overcontrol tendencies.

d. Reversion. If a backup mode is provided ior a flight control system

at least FCS Operational State III shall be provided following reversion.
Whil.e disengaged, interaction of backup mode provisions with the normal mode
shall not degrade operation below State I. If a single FCS power systeri is
used in aa essential or flight phase essent La] fully powered system, emer-
gency mechanical reversion or an emergency pover source shall be provided.
On single-engine aircraft, the ener ;ency power scurce shall be independent
of engine operation. It shall :)e possible to Le-engage the normal power
source in flight following operation with manual reversion controls or
emergency power. Manual or automatic changeover to or from emergency pro-
visions shall not result in capability worse than FCS Op,!raticnal State III.
e. Controller kinematics. Kinematics shall preclude hazardous uninten-
tional inputs (croo0stalk) into one or more axes with norm.,! control motions
w'thin the limits of ultimate, structural load factor, design maneuver, and
turbulence induced accelerations experienced at the crew station.

f. Veedback co crew station controls. The control device motion 1-d

force required to accomplish stability and control augmentation shall not be
evident at the cre4 station controls. Vibratory forces or motion acting upon
elements downstre-i of the controller shall not "Le evideut at the crew
station controls. Force and ruction feedback to crew station controls shall
he considered as not evident if the force magnitude is less ti.nn half the
lo-est breakct. force of the applic.-ible control.

L.SCUSSION

Performance requirements for MFCS are specified in 3.1.1 by rcference to

applicable specif 'cations and gE|,eral design requirements to be satisfied by
all FCS are defined in 3.1.3.

hlere augmeotation systems are used, the operation in turbulence require-

ments of 3.1.3.7 are ir,,ortapt c,.'sIdera tions rnd should be considered early
in the Oesi.gw proccss.

The 680-J program (References 49 and 57) :'nvestigated the need for
multiple modes, one or more of wh'ch exists so-ely or the purpose of provid-
ing a backup for the primary mode. The Mechanical Back-Up (MBU) and Flectri-
cal Back-Up (EBU) mode,; included in thE 680-J Survivable Flight Control System
(SFCS) fall into this caLegory. The MBU mode caused soiie degrada.tion of the
pitch normal mode staolitv '-roperties at low 3ma.]itudes. Thl.s was attr-hiitopd
 If an EBU mode is included in a future design it should not be allowed
to significantly degrade the normal mode of operation. For some applications,
inclusion of either an MBU or EBU would be useless, as in a case where the
unstable nature of an aircraft may preclude control with a simple, open loop
control system. Unless a clear need for an open loop backup mode can be
established, none should be provided in a production systam. A better
approach would be to strengthen the primary mode at those points where weak-
nesses tend to justify an EBU.

3.1.4.1 Mechanical MFCS design. In the design of mechanical components,

the reliability, strength and simplicity of the system shall be paramount
considerations. The signal transmission between the pilot's controls and
the control surfaces shall be redundant to the extent required to meet relia-
bility, failure immunity, invulnerability and other requirements of this
specificaticn.

3.1.4.1.1 Reversion - boosted systems. In the mechanicrl veision mode, at

least FCS Operational State III shall be provided. The normal, boosted,
control forces shall provide FCS Operational State I. It sha.ll be possible
to re-engage boost following operation with mechanical reversion.

DISCUSSION

These requirements for mechanical MFCS apply only where mechanical

implementation is used. The level of mechanical redundancy to be used is
determined by failure immunity, reliability, survivability and invulnera-
bility characteristics required for individual procurements.

For fully powered MFCS on multiple engine aircraft, emergency power

requirements may be determined by the invulnerability to engine failure
requirements of 3.1.9.4.

3.1.4.2 Electrical ýFfCS design. Electrical flight control systems (6.6)

shall be designed with special consideration to invulnerability to light-
ning strikes and to thp thermal, EMI and other induced Environments of
3.1.9.3.

DISCUSSION

Major progress ir,doveloping Electrical Flight (ontrols has been made in

recent years. Reference 58 discusses integration of hybrid electrical-
mechanical systems and presents a somewhat unique design approach to mechanize
a hybrid system. This concept features the use of aerodynamic summing to
qeparate the electrical and mechanical signal transmission paths.

Reference 59 descr Ues some of the problems encountered in designing the

USA SST control augmenttion system. A four channel system using mechanical
voting with a separate mechanical backup FCS was used to transmit pilot
commands,
the USA SST. The impact of failure immunity and invulnerability considera-
tions is also described 'or this application. Reference 61 describes design
and flight experience with a digital electrical flight control system on an
F-8 aircraft. A sampled data design synthesis example is included which
demonstrates the roll of various analytical and s 4 nulation methods. This
effort revealed that verificatiun of digita_ flight control software requires
an extensive effort, which should not be underestimated. Use of an iron
bird simulation was considered indispensable for a development of this nature.
A lesson learned, and an inherent consideration in electrical flight control,
is the need to replace the slop normally present in a mechanical system with
some equivalent electrical deadband in the pilot's input path. Reference 62
makes the point that Control Configured Vehicle and electrical flight control
concepts are interrelated and points out increased capabilities obtained with
the F-4 flight test aircraft.

Reference 60 concludes that safety and survivability requirements as

opposed to mission reliability requirements may dictate the complexity of an
electrical MFCS. Problem areas uuch as sensor accuracy and alignment con-
trol and display panel cockpit real estate limitations and lightning strike
susceptibility are discussed.

The 680-J program (References 49 and 57) and the American SST program
both found the growth of complexity encountered during design of complex
flight controls to be a problem. The basic simplicity and pure separation
obtained through aerodynamic summing should be seriously considered in the
future. A basic recommendation of the 680-J program was to eliminate elec-
tronic or mechanical voting in future designs when the aerodynamic configur-
ation permits the use of multiple independent surfaces which provide
aerodynamic summing. Recent developments which successfully used a form of
aerodynamic summing include the DC-10 and the B-52 CCV flutter mode control
system.

3.1.4.2.1 Use of mechanical linkages. If a separate artificial feel system

is used, or if mechanical linkages are used to connect a signal conversion
mechanism with the control surface actuators, friction and freeplay shall not
result in FCS operation below State I. Longitudinal and directional controls
shall be mass balanced in the fore and aft direction and lateral controls
shall be provided inboard to outboard balance, consistent with structural
mode and longitudinal force requirements. Any residual vertical imbalance
shall be consistent with feel requirrments.

DISCUSSION

Future system designs may utilize a fixed center or side stick or a

stick to which the feel mechanism is directly attached. However, if a
separate aitificial feel system is required it should be located as near to
thp pilot's control stick as possible to minimize the use of mechanical
linkage which produces friction and freeplay. Even so, 680-J program flight
testing demonstrated that even small amounts of friction and freeplay located
friction level since the electrical breakout force designed into the elec-
tronics must be equal to or greater than the sum of the feel breakout and
friction forces. Flight testing has shown that the pilot has cor.nrol dif-
ficulty due to small amplitude instability, when the airplane responds to
controller inputs prior to movement of the controller itself. However,
the electrical breakout force cannot be allowed to exceed the mechanical
breakout of the feel system by a large margin because the resulting
controller motion will appear to have excessive freeplay. The mechanical
and electrical breakout should be matched as closely as possible. Tolerances
should be specified which assure that the electrical breakout will be the
higher of the two. Freeplay can usually be reduced by using precision
bearings at the expense of increasing friction. If freeplay producing link-
age cannot be avoided, the linkage may be preloaded by springs of a high
enough force level to eliminate the freeplay.

Linkage may also be required in some electrical control systems in which

it is undesirable to incorporate or integrate the signal conversion mechanism
into the surface actuator. The output of the servo control unit would then
operate the control surface actuators through mechanical linkage. Again, the
amount of mechanical linkage used must be held to a minimum to minimize
friction and free-play. If any appreciable amount is used, precision bearings
and system preloading again should be considered. At this point in the system,
friction and free-play cause increased phase lag during closed loop operation
which could result in noticeable small amplitude limit cycling.

If mechanical linkage must be incorporated into the electrical flight

control system then inertial balancing becomes a'" important design parameter
which should be considered during the design stages. Inertial imbalance of
the mechanical linkage may produce forces which can be felt by the force
sensing device of the electronics. All controller mechanizations will require
attention to kinemp-Lics with regard to applicable vehicle rates, attitudes
and acceleratic,,s in all degrees of freedom. For example, longitudinal and
directional control systems will require mass balancing in the fore and aft
directý,n as well as the vertical direction. Lateral systems would require
in)xoard to outboard balance as well as vertical balance. A stick force
and/or position proportional to normal acceleration may be desirable. If so,
the feel system should include the desired residual imbalance. See Reference
1 for a detailed discussion of bobweights, control balance and feel. Initial
design of future electrical control systems should include a means of altering
the mass to provide system balance in the flight test airplane.

3.1.5 AFCS design. AFCS shall, be provided to the extent specified by the
procuring aclivity.

3.1..1.1 S-stem requirements. When the specified modes are used, the follow-
ing desig,, requirements apply.

3.1.5.1.1 Control stick Cor wheel) steering. If this mode is requi *d,
MIL-F-8785, or if applicable, MIL-F-83300, shall be used as the basis for
control capability.
4 3.1.5.1.2 Flight director subystem. If coxmmon mode selection is used,
it shall be possible to select control stick steering with flight director
operation in place of any of the other AFCS modes. Single-channel flight
director operation shall be possible when all but one channel of a redundant
system has failed.

3.1.5.2 AFCS interface.

3.1.5.2.1 Tie-In with external guidance. Internal FCS switching with zero
command signal input from external guidance systems shall not cause trans-
ients greater than engage transients per 3.1.5.2.3. Noise content in usable
external guidance signals shall not saturate or bias any component of the
FCS, shall not impair the response of the aircraft to the proper guidance
signals, and shall not cause objectionable control motion or attitude varia-
tion. Steering information transmitted to the AFCS shall be compatible with
the accuracy and dynamic performance requirements of the guidance loop. The
tie-in provisions shall not degrade performance of other subsystems by caus-
ing excessive loading or saturation.

DISCUSSION

Steering information may be transmitted to the AEGS by analog or digital

means. For digital implementations, sampling frequency and number of bits
per signal. are important compatibility considerations. For analog data links,
gain variation and zero shift of the data link should be considered to assure
compatibility with guidance loop requirements.

3.1.5.2.2 Seryo engage interlocks. Interlocks shall be provided to prevent

servo engagement and to provide disengagement in the presence of conditions
that render disengagement safer than engagement. Manual override of inter-
locks shall be provided wherever such override capability will enhance flight
safety.

3.1.5.2.3 Engage-Disengage transients. Normal engagement or disengagement of

AFCS modes shall not result in transients exceeding the limits set on MFCS
engage-disengage transients by MIL-F-8785 and MIL-F-83300. Normal engagement
transient requirements shall be met 2 seconds after completion of any maneuver
up to the maneuver limits of the aircraft or the limits of sensor equipment
being used.

3.1.5.3 AFOS emergency provisions.

3.1.5.3.1 Manual override capability. It stnall be possible to manually

overpower or countermand the automatic control action of the AFGS using the
normal pilot controls. Required pilot forces shall not exceed pilot capa-
bilities as defined by MIL-STD-1472. The overpower force for V/STOL aircraft
and helicopters shall not exceed the limit cockpit control forces specified
for Level 1 operation in MIL-F-83300. Manually overriding the AFCS shall
not result in an instability due to force fight between the pilot and the AFCS.
DISCUSr ,

The purpose of manual override capability is to allow the pilot to

immediately respond to an unforeseen emergency situation. The typical maxi-
mum forces listed below for override are consistent with modern aircraft
system practices and have been shown to be substantial enough to prevent
inadvertent pilot inputs tu the control surfaces during normal automatic
system maneuvers.

Single :hannel AFCS operations (single servo engaged)

Rudder - 80 pounds

Elevator - 20 pounds (stick)

- 35 pounds (wheel)

Aileron - 10 pounds (stick)

- 20 pounds (wheel)

Redundant channel AFCS operations (servos engaged in a redundant

configuration)

Rudder - 120 pounds

Elevator - 30 pounds (stick)

- 50 pounds (wheel)

Aileron - 15 pounds (stick)

- 30 pounds (wheel)

These forces are also adequately limited to allow piloL-initiated

recovery procedures in the event the AFCS misfunctions. The pilot has the
option to disengage the automatic system through normal disengagement switches
provided, or to override the system and disengage it after the initial
recovery maneuver.

Manual override for EFCS ("fly-by-wire") does not necessarily require

mechanical means. The electrical command authority of control stick steer-
ing or of the basic EFCS may be used to fulfill this requirement.

For override, there is no requiremenit to provide a force level Iliowing

the pilot to precisely control aircraft altitude or position. It is expected
that override will be used to initiate a recovery maneuver followed in a
short time by manual disconnect or diseiugagement of the auLoomatic flight
control system.

3.1.5.3.2 Emergency disengagement. Positive emergency means of disengage-

ment, in addition to normal mode selection, shall be provided for AFCS.
The emergency disengagement means shall also ground the power input side
of the servo engage solenoids. No intervening switching Tr-chanism butween
the point of ground and the solenoid shall exist.
DISCUSSION

The switching mechanism used should provide a means of positively

grounding the power input side of the servo engage solenoids. It is unlikely
that the main servo engage power wire(s) will be routed up to the flight deck,
then down to the solenoid, particularly on transport or bomber size aircraft.
Therefore, the cockpit switches may incorporate further means to remotely
apply the ground. Consequently, fail-safe design procedures should be used
for any supplementary circuitry to insure the integrity of the emergency
disconnect function.

Servo engage-disengage solenoids should not have high engage-disengage

voltages or current differentials. For example, a nominal 28-volt D.C. sole-
noid that engages at 26 volts and disengages at 6 volts is less desirable
than one that engages at 18 volts and disengages at 15 volts. The disengage
circuit configuration should be carefully designed to avoid the possibility
of ground loop voltages, under normal and plausible failure states of any
interfacing equipment, causing uncommanded engagement or disengagement.
Normal operation includes effects of transients such as lightning currents.

3.1.6 Mission accomplishment reliability. Tie probability of mission fail-

ure per flight due to relevant material failures in the flight control sys-
tem shall not exceed the applicable limit specified below. Failures in
power supplies or other subsystems that do not otherwise cause mission fail-
ure shall be considered where pertinent. Each mission to which this require-
ment applies shall be established and defined by the contractor, subject to
approval of the procuring activity.

a. Where overall aircraft mission accomplishment reliability is specified

by the procurement activity, QM(fcs) - -

b. Where overall aircraft mission accomplishment reliability is not

specified, QM(fcs) - 1 x 10-3
where: QM (fcs) =Maximum acceptable mission unreliability due to relevant
FCS material failures.

RM= Specified overall aircraft mission accomplishment

reliability.

AM= Mission accomplishment allocation factor for flight

M(fcs) control (chosen by the contractor). (6)

DISCUSSION

See discusslon under 3.1.7.

3.1.7 Quantitative flight safety. The probability of aircraft loss per

flight, defined as extremely remote, due to relevant material failures in
the flight control system shall not exceed:

QS(fcs) ( S()As(fcs)
 Af - Flight safety allocation factor for flight control
As(fcs) (chosen by the contrac-cor).
RS - Overall Aircraft Flight Safety Requirements as
specified by the procuring activity. (7)

Failures in power supplies or other subsystems that do not otherwise cause

aircraft loss shall be considered where pertinent. A representative mission
to which this requirement applies shall be established and defined in the
FCS specification (4.4.2). If overall aircraft flight safety in terms of RS
is not specified by the procuring activity, the numerical requirements of
table VII apply.

'TABLE VII
FCS QUANTITATIVE FLIGHT SAFETY REQUIREMENTS

MAXIMUM AIRCRAFT LOSS

RATE FROM FCS FAILURES

OVERALL A/C MIL-F-8785 QS(fs)<, x 10-7

FLIGHT SAFETY CLASS III AIRCRAFT
REQUIREMENT
NOT SPECIFIED ALL ROTARY WING QS(fcs)_< 22 5 X 10-7
BY PPOCURING AIRCRAFT
ACTIVITY... MIL-F-8785 CLASS I, QS(fcs) <100 x 10-7
__ 11 & IV AIRCRAFT

DISCUSSION - ANALYSIS CONSIDERATIONS

Reliability and flight safety requirements for the mater Lal flight con-
trol system (hardware reliability without consideration of pil,,t errors) are
specified on a probabilistic basis for the two operational levels most signif-
icant to the aircraft and its weapon system or other function; i.e., flight
safety and mission accomplishment.

A similar reliability requirement is included in MIL-F-8785B. A single

analysis should satisfy both requirements, although different analysis results
will apply to each requirement. Basic differences between the two realibility
requirements are:

MIL-F-8785B takes a worst case approach and assumes a maximum

mission length and that all failures occur at the critical point in the
flight envelope (with regard to flying qualities). Limits are placed on
encountering Level 2 and Level 3 flying qualities. No direct requirement
is placed on mission accomplishment. See Reference 1 for a discussion of
this requirement.
such a failure is critical. Failures associated with CCV systems, such as
ride smoothing, must be considered where the function provided is other than
flying quality.

Due to these basic differences in approach to specifying reliability, the

numbered values cited by MIL-F-9490D are at least an order of magnitude more
stringent than those found in MIL.-F-8785 if one compares mission accomplish-
ment to Level 1 flight safety to Level 2. However, the intent of both speci-
fications appears to be similar, and the implementations needed to satisfy
the flying quality requirement should be similar to those needed to satisfy
the flight controls requirement.

The flight safety analysis should consider all failure modes that
threaten flight safety, whether single failures or combinations of failures,
and whether extremely remote or not. Likewise the mission accomplishment-
reliability analysis should consider all, failure modes that threaten mission
accomplishment, whether single failures or combinations and whether extremely
remote or not. It should not be inferred that the probability of aircraft
loss due to relevant material failures in the FCS is identical to the proba-
bility of experiencing one or more failure modes that degrade performance
below Operational State III. Many of the failure modes that degrade perform-
ance below State III will be critical only under certain unfavorable combina-
tions of variables such as:

Visibility Conditions

Turbulence Levels

Airspeed or Mach Number

Altitude

Pilot Warning and Reaction Time

Gross Weight

Center of Gravity Location

Thus if a given failure mode will result in aircraft loss only under
commbinations of the above variables which can reasonably be expected 10 per-
centofhe Ime a failure probability of 10-7 per mission will contribute
an increment of only 10-8 to aircraft loss probability. The designer, how-
ever, must beware of over reliance on this philosophy. He still has the
responsibility to strive to eliminate as many hazards as practicable,
regardless of probability and avoid dismissing a potential problem with
just the thought, "Oh, that will never happen".

Where criticality varies with mission phase, -itis generally necessary

to construct A suitable mathematical model for each critical failure mode.
Ina some caces it may be necessary to distinguish between failure modes that
are hazardous chiefly at the time of occurrence because they introduce an
element of surprise and require i 'mediate pilot reaction, and failure modes
that are hazardous chiefly becaus-, they leave the svstem in a de~radpd
 An FCS Specification should be prepared by the contractor (4.4.2),
which includes the intended mission. This definition should:
Clearly distinguish between wartime safety and peacetime safety.

Different rules can be expected for operation, dispatch, maintenance, etc.

Define abort criteria if peacetime safety is to be the basis.

To a lesser degree, the same principles may sometimes be applied to the

probability of mission failure. A failure mode that degrades performance
below State II does not necessarily result in mission failure. All the per-
tinent variables must be taken into account when computing the increment of
mission failure probability that results from a given probability of occur-
rence of each specific system failure mode.

The fact that a given function is not classed as essential does not
necessarily assure that all the failure modes of the associated hardware are
noncritical. Such hardware, even if its basic function is not essential, may
have dangerous failure modes (hardover, oscillatory, divergent, etc.) that
can threaten loss of aircraft. The flight safety analysis must include any
such modes, in addition to the various failure modes of iardware performing
essential or mission-phase-essential functions.

The flight safety analysis, as well as the mission accomplishment relia-

bility analysis, must take into account the failure modes of monitoring and
self-test subsystems, to whatever extent these modes can impact flight safety
or mission accomplishment reliability. Also to be accounted for are latent
failure modes that might go undetected and so uncorrected, even with operative
monitoring and test systems.

Probabilities of component failures should include allowances for normal

wearout as well as random failure, unless it Is assured that the assembly
involved will be subject to scheduled overhauls at intervals sufficiently
short to preclude significant wearout. This consideration applies particu-
larly to hydraulic seals, bearings, and other parts that are typically
replaced in scheduled overhaul; also to cooling blowers for electronic
equipment, particularly if they contain brushes.

Note that survivability and invulnerability are related to reliability

but are specified in following sections, in absolute terms rather than on a
probability basis.

DISCUSSION - NTMERICAL REQUIRDIENT

Concept

Inn a qualitative sense, the probability of aircraft loss to relevant

material failures in the flight control systems must be "extremely remote",
which is defined as the probability of an event occurring which, although
range of a wing structural failure due to an extreme load condition, seizing
or binding of a high-force hydraulic actuating cylinder, or thethesimultaneous
individual
occurrence of two or more statistically independent failures,
probabilities of which are very low. For this specification extremely remote
is defined (6.6) as numerically equal to Qs(fcs)' the specified quantitative
FCS flight safety.

Flight Safety Requirement

To provide a means for determining compliance with the requirement, a

numerical value must be established. In many cases, a flight safety require-
ment for the overall aircraft or weapon system, RS, will be specified and the
maximum allowable probability of aircraft loss due to material failures in
the flight control system, QS( cs), can be established by the contractor
based upon the proportion of the maximum allowable probability of aircrait
loss, due to all material failures, which is allocated to the flight control
system.

A typical division or budgeting of the overall allowable loss rate is

depicted in Figure 7D. Using a typical value of As 8 fcs)-0.10 and assuming
a specified flight safety requirement for the overall aircraft, RS-0.9999,
then:

QS(fcs) • (1-0.9999) 0.10 £ .00001 losses/flight or no more than one

aircraft loss in 100,000 flights due to material failures in the flight con-
trol system.

In budgeting the overall allowable loss rate into system allocations,

the interdependency of systems must be recognized. For instance, powered
flight control systems cannot be separated from the hydraulic and electrical
power systems. Where dedicated power systems are used, reliability inter-
faces must be established and such failures included in the FCS flight
safety evaluation.

The numerical requirements specified for use in cases where flight-

safety is not otherwise specified are based on actual Air Force field safety
experience data, such as documented in Reference 46 and as shown in Appendix
A herein, used as follows:

For MIL-F-8785 Class III aircraft, field safety experience data for the
B-52, C-135, and C-141 aircraft were examined; and, their major accidents
(due to all material failures) in the 1964-1973 time period were reported to
occur at rates of 2,145/100,000, 0.846/100,000, and 0.822/100,000 flights,
respectively. Of these accidents, 1.365 B-52 aircraft were destroyed per
100,000 flights, 0.363 C-135 aircraft were destroyed per 100,000 flights,
and no C-141 aircraft were lost. Although there were no aircraft lost due
to material failures in the flight control system, the flight control system
failure which resulted in a major accident of a B-52 airplane could easily
have beeit catastrophic, and therefore the combined major accident rate of
0.055/100,000 flights due to material failures in the flight control system
was adopted as representative of this class of aircraft.
CI

CY
rj2

48 CY
 For MIL-F-8785 Classes I, II & IV aircraft, field s&ttetv experience for
the F-4 was examined, and their nmajor accidents (due to all material fail-
ures) in the same 10-year period was round to be 3,158/100,000 flights. Of
these accidents, aircraft were lost at the rate of 2.378/100,000 flights.
Of these, 0.546 and 0.351 were lost per 100,000 flights due to flight con-
trols and hydraulic systems, respectively, for a combined rate of 0.897/
100,000 flights, which was rounded off and adopted as representative of
this class aircraft.

The need for a higher degree of reliability for MIL.-F-8785 Cklzss III
aircraft is self-evident inasmuch as there are often no provisions for
evacuating personnel in flight and/or because they are designed to carry
nuclear weapons or other stores or equipment which must be recovered if at
all possible. At the same time, a higher degree of reliability is usually
easier tc accomplish because such aircraft are generally larger and can more
easily accommodate the additional redundancy required. In addition, the
design penalties. weight, and cost for ejection seats or escape capsules,
usually provided in MIL-F-8785 Class IV aircraft, are not usually required
for Class III aircraft.

For rotary-wing aircraft, field safety experience data [or the H-I, H-3,
H-43, and H--53 helicopters were examined. Their combined major accident
rate (due to all material failures) was found to be 1.826/100,O00 flights.
Of these accidents, aircraft were destroyed at the rate of 1.345 per 100,000
flights, with losses due to failures in the flight control system and hydrau-
lic power system occurring at rates of 0.192 and 0.096 per 100,006 flights,
respectively. These combine for a rate of 0.288 per 100,000 flights.

In calculating the predicted reliability of any given flight control

system to show compliance with the stated requirement, it must be recognized
that it will not always be possible to determine (on the actual airplane)
that all subsystems and components are failure-free and operable at the cnd
oi preflight check. In some designs, it may be feasible to check for com-
plete freedom from failure only at longer maintenance intervals. In those
cases it will be necessary to design to a higher reliability to coripensate
for the fact that daily takeoffs may be made with some components or subsys-
tems already in a failure state. See Appendix B for methods of determining
reliability increases required to compensate for blind redundancies.

Mission Accomplishment Requirement

In many cases, a mission accomplishment reliabilfit V reqUirement for tl'e

aircraft or weapon systems, R1, will be specified and the maximum allowable
probability of mission failures due to material failures in the flight con-
trol systems, (fcs ,, can be established by the contractor based upon the
proportion of the ma imum allowable probabiflity of mission failure, due to
all material failures, which is allocated to the flight control system. A
typical mission-accomplishment reliability requirement for an aircraft weapon
system might be 0.99 per mission, corresponding to t maximum allowable mis-
sion failure rate of 0.01 per mission. For this case, a typical value of
AM1CS), might be 0.10 resulting in a maximumn allowable mission failure rate,
due to relev-mt material failures in the flight control systems, of QM(fcs)
 For other aircraft which are dependent upon a large number of complex
onboard equipment to achieve mission accomplishment, such as an airborne
warning and command sy.tem aircraft" possessing a large and complex avionics
system, a lower mission-accomplishment reliability requirement such as 0.90
might be appropriate. For this case, however, AN(fcs), might be as low as
0.01 since a much greater proportion of the allowable failures would be
allocated to the avionics equipment. However, in this particulair example,
QA(fcs) for
(ie,QM(fc~s) the flight control
"_ (0.90)(.01). systems is again :5 .001 aborts/flight

Therefore, in view of the';e possibilities, the maximum allowable rate

of .001 or 1 mission abort per 1000 flights due to materinl failures in the
flight control system as established for use in cases where a specific mis-
sion accomplishment reliability requirnent is not specified by the procuring
aIctivity.

References 47 and 63 also provide pertinent background information.

Rference 47 reports on a 3tudy which documents reliability experience on
nLval tactical aircraft. Reference 63 describes unique features of the B-1
FCS and discusses the flight safety and mission accomplishment reliability
budgets establisoed for the B-1 flight control system. The B-1 FCS was
designed with an allowable mission failure rate due to FCS failures of 1 per
1034 flights according to Reference 63. References 59 and 12 document the
design of the USA SST flight controls. Very stringmnt reliability goals were
adopted for this system and the last prediction prior tL1 SST contract cancel-
lation showed loss rates in the range of L0-8 per mission. The design
criteria adopted and a discussion of some of the problems encountered is
presented. An important conclusion of this development wa.-s thaL reliability
calculations are really only applicable to a system that ha.." had the design
errors worked out ot it. ReLiability calculations are nsetu' for determining
the better of several design approaches, but they cannot assu'a safety during
the first few hundred hour.3 of flight. The SST development wi:-. planned such
that reliabltty of new designs was to be tested in the true fl.]Aht environ-
inent prior to depending on them for satety. This was to b.2 achieved by pro-
viding for use of the all mechanical backup control mode during early flights.
These flights were to be restricted to light gross weights with ,A forward cg
where augmentation was not mandatory.

.1.7.1 Quantitativ_ f1ht _safety-- all weather landingn sytem(\V.S). The

average hazard due to the use of the all weatner laiding system siiuill be
less than the risk allowed in the contractor's reliability budget Cor the
all weather landing system. To meet the requirement:s of 3.1.7, tie contrac-
tor shall allocate the FCS safety budget among AWfLS and other FCS. The
specific risk of a hazard due to use of the landing system ;nder an environ-
ment limit or operational resttiction shall not increase th, allowed risk by
a factor of more than thirty. An alert height shall be estoblished at an
altitude such that, vith all systems operative at the alert height, the
probability of a hazard occurring during the landing J-vextremely remote,
as defined in 6.6.
. o

3.1.7.1.1 Assessment of averaje risk of a hazard. The average risk of a

hazard due to use of the all weather landing system shall be established
considering:

a. The effect of each failure and combination of failures on

system performance and the probability of their occurrence.

b. The effect of each relevant failure and combination of fail-

ures in systems operating concurrently with the all weather landing AFCS
on aircraft performance and the probability of their occurrence.

c. The probability of the system not performing within the

required levels as specified in 3.1.2.10 taken in conjunction with the
probability that exceedance of those performance levels will result in
a hazard.

3.1.7.1.2 Assessment of specific risk. For each environmental limitation or

operational restriction which limits the use of the all weather landing sys-
tem, the specific risk s.hall be established. This evaluation shall comprise
the average risk assessment, adjusted for a 1.0 probability of occurrence of
environmental limits associated with the operational restriction.

DISCUSSION

An assessment ;f all weather landing system safety should be compiled to

correlate the reliability analyses. The assessment should comprise:

An analysis of the average risk associated with the system.

Analyses of specific risks incurred for unusual or limiting condi-

ti, ns.
A description of assumptions and supporting rationale used to
develop the preceding analyses.

The average risks are defined as the risks incurred by using the system
under normal operational conditions but during a limited visibility condition.
The potential source of these risks are comprehensive since many systems other
than the AFCS can cause conditions contributive to a hazard during landing.
Thus, the supportive analysis must include the possible contribution to hazard
of such diverse systems as the AFCS, the manual flight control system, includ-
ing the stability agumentation systems, etc.

Malfunction or misfunction of the airborne systems may resulL in one or

a number of incidents such as those appearing in Figures 9D and 1OD.

The probability of occurrence of each of these incidents must be deter-

mined, considering the likely pilot actions for the required visibility
conditions.

80
 An incident ma-, occur duk to:

The effect of a single failure or combination of failures.

The performance of a failure-free system, i.e., variability of

the characteristic system parameter about its average value or operating
condition beyond design limits, or just a rather unlikely occurrence.

The effect of a failure combined with poor performance not

related to the failure.

Spe-ific risk is defined as the risk incurred whenever the aircraft is

operating in a limiting condition, either environmental or procedural, while
landing under limited visibility conditions. The specific risk analysis
provides the rationale for establishing such limits. The specific risk
analysis comprises the same data which formed the average risk analysis,
except adjusted to account for the limiting condition, such as an extreme
crosswind, or maximum approach speed, and so on. An analyvis is required
for each limiting condition, taken one at a time. in addition, the analysis
may include ierfarmance-affectlng parameters for which a statistical distri-
bution is not feasible, such as unusual location of the glide slope or
localizer transmitter, extreme approach terrain profiles, or worst case
combinations of runway gradients.

A complete statement of as.umptions and supporting rationale serves two

purposes within the context cf a svstem safety assessment. The statistical
analysis will be based on statistical data taken using limited exposure Limes
of components and equipment. The exposure times and resulting limited confi-
dence in the corresponding data may substantiate in-flight or ground test
procedures or regimen necessary to maintain the basic safety stntus of the
system(s). Occasionally an assumption is established in lieu of definitive
data or nonexistent data. As such data becomes available, a more accur:-.e
assessment may be made of its impact on the basis for system safety.

Reference 16 describes a logical method of evaluating the safety of a

landing system. Figure 8D is a model of the possible outcomes of any approach.
It is required that the probability of a hazard due to use of the all weather
landing system should be extremely remote. Note that the analysis must recon-
sider the approach outcome probabilities after executing a missed approach.
The outcome tree of Figure 8) may be further subdivided into detailed longi-
tudinal and lateral outcomes as shown in Figures 9D and 10D which show some of
the incidents which may be hazardous. Having built up these performance trees,
the probabilities of each event must be evaluated to determine the probability
of a successful landing as shown in Figures lID and i29.

Since not all incidents will result in a hazard, a relationship of

incidents/hazards must be assumed. British Civil Air Regulations, paper 367,
Issue 3, January 1970, proposed values considere to be representative of past
experience and this should be used unless it can be shown that these values
are not valid for the procurement aircraft. The incident and ratios assume
that the landing facility meets the recommendations of ICAO Annex 14 with
regard to the strip surrounding the runway. This extends 200 feet before the

81
 4: 4

F z

CIS

II"

82'
 S"-"w

00
- - - - - --- - - - -- f --

00

<W z
U4

- - --
-- - -- - - - - - - - - - - -a - - a -

CA,

83
II

843
 CO).

ýQm

0- -

- ~ A A.8A
 - 44L

0 01

b..

b..

0.~

4 I
b. I- b, 1 -

u ~0 0 0 0 C

o. o. o 09

86
threshold and to 500 feet on each side of the runway cznwerline of wiich
250 fiet has a prepared surface, the remainder being clear of obstruk'tions.
Where these recosendations are not met, the va!laes given below should be
redefined.

INC IDE•TS HAZA|b: I NC IDENT

a. Overrun runway but not more than 200 feet 1:100

b. Overtur. runway more than 200 feet 1,1

c. Hord landing harder than design ultintate 1:10

vertical velocity

d. Short landing but not more than 200 feet 1:30

short of threshold

e. Short landing more than 200 feet short of i.1

threshold

f. Runoff side of runway but not more than 250 1:30

feet from centerline

g. Runoff side of runway more than 250 feet from 1:1

centerline

I
h. Land with excessive crab, sufficient to 1:10
collapse 3ear

i. Drag wingtip before gear touches ground 1:1

j. Drag wingtip after gear touches ground 0:1

k. Land off side of runway but not morc than 200 1:30
feet from centerline
1. Land off aide of runway more than 200 feet 1:1
from centerline

3.1.8 Survivability. FCS Operational State IV )r State V shall be pro-

vided as rrequired by the procuring activity.

3.1.8.1 All engines out control. For those aircraft which are dependcittt
upon engine generation of fliglt control system power, supplen,entary means
or power source shall be provided as necessary to supplement the control
power available from the engine(s) where engines are unproven, airframe
aerodynamics not established in flight, or windmilling power is insufficient
to maintain operational State IV control capability anywhere in u.ne aircraft
operational envelope. Flight cco:trol system design (including power soirces)
shall be such that unintentional loss of any or all engine thrust shall not
result in less than FCS Operational State IV including any necessary transi-
tion to emergency source(s) of 'xw'ver. Provision shall be made for inflight
reversion to normal power wherein the transmission shall, not result in a
worse FCS operational state.

87
DISC1s 1 .1

The toregoing survivability rrquirements are spectfied in recognition of

the following factors:

Tha: aircraft parforme.nce requirements tnr range, payload, speed,

etc.. often dictate the need for such lightweight, compaet airframes that It
fm difficult tc- provide the necessary redundancy .md/or spatial separation
of subsyntems to mec the specified flight-safety requirements.

That such stringent performance requirements also make it difficult

to provide the required invulversbility to enemy action.

That supersor.ic wpoeAs, size, or other factors introduce aerodynamic

surface hinge moments of such magnitude that fully powered systems, without
provision for revision to mechitnical control, are requirad.

That tot some advanced aircraft the performance requirements are so

s-ringent that -ta•-ot-th.
art advancementb requiring several years of
refinement after introduction of the aircraft into service, before attainment
of a given reltabilit, requirement can be aLsured, will be required (e.g..
hiitorical experience with such advanced aircraft as the F-1O0, B-58, and
F-Ill).

The Air Force has recognized these factors, and the development of sur-
vivabillty mot.-*-pump servoactuator ("power-by-wire") units on the ADP 680-J
program hAi demonstrated that practical limited-authority control servos can
be incorporated to achieve tlese survivability requirements. See References
49, 64, b5, and 66. Also, see 3.2.6.5.4 herein for requirements for inte-
grated survivabi!ity servoa.ituators.

It should also be recognized thi.t incorporation of such limits can have

major impact upon the design of flight control actuation installations.
Therefore, unless othervibe specified by the procuring activity, such units
are required only for those aircraft where it is agreed that the design or
performance requirements are 4uch that the flight-safety requirements and/or
invulnerability to enemy action reQuirements carlnt otiserwise be met.

In addition, it ahould be recognizvd that th.. primary intent of the

survivabl•ity provisions is to provide sufficient control capability for the
flight crew and other occupants r:t survive situations in which the aircraft
will usually be lost or suffer isajor damage; and, where appropriate, to also
provide a last-ditch capability to safely recover the aircraft's stores
and/or vital equipment. Even with highly Pdvanced, high performan.e aircraft,
the design should be highly resistpnt to loss due either to random equipment
failure or enemy action.

The All-engines-out cont)-ol requireent is based upon potential economic

consequence in loss of aircraft or personnel hazard exposure under certain
conditions. All aircraft engine power may be lost from a number of circum-
stances involving flight envelope expansion of prototype or developmental
aircraft, common failure modes or design deficienciet of engines, engine
control systems, and inlet cucting, loss of fuel or fuel pumping capability,

a8

_--Mn"atSsaid bhjifSS~bIE
 - I
and lack of engine windailling power capability. where critical for flight
control purposs. It is not the intent of this requirement to arbitrarily
require the addition of emergency power source(s) for use in flight to
provide OperAtional State IV capability. It is intended that this minimum
control capability requirement be carefully addressed and compliance
assured in both aircraft developmental and operational phases. The parti-
cular mission or class of aircraft may dictate i better operational state
for the flight controls under all-engine-out tllght.

This survivability requirement may be satisfied with a standby emergency

FCS which provides the control capability to return to base and successfully
land the aircraft.

Reference 67 describes a study whose objectives were to determine mini-

msu requirements for backup FCS and to develop a deodgn procedure for
synthesizingl minimum backup systems.

This rtudy found that pilot-based requirements are not all precisely
defined and must be postulated. Hypotherized pilot r#'quirements, cillet5
analytical measures of "flyobility" and "landability", developed through this
study are included therein.

Reference 68 predicts that a requirement for a iutandby flight control

capability will also exist in future equipped with active redundant fly-bv-wire
control vsytew.s. Quadruple (tw-fail-operate) identical 4:hannelm with com-
PisratiV* failure monitoring oetween channels at varicus critical points
throughout the control path have been proposed to petuit ,-ompletion of the
wissioo after any single failure and successful recovery of the aircraft fol-
lowinp a *econd similar random failure.

However, no "ttev how complete the design analysir, thkr circuit protec-
tion incorpor^ted, or Owa phystical prote~ctias of channel.l, catastrophii., high-
intensity short cA'rcuits produced by battle damage or fai~led electrical
componentA can propagate the failure throughout all identical ,Thanunels At
c-ommon points exist. When identical. redundant channels are employ'ed. Identi-
cal failure modes also may exist. If severe physical or environmental condi-
tions (i.e., temperature, vibration, radiation, cI~ock) are encount;ered which
exceed original design criteria, failure of all redundant channel. can result
within a relctively short time ptriod. Redundancy is designed to protect
Against random component failures but little advantage is gained when all
channels are simultaneously overstrewsed.

A questionable major assumotion in reliability computational theory is

that one failure does not propalaL- additional failures. While great strides
have been made in development of fail-passive electronic designs, completely
fail-passive systems do not exist. Murphy's Law is rarely violatee! In
particular, combat damage greatly increases the probability of multiple
failures and high intensity shorts. Also, no fail--passive motion serors
now eaxit. It is impossible to predict and protect against all cond8tions
and failures to which the aircraft will be subjected. Historical cases for
this situatio.i are plentiful and the following are listed as .ypical ex-,mples:

89
 F-4 and F-lOS Aircraft--Numerouas aircraft have been lost to ground-
fire due to simultaneous rupture of redundant, hydraulic lines at critical
points throughout the fuielag, and wing where they or* routed in close
proximity to one anether. Design philosophy oritinall" applied to these
vehicles considered that these aircraft w-uld not be mployed in a combat
environment wherQ Sroundfire could be effective.

X-15, Nr. 1--All electrical and hydraulic power were lost on one
flight at the apogee of its trajectory when an experimental electronics unit
shorted under cold temperature conditions. One hydraulic APV was finally
restarted and the aircraf, was recovered with no electrical power available.
Circuit protection was installed which should have prevented loss of both
redundant electrical systems.

F-IlIA, Mr. 15--Engine stall resulted in subsequent loss of

primary system hydraulics and was very quickly followed by loss of the
utility hydraulics which form the reserve system. Difficulty in maintaining
control resulted in ejection of both pilots and loss of the aircraft.

X-22--One airctaft was severely damaged when both dual hydraulic

tubing runs ruptured almost simultantously due to fatigue developed from an
unexpected resonant vibration condition.

F-14--The first 7-14 was lost due to the same cause.

1-52--A B-52 was lost at WPAFR in 1974 due to similar fatigue

related dual hydraulic tubing failures. A first failure occurred and crew
warning was displayed, indicating loss of fluid in one hydraulic iystem.
The mission was continued and two hours later a similar failure occurred
in the second hydraulic system, risulting in complete loss of elevator
control. A night landing attempt in poo-r visib'ity conditions using
stabilizer trim was unsuci.essful.

Ideally from th' survivability standpoint, the standby flight control

system would be mechanized with (1) no parts identical to the normal Manual
FCS components. (2) complete independence from the normal FCS, (d) an inde-
pendent power medium, and (4) physical dispersion and isolation from all
normal manual FCS components and transmission elements to minimize the
possibility of unpredicted failures or hits from knocking out all means of
control. Also, a high degree of versatility for pilot selection of alter-
nate control surfa,:es (i.e., split surfaces, flaps, spoilers, etc.) is
desirable to permit. relatively stabilized flight with severe danuAge to the
control surtaces. The ke- to the success of developing a highly simplified
standby FCS is the fact that performance requirements are considerably less
in the emergency mode than are the performance requirements for normal
mission operation.

It must aleo bt noted that principles of system design for survivability

add low vulnerability are often in direct contradiction to principles of
good maintenance. F~r example, good maintenance design would locate redun-
dant elements close :ogether for ease of service checkout, and replacement.

90
Use of nonidentical components between the FCS and the star.dby FCS to avoti
identical failure modes, increases logistics, training and repair problems.

Recommended design requirements for standby emergency flight control

systems escablished by Reference 68 include:

The standby FCS should be the minimum, simplest form of system

which will permit recovery of the aircraft, return to base. and landing
following loss of the normal FCS due to battle damage or component failures.
Adequate control surface effectiveness to maintain trimmed flight and to
permit low level maneuvering in the landing zone 13 assumed. No attempt
to complete the mission on standby FCS should be expected. A minimum of
two (2) hour flight on standby FCS should be possible.

Complcte independence should be maintained between the normal

manual FCS and the standby FCS channels. This should include control stick,
controller, sensors, actuators, and power supplies (electrical, hydraulic,
or pneumaLic). A control power medium different from that used in the
normal system should be considered.

Standby control system design should be as simple as possible to

provide handling qualities of Level 3 or better. Closed-loop control
should on!,, be employed if this requirement cannot be satisfied with direct
control techniques. Safety aspects which will permit return of the aircraft
and crew should predominate over more complex designs having higher per-
formance.

Engagement of the standby FCG should be automatic upon loss of one

or more FCS hydraulic pressures. In addition, the pilot should be provided
with a switch to engage or override the automatic device if complete normal
FCS failure should result due to any other cause or if false switching should
occur when hydraullc pressure has rot been lost.

Provisions should be included to permit instantaneous, positive

control tranbfer from the normal FCS to the standby FCS or vice versa.
Transfer should be accomplished without inducing aircraft transients exceed-
ing structural limits or +2.0 g's wblichever is lower due to displacement
of the control surfaces from the trim position. To achieve minimum duty
cycle, protect against random failures, and provide small sized equipment,
the standby FCS should be designed to oe flown in the nonenecgized state.
When not in use, the standby FCS shoul.d not interfere or degrade perform-
ance of the normal FCS. Physical interlace within the cockpit must be
minimized. Ejection envelopes must be maintained.

Standby flight control systems should be low-cost, light weight,

highly reliable, and casily installed in existing combat aircraft. Elec-
trical, hydraulic, and pneumatic additions and modifications should be held
tj a minimum. DC electrical power should be the primary electrical source.
Hield modification of existing aircraft is extremely desirable.

All emergency standby pumps and power supplies should be physically

located as close to the actuators as possible to reduce the vulnerability of
long transmission runs. All major components of the standby FCS should be
protected by armor or located in a naturally protected area.

91
 High temperature transmission elements (tubing, wires, fittings,
connectors, etc.) should be installed throughout the system to insure that
fires in any area will not result in loss of operation of the standby FCS.

If closed-loop emergency control is required for flight safety,

structural filters in the ctandby FCS control loops should be neglected
unless complete structural instability would result. High-gain control
loops which would excite the structural modes should be avoided.

Hardover failure of the standby FCS should be monitored (i.e., by

means of a 'g' cutoff) to return the aircraft to a safe trim attitude.
The design shall be fail-passive where possible so that failure of any part
will not result in erratic hilgh-frequency oscillations or hardover comnands.
Means should be provided to disengage a seized standby actuator which would
prevent normal control by the FCS. Slab-lock should be an integral function
of the standby FCS, serving as the final emergency mode of operatL._.n.

Checkout of the standby FCS should be a normal part of the ground

test prior .o each takeoff. In addition, cycling of the standby FCS in
flight prior to entering a battle zone is suggested.

3.1.9 Invulnerability. Degradation in flight control system operation due

to variations in natural environments, adverse events of nature, induced
environments, onboard failure of other systems, maintenance error, flight
crew error or enemy actions shall be within the following limits.

3.1.9.1 Invulnerability to natural environments. Flight control systems shall

he designed to withstand the full range of natural environmental extremes
established for the particular vehicle or system witaou-c permanent degradation
of performance below FCS Operational State I, or temp-orary degradation below
FCS Operational State II. Reductions below State I rhall be experienced only
at adverse environmental extremes not normally encountered and shall be
transient in nature only; and, the function shall be -ecovered a2 scon as the
aircraft has passed through the adverse environment. System components and
clearances with structure and other components shall be adequate to preclude
binding or jamming, instability, or out of specification operatioa of any
portion of the system due to possible combinations of temperature effects,
ice formations, loads, deflections, including structural deflections, and
buildup of manufacturing tolerances.

DISCUSSION

Normally, the aircraft specification or contract will define the natural

environments or global operational areas in which the aircraft must perform.
The AFSC Design Handbook DH 1-5 DN lCl, Environmental Requirements, describes
methods for c.stablishing enviro;,mental criteria for specific systems and
vehicles. It must be kept in mind that, unless elaborate compensation
featuies are piovided in the design, some temporary performance degradation
(such as reduced response and increase in force levels at low subzero tempera-
ture conditions) will normally occur in most flight control systems when sub-
jected to adverse conditions. This degradation is usually tolerable if
temporary, completely recoverable, and FCS operation does not degrade below
State II capability. If a specific vehicle is required to operate primarily
in a certain combination of adverse environments, such that no degradation
below State I capability can be tolerated, this requirement must be specified
in the vehicle specification or contract.

92
3.1.9.2 Invulnez-bility to to lightning strikes and static atmospheric
electricity. Flibat control system shall maintain State II capability or
better when subjected to electric field and lightning discharges as speci-
fied in MIL-B-5087 and in AFSC Design Handbook DH 1-5, except that a
temporary, recoverable, more extensive loss of performance to State III
is allowable in the event of a direct lightning strike.

DISCUSSION

This reqAirement takes on added significance as more reliante is placed

on electrical means of control in the flight control systems (such as
essential use of fly-by-wire, stability augmentation, load alleviation,
and/or ride smoothing features), and the possibility of lightning strikes
cannot be ignored. Recent history of commercial jet airplane operations
indicates that regularly scheduled aircraft experience an average of at
least one lightning strike per year.

The problem of providing adequate protection may be compounded by the

use of new cowposite materials and advanced structural concepts in the
airframe structure and aerodynamic surfaces which are being developed to
save weight and improve life. The use of titanium, stainless steel, bonded
structure, and boron/graphite structure introduces new problems in the
electrodynamic design areas. Changes in structure electrical conductivity
can have adverse electrical effects including loss of effectiveness of the
structure as a shield against magnetic and electrostatic fields. The
structure may no longer be available to provide suitable antenna ground
planes, lightning protection, electrical power ground return, and shielding
from induced voltages into critical avionics and flight control systems and
interior aircraft components. Electrical compatibility may require addi-
tional ground return wire, shielding, conductive coatings, and special
Joining techniques novel to composite and advanced structure. New materials
and structural concepts should be thoroughly evaluated to determine the most
effective method of providing electrical compatibility with a minimum weight
penalty.

Detecting and avoiding lightning is a simple concept. However, a con-

siderable future development may be required be3ore it can be considered
practical for use in a tactical aircraft due to the space and weight require-
ment of the airborne lightning detection equipment, the nuisance of false
alarms, and the compromise ef a plamned mission imposed by avoiding lightning.

Neutralizing the aircraft is another appealing concept. Statistics on

lightning strikes on various aircraft types indicate substantial differences
between the number of lightning strikes reported per flight hour for various
aircraft types. These statistics indicate chat some aircraft configurations
are inherentlv less vulnerable to lightning strikes or that the aircraft con-
figuration Is less prone to initiate lightning strikes. Results of future
studies of this phenomenon may identify aircraft design features which reduce
vulnerability to lightning.

A technique considered most likely to yield satisfactory results is to

harden the aircraft to adequately resist lightning strikes which may attach
to the aircraft in flight. Potential ways to approach aircraft hardening
include:

93
 Protection should be provided from lightning-induced transients
on electronic flight control interconnect wiring. Large currents result-
ing from a lightning strike flowing through the aircraft skin can induce
significant voltages on adjacent interconnect wiring. To minimize these
transient effects, balanced circuits using twisted shielded wires should
be used where possible and the wiring should be physically separated from
likely lightning current paths. Redundant channels should be physically
separated from each other.

Certain air data and aircraft parameters are required as inputs for
electrical flight control systems. This information is obtained from probes
mounted external on the aircraft. These probes can be damaged by lightning
strikes. To prevent damage, lightning diverters can be usec to protect the
orifices and lightning arrestors can be used to protect the electrical cir-
cuits.

Integrity of the electrical power system is required for electrical

flight control system operation. Points of entry into the electrical system
such as external light wiring and pitot tube heater wiring should be assessed
for vulnerability. The wiring can be protected by lightning arrestors located
near the point of lightning current entry if required. Power generation and
distribution should also be examined for potential susceptibility to tran-
sients. if such susceptibility exists, then arrestors should be installed.

To provide confidence that a particular lightning protection system

will be adequate, lightning simulation testing should be performed on new
aircraft configurations. Scale model tests should be performed to define
potentially vulneratle locations on the aircraft where lightning will attach.
Components located in these vulnerable areas (e.g., wing tip lights) should
be tested for high current and voltage. Consult MIL-E-6051 concerning light-
ning tests and static electricity. Reference 85, "Final Draft, Aerospace
Recommended Practice, Lightning Effects Tests on Aerospace Vehicles and
Hardware" prepared by SAE Committee AE4, Special Task F, 1 May 1974, provides
a definitive comprehensive guide to lightning simulation and verification
testing of aerospace vehicles. This document has wide general acceptance and
is expected to be formalized in 1975.

3.1.9.3 Invulnerability to induced environments. Flight Control systems shall

withstand the full range of worst case induced temperatures and temperature
shock, acceleration, vibration, noise and shock, induced pressures, explosive
and corrosive atmospheres, electromagnetic interference (EMI), and nuclear
radiation inclucding electromagnetic pulse, projected in missions for the
particular aircraft, without permanent degradation or loss of capability to
maintain FCS Operational Stato II capability. These induced environments
within structural and crew survival limits shall not result in temporary
degradation during the exposure to the environment below FCS Operational
State IV capability. Tho FCS shall meet the requirements of MIL-A-8392,
MIL-A-8893, and the applicable requirements of MIL-E-6051 and MIL-STD-461.

DISCUSSION

Unlike natural environments, induced environments usually cannot be

specified in the contract or statement of work, but will be dependent upon
the design of the particular vehicle, its engines, and its subsystems. AFSC

94
Design Handbook DH 1-5, Design Notes IBI, Natural and Induced Environments,
and ICI Environmental Requirements, give considerable background informa-
tion. Tn addition to that, there are environments induced by the flight
control power systems, operating normally and under partial failure condi-
tions, which must also be considered.

Induced vibrations emanate from aerodynamic and engine acoustic energy

impinging on aircraft structure, and from mechanice! vibrations of the
engine and other equipment. Severe levels can induce malftnnctions and
fatigue failures in flight control components. All control system elements
must be designed to operate satisfactcrily without loosening, malfunction,
or failure in the vibration environment induced during all required opera-
ting conditions for the aircraft.

Some adverse environments induced by the hydraulic power system are:

temperature rise due to inefficiencies in the pumps and other parts of the
system, pressure impulses produced by the pump (pump ripple) and through
vaterhammer effect due to rapid opening and closing of control valve.s, and
temperature shock. The latter can cause sticking servovalves which could
lead to erratic, or even complete loss of surface control. The most likely
cause is the creation of differential fluid temperatures between the two
systems in a dual-tandem servoactuator as a result of either a malfunc-
tioning pump in one system or an open relief valve bypassing fluid below
the pump cutoff pressure. Thermal shock tests must be set up very carefully
to determine if a system is immune to these conditions.

3.1.9.4 Invulnerability to onboard failures of other systems and equipment.

The FCS shall meet its failure state/reliability budget, as allocated within
the weapon system, for self-generated failure (within the FCS) and for those
FCS failures induced by failures of other interfacing systems within the
weapons systems (3.1.6, 3.1.7). In addition, the FCS design shall comply
with the following:

a. Essential and flight phase essential flight control systems shall

retain FCS capability at Operational State III (minimum safe) or better
after sustaining the following failures:

(1) Failure of the crii:ical engine in a two-engine aircraft.

(2) Failure of the two most critical engines in aircraft having

three or more propulsive engines.

(3) Failure of any single equipment item or structural member which,

in itself, does not cause degradation below State III. This includes any
plausible single failure of any onboard electrical or electronic equipment
in any subsystem of the aircraft.

b. Flight control systems, including the associated structure and

power supplies on Class III aircraft, shall be designed so that the -roba-
bility of losing the capability of maintaining FCS operation to no less than
State IV as a result of art engine or other rotor burst is extremely remote
(6.6).

95
 c. Flight control systems, including the associated structure and
power supplies on MIL-F-8785 Class I, II and IV aircraft, shall be designed
so that the probability of degrading FCS operation below State V as a result
of an engine or other rotor burst is extremely remote (6.6).

DISCUSSION

The requirement is included to ensure that hazards due to failure of

other systems and equipment are recognized and that adequate measures are
taken in the design to ensure that the flight control system is protected
from such failures. Most aircraft can survive engine failures, including
rotor burst, landing gear tire burst, and failure of other systems such as
radio-radar transmitter-transmission line failures. However, with the
increased use of full-powered flight control systems, additional care must
be taken tc ensure that the airplane won't be lost due to failures it could
otherwise survive.

Protection from the failure of high-energy system components such as

pneumatic cylinders, hydraulic accumulators, and high-force spring cartridges,
must be given special attention.

There have been recent instances of crashes caused by flight control

system malfunctions resulting from hazards originating outside the FCS. A
Caravelle crash resulting from a wheel well fire, causing a total hydraulic
failure, and DC-10 crashes, caused by cabin floor collapse following an
explosive decompression, are examples.

In addition, electrical flight controls are more ;vulnerable than con-

ventional flight controls to certain hazards; special emphacis should be
placed on the design and tests of EFCS equipment. Examples are:

Modest temperature increases which would not affect a conventional

flight control system can cause electronic components to overheat and malfunc-
tion. Accordingly, cooling air supply failures must not affect more than one
channel of an AFCS computation or sensor capability.

Local fires must not be allowed to propagate through areas of more

than one channel of AFCS computation or sensor capability. Both separation
and measures to prevent flame propagation are needed.

3.1.9.5 Invulnerability to maintenance error. Flight control systems shall

be designed so that it is physically impossible to install or connect any
component item improperly without one or more overt modifications of the
equipment or the aircraft. Provisions for adjusting the flight control system
on the aircraft, except during initial buildup, major overhaul, or rigging
during ma-or maintenance activities, shall be minimized. All line replace-
able units (LR'T's) shall be designed to permit making internal adjustments
only on the bench. The system shall require only a minimum of terigging
following repla-ement of LRU's. In addition, all control linkages and other
flight control mechanisms shall be designed to resist jamming from inadver-
tent entry of maintenance tools or other material.

96
DISCUSS ION

This requirement is especially important with the increasing complexity

of flight control systems and components which tend to increase the potential
for serious maladjustment through maintenance error. In general, the first
cost due to increased engineering effort and tooling will be somewhat %igher
than normal to meet this requirement, but th-' overall costs of maintenance
and the probability of failure or loss of performance will be much lower.
The concept has been used on some systems on commercial jet airplanes whose
overall record of dispatch reliability in Aay-to-day operations is a very
worthwhile goal.

In the study completed in 1972 to document aircraft flight control sys-.

tems field safety experience with the F-1.A, F-4D, C-141, and B-52G/H air-
planes, Reference 46, it was found that (of the causes 'or FCS failure)
faulty maintenance actions, while not aa numerous as material failures, were
equally catastrophic in some instances. In general, maintenance actions that
recult in accidents or hazards are not as easily corrected through design
action. The man who neglects to install a cotter pin or safety wire would
probably also neglect to assure the self-retaining bolt was in fact self-
retaining or that a self-locking nut was not reused.

However, additional design assurances such as adequate access, caution

notes, identificaticn markings, and unsymmetrical installations would help to
"deMurphyize" installations and assist maintenance personnel to do the job
right the first time. Specific conclusious/recommendations related to maii,-
tenance i'ere:
Require irreversiblE parts for critical applicatior.s where reverse
assembly or installation results in change in function or in possible
interference.

Require that adjacent electrical/hydraulic connections have physical

differences so that interchanging connections are impossible.
Require adequate protection be provided for critical components
subject to damage during routine maintenance.
Ensure that technical orders and manuals contain adequate warning
and caution notes when dimersions or procedures are critical or where
malpractice can result in damage to equipment or injury to personnel.

Note that, in addition to the foregoing, requirements for mainten-

ance provisions are specified in Paragraph 3.1.10.
3.1.9.6 Invulnerabiiity to pilot and flight crew inaction and error. Flight
control systems shall be designed to minimize the possibility of any flight
crew member controlling or adjusting system equipment to a condition state
which could degrade FCS operation.

a. Protection against improper position and sequencing of controls--

Wherever practical, cockpit controls, other than stick or wheel and rudder

97
pedals, shall be equipped with positive action gates to prevent inadvertent
positioning which can compromise safe operation of the aircraft. Positive
interlocks to prevent hazardous operation or sequencing of switches shall
be provided.

b. Protection against inflight engagement of control surface locks.

c. Pilot reaction to failure--Flight control systems shall be designed

so that the normal pilot reaction to cues provided by probable failure
conditions is instinctively correct.

d. Warning requirements--

(1) Warning information shall be provided to alert the crew to

unsafe system operating conditions. Systems, controls, and associated
monitoring and warning means shall be designed to preclude crev errors that
create additional hazards.

(2) A clearly distinguishable warning shall be provided to the

pilot under all expected flight conditions for any failure in a redundant
or monitored flight control system which could result in an unsafe condition
if the pilot were not aware of the failure.

DISCUSSION

Like prevention of maintenance error, the system designer can do much

to minimize pilot and flight crew error. The Reference 46 study sumnarized
that flight crew actions were involveO in only a small number of failure
case histories. However, the following significant recommendations were
drawn:

sequencing Require positive interlocks to prevent hazardous operation or

of switches.

Require that positive warning cues be provided when the pilot is

required to maintain his head "out-of-cockpit" during maximum maneuvering
situations. Consider use of head-uc displays.

Require that a loss-of-control prevention device be incorporated

in aircraft that are not highly resistant to departure from controlled
flight.

Ensure that the flight test program adequately identifies near-

stall/stall/post-stall characteristics.

Require positive stick centering as outlined in MIL-F-8785 after

modification as well as during initial design.

Require that all cockpit controls be equipped with positive action

gates to prevent inadvertent positioning which can compromise the safety and
operation of the aircraft. An example is an idle cutoff detent on throttles.

Require cockpit instrument illumination level compatibility he

demonstrated in a simulator or by other means.

98
 One examplc where itterlocks may be needed to prevent hazardous
operation involvea variable geometry controls. Redundant interlocks should
be used to prevent inadvertent actuation of control systems that would
produce structural damage, if actuated. For instance, flap actuation with
wings swept must be prevented.

The intent of this warning requirement is to provide crew warning

where a hazard cannot be otherwise avoided. Warning lights should not be
used as a substitute for adequate FCS design.

3.1.9.7 Invulnerability to enemy action. Essential and flight phase essen-

tial flight control systems, including associated structure and power sup-
plies, on all aircraft designed for combat operations shall withstand at
least one direct encounter from the threat defined by the procuring activity
without degradation below Operational State III.

DISCUSSION

F-105 losses in North Vietnam and Laos have been documented and type of
threat responsible for losses and the type of system damage responsible for
these losses has been recorded. Due to unacceptably high losses due to
flight control system damage, this requirement has been adopted for future
procurement.

This requirement establishes the minimum protection required for all

aircraft designed for combat operations. Adequate redundancy, alternate
controls, separation, shrouding, and/or armour protection should be used to
prevent degradation below the specified performance level. See Reference 69
for discu~ssion of gunfire tests on airplane flight control servoactuators.
Reference 70 provides design guidance for protecting hydraulic systems from
ground fire, and also lists other pertinent documentation. &FSC Dcsign
Handbook, DH2-7, also provides guidance informatiou,

3.1.10 Maintenance provisions. FCS design and installation shall permit

normally available maintenance personnel to sarely and easily perform
required maintenance under all anticipated environmental conditions. Means
shall be provided to facilitate the accomplishment of all required mainten-
ance functions including: operational checkouts, system malfunction detec-
tion, fault isolation to the Ltt (line replaceable unit) level, LRU removal
and replacement, inspection, overhaul, servicing, and testing.

3.1.10.1 Operational checkout provisions. Flight control systems shall be

designed with provisions for operation on the ground, without operating the
main engines, to verify system operation and freedom from failure to the
maximum extent practical. They shall be designed to operate with the power
generation subsystems supplied by standard Air Force ground carts, as speci-
fied by the procuring activity or by self-contained power supplies.

3.1.10.2 Malfunction detection and fault isolation provisions. Means pro-

viding a high probability for detecting failures and monitoring critical
performance conditions as required to isolate faults to the LRU level shall
be incorporated in all flight control electrical and electronic systems

99

..........................
required to perform essential and flight phase essential functions. These
means mity include cockpit instrumentation and built-in test equipment. For
the mechanical and fluid power portions of the flight control system, pro-
visions for the use of portable test equipment may also be incorporated as
rwquired to meet the maintenance support and operational concept of the
particular weapon system.

3.1.10.2.1 Use of cockpit instrumentation. Where acceptable procedures

result or are provided, cockpit instrumentation may be used for malfunction
detection and fault isolation where it provides readily understandable
condition indication either alone or in coordination with built-in test
equipment, or with portable test equipment (for nonplectrical and nonelec-
tronic components).

3.1.10.2.2 Provisions for checkout with portable test equipaent. Where the
use of built-in test equipmert would cause excessive penalties and where the
use of portable test equipment is compatible with the maintenance support
concept, provisions shall be made to permit the use of generally available
and commonly used portable test equipment. Components which require pecu-
liar, special, or new items of test equipment shall be avoided.

3.1.10.3 Accessibility and serviceability. Cor.ponents shall be designed,

installed, located, and provided with access so that inspection, rigging,
removal, repair, replacement, and lubrication can be readily accomplished.
Suitable provisions for rigging pins, or the equivalent, shall be made to
facilitate correct rigging of the control system.

3.1.10.4 Maintenance personnel safety provisions. Systems and components

shall be designed to preclude injury of personnel during the course of all
maintenance operations including testing. Where positive protection cannot
be provided, precautionary warnings cr information shall be affixed in the
aircraft and to the equipment to indicate the hazard, and appropriate warnings
shall be included in the application maintenance instructions. Safety pins,
jacks, locks, or other devices intended to prevent actuation shall be readily
accessible and shall be highly visible from the ground or include streamers
which are. All such streamers shall be of a type which cannot be blown out
of sight such as up into a cavity in the aircraft.

DISCUSSION

Successful operation of an aircraft and its flight control system is

highly dependent upon the ability of the service personnel to effectively
maintain it in the fully operational condition. The foregoing requirements
emphasized that the features which allow effective maintenance must be
designed into the system to provide service personnel the means for safe,
speedy detection, location, and correction of faults, and the accessibility
necessary for preventive and corrective maintenance and for part remcval
and replacement.

Functional Checkout Provisions

The need to provide direct, easily accomplished capability for checking

the system's operational status on the ground without operating the main

100
engines is self-evident. Hovarer, full performance need not be demonstrated
if system condition and freedom of failure adequate for safe completion of
all operational modes can be satisfactorily demonstrated. Therefore, it Vill
usually not be necessary to supply hydraulic flow from the ground cart, APU,
GPU, etc., at the full system design flow rate. Also, it is recognized that
it is impractical to verify the condition of engine driven pumps, generators,
and associated components and circuitry without running engines.

Malfunction Detection and Fault Isolation Provisions

"The specified requirements emphasize that the means to detect failures

and isolate faults to the LRU level in essential flight control electrical
and electronic systems must be incorporated into the basic anboard equipment.
However, these functions are not necessarily required in flight. It is also
recognized thrt such a requirement often cannot be met with practicality in
the mechanical and fluid power portions of the system, and that provisions
for checkout with portable test equipment shnuld oe made with recognition of
the problem in keeping the test equipmen' current with airplane changes.

Careful attention tc detail circuitry is required early in the design

phase in order to satisfactorily incirporate the necessary built-in test
equipment.

Accessibilit' and Serviceability

In addition to the specifitd requirements, the destgn of mechanical

controls should be such that removai and rep'acement of components, including
the control surfaces, can be accomplished w~thuut disturbing the rigging
insofar as possible. Special Lo~ls require-! for InstallatLon and rir,gi.g
of the control systems should be kept to a minimum and be ia accordance with
thL applicable specificatione. Care should also be taken to avoid installa-
tion of items which may rnquire replacement in areas where removal and
reinstallation is ex:remely JulIficult, such as torque tubes buried in wings.

Maintenance Personnel Safe.-j

It is incumbent upon the design or• -ization to ensure that all com-
ponents and systems are designed and installed to allow maintenance without
significant hazard to the se-vice personnel. It must be recognized that
some hazards cannot be avoided or eliminated altogether, and that precau-
tionary warnings must be attached to or adjacent to the actual comp'onents
and be included in the maintenance procedures and iistructions.

In the flight control system, two of the most hazardous areas of concern
to the maintenance pursonnel are:

The inadvertent release of stored mechanical, hydraulic, pneumatic,

or electrical energy; i.e., from springs, air-oil accumulators, air bottles,
charged capacitors, etc., which can be hazardous even with system power
sources turned off.

Inadvertent motion or excessive rate of motion of control surfaces

or control and power actuators both within the flight control syatem and in
other systems using the same power sources, such as for the actuation of
wheel-well or weapon-bay doors.

101
 iM dIevices which contain any typo of store.d energy (such as mechanical,
electricail, hydraulic, or pneumatic), o" which can produce energv capable of
causing injury to matntenAuci personnel, should be Provided with positive
means of disconnecting the source of energy, or allowing controlled release
of the energy, or preventing inadvertent energy releac.

In addition to using safety.. pins, locks, or other devices to prevent

inadvertent ak•uatlon of other systems, all flight control system checkout
and test provi dions should be designed with personnel safety in mind. During
actual perfor'ance of such functions, close coordination between personnel
operating coc';plt rc,ntrols and others observing system operation must be
maintained. other maintenance functions which could possibly he in conflict
should he prohibited at the same time, and all personnel should be kept clear
of control surfaces to prevent being knocked oft balance or otherwise injured.

3.1.11 Structural integrity.

3.1.11.1 Strength. The overall tlight control systems shall b designed to

meet the applicable load, srreng.:h, and deforniation requirement.. of MIL-A-
8860, MIL-A-8861, MIL-A-8865, MIL-S-8698, and MIL-STD-1530. 1he components
of the systems shall be designed in accordance with the strength requirements
of MlL-A-88CO,O IL-C-b021, MIL-F-7190, MIL-A-21180, MIL-A-22771, MIL-F-83142,
MIL-II)BK-5, and MIL-HDBK-17.

3.1.11.1.1 1?4mage tolerance. Those structural elements of the flight con-

trol system that are essential to safety of flight (to control essential and
flight phase essential functions) shall meet the damage tolerance require-
ments of MIL-A-83444.

3.1.11.1.2 Load capability of dual-load-path elements. The load path remain-

ing after a single failure in dual-load-path elements shall meet the following
r-cq u ireihiL8tuts-

a. Where the failure Is not "vident by visual Inspection or by

obvious changes in control characteristics, the remaining path shall be
capable of sustaining a fatigue spect rum loading based on one overhaul
period. The time interval correspondiný, to an overhaul period shall be
established by the contractor. The remaining path shall also withstand, as
ultimate load, loading equal to 1.5 timcq the limit loads specified in MIL-A-
8865, or 1.5 times the limit lo.ids specified in MIL-A-8865, or 1,5 times
the load from an alternate source such as a powered actuation system or
loaids resulting from aerodynamic or other forces, if such load is greater.

b. Where the single failure, is obvious, the remaining load path

shall be capable of withstanding, as ultimate load, loading equal to 1.15
times limit loads specified in MIL-A-8865, or 1.15 times the load from an
alternate source, such as a powered actuation system or loads resulting
from aerodynamic or other forces, if such load is greater.

DISCUSSION

These are basic requirements for aircraft design. Additional information

and guidance can be found in AFSC Design Handbook DH2-1, Design Note DN 2A1:
Strength and Rigidity. In addition, it is incumbent upon the design

102
organi~.tion to exercise great care in application, design, and in due
regard for plausible misfeasance in use to assurv that no parts o' tht,
system or components moy be subjected tu, opetation, eitkir intvromittent l
er continuous l y, at loads greatter thgn for which the palt h1a lo, vit dik t ivn,.4

The essence of these requi rementt is that the design o! kttuit,t u I vI ut t stS
of flight control systems shall he such that. in the event o: fidlut, u ,.,
single principal element, the retaining structure shall bet, apable tt sk;s-
tatniAg operational loading without endangering flight vtfttv. fail-: itt
deoign can be achieved in a number of ways, incu 4 ing the. f,,llowin!, t,
provide adequate residual strength for repei.Led loads followine init ital
failures:

By multiple load path structure.

By use of multiple strractural memb# rs to prevent rack pipaj.*,Itioin

-.
beyond given boundaries.

By apportioning structure to ensure that %ndetectable cracks do

not become unstable between insalction intervals.

The use of dual-load path configurations in the desi.'n oti st ru'tu|,tl

and mechanlial elements in ussential subsystems has been standari practtcc
for commercial jet airlines for many years. The safetv ta, Lor ott' \ spci 1-
fled in 3.l1ll.l.2a for load paths in which failures are not easilv d-ttu¢-
ted, is the same as required for single load path stiucture. The tactor ot
1.15 specified in 3.l.ll.L.2.b for load paths in which failure,- ar" t.i.slIv
detected, is to provide a reasonable margin for dynamic e lects which may bo
caused by a failure in the redundant load path. However, it li assumed that
the failed part will be replaced betore accumiulated fatigu. dan•mag becornt.•
a signif.icaot factot.

3.1.11.2 Stiffness. 'rite stiffness of flight control systemws ,-hall be suf-

ficiernt to provide satisfactory operation and to enable the aircit'.t to meot
the stability, control, and flutter requirements as defined in the appli-
cable portions of MIl.-F-8785, MIL-A-8870, M•I-F-83300 and ?lil-A-8865. Normal
6tructural defle,'tions shall not uause undesirable control system inputs or
outputs.

DISCUSSION

It is required, as specified in MIL-A-8870, that aircritt construction,

materials, and design shdll be such that there will be no flutter, buti.,z
divergence, or other dynamic aeruelastic, aerothermu'.l.|sti.c, or ct, 0 VL,
elastic instabilities of the airplane or its components at all speeds up to
1,15 VL for all design ranges of altitudes, thermal conditions, and m.mnt-urs
where losse's in rigidity (stiffness) may occur, and at all weilzhts. external
store configurations, and other loading conditions. As. urance of compliance
is required by analytical or experimental data (inkluding flight tost data
up to limit speeds), or both. that an increase of ls percent in equivalent
airspeed at all points on the- limit speed envelope of the airplane, both at
constant Mach number, and sepiaraLely, at constant altitude, will not result
in flutter, buzz, divergence, or other dynamic aeroelastic, aerothermoelastic,
or aeroservoelastic instabilities,

103
-- ----- "!
Detail design requiremen.s are specified in MIL-A-6870 and include
the following which are quoted whol, or in part with minor modifications
as deemed necessary to avoid misunderstanding:

Augmentation system. For airplanes with augentation systems,

the spifrited flutter margins and damping requirements must be met both
with the system operative and with it inoperative. If augmentation is
esentiAl to safety of flight, augmentation-off flight tests cannot be
performed in the portion of the flight envelope where its function is
essent lal.

Fail-safe stability. Aircraft must be free from flutter, diver-

gence, or other aeroelastic instabilities st all speeds up tO VL following
any of a specified list of iailures, mslfunctionq. and adverse conditions
plus any other probable single failure, malfurction, or adverse condition
(hffectinb Clutter )r divergence. The specified list includes "failure,
malfunction, or disconnection of any single element of the main flight
.-ontrol system, augmentation systems, automatic flight control systems,
tab control system, or in any flutter damper connected to a control surface
or tab." "IDetail design shall be such as to provide mk.ltiple loaJ path8
to elimina-, ritical single failures, or as a minimum, the design should
provide a safe life of critical elements. Witt, such a failure, the damping
coefficient, g, Phall be at least 1 percent (0.01) for all critical flutter
moder at all attitudes and speeds up to VL."

"Variable geometry airplanes. Airplanes having variablt or

movable geometry such as tilt wings, variable sweep, variable dihedral,
rotary airfoils, and pivocing stores " ill be designed to preclude flutter.
Free play in pivots and joints and thL aerodynamic interaction between
lifting surfacts in close pruximity 6hall be included in flutter-safety
evaluat ions."

"Control su. Ace and tabs. Fach control surface or tab shall be
either mass balanced nr ... rettrained ... to preclude flutter in all
critical modes, under all flight operations, for both normal and emergency
operating conditions of the actuating system. The adequacy of mass balance
or stiffness shall be established by flutter analyses or model testc."

In MIL-A-8870, it is stated that the surface or tab be mass balanced

or "made irreversible by sufficiently high stiffness and compliance with free-
play requirements to preclude flutter ... ". It should be noted, however,
that the stiffness requirements can be mec by using force servos or control
surf ce locks (which engage upon failure of the actuation ;jstem to function)
as well as by using so-called irreversible (position) servos.

In addition, MIL-A-8870 also states that, "In determining the

adequacy of the satitfness, the rigidity (stiffness) of all actuating elements,
the rigidity (stiffness) of the control surface or tab shall, be included. In
addition, rotational freeplay of the tabs and control surfaces shall be less
than or equal to that specified in 3.2.7.3.1 (Freeplay of Irreversible Con-
trol Surtaces) and 3.2.7.3.2 (Froeplay of Irreversible Tabs) throughout the
service life of the airplane."

104
 .ontrol surface balance is also importalt for minimizing control
forces and maintaining stability. The three important balance considera-
tions: aerodynamic, static, and dynamic balance, are discussed in soire
detail in AFSC Design Handbock DH 2-1, Design .Note 3B2; Control Surfaces.

"Hydraulic dampers, In the event that mass balance or irreversi-

bility is impracticable, hydraulic dampers may be used kor the prevention of
flutter. Flutter analyses or flutter model tests shall be performed to
assure that the obtainable damping is sufficient to prevent flutter. The
rigidities (stiffness) of the damper elements and the supporting structure
to which the elements are attached shall be sufficiently high to preclude
loss of damper effectiveness by structural deformation (deflection) at the
flutter frequencies. The freeplay of the damper shall not exceed that
specified in 3.2.7.3." (In MIL-A-8870).

"Single-deuree-of-freedom flutter of control surfaces. Flutter,

such as control surface buzz, shall be prevented by providing control sur-
face torsional ard rotational rigidity (stiffness), by use of hydraulic
dampers, by use of aerodynamic configurations which are not susceptible
to thib phunomenon, or by a combination of these means. In airplanes whose
VL equals 0.8 Mach number or greater, space, rigidity (stiffness), and
strength shall be provided for incorporating hydraulic dampers in antici-
pation of their use.

"Other controls and surfaccs. When not displaced from the

retracted position in flight, flaps extending outboard of the 50 percent
span station of the main surface shall, if practicable, be rigidly locked
in the retracted position. Airplane components which may be exposed to the
airstream and which can be important with respect to flutter (including, but
not limited to, trailing edge flaps whicn are impracticable to lock; dive
brakes; spoilers; scoops; leading edge flaps; and fixed, retractable, or
jettisonable ventral fins) shall be made free from flutter by suitable mass
balance, hydraulic dampers, structural rigidity (stiffness), or irreversible
control systems. The irreversibility criteria for control surfaces speci-
fied in 3.2.7.3 shall be applicable. In cases where mass-bal-.nced reversible
spoilers are employed, coincidence between the spoiler rotational naturnl
frequency and low natural frequencies of the main supporting structure shall
be avoided in order to prevent objectionable, lowly damped, gust-excited
oscillations."

3.1.11.3 Durability. Flight control systems shall be designed to meet the

durability requirements of MIL-A-8866 and equal to that of the airframe
primary structure considering the total number of ground and flight load
cycles expected during the specified design service life and design usage of
the aircraft from all commands; e.g., from the MFCS, AFCS, servo feedback
and from load inputs. The requirements of MIL-A-8892 regarding vibrations
and MIL-A-8893 regarding sonic fatigue also apply to the FCS.

DISCUSSION
These are basic requirements for aircraft design, and it is especially
important that all essential and flight phase essential components comply.

105
 As stated in MIL-A-8866, "The procuring activity shall specify the
design service life and design usage. Where itructural capabilities are
provided by the contractor beyond that specified by the procuring activity,
these additional capabilities she,.l be included in the design usage, and
the design cervice life shall be maintained and so stipulated in the con-
tract specification. The design usage shall be based on the mission
requirements of the weapon system and shall stipulate the average usage
per fleet airplane in terms of:
Total Flight hours.

Total number of flights.

Total number and type of landings.

Total service years.

Mission profiles for each type o' mission including training

flights to be flown. These profiles shall be divided into the mission seg-
ments according to operational segments (i.e., climbout, cruise, inflight
refueling, low-altitude penetration, air-to-air combat, air-to-ground
combat, etc.). The mission profiles shall also stipulate the approximate
duration, altitude, airspeed, and payload configuration requirements for
each mission segment.

Number of flights of each mission.

Proportion of j .- altitude usage (other than for takeoff and land-

ing operations) between .tIest obstacle clearance, terrain following and
contour flying, and their respective terrain clearance requirements.

Definition of the terrain roughness models and the number of ter-

rain following and contour flying flights for each mode] or definition of
the low altitude routes and the number of flights for each route.

Terrain following maneuver load factor authority (automatic ter-

rain following mode) requirements".

From this information, the contractor can define the number of flight
load cycles to be expected during the lifetime of the aircraft; and, with a
design fatigue-scatter factor, as defined in MIL-A-8866, the number of
fatigue flight loading cycles required for design can be determined. In
addition, the accumulation of load cycles during ground checkouts pric to
flight and during troubleshooting maintenance operations must be accounted
for. Components and other eE-.ments subjected to loads from hydraulic
actuators bottoming under full system pressure can accumulate significant
fatigue damage during such operations. Note th.t fatigue life requirements
may be more stringent than wear life requirements inasmuch as replacemenn
or rework of parts subject to wear is allowed. (See 3.1.12)

3.1.12 Wear life. Mechanical elements of the FCS shall be designed to have
wear lifa equal to the wear life specified for the overall aircraft. Parts
subject to wear, such as hydraulic seals, bearings, control cables, sensors

1C6
and hydraulic actuator barrels, n'ay be repLaced ,L thei.r wearing striace•
renewed after they exceed their useful life. However, all replacements
shall be with 4 n the FCS wear out-replacement budget established for the
overall weapon system. Electronic and other nonmechanical LRU's shall
remain economically repairable and shall meet reliability requiremuents
throughout the specified airframe lifetiae.

DISCUSSION

This requirement parallels that of 3.1.11.3 for tatigue life in that

the wear life of the flight control system and its components must also
meet the requirements specified for the primary aircraft structure. Predic-
tions of the number of operating cycles and their Load and stroke distribu-
tion should be based in large part on preflight, taxi, and flight test
experience with similar aircraft. It must be recognized that the elements
of the system which are commanded by the stick or wheel and rudder pedals
will usually receive the bulk of the long-stroke cycles, the elements com-
manded by the AFCS and stability augmentation systems will usually receive
the bulk of the short-stroke cycles, and that many elements will receive
all the commands. In order to develop adequate design- and conduct meaning-
ful. tests, life cycle predictions for each portion of the system mlust be
made and a budget established for wear life of all FCS parts.

Electronic and other nonmechanical components wear life (useful life)

should alsi be defined in cost effectiveness terms for a particular weapoln
system. For example, a criterion might be: FCS components Shall not require
parts replacement maintenance in excess percent of the original cost
basis throughout the airframe lifetime.

3.2 Subsystem anc component desin..requirements.

3.2.1 Pilot controls and displays, WhWcL'ver an FCS cLtrLol, display or

annunciator is interfaced with redundant flight control channels, mechanical.
and electrical separation and isolation shall be provided to make the proba-
bility of common mode failures at least extremely remote. FCS controls and
displays shall be designed in accordance with MlI,-STD)-1472.

3.2.1.1 Pilot controls for CTOL airc jt, . Il t' s cockpil I, Ior
t'.tr, con-
ventional takeoff and landing (CTOL) aircraft shall be designed and locatud
in accordance with AFSC Design Handbook D11 2-2, DN 2AI, Aircrew Controls;
DN 2A5, Flight Coatrols; and the following subparagraphs. Strict adherence
to the prescribed location and maximum range of motion or these controls is
required.

3.2.1.1.1 Additional requirements for control sticks. If a control stick is

used and is removable, it shall be positively retained in place when
installed. It shall be possible to install the stick only in the correct
manner, and suitable means shall be provided to prevent rotation of the stick.

3.2.1.1.2 Additional requirement for rudder pedals Rudder pedals shall be

interconnected to insure posiLive movement of each edal in both direr :-oils.

107
3.2.1.1.3 Alternate or unconventional controls. If pilot's controls other
than the conventional center located sticks, W-type wheels, rudder pedals,
trim controls and indicators, wing incidence control, wing sweep control,
landing flap control and indicator, speedbrake control, and automatic
flight control panels specified in AFSC Design Handbook DH 2-2, DN 2A5,
are utilized, demonstration of their adequacy and suitability is required
prior to installation in an aircraft.

3.2.1.1.4 Variable geometry cockpit controls. Wing incidence controls and

wing sweep controls shall be designed and located in accordance with AFSC
Design Hardbook DH 2-2, DN 2A5; Flight Controls. Other controls shall be
such that actuation in a forward, upward, or clockwise direction results in
increased magnitude of the controlled variable except where such motion is
in unavoidable conflict with an obvious and direct relationship between the
control motion and resulting change of the controlled variable.

3.2.1.1.5 Trim switches. Electrical trim system switches of the five-

position, center-off, toggle type shall be in accordance with MIL-S-9419.
Control stick grips in accordance with MIL-G-25561 shall already have the
trim switches, conforming to MIL-2-9419, installed. Three-position trim
switches shall be approved switches similar or equivalent to the MIL-S-9419
switches.

3.2.1.1.6 Two-Speed trim actuator. Two-speed trim actuator systems shall

be designed to preclude runaway or inadvertent operation in the high-speed
trim mode.

3.2.1.1.7 FCS control panel. The FCS control panel shall provide the pilots
with the integrated means to select the MFCS and AFCS functions.

3.2.1.1.8 Normal disengagement means. Means for disengagement of all modes

of the AFCS shall be provided which are compatible with the requirements of
3.1.9.6.

3.2.1.1.9 Preflight test controls. Additional controls shall be provided

in the cockpit for initiating and controlling the progress of preflight
tests, where necessary.

DISCUSSION

A high degree of commonality between cockpits of aircraft of the same

type is required in order to minimize the possibility of human error as
pilots transition from one aircraft model to another. The specified sections
of AFSC Design Handbook DH 2-2 include design and location requirements for
cockpit controls for conventional aircraft primarily by reference to MIL-
STD-203 plus several updating revisions. A number of new control concepts
such as hand and wrist operated side-arm controllers, and the RAMS-Horn and
Brolley-Handle controls to replace the conventional W-type wheel on large
aircraft, will provide increased visibility of the flight deck control panels
for use of moving map displays and other advanced pilot aids. Demonstration
of their adequccy may be accomplished by installation on a flight control
simulator and/or in the second cockpit of a trainer or research aircraft as
agreed by the procuring activity.

108
 In demonstrating adequacy, the procedures described and data in
Reference 71 may be helpful. Reference 71 documents an iE light investiga-
tion of the characteristics of three unconventional cockpit controllers in
a variable stability airplane. Controllers evaluated included a circumfer-
ential wheel segment and column, a circumferential wheel segment with a
band-size controller mounted on the right hand top of the segment, and a
dual side arm hand-size controller. The controllers were evaluated by the
pilots while performing various up-and-away and approach flight maneuvers.
A B-26 variable stabilit-y airplane was mechanized to simulate the character-
istics of a B-1 type airplane in three task flight phases. The primary
objective of the 6tudy was to determine the relative merits of the controller
concepts in dn overall airplane mission oriented environment. The study
concluded that the dual side-arm controller configuration is the most prom-
ising for future application.

Reference 72 recommends that the AFCS control panel be located on the

left hand console just aft of the throttle quadrant for aircraft with con-
trol sticks such as the F-12 series aircraft. This reference includes a
description of the manual and automatic FCS of the F-12 series aircraft andi
the design philosophy utilized in the design of the control system is
reviewed.

Reference 73 contains a good survey of the various approaches to the

design of primary hand controllers.

One FCS control panel implementation apprcoach which provides means to

manage the AFCS functions includes:

The AFCS engage/disengage switch should provide the means f'or

engaging and disengaging the automatic control function. The switch should
be mechanically or electrically interlocked in t~he OFF condition until all
engage interlock requirements are satisfied. Flight director command signals
';ho'ild operate independently of the engage/disengage switch.

The mode select switches should function P i~ote switching

devices to control the operational modes of the AF%^b. £he mode select
switches should allow simultaneous engagement of compatible modes and should

Parameter select controls should provide the fol~owing capability

for pilot~-assist modes having preselect capability.

(a) Ability to preset the selected ref .,rence parameter value prior
to mode engagement.

(b) Ability to have the selected parameter synchronized with the

existing conditions prior to mode engagement so that the existing condition
is held upon mode engagement.

(c) Ability to update the selected reference parameter during

operation of the mode.

109
 Parameter select contcols should provide capability for setting
parameter values as required by the AFCS guldance modes. The parameter
setting device shoul. be simple to use and the value selected shall be
continuously displayed.

3.2.1.2 Pilot controls for rotary-wing aircraft. The pilot's cockpit con-
trols shall be designed and located in accordance with the appl 4 cable
portions of AFSC Design Handbook Di1 2-2, DN 2A1, SN 1(2), MS 33572, MIL-
STD-250, and the following subparagraphs. Strict adherence to the prescribed
location and range of motions of these controls is required. If a cont 'ol
stick is removable, it shall be positively latched in place when installed.
It shall be possible to install the stick only in the correct manner, and
suitable means shall be provided to prevent rotation of the stick. Direc-
tional pedals shall be interconnected to insure positive movement of each
pedal in both directions.

3.2.1.2.1 Interconnection of collective _itch control and throttle(s) for

helicopters powered by reciprocating engine(s). The collective pitch control
shall be interconnected with the throttle control(s) and synchronized to
provide the proper throttle setting(s) as collective pitch is increased or
decreased. Means shall also be provided to permit throttle control, inde-
pendent of collective pitch lever movement, by rotation of the grip on the
lever.

3.2.1.2.2 Interconnection of collective pitch control and engine power con-

trols for helicopters powered by turbine engine(s). An engine power level
control lever shall be provided for each engine. The power level control
lever shall have three discrete positions: off, idle, and fly, which shall
establish three operating ranges of engine power. A fourth optional dis-
crete position may be Incorporated to provide a contingency emergency
power level. The collective pitch controller may be interconnected with
the engine power control such that (for a given power level control position)
it establishes the approximate power being delivered to the rotor, and also
signals power level changes in maneuvering flight to minimize transient
rotor speed droop and overspeed. Rotor speed select control shall be pro-
vided on the collective pitch controllers. Individual engine power trim
or power turbine speed trim controls may be located on the collective
pitch controllers or on the engine power level control panel.

3.2.1.2.3 Alternate or unconventional controls. If pilot's controls other

than the conventional center located cyclic pitch sticks, left-hand side
located collective pitch sticks, directional pedals, control system power
boost controls, automatic flight control system controls, and trim controls
specified in MIL-STD-250 are utilized, demonstration to the satisfaction of
the procuring activity of their accuracy and suitability is required.

DISCUSSION

" helicopter pilot normally flies with hands on the controls due to the
dyimamics of the aircraft and the requirements of various helicopter missions.
Temporary locking of the thrust lever or collective pitch controller will
free his left hand to operate switches on the console, etc.

110
 It has evolved that the rotary-wing aircraft pilot sits in the right-
hand seat, which is probably the major departure from fixed-wing aircraft
design practice. The second significant difference is in the force level
of the controls. Helicopter control forces are significantly lighter than
for fixed-wing aircraft because of the delicate requirements of hover mode
operation. Frequently, however, helicopters are fitted with maneuvering
force-feel systems which become effective in forward flight.

The helicopter industry has remained with the center stick and pedals
because of the obvious awkward nature of handling a control wheel in hover.
The pedals on older helicopters traveled in circular arcs. The recent trend
is to make their travel more straight, which, however, complicates the
linkage somewhat.

The thrust lever has frequentiy been a cause of pilot-induced vertical

oscillations because its up and down n.. •ion is in the same sense as that of
the aircraft and therefore requires careful attention to damping and force
level. Recent development programs with electrical flight controls and
advanced flight control concepts have provided limited evaluations of side
arm controllers. It is apparent that a considerable amount of effort is
required to make these acceptable for production rotary wing aircraft.

3.2.1.3 Pilot controls for STOL aircraft. Pilot's cockpit controls for
short takeoff and landing (STOL) aircraft shall be designed and located in
accordarnce with the requirements specified in 3.2.1.1, and subsections, for
CTOL aircraft, and MIL-F-83300 for V/STOL aircraft as applicable.

DISCUSSION

There is a need to retain as much commonality as practical between

cockpit controls for STOL and CTOL aircraft to minimize the possibilities
of pi'.ot control error. Recognizing that it is too early in the development
history of STOL aircraft to specify firm requirements, the tentative require-
ments that follow are included to provide guidance. They are based on pre-
liminary design studies of potential STOL aircraft types but have not yet
been verified by actual use. If design or other factors related to a speci-
fic new STOL aircraft lead to alternate designs, they should be pursued and
coordinated with the procuring activity for approval.

Thrust vector control(s) for powered-lift fixed-wing STOL aircraft.

For aircraft with vectorable engine thrust controlled by a cockpit lever, or
levers, the thrust vector control lever(s) should meet the following require-
ments as applicable:

a. For single seat or tandem cockpits, and side-by-side fighter

cockpits with the throttle on the left-hand side, the thrust vector lever
should be located just to the right (inboard) of the throttle lever(s) and
approximately on the same axis.

b. For side-by-side cockpits with throttles on a center console,

the thrust vector levers should be located adjacent to the throttle levor(s)
such that they can be easily controlled by either pilot.

ill
.OP,
c. The angular travel of the thrust vector control lever(s)
should be approximately equal to the angular travel of the throttle lever(s)
from flight idle to maximum thrust. Forward lever movement should direct
engine thrust aft and result in forward aircraft acceleration, and aft move.-
ment should direct thrust down and result in increased upward for~ces on the
aircraft.

d. The thrust vector lever(s) should have feel characteristics

similar to the throttle lever(s). Friction should hold the thrust vector
control in any set position, and the breakout force should be no more than
3 + 1 pounds.

e. Thrust vector lever(s) should be designed and located so that

they may be moved by the pilot (or copilot) with one hand in a single motion
simultaneously with the throttle(s) such as for a go-around.

f. The transition from one set of controls to another set should

be smooth and should not cause undesirable transients.

g. Loss of one engine should not prevent control of vector con-

trols on the remaining o~perable engine.

Speed commnand control(s') for powered-lift fixed-wing STOL aircraft

with engine controls integrated with longitudinal aerodynamic controls. For
aircraft with a speed control system with engine controls integrated with
longitudinal aerodynamic control for use in the STOL flight mode, the cock-
pit speed controller should consist of a speed comm:.nd leiver or lever(s) as
follows:

a. For single-seat or tandem cockpits, and side-by-side fighter

cockpits with the throttle on the left-hand side, the speed command lever
should be located just to the zight (inboard) of the throttle lever(s) and
approximately on the same axis.
b. For side-by-side cockpits with throttles on a center console,I
the speed command levers should be located adjacent to the throttle lever(s)
such that they can be easily controlled by either pilot.

c. The an~gular travel of the speed command lever(s) should be

approximately equal to the angular travel. of the throttle lever(s) from
flight idle to maximum thrust. Forward lever movement should command
increased speed, and aft movement decreased speed.

d. The speed commaand lever(s) should have feel characteristics

similar to the throttle lever(s). Friction should hold the speed command
control in any set position and the breakout force should be 3 + 1 pounds.

e. Speed commaiA lever(s) shouldi be designed aind located so that

they may be moved by the pilot (or copilot) with one hand in a single motion
simultaneously with the throttles such as for a go-around.

f. The speed command control(s) and throttle control(s) should be

designed such that the latter can override the former for reversion to the
contentioral flight mode.

112
 g. The incorporation of the speed command control should not
interfere with the normal relationship of the throttle lever(s) and the
engine fuel .,ontrol(a).

h. The transition from one set of controls to another set should

be smooth and not cause undesirable transients.

Lift vector control(s) for po ered-left fixed-wing STOL aircraft,

with flap controls integrated with thrust vector controls. For such air-
craft, the cockpit lift vector control, for use in STOL flight should con-
sist of a lift vector command lever or lever(s) as follows:

a. For single-seat or tandem cockpits, the lift vector control

lever should be located just to the right (inboard) of the throttle lever(s)
and on the same axis.

b. For side-by-side cockpits, the lift vector control levers

should be located adjacent to the throttle lever(s) such that they can be
easily controlled by either pilot.

c. The angular travel of the lift vector control lever(s) should

be approy' ily equal to the total angular travel of the flap position
control i , Forward lever movement should command decreased magnitude of
the lift v. or, and aft movement should command increased magnitude of the
lift vector

d. The lift vector control lever(s) should have feel character-

istics similar the throttle lever(s). Lever friction should hold it in
.

any set positio., and the manuial override (breakout) force should be 3 + 1
pounds.

e. Lift vector control lever(s) should be designed and located

so that they may be moved by the pilot (or copilot) with one hand in a
single motion simultaneously with the throttles such as for a go-around.

f. The flap control lever should be mechanized to track the flap

position command when. the lift vector control lever(s) is (are) in use.

g. In conventional flight modes, the lift vector control lever(s)

should command thrust vector orientation.

h. The transition from one set of controls to another set should

be smooth and not cause undesirable transients.

3.2.1.4 Pilot displays.

3.2.1.4.1 FCS annunciation. The FCS control panel or associated panels

shall provide means to display:

a. AFCS engaged.

• Mode engaged.

c. That iitomatic mode switching has occurred--if required.

d. Preselected values for selectable mode parameters.

113
3.2.1.4.2 FCS warning and status annunciation. FCS warning and status
annunciation shall be provided in the cockpit. Annunciation shall be
designed to clearly inidicate the associated degree of urgency.

a. First degree--lImmedia.te action required (warning may be

audibl e). 0

). 'aution, action may be required.

Second degre ..--.

c. Third degree--Informational, no immediate action required.

A panel comprising means for displaying first degree annunciations shall be

located within the normal eye scan range of the command pilot. A first
degree warning or status indication, which applies only to a particular
mode or phase of flight, shall be inhibited or designed to clearly indicate
a lesser degree of urgency for all other modes or phases of flight.

3.2.1.4.2.1 Preflight test (Bit) status annunciation. If BIT is used, this

display shall.,

a. Indicate the progress of the preflight tedt.,

b. Instruct the crew to provide required manual inputs.

c. Indicate lock of system readiness when failure conditins are

detected.

3.2.1.4.2.2 Failure status. Failure warnings shall he displayed to allow

the crew to assess the operable status of redundant or monitored flight
control systems. Automatic disengagement of an AFCS mode shall be indicated
by an appropriate warning display. Manual. disengagement by the crew shall
not result in warning annunciation.

3.2.1.4.2.3 Control authority annunciation. If available manual control

authority can be reduced below the level required for maneuver control by a
function such as automatic trim or stability augmentation, pilot displays
shall be provided to indicate available control authority for essential and
flight phase essential FCS. Warning shall be provided if remaining manual
contiol becomes critical.

3.2.1.4.3 Lift and drag device position indicators. Indicators shall be

provided in the coclkpit to indicate to the pilot(s) the position of each lift
or drag device having a separate control. They shall also indicate the cor-
rect takeoff, enroute, approach, and landing positions; and, if any extension
of the lift and drag devices beyond the landing position is possible, the
indicators shall be marked to identify the range of extension. In addition,
an indication of unsymmetrical operation or other malfunction in the lift or
drag device systems shall be provided whenever necessary to enable the
pilot(s) to prevent or counteract an unsafe flight or ground condition.

3.2.1.4.4 Trim indicators. Suitable indicators shall be provided to:

a. Indicate the position and the range of travel of each trim

device.

114
 b. Indicate the direction of the control movement relative to
the airplane motion.

rangofc. Indicate the position of the trim device with respect to the
rangofadjustment. (Trim devices such as the magnetic brake used in
helicopters to instantaneously relieve pilot's control forces by changing
the feel force reference to zero ait the control position held by the pilot
at the time the trim switch is activated shall not require separate trim
indicator.)

d. Provide pilot warning of trim failures which could result in

exceeding the State III requirements of 3.1.3.3.4.

Aircraft which require takeoff longitudinal trim netting in accordance with

cg location shall have suitably calibrated trim position indicators. Where
suitable, trim indicators shall be in accordance wit~i MIL-I-7064. In air-
craft requiring quick takeoff capability or certain single pilot aircraft,
which use a single trim settin8; for all takeoff conditions, a trim for take-
off light shall be provided.

3.2.1.4.5 Control surface position indication. Indicators shall be provided

in the cockpit for all control surfaces whose positions are indicative of
potential flying qualities below Level 3, when the cockpit controls do not
provide a positive indication of long term or steady state control surface
position, or where the effects of control surface positioning is not readily
detectable by other means.

DISCUSS ION
The following general considerations apply to systems designed forI
redundant operations--typified by the all weather landing system:

The crew should be aware of the operatiLonal status of the landing

system, by annunciation of modes or warning that action is required. It is
desirable that three categories of warning be provided to the flight crew
so that immediate attention to a problem is demanded only in the event of a
critical condition, e.g., failure of a necessary system at low altitude.
The three categories of warning are defined in terms of the associated
degree of urgency for responsive action.

a. Immediate Action Required--loss of system function, hazard-

ous condition imminent. An example of this situation might be taken as
total loss of the AFCS at low altitudes during a limited visibility approach.

b. Caution, Action may be Required--probable loss of system

function. Hazardous condition may be developing. Pilot should make an
assessment of system status before responding.

c. informational, No Immediate Action Required--possible loss

of system function in near future. No impending hazard. An example is
pretest of a system identifying a failure. Hazard can be avoided by
avoiding use of that system or made.

115
jow,,
The probability of losing the capability to isolate failures and
annunciate system status should be minimized. This may require special
considerations relative to power source selection. For example, if fail-
ures are annunciated by lights$ then the design must. ensure power to the
lights when the channtel failure is a power failure.
The probability of the crew mismanaging a safety-critical system
should be m~inimized. Zealous pursuit of this objective can lead to criteria
which require that interlock logic be implemented that prevents the crew
from isolating a critical channel unless the channel has been annunciated
as failed, and which prevent the crew from re-engaging critical chainnels
that have been isolated due to a prior failure indication.

The system design should allow smoke clearing procedures so that

the crew can safely cut power to any electrical box which might produceI
obnoxious amounts of smoke A.nd fumes.
The annunciation and control functions should be implemented so
that it is not possible to propagate failures or false failure annunciations
across the redundant chunnels.

Wire runs, cable runs, and cross-channel cabling should be mini-

mized.

Sinct. the annunciation and control box may be conmmon to all channels,
special precaution may be required to protect against injury to, or destruc-
tion of, this box causing loss of cll operating channels.

Referenne 12 describes the design trades performed to develop the pilot

displays for the Am~erican SST. Specific options considered, the packaging
design used and conclusions reached are discussed.

The requirement to annunciate manual control authority when masked by

automatic trim is in response to aircraft lost due to loss of pitch control.
An F-111 was lost following a failure in the fuel transfer system which
caused an aft cg condition to develop. The series autotrim, which is part
of the F-111 augmentation, maLntained the stick in the trimmed position and
the stabi-'.ty augmentation masked the degrading pitch stability. As air-
speed was reduced arid control limits were reached, the F-1ll went out of
control and was lost, Refurence 6.

Runaway trim has caused many accidents in the past. Many of these
accidents occurred because the pilot was not aware of the malfunction until
it was too late. Low altitude, night and instrument conditions affect the
pilot's capability to detect and react. Commercial transport aircraft provide
an aural warning whenever pitch trim is changing. Such a device is highly
desirable, particularly if a single failure can result in runaway trim.

3.2.2 Sensors. Sensors shall be installed in locations which allow adequate

sensing of the desired aircraft and flight control system parameters, and
which minimize exposure to conditions which could produce failures or un-
desired output signals.

116
DISCUSSION

Careful attention must be given to the location and detail installation

of all sensors to ensure that they provide aignals of the quality necessary
for the flight control system without distortion due to undesirable struc-
tural modes or other effects. The locations must not be such as to subject
the sensors to damage or change of output charactsristicc due to environ-
mental conditions, and must be accessible for inspection, removal, and
reinstallation by maintenance personnel. Redundant air data sensors, for
example, can cause problems because oZ natural variations in local flow
fields with angle of attack and sideslip.

Reference 12 describes the sensor selection trades considered for the

American SST which determined the type of senscr to be used and the preferred
locations for these sensors.

3.2.3 Signal transmission

3.2.3.1 General requirements.

3.2.3.1.1 Control element routLna. Within the restrictions and requirements

contained elsewhere in this specification, all portions of signal trans-
mission subsystems, including cables, push-pull rods, torque tubes, and elec-
trical wiring shall be routud through the airplane in the most direct manner
over the shortest practical distances between points being connected. Pro-
tecuon from use as steps or handholds shall be provided.

DISCUSSION

Considerable care must be taken in the design of control signal trans-

mission installations in order to meet the foregoing requirements. These
and wany other considerations, ruch as the ability to provide the required
signal transmioslon accuracy, fitting the components into the space available,
and obtaining minimum weight, go into the selection of signal transmission
elements for a given aircraft. Pertinent requirements specified elsewhere
in this specification ranked in an order of most to least important includet

Suitable system separation and clearance which precludes contact

with stricture and other equipment, piping, wiring, and controls under all
operating extremes is needed. (3.2.3.1.2)

Single failure points where failure is not extremely remote must

be avoided. (3.1.3)

Protection from adverse natural and induced environments including

lightning, static electeicity, and mechanical damage is needed. (3.1.9)

Suitable access for maintenance must be provided and interference

with access to other systems, equipment and adjustment devices must be
avoided. (3.1.10.3)

Control elements routing should be determined early in the design of

an aircraft before "freezing" the location of equipment which could comprom-
ise the control routing.

117
3.2.3.1.2 System separation, protection, and clearance. Where redundant
cable, puehrod, or electrical wv"tng are provided, they shall be separated
as r%.quired to meet the invulneribility requirements of 3.1.9. Advantage
shall be taken of the shielding aýf',rded by heavy structural members,
existing armor plate, or other equipment for the protection of Important
components of the control systems. Clearance between flight control system
components and structure or other components shell be provided as necesscry
to insure that no probable combination of temperature effects, air loads,
structural deflections, vibrations, buildup of manufacttiring tolerances, or
wear, can cause binding or jamming of any portion ot the control system,
In locally congested areas only, the following minimum clearances may be
used after all adverse effects are accounted for:

a. 1/8-inch between static elements except those within an LRU

where closer clearances can be maintained or where contact cannot be
detrimental.

b. 1/8-inch between elements which move in relation to tach other

and which are connected to or are guided by the same structural or equipment
element(s) except those within an LRU where closer clearances can be main-
tained or where contact cannot be detrimental.

c. 1/4-inch between elements which move in relation to each other

and which are connected to or are guided by different structural or equipment
elaments.

d. 1/2-inch between elements and aircraft structure and equipment

to which the elements are not attached.

DISCUSSION
The minimum clearances specified above are based upon experience and are
listed in the descending order shown based upon the relative probability that
the elements will retain their selected positions from aircraft to aircraft.
Every effort should be made to avoid the minimum spacings, however; and it
should be noted that the minimum* listed are the clearances which must be
provided after all of the adverse effects (e.g., loads, deflections, vibra-
tions, tolerances, wear, etc.) ure accounted for.

As a general objective, control elements should clear items uf equip-

ment, structure, electric wire runs and hydraulic and pneumatic lines by
2.0 inches, where possible.

3.2.3.1.3 Fouling prevention. All elements of the flight control system

shall be designed and suitilbly protected to resist jamming by foreign objects.

DISCUSSION

This is a most important requirement. Lives have been lost because

foreign objects have jammed controls and caused crashes, unplanned ejections,
and other unsafe events. There have been several instances of control jams
because of tools, screws, bolts, nut strips, and other objects binding
flight control mechanisms. Manwy such events are documented in Reference 46,
including one where an aircraft loss was attributed to a jammed pitch/roll
mixer by a tube of fuel tank sealant found in the wreckage.

118
 Machannsms and installations should be designed to preclude jamming by
foreign objects. Compact installations of parallel rods and adjacent bell-
cranks may have an orderly appearance but present many opportunities for
jamming. Clearances between control path& should be determined by the
dimensions of the tools and related items most l 4 kely to be used in main-
taining and inspecting the area. Many cases of jamming by flashlights
and screwdrivers have been identified. Moving elements of control systems
should be located near the top surface of their enclosures. The supporting
elements should be designed so that they cannot trap a tool or other
foreign object. Protection provisions should also consider the effects of
inverted flight in fighter/attack type aircraft and zero or negative "g"
flight in all aircraft as may be introduced intentionally or caused by
turbulence.

In areas where a great amount of maintenance is required, a permanently

attached cover should be installed on pulley brackets and complex mechanisms
to prevent foreign objects such as rags, nuts, bolts, etc., from lodging
between cable and pulley groove and in linkage so as to jam the control
system. In all locations, vertical or near vertical pulleys should be
equipped with guards. In unpressurized sections, the design of mechanisms
including pulley, sector, and drum support structure uust be such as to
prevent slush and ice accumulation from jamming the control system.

These recommendations should be strongly considered even if they require

additional space for control runs. In a fly-by-wire system, the mechanical
portion would be much simpler and include fewex points which could be jammed.
It would be easier to reduce mechanical density, include proper inspection
panels, and take other steps to reduce opportunities for tool and other
foreign object jamming.

3.2.3.1.4 Rigging provisions. The number of rigging positions shall be kept

to a practical minimum. They slhll be readily accessible and located where
space for the rigging function is available. Installed rigging pins shall
be highly visible from the ground or include streamers as specified in
3.1.10.4. Control xirface actuator outputs shall not be rig pinned.

DISCUSSION
The m.,.Lmization of rigging errors justifies the additional engineering
effort and tooling precision which may be required to achieve adequate adjust-
ment of the signal transmission system with a minimum number of rig positions.
The use of streamers is important to minimize the possibility of clearing an
aircraft for flight before the rig pins are removed.

3.2.3.2 Mechanical signal transmission

3.2.3.2.1 Load capability. Elements of mechnnical signal transmission systems

subjected to loads generated by the pilot(s) shall be capable of withstanding
the loads due to pilot's input limits specified in MIL-A-8865, Section 3.7,
Flight Control System Loads, taken as limit loads, unless higher loads can be
imposed such as by a powered actuation system or loads resulting from aero-
dynamic forces. Where higher loads are thusly imposed, they shall be met with
the same margins and circumstances as specified in MIL-A-8865.

119

~i
3.2.3.2.2 Strength to clear or override jammed hydraulic valves. All mech- V

anical elements which transmit input commands to metering valves of hydraulic

servoactuators shall have strength to withstand higher loads, abuve those for
normal valve stroking, required to clear foreign material that may occur in
projected usage.

3.2.3.2.3 Power control override provisions. Provisions shall be made to

permit the pilot(s) to clear or override metering valve jams unless there is
sufficient aerodynamic control power from the remaining operative surfaces to
override control moments generated by the jammed surface in its most adverse
position.

DISCUSSION

Specific values for valve jam-clearing forces depend upon the specific
valve designs and the system design approach. On many hydraulic metering
valves, a 200-pound force will be sufticient to shear all chips or other
foreign material which could jam a valve. On others, especially those with
tapered metering slots where a chip might become wedged, more force may be
required. In systems where detented linkage is used to allow override of
a jammed valve, the maximum detent breakout force, considering all adverse
tolerances, must be considered.

An alternate to this requirement is to use a dual-concentric-spool

valve, such as used on a number of commercial jet airliners, which allow
continued functioning in the event of a solid jam of one spool in a mid-
position and neutralization of a hardover.

3.2.3.2.4 Control cable installations. Control Cable i:.stallacions shall

be designed to accommodate easy servicing and rigging, and tbh.: number of
adjustments required shall be kept to the practical ml.' ,

3.2.3.2.4.1 Control cable. Cable used for the a.-tuation of flight controls
shall be the most suitable of the following types for each application. Use
of carbon steel or other type cable not listed below requires procuring

activity approval.

a. Flexible ny~on-coated corrosion-resisting steel wire rope in

accordance with MIL-W--83420.

b. Preformed flexible corrosion-resisting steel wire rope in

accordance with MIL-W-83420.

c. Preformed flexible corrosion-resisting nonmagnetic steel cable

in accordance with MIL-C-18373.

DISCU.M[ION

Stainti--s steel cable has been required for new USAF aircraft designs
since che issuance of MIL-F-9490C in 1964. Prior to that time, carbon-steel
cable: per MIL-W-83420 was also allowed and is still being designed into
comme3rcial jet aircraft, including many purchased for USAF use, where
corrosion resistance is not as significant as for many military aircraft.

120
 In addition to its corrosion resistance, tests such as reported in
Reference 74 have shown that the fatigue life of stainless steel cable is
superior to carbon steel cable (either galvanized or tin coated), espec-
ially at low temperature (-65*F to which many cables are exposed in flight).
Other tests also indicate its superiority at higher temperatures, espec-
ially in corrosive (salt spray) atmosphere.

Stainless steel cable is not immune to failure in service, however,

and there has been a history of control cable failures in high vibration
areas caused by excessive wear on the outer wires where the cables make
contact with the fairleads. At one time, such failures in fuselage-mounted
cable runs in F-5 and T-38 aircraft became such a serious problem that cable
replacements were required after as low as 40 hours service.

This experience led to the evaluation of standard stainless steel cable

jacketcd with extruded plastic materials. In the test program documented in
Reference 75, cable jacketed with nylon proved superior to polyolefin mater-
ial and was adopted for standardization. Its use on the F-5 and T-38 air-
craft has completely solved the failure problem; and, of 10,000 installatious,
only two removals (due to overheat near the engine) were required.

Use of nylon jacketed cable (now specified by MIL-W-83420) has also

resoived a similar problem on C-141A aircraft. Replacement of bare stainless
steel aileron and spoiler control system cables, subjected to aerodynamic
induced vibration in the wing, has been required in as few as 400 flight
hours due to extieme work haidening and wear adjacent to the roller fairleads
In most cases, 1,500 hours was the maximum life for the bare cablp; but, it
now appears that adoption of the jacketed cable has eliminated this problem.
Similar experience has been had with certain wing-mounted carbon steel
cables on 707 airliners. They are now furnished to the airlines, and the
USAF AWACS fleet, with nylon-jacketed carbon steel cable in the lateral
control system. Bare carbon steel is still used, however, and provides
acceptable service life.
In the sizes most commonly used for flight control applications, 1/8 and
3/32-inch nominal diameter, available coating thicknesses (per MIL-W-83420)
are as follows:

Nominal Cable Nylon Wall Nylon Jacket

Diameter Thickness Diameter

3/32 .016 1/8

3/32 .031 5/32

1/8 .031 3/16

The .031 thickness wears better, but cable with .016 Jacket has lower
friction. With either thickness, friction will be higher than with uncoated
cable. See MIL-W-83420 for the Jacket diameters and thicknesses for other
sizes. The increase in diameter due to the Jacket must be considered in the
design of cable grooves on drums and sectors, and may require the use of dif-
ferent pulleys than used for unjacketed cable.

121
 The requirement that approval must be obtained before using carbon
steel and other type cable 4s not intended to prohibit their use; but,
rather, to ensure that there are sound technical and/or economic reasons
for selection, and they will not be subject to failure due to excessive
wear, fatigue, or corrosive environments.

One reason for use of another type is to reduce cable stretch under
load. The standard 7 x 7 and 7 x 19 construction carbon-steel cable per
MIL-W-83420 has a modulus of elasticity roughly 30 percent greater than for
standard construction stainless steel. Where greater stiffness is required,
special 1 x 19 construction carbon-steel cable and aluminum clad standard
carbon ateel and stainless steel cable can be considered.

At one time, there were few vendors equipped to make acceptable stain-
less steel cable, and the price was considerably greater than for carbon
steel. This situation has improved, however, and a realistic comparison of
initial and replacement costs should be made before assuming which will be
most cost effective.

3.2.3.2.4.2 Cable size. Cable shall be sized to meet the load requirements
of the system with ample safety factors to compensate for wear and deterior-
ation where pulleys, fairleads, etc., are encountered. Cable size shall
also be adequate in regard to permissible cable stretch, pulley friction
values, and other variables which affect system performance. Where substan-
tial loads are carried, cables shall be sized so that limit loads do not
exceed 67 percent of the rated breaking strength of the cable and do not
exceed the maximum cable limit loads allowed for their pulleys.

DISCUSSION

All cables must have a rated breaking strength of at least 1.5 times
design limit load. In addition, the size selected should be such that
maximum limit load does not exceed the limitations snecifled for the
selected pulleys. See AFSC Design Handbook DH 2-1, DN 3BI, Subncte 1.1.2(1),
"Standard Pulleys," for limitations specified for cable used with MS20219,
MS20220, and MS20221 pulleys.

3.2.3.2.4.3 Cable attachments. The minimum practical number of inter-

connections shall be used which allow all cable segments to be connected
manually. Cable disconnects shall be located and designed so that it is
physically impossible to wisconnect in any manner, either cables in the
same system or the cables of different systems. Cable disconnects and turn-
buckles shall be so located that they will not hang up or interfere with
adjacent structure or equipment or on each other and will not snag on cables,
wires, or tubing. Corrosion-resistant steel MS swage-type cable fittings in
accordance with MIL-T-781, swaged to form cablei assemblies in accordance
with MIL-T-6117, shall be used wherever possible. Thimble ends per MIL-T-
5677, attached to cable by splicing and wrapping in accordance with MIL-S-
5676, may be used in applications where additional joints are needed to
prevent bending fatigue failures. Turnbuckles used in flight control cables
systems shall be in accordance with MIL-T-8878. Turnbuckle and fittings
shall be designed so that they are not subject to bending forces which can
cause fatigue failures. Turnbuckle terminals shall not have more than three
threads exposed at either end. Nil turnbuckle assemblies shall be properly
safetied in accordance with MS33736.

122
DISCUSSION

The applicable terminals in accordance with MIL-T-781 are controlled

by the following standards;

MS20658, Terminal, Wire Rope, Swaging, Fork End.

MS20663, Ball End, Wire Rope, Swaging, Double Shank.
MS20664, Ball End, Wire Rope, Swaging, Single Shank.
MS20667, Terminal, Wire Rope, Swaging, Fork End.
MS20668, Terminal, Wire Rope, Swaging, Eye End.
MS21259, Terminal, Wire Rope, Stud.
MS21260, Terminal, Wire Rope, Stud.

These standards call out both cadmium-plated carbon steel and cor-
rosion-resistant steel, but only the latter have been qualified.

The difference in the MS20658 and MS20667 fork .ycs is that the
former are sized to accommodate an MS27640 heavy-duty ball bearing between
the tines, whereas the latter are sized to accommodate the MS20668 eye ends.
The difference in the MS21259 and MS21260 stud types is that the latter has
a shorter length of thread on the threaded end and also comes in both a
short and a long threaded end.

Note that there are two types of terminals as follows:

Type I: Sleeve (or shank) terminals which are the regular termin-
als for general use in aircraft control cable installations.

Type II: Ball-end terminals for use in ordnance and glider con-
trol installations and in attaching cables to quadrants, drums, etc., in
cable control systems on powered aircraft.

A typical thimble-end connection is shown on MS33736 and may be used to

prevent bending fatigue failures as shown in AFSC Design Handbook DiI 2-1,
DN 3B1, Subnote 1.2(1), "Fatigue Failure Turnbuckle."

Components of turnbuckles in accordance with MIL-T-8878 are controlled

by the following standards:

MS21251, Turnbuckle Body, Clip Locking.

MS21252, Clevis End, Turnbuckle, Clip Locking.
MS21253, Clevis End, Turnbuckle, Clip Locking (for Bearing'.
MS21254, Eye End, Turnbuckles, Cli.p Locking (for Pin).
MS21255, Eye End, Turnbuckle, Clip Locking (for Wire Rope)
MS21256, Clip, Locking, Turnbuckle.

MS33736 specifies methods of safetying turnbuckle components with the

MS21256 locking clips.

123
 .....
....
...
3.2.3.2.4.4 Cable routing. Control cables shall be arranged in parallel
runs, and be accessible to inspection for their entire length. Cable runs
located in aeroelastic structure, such as aircraft wings, shall be routed
so as to minimize any induced control action, caused by structural flexure.
Spacing between adjacent cables shall prevent cables, turnbuckles, and fit-
tings from chafing during all operating conditions including vibration.
Slack return cables shall not snag on each other or any other equipment or
structure when the controlling cables are loaded to design limit loads at
the adverse extremes of temperature, structural deflection, and other
operating conditions. Cables shall not be subjected to critical bends at
the junction with cable terminals or other attaching points such as on
drums and s~ctors.

DISCUSS ION

A minimum number of pulleys and brackets is highly desirable, and con-

sideration should be given to their simplification. Unsupported spans of
150 to 200 inches have operat-ed very satisfactorily; however, idler pulleys
should be used in long straight runs to minimize friction over fairleads and
grommets with normal structural deflections, Simple brackets may usually be
designed if the cable runs are kept parallel to at least one axis of the
aitplane or parallel to the supporting surface. A fan type cable run
usually results in complicated and/or inaccessible brackets.

The main flight control cables in the wing should be run along the wing
neutral axis, and all other cables should be as near to the neutral axis as
possible. Runs from any one control element should be located on the same
side and at the same distance from the neutral axis to eliminate any induced
control action caused by wing flexure. To maintain rigging and control
clearances, idlers should be used to restrict cable movement away from the
wing neutra'l axis.

It is not desirable to route control cable around m~ovable equipment and

hatches. Each new aircraft model should be thoroughly Inspected to determine
that all removable or hinged covers on equipment, or rotating or swinging
Items of equipment, do not interfere with or rub on the control cables.

When using the minimum local spacings allowed per 3.2.3.1.2, the cables
should be supported more frequently than normal and turnbuckles placed where
more clearance is available. The effect of return cable slack caused by the
application of design loads on the controlling side, and due to temperature
and other effects, must be carefully considered. The adequacy of guards,
fairleads, and rub strips should be confirmed during proof and operational
tests on a production aircraft. Reconfirmation should be done at each major
revision or model change.

3.2.3.2.4.5 Cable sheaves. Cable drums, sectors, and pulleys of adequate

capacity and diameter for their function and to meet aircraft life require-
ments shall be provided. They shall be large enough for the cable wrap
angle such that the cable strands are not overstressed. The diameter and
number of grooves on cable drums, and the radius and angle of control cable
sectors shall be adequate for the required cable travel. Overtravel allow-
ance shall not be less than 5 percent of full travel in either direction and
at least 10 degrees. When cable wrap varies with cable travel, the initial
124
AIpo

wrap w-ith the sheave in the neutral position shall be at least 115 percent
of the full cable travel in either direction. If overtravel exceeds the
minimum required, cable wrap shall be increased a corresponding amoun~t.
All cable grooves on drums and sectors, machined or die cast, shall have
root radii properly sized for the cable size used thereon. Specific
approval shall be obtained before using plain pulleys in essential appli-
cations. Antiiriction pulleys used in flight control systems shall be
MS standards in accordance with MIL-P-7034, and the design li~mit load
shall not exceed the allowable limit load spectfied for the applicable
standard.
DISCUSS ION

Tests have been conducted to show the reduction in bending life as the
sheave to cable ratio is reduced. The table below shows the approximate
manner in which relative laboratory bending life, is reduced as the sheave to
rope ratio decreases.

Sheave to Rope Ratio Relative Laboratory Bending LifeI

30 100
28 86
26 72
24 59
22 48I
20 38
18 29
16 21
14 15
12 11
10 8
8 6
6 4
Source: Roebling Wire Rope Handbook, 1966, Page 57.
This table was developed by running actual tests on cable. it shows
that by reducing the sheave diameter by one half, relative cable life is
reduced by 70 to 80 percent.

There are different formulas for calculating bending stresses in the

wires of cable when it is bent around a sheave during operation. Using the
formula:

f .67Ld f Bending stress -psi

D E = Modulus of elasticity of wire - psi
d Diameter of outside wire - inches
D = Pulley root diameter - inches

the bending stress can be calculated. This formula is a median of eight

different one's advanced for the solution of the problem. The stress produced
by bending can be compared to the stress produced by a straight tensile load.

125
 The following comparisons for the MS pulleys for 1/8 through 3/16 inch
aircraft cable demonstrate how the smaller pulleys greatly reduce cable life
and increase bending stress.

SHEAVE EQUIV.
ROOT TO BENDING TENSILE
DIAM. CABLE STRESS LOAD RELATIVE
CABLE PULLEY (IN.) RATIO (psi) (LB) LIFE
1/8" 7x19 MS20220-1 1.255 10 128,600 1055 8
1/8" 7x 19 -2 2.505 20 64,400 528 38
1/8" 7x19 -3 3.755 30 43,000 352 100
1/8" 7x19 -4 5.OS Q0 32,200 264 -

51/32" 7x19 M S2 02120-1 1.25 7..:'158,400 1965 5

5/32" 7x19 *2 2.505 15 79.300 983 18
5/32" 7x19 -3 3,755 22.5 53,000 657 51
5/32" 7x19 -4 5.005 30 39,700 4921 100

3/16" 7x19 MS20220-1 1.255 6.5 '188,500 3280 4I

3/16" 7x19 -2 2.505 13 94,500 1645 13
3/16" 7x19 -3 3.755 22.5 63,000 1100 33
3/16" 7x19 -4 5.005 25 47,200 820 65

This comparison shows the importance of using the largest turn radius
possible. Although the bending stress formula used shows only a linearI
relationship~ to the root diameter, the relative life from the first table
shows how much the higher stress reduces cable life.

Because of the many other factors involved, it is impossible to estab-

lish firm criteria for the proper cable-pulley ratio. Final determination
has to be based on expected load, safety factor desired, and required life.
Adequate testing should be conducted prior to final sheave design and pulley
selection.

The importance of groove radius is demonstrated by the results of tests

run on 3/16 in.7 x 19 preformed stainless steel cable, summarized in Fig.-
ure 13D. In each case, the cable was deflected 90 degrees around the shea-'e
under a load of 800 pounds with oscillations of 1 inch amplitude. For each
of the three pulley sizes, the best cable life resulLed with a groove radius
of one-half the cable diameter. This allows for maximum support of the cable
by the pulley and prevents the cable from flattening or becoming distorted.
Care must be taken, however, to allow adequate clearance for the cable in
order to prevent wedging and allow the cable to rotate freely. One formula
used successfully for a great number of applications is:

126
 Ca /I

M C
80

Clq

1:11

U .r
....
 Ii

RR= C/2 x 1.15 where:

RR = root or bottom radius

C = cable diameter,

Antifriction pulleys are required to keep cable system friction within

acceptable limits. However, careful attention to the number of pulleys,
wrap angles, and rigging load is required, especially if friction is criti-
cal. In long, straight runs, however, idler pulleys should be used to
minimize friction over fairleads and grommets with normal structural deflec-
tions.

The approved antifriction pulleys in accordance with MIL-P-7034 are con-

trolled by the following standards:

MS20219, Pulley, Groove, Secondary Control, Aircraft

MS20220, Pulley, Groove, Flight Control, Aircraft
MS20221, Pulley, Groove, Heavy Duty, Control, Aircraft
MS24566, Pulley-Control, Antifriction Bearing

Their allowable loads are listed on the standard drawings, and are sum-
marized in one table in AFSC Design Handbook DH 2-1, DN 3BM, Subnote 1.1.2(1),
"Standard Pulleys."

It should be noted that these pulleys are sized in increments for use
with either two or three cable sizes. Therefore, only the largest cables in
each size range will have an optimum fit in the groove. Thlo is a compromise
to keep the number of sizes which must be stocked within a reasonable limit,
but does compromise optimum life and friction somewhat. The flattening of
the cable in an oversized groove not only reduces life as shown in Figure 13D,
hut alau increases friction.

3.2.3.2.4.6 Cable and pulley alignment. Fixed-mounted pulleys shall be

aligned with their cables within 2 degrees as specified in AFSC Design Hand-
book DR 2-1, DN 3BI, Subnote 1.1.3(l), Cable Pull. Where a control cable
has an angular motion with respect to the plane of the pulleys, the maximum
misalignment resulting from this motion must not exceed 2 degrees, and the
cable shall not contact the pulley (or quadrant) flange for the total cable
travel.

DISCUSSION

Accurate alignment is required to prevent cables from coming out of their

pulleys. A design misalignment limit of 0.5 degrees is usually used to ensure
the 2-degree limit on the manufactured product. Pulleys should be mounted in
vertical planes; however, in some situations, it may be necessary to use cable
guide tubes or closely mounted fairleads to limit misalignment due to catenary
effect or slackening of the cable.

128
3.2.3.2.4.7 Pulley-bracketgsacers. Loose spacers between pulleys, bearings,
and pulley brackets shall not be used.

DISCUSS1ION

Spotwelded, riveted, or other fixed spacerv, flanged bushings, or dimpled

bracket. should be used in lieu of loose spacers.

3.2.3.2.4.8 'Sheave guards. Guards shall be installed at all sheaves (pulleys,

sectors, drums, etc.) as necessary to prevent the cable from jumping out of the
groove of the sheave. Guards shall be installed at the approximate point of
tangency of the cable to the sheave. Where the cable wrap exceeds 90 degrees,
one or more intermediate guards shall be installed. All guards shall be sup-
ported in a way which precludes binding of the sheave due to relative deflec-
tions in the aircraft structure. Additional guards shall be installed on
sectors as necessary to ensure retention of the cable end in its attachment
under slack cable conditions. The design of the rubbing edges of the guard
and the selection of materials shall be such as to minimize cable wear nnd
prevent jamming even when the cable is slack.

DISCUSSION

The number of guards required varies with the angle of cable wrap and
cable flexibility. Cable installation and replacement requirements will
usually determine the type of guards best for each sheave. In complex
bracket assemblies, removable guards (pins, bolts, and spacers) are usually
preferred. In sim~ple brackets, fixed guards (rivets and spacers) may be
considered provided the pulley may be easily removed.
3.2.3.2.4.9 "Sheave spacing. In any given cable run, no portion of the cable
shall ever pass over more than one sheave.

DISCUSS IONj
This is to reduce wear and friction. Cable tends to twist over each
pulley. If the twist from one pulley rides on to another pulley, it will
cause increased wear and frictioui.

3.2.3.2.4.10 Cable tension. Cable rig loads shall insure positive cable
tension in control and return legs of closed-loop cable installations under
all operating conditions including airframe deflection and differential
expansion and contraction between the t.able cnd airframe structure through-
out the designed operating temperature range. The cable return leg may be
allowed to go slack when the control leg is loaded above the normal operating
load, providing it cannot snag, when the control leg is loaded at any load up
to limit load, and that there is no hazardous loss of system performance.
Cable tension regulators shall be provided only if positive cable tension
cannot be maintained in both legs, with reasonable rigging loads.

DISCUSSION

Closed cable installations should never go slack under normal operating

loads, or system deadband and loss of resp)onse will occur. Limit loads are

129
normally developed only under adverse conditiona such as sticking or Jammed
control valves or linkages, however; and, it is usually permissible for the
return leg to go slack under such occurrences.

Closed cable installations are rigged to a rredetermined load in order

to decrease the deflection between the location of the input force and the
location of the output force. The rigging load must be greater than half
the maximum normal operating load so that the return leg does not go slack
under the range of normal operating load.

With a rigging load equal to half the maximum normal operation load,
the cable deflection throughout the normal operating load range will be
approximately half the deflection of cable without rigging load. See
Figure 14D. Increasing the rigging load reduces deflection further, but
increases friction and may overload pulleys.

Because of differing coefficients of thermal expansion between the

cable and the airframe, cable loads can vary through a wide range due to
temperature changes. As ambient temperature increases, rigging loads of
closed systems can increase to the point where friction has a detrimental
effect on resolution and stability of the system. As ambient temperature
decreases, the rigging load could be so low, or lost completely, that a
"spongy" or inaccurate response of the control surfaces will result.

Cable tension regulators are often installed in quadrant assemblies of

a control installation to take up the slack or allow for contraction of the
cables without appreciable variation of the rigging load during temperature
changes throughout the design range.

Without Rigging Load

F *~~*t-- .. ...

Sag

d = PL
EA

With Rigging Load

______-__
___
,__

R + '-5"LP
•,b -PL
R -2 d = 2 EA

d = deflection where
R = rigging load
p
A = net cross-sectional area of the cable R -'i-
>0
cable
L '2 modulus of elasticity tbr the
Figure 14D. Rigging Load and Operating Deflection

130
3.2.3.2.4.11 Cable tension regulators. When used, tension regulators shall
maintair required tension at all times. Integral calibration shall be pro-
vided to show proper cable tension without the use of external tensionmeters
or other equipment.

DISCUSSION

The advantages of tension regulators should be carefully weighed against

the disadvantages of additional weight, complexity, cost, and the possibility
that a failure may introduce dangerous control transients or cause the cable
to go completely slack. A better approach is often to design a "soft" system
with cables small enough to stretch to allow for temperature chauges but still
tight enough for operation at minimum designed temperature.

3.2.3.2.4.12 Fairleads and rubbing strips. Fairleads shall not cause any
angular change greater than 3 degrees in the direction of the cable under all
conditions including those due to structural deflections in flight. Fair-
leads shall be split to permit easy removal unless the size of the hole is
sufficient to permit the cable with swage terminals to be threaded thiough.

DISCUSSION

Fairleads and rubbing strips may be needed to keep cables from chafing,
snagging, and slapping against each other and adjacent parts of the aircraft
The necessity for fairleads can be reduced by keeping cable runs away from
structure as much as possible. Rub strips may often be installed if there
is a possibility of the cable hitting structure or equipment.
Where space permits, the fairleads should clear the primary flight
control cables by a minimum of 1/4 inch. The cables may rest against the
lower edge of the hole in fairleads on long, straight cable runs where the
cables would normally sag due to their own weight even though propetly
rigged.

Grommet Type Fairleads

A grommet type fairlead should be used where cable passes through

structure unless a pressure seal is required. The fairlead holes should be
as large as possible and a tight fairlead should not be used unless abso-
lutely necessary. If a tight fairlead is required, the installation must be
adjustable to correct for shop errors. Holes in a tight fairlead should be
approximately .05 larger than the nominal cable diameter.

Wing Fairleads

Wing fairleads should be slotted to allow the cable to rise and

fall with the win& deflected under 1/2 the design load factor. If this is
not practicable, fairlead pulleys should be used.

3.2.3.2.4.13 Pressure seals. Pressure seals shall meet compartment seal-

ing requirements within cable installation friction requirements. They shall
be designed to preclude jamming the control system.

131
DISCUSS1ON

Types which hasv been successfully used in mAny applications include;

The Finned-Type shown following which has been used to seal

pressurized compartments in many applications where minimum friction is
required. They may be installed or replaced after cables are rigged, but
must be installed with the small end to the high pressure side of the
bulkhead, as they will not s~al if reversed.

FINNED PRESSURE SEAL

('able
Retaining
R n- Groove
Restraining "Bulkhead
Rings%b. (Pressurized Side)
1J" Seal

The Eyeball-Type shown below which h&s ati angular self-aligning

feature which .an reduce wear and subsequent leakage in cable installations
subject to misalignment.

I-YFBALL PRIESSURI- SIAL

CA-table

Washecr
Seail L'over
Seal Plate
-BuWkhead

, \\ Nutplate
--
390 (askets
6
- Nylon Ball

132
3.2.3.2.5 Push-pull rod installations. Push-pull rod installations shall
be designed to preclude binding or separating from the mating linkage, and
shall permit servicing and rigging.

DISCUSSION

Push-pull rod installations are often determined to be more suiLable

than control cables or other signal transmission means, either as a total
concept or for selacted locations within a control cable instUllation.
Push-pull rod inutallations include the rod assemblies, with fixed and/or
adjustable terminals, levers, and bellcranks, and guides or other supports
as necessary to prevent fouling.

3.2.3.2.5.1 Push-pull rod assemblies. Push-pull rod assemblies shall be

designed and installed such that inadvertent detachment of adjustable term-
inals is impossible, and such that any change in lenigth due to loosening of
the terminals cannot result in an unsafe condition. On any single rod
assembly, adjustment shall be possible at one end only. The fixed end of
each rod shall be attached to its mating linkage element in a mannev which
precludes rotation of the installed assembly. The adjustable end shall be
of the clevis type or join a clevis type in such a manner that it is also
prevented from rotating. Wheu an unsymmetrical rod is used, such as one
with a cutaway portion to allow for relative motion of an attached link,
the rod end terminals and mating linkage elements shall positively prevent
incorrect installation of the rod. Push-pull rods shall have a minimum wall
thickness of 0.035 inches and shall be capable of withstandizg loads of 1.5
times limit loads in both tension and compressicn without failure, buckling,
or any other form of permanent deformation. All joints shall be made in a
manner which precludes loosening and fatigue failure. All closed cavities
in rod assemblies installed in unpressurized spaces shall be provided with
drain holes adequate to drain ingested water unless cavities are air tight.
All push-pull rod terminals shall incorporate antifriction bearings per
3.2.7.2.1.1 or self-lubricating spherical bearings as specified in
3.2.7.2.1.2. All terminal pins shall be retained as specified in
3.2.8.3.2.2. Loose washers or other l.oose spacers shall not be used to
maintain terminal spacing in the connecting linkage.

DISCUSSION

Rotation of a single-adjustable-end rod can be prevented by mating a

fixed clevis terminal on the rod with a nonadjustable linkage lug end, or
conversely by matins, a fixed lug end on the rod with a nonadjustable clevis
on the linkage element.

Rods requiring adjustment at both ends are not rermitted. If fine

adjustments of rod length are necessary, it may be allowed through deviation
providing the nonseparation and adverse-length requirements are met. A turn-
buckle approach, i.e., with right-hand threaded terminals on one end and
left-hand threaded terminals on the other, should not be used. If very fine
adjustment is needed, terminals with differing thread pitch (one end finer
than the other) can be used. Where dual-end adjustment is authorized, the
rod should be designed so that, if the terminal connections inadvertently
loosen, either end will bottom on the rod prior to the terminal at the
opposite end becoming detached.

133
Push-pull rods should not be used to carry heavy compressive loads; but
where both compression and tension loads exist, the heaviest load should
put the rcd in tension. The 0.035-inch minimum wall requirement is an
arbitrary limit which has been deemed necessary to prevent failures due to
handling and other maintenance even though, in some cases, strength require-
merits will be exceeded.

Drain ho es are required in all hollow rods with loose fitting ends or
with ends -tLached with a threaded joint which will allow moisture to enter
the rod cavity directly or entrained in vapors which can subsequently con-
dense. In addition to the possibilities of corrosion, and the addi.tion of
weight to the rod (which might even introduce unwanted control moments in
the linkage), rod failures have occurred due to expansion of the water upon
freezing. Welded joints a I ends riveted after assembly with wet epoxy
primer are generally considered sufficiently air tight. Where drain holes
are used, they must be lgrge enough to drain collected moisture before the
freezeover, and not so large that they unduly weaken the rod.

hollow nonadjustable rod ends should not be attached with rivets or

other fasteners in a manner where they are subject to bending and fatigue
failure. See AFSC Design Handbook DH 2-1, DN 3B1, Subnote 2.2(2), "Example
of Why Shear Bolts Are Preferied When Installing Rod Ends." An alternate is
to use a riveted joint with a plastic or phenolic filler plug in the hollow
rod end.

Regarding lateral spacing of the terminal in its connecting linkage, see

AFSC Design Handbook D11 2-1, DN 3B1 Subnote 2.2(1), "Benefit of Bushings for
Rod End Installation." The use of bushings will prevent loose joints due to
neglect to install loose spacers, and will be helpful in preventing stress
failures in the clevis end.

3.2.3.2.5.2 Levers and bellcranks. Applicable requirements in AFSC Design

Handbook DH 1-6; System Safety, Section 3J; Flight Control Systems, Design
Note 3J2; Mechanical Flight Controls; Pulleys, Brackets and Bellcranks,
and Design Note 3JX; Safety Design Check ilst, shall be met. Bearings shall
have adequate self-aligning capability if necessary to prevent excessive
deflection loads on levers and bellcranks, and, their installations shall be
designed for easy replacement so that the parent part may be reused. Levers
and bellcranks designed with dual load paths having the two sections posi-
tively joined by permanent fasteners, such as rivets, shall be bonded with
adhesive.

3.2.3.2.5.3 Push-pull rod supports. Where lo-g sections of push-pull rods

are utilized in applications where jamming is not extremely remote, guides
shall be installed at intervals to preclude fouling in the event of rod
failure.

3.2.3.2.5.4 Push-pull rod clearance. Clearance between push-pull rods, and

between rods and aircraft equipment and structure, shall be as specified ia
3.2.3.1.? except that 4t shall also be sufficient to permit removal of
adjacent LRU's without disconnecting the rods.

134
3,2.3.2.6 Control chain. Where used, control chains shall be of standard
aircraft quality and conform to MIL-STD-421. Connecting links shall be
retained with standard nonhardened cotter pins. Spring clips shall not be
used.

DISCUSSION

In many ca'xs, where rotational signals ulhich must make a multiplicity

of turnc dnd be transmitted to another shaft located too remotely for con-
nection through gearing, chain drives will. prove to be the best solution.

The requirement to bond joined sections of dual load path levers and
bellcranks with adhesive is meant to prevent entrance of moisture between
the fayed surfaces, and jamming due to separation of loose pieces.

3.2.3.2.7 Push-pull flexible controls. Push-pull flexible controls may be

used for transmitting control signals in noncritical applications, but spcc-
ific approval from the procuring activity must be obtained before use in
esse. ial and flight phase essential applications. Where used, they shall
conform to MIL-C-7958. Installations shall avoid an excessive number of
bends to keep friction forces within acceptable values and minimize the
possibility of jamming, and the routing shall preclude damage due to per-
sonnel using them as steps and handholds. Conduits shall be stipported at
frequent intervals, but not so tightly that the control is rest:rained
axially.

DISCUSSION

The requirement that specific approval must be obtained before use of

flexible controls in essential and flight phase essential applications is not
intended to prohibit their use, but rather to ensure that the contractor has
fully investigated their capability to perform satisfactorily in the intended
application and exercises proper care in the installation design.

Sliding-friction flexible controls were the first type used, and MIL-
C-7958 is oriented to that type. However, because of their higher efficiency,
the ball-bearing type has come into use for a number of recent applications.
These include engine controls, wing sweep and flap controls, and wheel brake
and landing gear controls on the F-Ill and rudder control on the F-15.

Installation of the bali-bearing type generally requires more care than

for sliding friction controls. With the latter, Lare must be taken in the
installation design to limit the number of bends so that friction forces do
not become excessive; and, in the actual installation, they must not be
forced into other than a natural curve. The b..lk-bearing types are more
sensitive to installation error. All bends musu be kept in a single plane or
the control helixed into other bend planes at a controlled rate (within a
limited rotational arc per unit length) to prevent binding or damage. They
must also be supported at frequent intervals, but not so tightly that the
conduit is restrained axially or pinched where motion of the internal compon-
ents may be impaired. Routing should preclude personnel using them as steps
and handholds per 3.2.3.1.1.

135
3.2.3.3 Electrical signal transmission. The following requirements apply
to all essential and flight phase essenti1al signal paths. Except for power
sources, such systems shall be independent of failure modes associated with
any other electrical system. Cross connections between redundant electrical
signal paths shall be eliminated, or minimized and electrically isolated.
Wire runs and components in redundant control paths shall be physically
separated and electrical shielding shall be installed, as necessary, to meet
failure immunity and invulnerability requircments. All interconnecting wir-
ing shall be prefabricated, jacketed cable assemblies. The outer jackets
shall be identifiable by a unique color or other means. Wiring installation
shall be in accordance with MIL-W-5088.

DISCUSS ION

Requirements for electrical power sources are discussed in detail in

3.2.5.4. Failure immunity requirements which permit loss of only one redun-
dant channel due to any single failure, not extremely remote, are discussed
in 3.1.3. Identifying each channel supplying essential and flight phase
essential systems will serve to prevent damage from careless maintenance.

Wiripg associated with redundant systems must be adequately sefarated

and/or protected from hazards such as:

Wire bundle fire

Equipment or junction box fire

Connector shorting or decoupling

Fuel Fire

Engine case burn through

Turbine burst fragments (including turbofans and starter turbines)

Battery chemical leakage

Abrasion from rocks, ice, and mud

Burst hot air ducting

Lightning currents from plausible failxres of lightning protection

Various systemr of bundle routing, raceway selection or wire protection

may be developed. For circuits which are to be separated from one another
for reasons other than EMI, adequate separation can normally be a!hieved by:

Physical separation by either routing in separate bundles or

raceways, by maintaining a safe clearance from other wires, or by enclosing
the critical wire in suitable sleeving or tape.

Never routing through the same connector.

Not routing through the same junction box.

136
 Not routing through areas where excessive environnmental conditions
or mechanical failures can adversely affect any redundant system wiring,
e.g., turbine burst envelopes, hot air from a burst pneumatic duct, etc.

Within the AFCS, a critical wire may be defined as any wire which, when
grounded, opened, shorted to an energized power source or an adjacent signal-
carrying wire will induce one of the following:

Bypass a monitoring function.

Create a simultaneous fault in any two identical control channels

or any two identical sensors.

Cause any two identical control channels to receive a single-

source input signal.

Inhibit the commanded disengagement of a control. channel or its

hydraulic servo package.

In fail-operational autopilot packaging particular care must be exer-

cised to ensure that system isolation is not jeopardized at the mode select
panel, the automatic test unit, and the accessory boxes, In these areas,
cables should be routed with suitable physical separation or shield protec-
tion to separate connectors. In addition, automatic control and flight
director signals should be isolated from each other such that failure in one,
downstream of the last comm~on tie, does not have an adverse effect upon the
other.

3.2.3.3.1 Electrical flight control (EFC) interconnections. EFC(6.6) wiring

in individual channels shall be routed, isolated and protected to minimize
the applicable threats to redundancy. Channel loss due to any foreseeableI
hazard, not extremely remote, shall be limited to a maximum of a single chan-
nel. The adequacy of the separation, isolation and protection attainable in
any given location for any given hazard shall be evaluated for each aircraftI
design. Additional protection shall be provided for the EFC wiring where
analysis shows that any single hazardous event, not extremely remote, could
cause the loss of more than one EFC channel. Primary structural components
shall be used to afford this protection where possible. Where it is approved
by the procuring activity to route the EFC wiring through wheel wells or other
areas subjected, during flight, to the slipstream or impingement of runway
fluids, gravel, etc., the wiring shall be protected by enclosures and routed
directly through without unnecessary termination or junctions. Where termina-
tions or junctions to equipment in these areas are required, they shall be
protect.~d from such impingements. This shall also 'be done in areas where a
high level of maintenance is likely to be required on other systems and
equipment.

DISCUSS ION

These requirements are based on the Reference 76 handbook which was

generated under an AFFDL contract. The handbook recommendations were based
on Apollo techniques and hardware, proposed technical and hardware for the
American SST and on information from the Air Force Survivable Flight Control
* System Program.

137

... .-
.........
 I I,
These channel separation and routing requirements are in addition to the
overall. reliability and vulnerability requirsments stated in 3.1.7 and 3.1.9,
and amplify the failure immunity requirements of 3.1.3. The general relia-
bility and vulnerability requirements may lead to even more 3Lringent inter-
connection requirements than the minimum requirements stated here.
lazards which should be considered as foreseeable hazarus in most appli-

cations include:

Combat damage

Localized fire

Turbine burst

Tire burst

Collision

EMI

Lightning

Static electricity

Chemical Damage

Isolation is needed to assure that no single failure(s), not extremely

remote, of other systems (including wiring failures in other systems) do not
cause failures in the EFC wiring. Isolation may also be needed to minimize
electromagnetic interference and electromagnetic pulse pickup. As specified,
each situation must be analyzed and where attainable isolation oi channel
separation is inadequate, protective measures must be taken.

3.2.3.3.1.1 Cable assembly design and construction. The outer jacketing for
EFC wiring shall not create stresses on the wire and connector terminations
and shall not stress the wires in a mauner which opens the connector grommet
seals. During design of the cable assemblies, particular attention shall be
paid to the requirements of the circuits within the cable and adequate EMI
and EMP control methods, e.g., shielding, twisting, etc., shall be incorpor-
ated into the design. Where shielded wires are used provisions shall be
made for carrying the shields through the connectors where single point
grounding is necessary. A signal return wire shall be provided for each
signal level circuit in the cables. All cable assemblies shall be constructed
in an area with temperature and humidity controls and positive pressure venti-
lation and shall be cleaned (all wire cuttings, etc., removed) and inspected
after layup and prior to jacketing to assure that no potentiallv damaging
particles have been included. parLicularly at the entrance to the grommet
seal. All cable assembiies shall be constructed, tested and inspected by
specially trained and certified personnel. Terminal boards shall not be
used in EFC wiring. Splices shall be qualified. permanent-type splices.

138
3.2.3.3.1.2 Wire terminations. C ii p type wi re I'lI n,1, 1o,0 (,'
kp de , lug ,I
connector) shall be used on all 1EFC cables. Soldered :Oth potted ,,oiniecttoiis
shall not be used. With the terminal installed onl the wite, the wire Shal I
be visible for in, , ection at both ends of the crimp bire a L. The length (,i
wire visible be:- niý- insulation and barrel shabll 10nt ex coed ,1/10 inci.

3.2.3.3.1.3 .I. cLion and rep] icewent. The ,1( witill' shal.l b.- lnstoll l-i
so that it I be inspected for damage and replaced as necessary. The instal--
lation shall provide for visual inspection in critical areas .,uch as hazard-
ous environment areas or areas where a high leveL of maintenance is requtired
on system or equipment in close proximity.

3.2.3.3.2 Multiplexing. Multipi exed signal Lransmissiolt ,.".rckuits shall be

the digital time- ivision-multiplexing type utilizing a twisted shi.elded
pair cable as the transmission media for the multiple), bus. The multiplex
data bus line and its interface electronics, multiplex terminal. unit shall
meet MIL-STD-1553.

DISCUSSION

MIL-STD-1553 deals with twisted shielded pair multiplex bus. It CoVeUrS

the data bus characteristics, the interface between the data and the remote
terminal, and the interface between the principal parts of the temote term--
inal. The interface between the remote terminal and the subsystem is not
part of the standard.

Reference 77 describes trade studJes supporting the selection ot a

fly-by-wire multiplexing concept. Arguments for selecting the preferred
multiplex concept are presented and several potential alternatives are
described. Referance 78 describes bench testing of the breadboard demon-
strator developed. Reference 79 describes the design, qualification test--
ing and flight testing of flight--.worthy tultip.lexitig hardware in an NC-i It
Inflight Simulator Airplane.

Reference 80 answers the question: "Why Multiplex Data in an Aircraft

Electrical System'?" This reference predicts equal or improved performalice
in the following areas due to use of multip.lexing In aircraft sylstems:

Weight

Redundancy/Reliabil i t.y

Growth and Flexibility

Maintainability

Cost

I 39
3.2.4 Signal computation,

DISCUSS ION

With the increased~ use of computers in flight control systems, a

need for specification requirements has developed. General design require-
ments pertaining to control signal computation subsystems have been compiled
in this section. Prior to procurement-of the flight control system couiputa-
tion equipment, the contractor should establish the type of computer to be
used for each flight control function and its relationship with other com-
puters used on the aircraft. The relative figures of merit of analog and
digital types, central versus dedicated or federated (semidedicated) types,
and in combining functions such as in a multipurpose air data computer, or
in an integrated automatic guidance and control system should be established
with care.lul attention to fac~tors such as mission environment and the various
threats and hazards.

3.2.4.1 General requirements.

3.2.4.1.1 Transient power effects. Flight control computers shall not

suffer adverse effects, which result in operation below FCS Operational
State I, due to power source variations within the limits specified for the
applicable power system. In the event of power source interruption, no
adverse effects shall result which limit operation or performance of flight
control computers upon resumption of normal quality power.

3.2.4.1.2 Interchangeability. The requirements of 3.2.7.1.2 shall be met,

and tolerances shall be such that interchange of any computer component.
module, or LRU with any other part bearing the same part number shall
require only minimum resetting of parameters or readjustment of other com-
ponents in order to maintain overall tolerances.

DISCUSS ION
The designer should ensure that multiple power systems per 3.2.5 asI
necessary to meet the reliability and invulnerability requirements specified
in 3.1.7 and 3.1.9, respectively, are provided. It should be noted that
mechanical computation means as specified herein include those means
powered mechanically from the pilot or from the operation of or feedback
from an actuated system or by fluid power from a hydraulic or pneumatic
power source.

One means of preventing voltage variations from changing the correla-

tion between commanded and actual values in FCS is to base both reference
and command signals on the same voltage source as the corresponding feed-
back signal.

3.2.4.1.3 CoMpute ignals.

3.2.4.1.3.1 Signal transmissions. Signal transmissions between computer

components and modules shall be done by using direct mechanical, hydraulic,
pneumatic, or electrical connections, as required. Use of light transmis-
sion technology or other nonconventional transmission paths requires
specific approval of the procuring activity.

140
 pr,",

3.2.4.1.3.2 Signal path protection. Where redundant computing paths are

provided they shall be isolated or separated when required to meet the
invulnerability requirements of 3.1.9.

DISCUSSION
The use of fiber optics or other c..,xnconextjional signal paths may be
considered in future computation equipmenti 'rtd, the requirement that
ecifi(
_ approval must be obtained not i0l'ended to prohibit their use
but rather to ensure that the contractor has fully investigated their capa-
bility to perform the essential functions reliably and can present substan-
tiating evidence for approval before committing designs. Environmental
conditions, loads, and life cycle requirements should be consistently
applied to all computer components that interface. In addition, separation
must be provided so that a failure at an interface will not cause the loss
of more than one computing system. Isolation and separation of redundant
computing paths must be consistent with the overall redundancy concept.

3.2.4.2 Mechanical signal computation.

3.2.4.2.1 Element loads. Mechanical computer signal transmission elements

subjected to the pilots' input force shall be capable of withstanding the
loads specified in 3.2.3.2.1.
DISCUSSION

Mechanical computation equipment include& mechanisms and hydraulic and

pneumatic components for scheduling, comparing, summing, computing, and
gain changing as required for input/output, mode control, and signal conver-
sion and transmission. Most of these computation elements are subjected to
the same loads applied to other signal transmission components.

3.2.4.2.2 Geared mechanisms. All geared mechanisms used in mechanical

computer components shall meet the requirements of MIL-G-6641.

DISCUSSION

Mechanical computer geared elements shall be designed so that backlash,

friction, and inertia are minimized as necessary to provide adequate sensi-
tivity between the input and output of the computer.

3.2.4.2.3 Hydraulic elements. Hydraulic computing elements shall be

designed in accordance with MIL-C-5503, MIL-H-8775, MIL-G-8890 or ARP 1281
as applicable. Specification MIL-V-27162 shall be used as a general guide
for the design of control valves used in hydraulic computing components.
DISCUSSION

Requirements for hydraulic elements of mechanical computers that are

integrated into the flight control system must be consistent with the require-
ments for other hydraulic elements in the system.
The performance characteristics of valves used in computers must be
adequate for the computer to achieve its required performance having taken
into consideration the effect of valve gain and friction on valve stability

141
and ere1is, VlblratIon of the cUMpIUtlU iUIi
. dit• ing li' J, 7lance testing
(auk
aS a means of meeting design requiremepts will not be allowed unless the
amp.litude and frequency of vibration is equivalent to the installed vibra-
t on environment in the aircraft.

3.2.4.2.4 _neumat lc eleQ.ut_, All. pneumatic, computing elements shall be

designeod In accordance with MIL-P...8564 and AFSC Design Handbook DH 1-6,
Section 3G, Pressurization and Pneumatic Systems, as applicable.

1)ISCU S S ION

Requiiements for pneumatic elements of mechanical computers that are

integrated into the flight control system must be consistent with the
requirements for other pneumatic elements in the system.

A dynamic and steady-state analysis should be accomplished on mech-

aiitcal computer systems to define the effect: on stability and/or stcady-
state varlations caused by manufacturing tolerances, wear, and environmental
conditions.

Most real systems are nonlinear to some extent, but the usual region of
operation is nearly linear. The purpose of this analysis is to study the
effects of nonLl.nearit'es and parameter variations inherent in the system,
such as friction, stiction, backlash, saturation, tolerances, wear, and
changes due to environment, which can be considered and the system designed
so that any adverse effects are unimportant or are compensated for.

Due to the failure immunity requirements stated herein, mechanical

computers must be designeo such that the airplane is capable of continued
norma.l flight and landing after any 6ingle failure in the computer system
whose. fail.ure probabil.ity is greater than extremely remote.

Requirements for mechanical computers that are integrated into the

flight control systems must be consistent with the other basic system
requirements. Consideration must be given to the prevention of jamming
mechanical computers by foreign objects, such as rags, bolts, and nuts.
This may be acomplished by, but not limited to, auequate clearance between
partoi, thi provision of shear outs and funk struts, or by permanently
att.achiod coveCs as the design dictates.

3.2.4. Elaetrcl st 1j..o.1p uat ions..

Wi SC] SSSLON

AI ll . ectrica. l signal complLpau tions to t ' light contirol system may

be cctigorI 7ed as being performed by either an analog or a digital computer,
and os such, are subject to the followilng requirement t . Signal computations
iIc.1d ,ii~Ii c ;sStmmation aid ampl.ifl.cation as well as the solution of complex
ctlip
at Omil t ic flight. control equations. Niial og computer equipment includes
ha rdwat , coliponetts5 .reiiired ILcr input/output, mode control, signal pro-
,:essi.ng, and control and signal transmission. Digital computation equipment
inc .`1udes hlardiware and asstic iated software for data' processing, program
storage, input/output, coatrol, *and signal. transmission.

"14 2

I...
. ....
3.2.4.3.1 jB_._comutatIo n.
Ana__ Redundant eletrteal signal pnaths within a
computer shall be isolated as requited by failure immunity and itivwlnera-
bility requirement specified herein. For failures which may cause. a
hazardous deviation in the airvraft flight path, the computer shall have
provisions for rapidly disabling its command outputs or servos unless other
fail-safe provisions exist.

DISCUSSION

The failure immunuity requirements of 3.1.3 and the associated rell:a-

bility and invulnerability requirements stated herein require isolation and
separation of redundant channels. This isolation should exint in computer
elements as well as in signal transmission lines. The designer should take
care that nonlinearities and variations in computer component characteristics
due to tolerances, wear, aging, and environmental conditions do not result
in failure to meet or maintain performa,.-ce or stability requirnments est.abh-
lished for the computer. Careful design will be required to satisfy the
stability margin requirements specified herein at the system level.

3.2.4.3.2 Digital computation. At the time of aircraft acceptance by the

procuring activity, the total time used in flight control computations for
worst case conditions shall not exceed 75 percent of the available computa-
tion time allocated for flight control use. Resident and bulk storage shall
be sized such that at least 25 percent of each type is available for growth
at the time of aircraft accepcance. Computation and sample rate shall he
established at a level which ensures that the ligital computation process
will not introduce unacceptable phase shift. round off error, nonlinear
characteristics, and frequency foldover or aliasting into the system response.

3.2.4.3.2.1 Memory protection. Memory protection features shall be pro-

vided to avoid inadvertent alteration of memory contents,. Memory protection
shall be such that neither electrical power source transients vithin tho
limits specificd nor FNI as specuified in 3.2.5.14.1 shall cause 1oss Of
program memory, memory, cramble, erroneouis commands, or loss (,f abl lilt
for continued operation. The transJetits shall be as spe-cified in M]lt-STD-704
for Category C utilization equipment. For applcatiotii, where systecm faI lures
could be hazardous to safety of flight, the levels for normal, abnormal,
and emergency electric system operation shall apply. For applications
which are n9t critical to safety of flight, thr levels for normal operatinn
shall apply. These transient requirements shall apply to cases when all
or only one of th? redundant power sources are operating.

3.2.4.3.2.2 Program scalLnj[. Pai aiieter scaling, word size input limiting,
and overflow protection shall ensure correct processing and continuous safe
operation for all possible combinations of maneuvering demand and gust or
other plausible disturbance within the service envelope of the system. Any
condition capable of producing an overflow in an essential or flight phase
essential function shall be precluded by hardware overflow detection and
software or firmware that provides for data recovery and continuous safe
operation following an overflow. Sealing shall provide satisfactory reso-
lution to prevent the granularity due to digitizing processes from intro-
ducing, into the system response, unacceptable levels of nonlinear
characterisCics or instabilities.

143
3.2.4-3.2.3 Software support. For programmable computers a software sup-
port nackage shall be provided to aid ini generation and 1'alidation of new
programs. This support package shall be designed to be executable, either
on the airborne computing system for which it warn designed or on a large
scale digital computer specified by the procuring agency. The support
package shall include the necessary software and appropriate peripheral
devices in accordance with the contractor data requirements list (DD 1423).

DISCUSSION

One of the more important advantages of digital computation compared

with the alternative analog mechanization is the ability to modify and add
to the functional capability of the original system with minor impact on
cost. This flexibility to accept changing requirements and the more
universal application of digital computers requires that the del.ivered
equipment have spare memory capacity and spare computation time available
for later use. Reference 12 describes digital vs. analog trades iude in a
recent development. Conclusions resulting from these trades are presented
for the AFCS and the MFCS.

Airborne digital computers are required to accept electrical power

supplies having degraded characteristics compared with normal power specifi-
cations for ground based computers. Considerable care is required to ensure
that the transients to be expected in airborne electrical power generation
do not cause loss of program memory. No special requirements should be
placed upon the aircraft electrical power system because digital computation
techniques are being used.

Fixed point processor hardware is expected to be used for airborne

flight control applications because of the reduced cost of this mechaniza-
tion. This Implies that the potential exists for exceeding the word size
and causing overflow during arithmetic operations. The computed output in
this event can go from large signal in one direction to a maximum hardover
in the opposite direction. The program scaling requirement is to design to
ensure that the software/hardware design is adequate in this regard.

In the process of providing overflow protection through parameter

scaling and word sizing there i.j an inherent tradeoff between resolution
and signal limiting. The effort to prevent overflow through scaling must
not degrade the resolution to a level which causes unacceptable limit cycle,
dead band, or hysteresis characteristics in the system response.

Scaling shall provide satisfactory resolution to prevent the granu-

larity due to the digitizing process from being apparent to the pilot and
providing the source of additional excitation energy for structural elastic
modes. Further, scaling shall provide satisfactory resolution and update
rate in the signal to the servovalve to prevent the granularity due to the
digitizing process from exciting the se~rvovalve in an unstable mode.
(Reference 79).

Software and software support packages are needed to ensure that the
procuring activity has complete control over maintenance of the delivered

144
equipment and the ability to make modifications as reqt.ired. Where general
purpope computers are used, the following programs should be provided:
assembler (or computer), linkage editor or loader, simulator or other debig-
ging aids.

Program documentation must be included as a part of the FCS Analysis

Report (4.4.3.1). Program documentation included therein should include:

A master program tape.

A source deck correspoxoding to the master tape.

Listings of the program.

Flow charts illustrating the program organiz~ation, timing and

logic.
Input-Output data specifications.

The need for peripheral device is determined by the software used.

Typical devices include card and paper tape readers, magrutic tape, disc
files, high speed printers, teletypewriters, and magnetic tape output.

3.2.5 Control power.

3.2.5.1 Power capacity. Sufficient electrical, hydraulic, and pneumatic

power capacity shall be provided in all flight phases and with all corres-
ponding engine speed settings such that the probability of losing the
capability to maintain at least FCS Operational State III airplane perform-
ance shall be not greater than extremely remote when considering the com-
bined probability of system and component failure and the cumulative
exceedance probability of turbulence. Hydraulic power shall be used to
actuate powered essential and flight phase essential MFKS.

DISCUSS ION

The trend toward neutral or negative aerodynamic stability, with

increased reliance on artificial stabilization in high performance aircraft.
increases surface actuation rate demands. This in turn increases the size,
weight, and cost of the power systems. Therefore, it is very important that
a careful analysis of requirements be made as early as possible in the air-
craft development phase~ since these requirements impact the procurement of
many long lead items such as hydraulic pumps, control valves, reservoirs,
tubing, and the prime movers such as engine power takeoffs and APU's.

In many cases, the power requirements can only be optimized by deter-

mining control rate requirements on a realistic flight simulator "flown"
by typical service pilots. The simulation should include turbulence
intensity levels, as specified in 3.1.3.7. To determine control, surface
rates and power requirements under system partial failure conditions,
reduced turbulence Intensities (s~uch that the combined probability of
turbulence and of each selected failure condition equal the maximum allow-
able failure rate for the specified flight-safety reliability requirement)
shovld be used.

! 45
 The filtent or the rt'quiremout to u-e hydraulic power for MFCS is not
to prollibIt; uI5e of aerodlvnamtcaliy boosted (control tab) controls. Vse of
,Jectrical nr pnuontivit Ic power- except for noncritical applications, will
req ,•'ieo approv, 1l of- oWroc
pi .1r g activity,

S.5)2 Pujri rt It' . Essential and flight phascw essential flight controls
sha 1I. be given prioritv over nonicritleal. controls and other acttiated
futltetios duit tug s tmu tnlteouý, denind operation. However, no specific
priority provi.sIons, -.110h as hydraulic prLorttv valves, are required unless
there is a lkel I hood oft simultaneous demands which could prevent one or
more os.ential or tflight phase esseatial actuation systems from meeting
their performance rquirements, Where provided, priority controls shall be
highly resitstant to deterloration, binding, or failure while dormant under
M111a1 aircraft operations so that they willI function as required when
colikittiois( di.etate, If t Ilght safety can be endangered by failure of such
control ,, ground cleckout means for ready determination oF their opera-
hitI It shal'l he provided and vrocedures specified.

1 1.SC:U SS ION

With the use of fully powered flight control systems powered by

hvdraul tc or vlectric systems that also supply other loads, care must be
ta-Iken to ensure that power d'o.mands of those other functions do not deprive
essent ia I flight control actLuatlon, subsvstmnts kf sufficient power to perform
their functions. In many cases, the power d,'mands for landing gear retrac-
tion and extension are greater than required for flight control; and, during
landtig gear operation by hydraulic systems which also supply utility
t'uc t ionS, (su8,h a1 where the dedicated hydraulic system has failed), pro-
visions must !,,. madet to prevent disruption of flow to the essential flight
con t r o I

I.".', tlvdiau••ci' ,ey subs'stems,.

All
MI yaul ic power generated and
" Ji.iil i-ii cýst ., - mria I yy used H igbt control shall be designed in
f,,r
• 'oidanc,, wttii bl-.l -.'44t -t no --II--8891 as zippl icable. The FCS shall
Ope tlte ill accordame e with thhis specifi aeat ion when supplied with such
hvdrakuI It, power. \App, ticible requirementts in AFSC Design Handbook DH 1-6,
1v'stqins Safet y, So t: Ln IIF, 11ydratilic Systems, shall also be met.

ii! 5C1185 ION

t
t:vd'v;11,,Ic
po'e U , r u1'c Tit0, tull\ -- powered essential and flight phase
eq-0I,•[/ MF(CS, is sp'.,it 'ed oo the basis of proven performance and ability
to pr )vide high force outptI'Lits width minimum weight . Use of electrical-
iec11IUnal.Ca neCtuat t.en or prOm'ttIC power wll1 require justification and
specific approval by the procuring activity. Development work directed
toward use of liquid metal as hydraulic fluid is described in Reference
81, and may be further pursued in the future.

Requirements stated herein which may determine hydraulic capacity

include: MFCS and AFfCS performance (3.1.1 and 3.1.2), failure immunity and
safety (3.1.n,2) nd opeoation In turbulence (3.1.3.7).

146
 Redundancy Is specified by 3,1.3.1 at the system level. However, it
must be recognized that hydraulic system failures can be a major cause of
flight control system failure, and the MIL--H-5440 requirement to keep at
least one system free of any noncritical system functions has been in
effect for many years. There are many aircraft, however, which require
two or more power sources for actuation of utility or noncritical flight
control functions. In the past, these have often been actuated by an
alternate power means, such as a stored-gas-high-pressure pneumatic system
for emergency landing gear extension, or an electric motor for emergency
flap extension. However, as such loads become higher, such as due to
increased aircraft size or speed, there is more incentive to operate
hydraulically. Therefore, if it is clearly shown that significant penal-
ties can be avoided by t ilizing the "dedicated" hydraulic system as an
alternate source of power for the utility or noncritical flipht control
function, the procuring activity may entertain a request for deviation to
the MIL-H-5440 requirement if a reliable isolation shutoff valve can be
provided.

3.2.5.4 Electrical power subsystems. All electrical power generation and

distribu.tion subsystems used for flight control shall provide electrical
power in accordance with MIL.STD-704. The FCS shall operate in accordance
with this specification when supplied with power in accordance with
MIL-STD-704. Applicable requirements in the following AFSC design hand-
books shall be met:

a, DH 1-4: Electromagne•lc Compatibility.

b. DH 1-6: System Safety.

c. DH 2-1: Airframe.

d. DH 2-2: Crew Stations and Passenger Accommodations. I

Electrical systems which provide power to essential or flight phase
esseatial controls, shall insure uninterruptible, isolated redundant power
of adequate quality to meet FCS requirements a:ter any malfunction uot
considered extremely remote. Such electrical systems shall, except for
basic power source, be independent of failure modes associated with any
other electrical system. Essential and flight phase essential FCS shall
be automatically provided altecnate sources of power wheie interruption
could result in operation below FCS Operational State III. A protected
alternate source of power shall be provided for all eusential or flight
phase essential control signal transmission paths sufficient to continu-
ously maintain at least FCS Operational State III performince in the -vent
of loss of all electrical power supplied from engine-driven generators.
Control systems employing both ac and dc power inputs shall normally have
interlocks incorporated to disconnect both power inputs should either type
of power be lost. However, if the loss of either power source can be shown
to be equivalent to loss of both or FCS Operational State III or better is
maintained with either power source, interlocks are not required.

147
3.2.5.4.1 Electromagnetic interference limits. The FCS shall operate
within the limits of MIL-E-6051 and MIL-STD-461 environment. Electro-
magnetic interference created by the systems and components during normal
operation shall be within the limits of MIL-E-6051 and MIL--STD-461,
respectively. Failure modes of all onboard systems and equipment, includ-
ing flight controls, wherein these limits may be exceeded shall be identi-
fied in addition to sources of conducted EMI that may be detrimental to
FCS operation. Additionally, the estimated magnitude of EMI generated by
these failure modes shall be provided for the assessment of the safety of
the EFCS.

3.2.5.4.2 Overload protection. Overload protection of the primary power

wiring to the system or component shall be provided by the airplane con-
tractor. Installation requirements of the system or component specifica-
Lion shall specify the values of starting current versus time, surge
currents if applicable, normal operating current, and recommended protec-
tive provisions. Additional protection as necessary shall be provided
within the system or component. Such circuit protection shall not be
provided in signal circuits or oher circuits where opening of the protec-
tive devices viill result in unsafe motion of the aircraft.

3.2.5.4.3 Phase separation and polarity reversal protection. In systems

affecting flight safety, phase rwvL sal and polarity reversal shall I
prevented as far as practical by keying, physical restraints or other
positive means.

DISCUSSION

Clectrically powered controls which can be considered essential to safe

tlight include AFCS aui.oland controls, certain command augmentation and
stability augmentation systems, and all Electrical Flight Control (fly-by-
wire) systems. In order to meet flight-safety requirements, these systems
ace redundant so that the critical control function will he maintained
even when failures occur. Their electrical power sources in the FCS and
from the aircraft must be equally dependable and redundant.

The requirement for redundancy has the greatest impact on the design
of generating system configurations. A singlc fault on any part of a
p)aralleled multichannel generating system will result in loss of power to
all airplane systems until the fault is cleared. During certain extreme
c-ises, this could takti up to 3 or 4 seconds and could occur during a
critical period such as the final moments ot an automatic landing. Electri-
c-i ir-olation of the generating systems would prevent a single fault from
* £ecting more than one channel of flight-critical e',ipment.

The degree of isolation and the number of isolated channels that may be
•.equired will be dependent on the specific requirements for the airplane in
question. In general, an independent source of electrical power will be
r'cquired for each redundant channel of essential or flight phase essential
.•ontrol sys.tems.

148
 Isolated Versus Parallel Operation of Generators

Parallel operation of multichannel (three or more) generating

systems may offer considerable performance and economic advantages over a
system composed of isolated channels. However, parallel operation
includes the possibility of a single fault causing trips of more than one
channel or an overload momentarily affecting and degrading power to all
airplane loads. Also, the load division circuitry required for parallel
operation adds complexity to the generating system and increases the
chances for malfunctions which could cause the temporary loss of one or
more generating channels.

Essential and flight phase essential control syste•is are provided

in tarying degrees of redundancy, and this imposes the requirci-ent that
power sources to these systems be equally reliable. A parallel system, if
composed of three or four generating channels, will be a highly reliable
source, but it is vulnerable to several single failure .iodes (failure of
current transformer shorting contacts, excitation loss, open current trans-
former loop, main bus or load circuit faults, synch bus faults), which can
transiently interrupt or seriously degrade the quality of power on all main
buses simultaneously. Abnormal power quality will be supplied to all loads
for a time ranging from 0.020 to 3.0 seconds. This time is dependent on
the specific type of failure and the delays associated with the protective
circuitry. It should bo noted, however, that simultaneous failures will
be normally of very short duration and will be automatically cleared from
all but the faulted bus. In the unlikely event that multiple failures
result in an inability of the system to automatically clear a fault, proper
crew action can restore power to the unfaulted buses. Past experience shows
that nuisance trips can occur which may result in overloading of the remain-
ing channels and a brief "all power lost" situation.
fhe required reliability of power sources may be provided most
simply by isolating redtndant genei ting channels and, in effect, providing
two, three, or four generating channels with no interconnecting ties between
buses. This isolation ensures that a fault on one channel cannot affect the
others. However, isolation also means that system overload capabilities are
decreased from those of a parallel system of equal rating; and, isolation
may impose weight penalties on the airplane design if sufficient generating
system capacity with provisions for future growth and overload capability
is to be obtained. The degree to which power sources must be isolated is
peculiar to each design and application.

Redundant Power Sources

The concept of isolation, as mentioned i the paragraph above,

provides redundancy equal to the number of generating channels. The redun-
dancy of power sources, however, is expected to be equal to the number of
redundant channels of flight-critical equipment. Autoland systems are
being proposed in triple redundant, fail-operative versions. If this
system was installed in a two-engine airplane (two isolated generating
channels) a third power source should be provided. A battery-inverter
standby system may be considered as a redundant source, but its capacity

149
 .~~~~~~~~- .w -7 -- -- . .. .. .. . .. ............. n .

severely limits the loads which can be operated from it. A third isolated
generating channel, operating continuously, would be required to satisfy
the redundancy definition, and its capacity must be adequate for one set
of load equipment. Monopropellant emergency power turbine generators are
now being installed in several fighter aircraft for an independent baeJkup
power source.

A combination of parallel and isolated operation can also be con-

sidered (for example, a four channel system operating with channels one and
two paralleled and channels three and four parralleled, but one a'Id two are
isolated from three and four). These four channels are essentially two
isolated sources, and if more redundancy is required, additional isolated
sources would be required.

Power Limiting Devices

As mentioned above, the degree of isolation of isolated generating

system channels can be compromised by a switchable bus. A transfer bus (to
which essential loads are connected) is generally arranged so that loss of
power to it would cause it to be transferred to the alternate source of
power. This switching capability may well compromise the integrity of both
of these power sources in that a fault in the critical load equipment (or
on it-s bus) could be applied to one bus and then the other after switching.
For this reason, a transfer bus scheme should not be considered for rn air-
plane with essential electrical control systems unless a device is included
in series with the transfer bus that eliminates the possibility of a single
fault causing unacceptable disturbances to more than one power source.

The development of a practical and reliable power (or current)

limiting device for this purpose would simplify power system design for
critical loads. Some of the basic requirements of a power limited device
are as follows:
Sized to coordinate with the largest thermal circuit braakerI
connected to the priority bus.

Sized to carry the maximum startup load connected.

Capable of dissipating the electrical losses incurred during

maximum load and faulted operation,

Self-cooling--no cooling air would be supplied.

Reliability must be of exceptionally high order.

Failures must be passive, i.e., must not fault the main bus
due to component failure of the device.

Waveform deterioration during limiting mode must not be

severe enough to cause damage to any of the connected loads.

150
3.2.5.5 Pneumatic power subsystems. Pneumatic power using ram-air, engine
bleed air, 9'ored gas, mechanically compressed air, or generated gas may be
used for nonzritical flight control functions and for driving hydraulic
pumps and eiectric generators. High pressure pneumatic systems used for
FCS functions shall conform to MIL-P-5518, the applicable requirements in
AFSC Design Handbook DH 1-6: System Safety, Section 3G: Pressurization
and Pneumatic Systems, and the applicable requivements under 3.2.5.1,
Hydraulic Power Subsystems, herein. Engine bleed air systems shall conform
to MIL-E-38453.

DISCUSSION

This requirement was expanded to include ram-air and engine bleed air
sources in recognition that low-pressure pneumatic sources are readily
available on jet aircraft and have been and will continue to be considered
and used for powering noncritical flight control functions. Neither high-
pressure nor low-pressure pneumatic sources appear feasible for powering
essential or flight phase essential functions, other than hydraulic pumps
and electric generators, at this time.

This requirement is not meant to apply to boundary layer control as

may be used for short field takeoff aad landing applications.

3.2.6 Actuation

3.2.6.1 Load capability

3.2.6.1.1 Load capability of elements subjected to pilot loads. Elements

of actuation systems subjected to loads generated by the pilot(s) shall be
capable of withstanding the loads due to the pilot's input limits specified
in MIL-A-8865, Section 3.7, Flight Control System Loads, taken as limit
loads, unless higher loads can be imposed such as by a powered actuation
system or loads resulting from aerodynamic forces, Control signal boost
actuator outputs may be load limited by spring cartridges.

3.2.6.1.2 Load capability of elements driven by power actuators. Elements

subjected to loads generated by a powered actuation system, including all
parts of the actuator shall be capable of withstanding the maximum output
of the actuation system, including loads due to bottoming, or the maximum
blowback load, as controlled by pressure relief valves or other load
limiting provisions, whichever is greater, as the limit load. Ultimate
load capability shall be 1.5 times limit load. In dual load path design,
each path shall be capable of sustaining load as specified in 3.1.11.1.2
without failure.

DISCUSSION

These requirements have been included to clearly define the load capa-
bility requirements for both the signal input and the output force elements
of actuation subsystems and apply to control signal boost actuators as well
as to surface positioning o'ctuators.

151
3.2.6.2 Mechanical force transmitting actuation. For control cable actua-
tion, the requirements specified in 3.2.3.2.4 and subparagraphs apply. For
push-pull rod actuation, the requirements specified in 3.2.3.2.5 and sub-
paragraphs apply.

3.2.6.2.1 Force transmitting powerscrews. Powerscrews with rotary input

and linear output motion may be used to actuate relatively low-duty-cycle
flight control surfaces, such as wing flaps and trimmable stabilizers, but
specific approval from the procuring activity shall be obtained before use
in high-duty-cycle applications. Nonjamming mechanical stops shall be pro-
vided at both ends of the screw to limit travel of the nut; and, they shall
be designed to withstand all possible loads, including possible impact
loading, without failure. Provisions shall be incorporated into the nut
to minimize entry of sand, dist, and other contaminants; to retain its
lubricant; and to preclude the entry or retention of water. However, posi-
tive sealing is not required if the screw is installed such that it is
protected from such contamination or is inherently resistant to wear and
jamming by contamination.

3.2.6.2.1.1 Threaded powerscrews. Standard thread forms only shall be used,

and the thread roots shall be rounded as necessary to preclude stress crack-
ing. Lubrication provisions shall be adequate for controlling efficiency,
wear, and heating to acceptable values. Where in service lubrication is
necessary, lube fittings in accordance with 3.2.7.2.5 shall be provided.
If the design is dependent on inherent friction to maintain irreversibility,
this characteristic must be adequate under all expected operating conditions,
including the full range of loads, both steady loads and reversing or
variable-magnitude loads which may be encountered due to control surface
buffeting or buzz, temperatures, and environmental vibration over the full
service life of the unit.

3.2.6.2.1.2 Ballscrews. An adequate number of balls and ball circuits shall

be provided to keep individual ball loading within allowable nonbrinelling
limits. On units used in essential and flight phase essential applications,
at least two separate independent ball circuits and a secondary load path
with load capability per 3.1.11.1.2 shall be incorporated.

DISCUSSION

Force transmitting powerscrews have been used for a long time for non-
critical flight control applications (e.g., landing gear actuation on B-17,
B-29, B-50, and B-47 airplanes, and flaps and stabilizer trim on B-52, KC-135,
and many commercial airliners), but as yet not for actuation of essential
control surfaces. The requirement that specific approval must be obtained
before using powerscrews for high-duty-cycle applications is not intended
to prohibit their use, but rather, to ensure that the contractor has fully
investigated their capability to perform reliably under required conditions
and can present substantiating evidence for approval before committing the
design. Trim actuators including those commanded by AFCS, are usually con-
sidered in the low-duty-cycle category. A nonjamming stop is one which does
not prevent actuation of the nut by the normal means.

152
 One detail point to note here is that highly loaded threaded powor-
screws develop considerable friction, and the design and lubrication
provisions must be thoroughly evaluated by analysis and supplemented by
rigorous testing under realistic operating conditions. Lubrication
provisions must be adequate for controlling efficiency, wear, and heating
to acceptable values.

A prime example is the F-ill Acme threaded powerscrew used for variable
wingsweep actuation. An extensive trial and error development program, in
which a great number of material combinations were evaluated, was required
to produce the grease-lubricated teflon and fiberglass cloth lined screw
nut design which eventually met the design requirements.

3.2.6.3 Mechanical torque transmitting actuation. Specific approval from

the procuring activity must be obtained before use of such provisions in
essential and flight phase essential applications. Backlash accumulation
shall not prevent the system from performing its required function throughout
the service life of the airplane.

3.2.6.3.1 Torque tube systems. Torque tubes which are exposed to possible
misuse, such as support for maintenance personnel, shall be shielded from
such misuse or shall be of adequate stiffness to prevent damage to the instal-
lation. Each torque tube, in a linked run of tubes shall be removable and
reinstallable in the aircraft without disturbing the support, component, or
other interfacing system element at either end of the torque tube. Guards
which are capable of containing a broken torque tube against thrashing shall
be installed in appropriate locations to prevent damage to wiring, tubing,
and other equipment. The rated operating speed of a torque tube system
sha'.1 be no greater than 75 percent of the critical speed.

3.2.6.3.1.1 Torque tubes. Torque tubes shall have a minimum wall thickness
of 0.035 inch and shall be seamless, except that steel tubes, seam welded by
the electrical resistance method, may be used.

3.2.6.3.1.2 Universal joints. Universal joints shall be in accordance with

MIL-J-6193 or MIL-U-3963, as specified in AFSC Design Handbook DH 1-2, Gen-
eral Design Factors, Section 4C, Universal Joints, and shall not be used
for angularities greater than specified therein or recommended for the
specific component by the manufacturer.

3.2.6.3.1.3 Slip joints. Adequate engagement shall be provided to insure

that disengagement will not occur under all expected operating conditions,
or due to buildup of adverse manufacturing and installation tolerances.

DISCUSSION

Torque tubes systems have been used on many aircraft, primarily f9r
actuation of trailing edge flaps, and the foregoing requirements have become
well established. The requirement that specific approval is required before
using torque transmissions in essential applications is not intended to
prohibit their use, but rather to ensure that the contractor has fully inves-
tigated all components, e.g.,; gear boxes, powerscrews, rotary actuators,
etc., to ensure they can perform reliably under all operating conditions.

153
 I'!
All torque tubes should be mounted on antifriction bearings with
supported couplers (jackshafts mounted to structure on antifriction bear-
ings) spaced at close enough intervals and with sufficient misalignment
capability (within the couplers) to prevent undesirable bending or whipping
of the tubes. In addition, the prevention of spark generation in fuel
system areas should be given careful consideration in the detail design.

A minimum of parts, joints, and related components should be used to

accomplish the required purposet however, it must be possible to remove the
torque tube sections from the airplane and replace them readily.

3.2.6.3.2 Gearing. All gear boxes used in actuating systems shall meet
the requirements specified in MIL-G-66Il.

3.2.6.3.3 Flexible shafting. Flexible shafting may be used providing that

minimum bend radii, rated rotational speed, and rated torque are not ex-
ceeded, and that extreme temperatures and other operational variations and
environments do not cause binding. Flexible shafts shall be installed with
the fewest possible bends and shall be securely fastened to supporting
structure at close intervals.

3.2.6.3.4 Helical splines. Involute helical splines shall use only the ASA
standard tooth forms Numbers 1 through 5. Ballsplines shall meet the
requirements specified in 3.2.6.2.1.2 for ballscrews.

DISCUSSION

Helical splines (also known as Yankee screw drivers) have not yet been
used in flight control actuation systems but are getting more and more
attention as the needs to design mechanisms which can transmit high torque
(or translate linear force to torque) in thin airfoil sections increase.
When used, lubrication provisions must be adequate for controlling
efficiency, wear, and heating to acceptable values. If the design is
dependent on inherent friction to maintain irreversibility, this character-
istic must be adequate under all expected operating conditions including
the full range of loads, temperatures, and environmental vibration over the
full service life of the unit, both steady loads and reversing or variable-
magnitude loads which may be encountered due to control surface loads,
buffeting, or buzz.

3.2.6.3.5 Rotary mechanical actuators. Rotary mechanical actuators used

with a through shaft which attaches to torque tubes at both ends, thus
serving as a portion of the torque distribution system, shall be capable of
reacting full system torque in both the forward direction (due to a jam
anywhere in the system) .r in the backdriving direction (due to overrunning
load), unless provided with a torque limiter and nc-back brake or other
devices which would preclude such loading.

3.2.6.3.6 Torque iimiters. Where used, torque limiters designed to slip or

lock to adjacent structure shall be properly located in the transmission
system to prevent drive loads in excess of control surface limit load from
being transmitted past the limiter in the event of overload or jamming.

154
The rate of application of the limiter(s) and the spring rate ot the trans--
mission system shall be matched so that the stress in any member due to
sudden application does not exceed its yield strength.

3.2.6.3.7 No-Back brakes. No-back brakes shall prevent back drivhng (or
feedback) forces imposed on the output of an actuating methanism from
being converted to torques which can cause the input shaft to rotate. II
no-back brakes of the dissipative type, provislons shall. be included to
distribute beat generated bN the brake so that temperatu0re liitations are
not exceeded.

DISCUSSION

Rotary mechanical actuators (often .'eferred to as power: hinges) with

torque limiters and no-back brakes have been used in some relatively recent
applications e.g., wing tip fold actuation on the RS-70, weapon bay door
actuation on the F-ill, and leading edge flap actuation on the Boeing 747)
but, prior to their selection for actuation of the B-i rudder, have not
been used for actuation of a primary control surface.

As an alternate to a no-back brake, a mechAnically irreversible actuator

may be used providing it can react rated static limit load applied to the
output coupling with the input coupling discounected, without being hack-
driven while being subject to any vibration condition within the required
vibration envelop or spectrum. Where torque limite,.s are used, it is
desirable that they release upon removal of the downstream Janwing load
without a requirement for change in the upstream torque value or direction.

3.2.6.4 Hydraulic actuation. Hydraulic actuation component.- shall be

designed in accordance with MIL-H-8775 or MIL-H-8890, and specific component
specifications as applicable. If hydraulic bypass privisions are necessary
to prevent fluid lock or excessive friction load ot damfpig, bypassing and
resetting shall occur automatically when system pressure drops below or
returns to the minimum acceptable value for actuation. In actuation systers
designed for manual control following hydraulic failure, provisions shall be
made to permit bypassing of the hydraulic systems fo, checkout purposes and
to permit pilot training with the emergency manual system.

3.2.6.4.1 Hydraulic servoactuators. Hydra 3Orvoactuators shahl be

designed in accordance with ARP 1281. Elec, traullc servovalves shall he
designed in accordance with MIL--V-27162. If electrical-input hydraulic
servovalves having mechanical feedback ot actuator position are used, the
applicable requirements of ARP' 988 shall be met.

DISCUSSION

The aval.lability of ARP 1281. by the SAE allows the deiet ion of a number
of detail design requirements for hydraulic 6ervoactuadtors from this speci-
fication. It is prepared in the format of a MIL spec I icat iou, and Is p)lanrc
to be released as such following proper coordination.

155
 MIL-V-27162 for electrohydraulic servovalves has recently been updated
incorporating application requirements in ARP 490. Electrohydraulic servo-
valves with mechanical feedback of actuator position are not generally used,
and ARP 988 is considered adequate at this time. One application where
they were used, which was used as the primary model for the requirements in
that document, was in the spoiler servoactuators on the F-111.

Actuator Stability

ARP 1281 specifies that the detail specification shall indicate

required servoactuator and mounting structure spring rate, structural mount-
ing arrangement of mechanical input member, and stability requirements. To
determine the absolute stability of an actuation system, the open-loop
transfer functions may be written, and Nyquist's stability criterion applied.
However, the basic requirements for stability are satisfied whenever the
actuator's dynamic stiffness is greater than its static stiffness. Limit-
cycle type instabilities can also arise as a result of adverse distribution
of nonlinearities in the system due to wear' of components, friction, and
erosion of the control valve.

The actuator's dynamic stiffness, which is discussed following

3.1.11.2, must be higher than its statiu stiffness in order to produce a
stable system (unless complex frequency-dependent pressure gain control is
employed). Overall stiffness, is basically determined by flutter resis-
tance requirements rather than actuator stability or dynamic response
requirements. The spring rate of the actuator and backup structure should
be as high as possible but not Lo the extent that weight penalties are
introduced after the flutter stiffness requirements are met.

With the advent of so-called irreversible flight controls, the

philosophy has often been to design the stiffest system possible. Normally,
this has also meant the highest possible static stiffness, which has often
resulted in a number of stability problems.
The proper approach to the stiffness design is to first of all
determine what is the lowest permissible static stiffness for the system at
hand. The main considerations are: flutter resistance, required surface
position resolution, the allowable change in gearing between the control
surface and the pilot's controls with hinge moment changes, and the allow-
able control surface deflection with no input command which will not
appreciably change the characteristics of the "free" airplane response.

The automatic flight control systems are usually not critical with
respect to loss of servopositioning effectiveness caused by low static stiff-
ness. The reason is that the autopilot systems normally have "q" programs
which lower the loop gains with increasing airspeed. Low static stiffness
will merely add to the intentional "q" program and may consequently be
compensated for during design testing.

If a particular surface actuation system requires a high static

stiffness approaching or exceeding the dynamic stiffness requirement, then
2ither the dynamic stiffness must be increased or a mechanical or electro-
hydraulic compensating network must be provided.

156
3.2.6.4.2 Motor-pump-servoactuator (MPS) packages. This is defined as an
integrated servoactuator package which incorporates an electric motor
driving a hydraulic pump, a hydraulic fluid reservoir, a servoactuator,
and necessary accessories packaged in a single, self-contained LRU. Indi-
vidual components within the integrated package shall be designed in
accordance with the applicable requirements of the corresponding compon-
ent specifications, Essential or flight phase essential applications
require specific approval from the procuring activity.

DISCUSSION

Such integrated packages have been used for a number of years for
surface control on British aircraft starting with the Boulton Paul delta
research aircraft, P111 and P120 the Saunders Roe "Princess," the Vickers
"Valient," the Hawker Siddeley "Vulcan" the BAC "VC-10," and the Short
"Belfast." In these applications, they are used as the primary control
without connection to the main hydraulic system.

Development has continued in this country on the AFFDL ADP 680-J program
where limited-authority units are being considered as backup to the main
power servos to provide survivability capability. See References 49, 65 and
66.
3.2.6.4.3 Actuating cylinders. Actuating cylinders without control valves
and feedback provisions in the same LRU shall be designed in accordance with
MIL-C-5503, except that the life cycling requirements shall be modified to
reflect the specific usage. (See 3.1.12)

DISCUSSION

MIL-C-5503 has been in use for many years and is still considered
adequate for nonservoactuator type actuating cylinders, except for the
endurance requirements. Endurance requirements (in MIL-C-5503C) are specified
for utility system cylinders and for flight control cylinders, both manually
controlled (2,000,000 cycles) and automatically controlled (5,000,000 cycles)
with packing changes permitted after each 500,000 :ycles of operation.

Such requirements are strictly arbitrary and do not reflect needs for
any specific application. In many cases, especially large Class III aircraft
(per MIL-F-8785) and helicopters, endurance requirements may be considerably
greater. Also, with the use of plastic or metal dynamic seals (or combina-
tions thereof) much higher seal life than is possible with O-rings is obtain-
able. Allowing changes at 500,000-cycle intervals may impose a burdensome
maintenance penalty.

3.2.6.4.4 Force synchronization of multiple connected hydraulic servo-

actuators. In essential and flight phase essential flight control actuator
installations employing multiple connected servoactuators, the actuators
shall be synchronized as necessary to assure specified performance and
fatigue life as specified in 3.1.11.3 in the structure between actuators
without undue structural weight penalties.

157
 1)1 ( I;5S Ii i

I(OcaUse 1t LIe need Ofor hC

11 Sg01u A. I U .AIit y In the actuat ion subsystems
0 t 'CI' t
L! I high
. petU t0li 1 le Uca
. rci raft to t1) ma .1n ta In cont.rol
oII of and prevent
1iLutt•
t .,t essential ae1orodynamic surfaces, multij,le side-by-side arrangements
ot tllioh i or four1 sorvo.c-t-ua tors, rather than dual.-system tcandm-n sCttuators,
AIL!ebei u, cns tidrod. (ro.ss tolan
svuc hr on tIon
tI luad elIthor to signifi-
tnLt rohduct in,i in t lit. tattige life of thl act1:ato1r and their support strue-
Lutr'e ,1r 0vt'rd..ai l, weight penalties to obtain the desireod life.

3. 2 . to.4 .5 _t.iy1dmau1ic motor's. Iydiaulic mo or,; ilay be uacd to actuate rela-

Lively Low-.dutyv--clyc1e, noLer it ILcal tI ight control sulrfaces, such as wing
fl apa, but spectific approval. from the procuring actilvity must be obtained
he [ore use in high duty cycle1 nonCriic.al applications or in any essential
or Flgliht phase ossontial application, They shall be designed in accordance
wit hi Mil-M-7997,
i)i.SCI, 88[ON

T'l I req [rulriI t s that specific approva I i,'ust be obtaitned before using
hydraulic motors in systems controlling high duty cycle or essential func-
t tons is not. intended to prohibit their uSe , but -atiher , to ensure that the
contractor has
1 u1l.y IIvestigated thei Lapab1iiI.y to piL. orm the essential
fu'nctioLs 'el. h1)vly and can present substaot. tat lug ev idence for approval
before committing designs. One problem that has been encountered in previous
designs hl:s been a re]atively high rote of wear In the gear reduction train
leading to excessive backlash and deterioratton in system stiffness.
3. 2 . t.5 LE'ie ci: ru,.uchaulcal actunt:ion. 11ecctric power may be used to actuate
1elat. \'elv low-duty-cyeCle, noncrittIcl fIlight control fu'c tlons, such as for
L.O LI,,', il 0 he \10CS, but iI c ap poval tpe.L trohhe procur tug activity must
bh oA ailloud betore ku s- i.ni ess.ential and I light phase essential applications.
lc'c L rolnet' lion c a aL CtLZIt 1,U conillrIun t h 11h dosignbd int ac-,ordance with
l'11.--l.--708t , and spec i I L.C component spec i. [cations as appl icabile, and the
fIo low i ng. Pei Iormance requirements shau i be adequate for intended applica-
* ion.

,'t u c
L2 (: a,'
attja t t L ioin. i'itul .rl,
t ic \'i•.i" m. .sd to actuate rela-
tlyelv lou-duty-c.Vyle, noncritical
flight contrvol surkaces, such as wing
i',ips, bout pec-ific approval front the procorhii ;ac tiivity most be obtained
buteore use in essential and fli. ht phase essential. applications.

'3.2 . 6. 0i . 1l i-jr sour puumot

ne ic act.uI I 1o01. lHigh- pre•;ure pneumatic actua-
L iont cimpccnt S ,;hzol II he des I gned In acc o rd nce wit hi MIl1-P-8564

3. .2.0 .* u. l2hile motictdr-i ye turhineL'ss . PneouuaLi L drive turbines shall be

dCs tuIC d 1n1 aIC-CordancII--e WIiii M•L-D--7602 when used fc r FCS purposes.

01• )-1!<.
SS I ()N

Rv'I ucro'e 5c2 des c i)U s ini quIe

q [,is pncultýaat IC, hi gh torque
t't-s.,rl
t,,t't'y I . tU
i[ t. I ei) hi i quo
teC 1 i c ab) , to ai i rcc ift pr imary or stan dby fl.ight
.'O lt. t't I ,

1:
3.2.6.7 Interfaces between ictua•ti..on .yste.i
sct.temr suppc. t :.tt and
control surfaces

3.2.6.7.1 Control surface stops. Surface stops shall be provided each

flight control surface to positively limit its range of motion. Sto ps ha; 1
be located so that wear, slackness, or takeup adjustment.4 will not adverswlv
affect the control characteristics of the airplane because of a change in
the range of surface trivtel. Each stop shall be able to withstand any loads
corresponding to the design condltions fOL the control ;vstem. Whore pwo'r
control actuators are attached dtrectAlv to the control. surfaO:'c st opdta II
be provided within the actuator. Svch actuators fhall not oniy be designed
for maximum impact loads, but for the cumulative fatigue damage due to load
cycling predicted during flight and due to bottoming during ground checkout
and taxiing. Where control valve command input stops are provided, the
actuators shall be designed for maximum impact stop loads.. and not for
fatigue damage due to bottoming, except as normally enkcountered with the
input stops and feedback provisions functioning.

3.2.6.7.1.1 Adjustable stops. All adjustable stops shall be Positively

locked or safety wired in the adjuste.d position. Jam nuts (plain or qelf-
locking type) are not considered adequate as locking devices for this appl -
cation.

DISCUSSION

Control surface stops are required to prevent exceeding alJowabho

travel limits such as dictated by: aircraft controllability requirements,
prevention of damage to the control surface or its primary surface, ard/or
personnel safety considerations when the airplane is on the ground. Where
control valve conusand input stops are provided, the actuator must still with-
stand bottoming loads in the event of. misrigging, failure ot the valve
stops or input links, failure or malfunction of feedlvick provisions, toss of
hydraulic pressure where other Wtolators or aerodynamic forces can bottom
the actuator, and when the system is depri ssuri-cýd normal I v att ot e(acil, f light
Where a power control. actuator is located remotely itemo the surface , the
actuator may be used as the primary surface stop, providiiig the c~nuiiecting
linkage has an extremely remote failure probability.

3.2.6.7.2 Control surface ground gust .piotection. All flight control .;Ir-.
faces shell have provisions to prevent damage from ground wind loads as
specified in MIL-A-8865, However, no separate provisions are required if the
damping characteristics of Instnlled flight control w,'tuators suffice Vkr
gust protection.

3.2.6.7.2.1 Control surface locks. hlere control surface locks arM useý01d,
the lock system shall be internal within the airplane. E:xternal loc-ks 1mAy
be used for helicopter rotors. The locks shall either engage the surfaces
directly or lock the controls as near to each surface as practicable and
shall be spring loaded to the unlocked position. Control surface locks shall
be designed to preclude attempting takeoff with controls locked.

159
3.2.6.7.2.2 Protection against infli Lht enagement of control surface
locks. Control surfece ground gust loke and their controls shall be
designed to preclude their becoming engaged during flight.

3.2.6.7.3 Control surface flutter and buzz prevention. All flight control
surface actuation systems controlling surfaces which are not dynamically
balanced shall be effectively irreversible or provided with sufficient damp-
ing to prevent flutter, burz, or other rciated dynamic instabilities for all
operating modes and meet the requirements of MIL-A-8870. No active powered
compensation technique or iiechanization designed to artificially increase
effective stiffness, damping, or natural frequency shall be used without
prior approval of the procuring activity.

DISCUSSION

The control surfaces of any airplane which can be nosed over or up by

high winds when the control surface is displaced from the neutral position
should be locked in the neutral position. Servo tab and spring tab type
surfaces need not have locks or snubbers installed if it can be shown that
the connecting springs and linkages are sufficient to prevent gust damage
to any of the components.

Specific things which can cause inadvertent engagement of gust locks

include inadvertent operation of cockpit control lever, relative deflections
between the lock control system and the aircraft, component failure, combat
damage, etc.

See discussion following 3,1.11.2, Stiffness, for some of the most

pertinent requirements specified in MIL-A-8870. When detailed flutter
analyses and wind tunnel tests are not yet available, the following general
guidelines may be used:

For the prevention of flutter, each control surface including its

actuation system should have a minimum natural rotational frequency about
the control surface hinge line of 1.5 tLimes the natural torsional frequency
of the main structure to which it is attached, This should provide suffi-
cient separation of natural frequencies to prevent oscillations of the
control surface and main surface or structure from coalescing and causing
flutter.
For the prevention of transonic buzz instability, experimental data
indicates that the system will be sufficiently stiff iV its natural rotational
frequency

= speed ot sound in ft!sec

Sstentichord of hinged surfakce at the 3/4 span in feet

Transonic buzz was tirst encountered on jet airplanes and has to be considered
un all aircraft which fly at high subsonic or transonic speeds. It is still.

160
not well understood, but experimental data taken at the Wright Air Develop-
ment Center in the 1950's led to the development of the equation noted above.

Required actuation system stiffness

With the required natural rotational frequency identified, the required

actuation sibsystem spring rate (Kreq'd) can be determined from the follow-
ing equation:
Kreq'd N - In lb/in. whlere
1 g
Wn. required natural rotational frequency in rad/sec,

moment of inertia of the control surface about its hinge line

in lb-in.-

m11illinmuln actuation lever arm in inches.

9 1gravitational constant: 386 fii./sec".

Actuation system stiffness determination

lo meet the fail-safe stability requirement, it is ususally necessary to

provide the required spring rate with only one actuator per control surface
operating even though multiple actuators are installed. The actual effective
spring rate of a flight control surface actuation subsystem (Keff) is the
total spring rate of the supporting structure from the actuator to the hinge
line (KsI), the spring rate of the actuator (Kact), and the spring rate of
the surface structure (KS2 ) summed in series as shown below:
_______I I I I
Keff0(dw) -KS, + Kact jOW) _f KS2

KS 1 Ifinge Line

NII
KsKact (jWd

Figure 15D. Actuator stiffness determination

161
 Frequency rel at ionsh ip

-lie frequency do pendenf-o of the net st iffLness of a typical hydraulic

F I ig'ht. coit~roi. t-ervote tuaror is s~hown he] ow:

K Kp

w -ro Log ly 1ndc pe ndc i

FioIr 16f stiffnes vs )vtt
frequency

C~~~~~~~
;t t t i Cf
stewc Io vte t nI t zr eun

i/iIIvr s~tt:ta I f re u \ ncltt Suptinc

t o th

I* WIWI

Ni) I-l oi -rt iuy(tdai/co

1't,~cIf
* I'-; il Lii1 vor s~aft t. ll repie
lk of cl tisp t hi lensto~i

S11i" it h(: Ic', Ki rIq"Irw I)\ ('ank hr'011 cuatsd

it.l ollows :

KAM A~- Ri I)K'

;t i. il

1K i~~~he
((clcI 'c Pr1'C"I~TtL gm i [111.i.
sit in. ItJingitig act na r Ikclikigc

itIll. it. ' U i;1 (,\II'll IILSS 1- g l

"ill ý1 '~ h'k. t' d o Ik

 Dynamic stiffnese is determined by the solution of complete trannfer
functions, and becomes constant at all frequencies above the frequency-
independent dynamic stiffness lower limit, W) , which can be determined as
follows:

[) AKVR [KA(O)

The frequency-independent dynamic stiffness, KA( ma), of the actuator

is made up of a number of incremental springs. For conventional linear
actuators, the primary springs are due to the actuator sý7ucturr (Kac
i.e.: the cylinder barrel, piston rod, and end caps, the bearings (Kbrg 5 ,
and the fluid compliance (Kfluid), which are also summed in series as
follows :
__ _ I 1 I
KA(* -Kc str + Kbrg
K + Kfluti where.

4 8?7 AA
Ktluid = - Xt where 6 = Iluid bulk mod ulus, psi

?7 = volunie!ric etTiciency

A effect •vc area. in.

X, totalstroke, in.

In calculating the fluid spring, a realistic value for bulk modulus

should be used. Most available data represents well-bled fluid with very
little entrained air. For normal situations, the value used should be
reduced to 80 percent of the ideal; and, the tangent modulus (at the normal
actuator pressure) rather than the secant modulus should be used. 1I the
moving parts of the actuator(s) are heavy in relation to the surface weight,
they must be appropriately accounted for.

Stiffness improvement methods

On stiffness-critical actuating systems, the structural springs may

oiten be more rigid than the fluid spring, and as a result, the fluid compli-
ance may have a great effect on the overall stiffness of the system. However,
increasing fluid stiffness by increasing actuator piston area introduces
weight penalties in two ways. It increases the size and weight of the
actuator, and it increases the flow demand on the bydraulic syntem which, in
turn, can increase the size and weight of '.ydraulic pumps, fluid lines,
reservoirs, and other components, plus weight of all structure which must
withstand actuation loads. It may be much more economical (of weight) to
stiffen the structural springs once i-he need is recognizcd.

163
 7-:

In situations where large weight penalties would be incurred to meet

the frequency requirements by stiffening existing structure and '2omponents,
other improvement methods such as the following can be considered:

Utilizing inactive actuators. Where multiple actuators ar% used

to satisfy reliability requirements (which is the normal practice for
essential controls), they can be designed to contribute stiffness and damp-
ing to the system even though hydraulic snply pressure is lost through
hydraulic system failure. This could be accorplished by pressure activated
valving. When pressure is lost, a spring loaded valve connects the input
and output of the control valve to a coinpensator at return line pressure.
The servo no longer supplies power to the system but does provide stiffness
when the metering valve is closed and damping when the valve is open. This
concept adds some complexity, but the weight addition culd be considerably
less than for stiffening existing structure and actuators.

Adding an additional actuator. The ctoncept here is to design an

actuation system with one more channel than is required for redundancy.
Thus, stiffness may be satisfied with two channels instead of one. For
example, in a surface control system that requires three redundant channels,
each channel must satisfy the maximum. hinge moment and minimum stiffness for
the situation when the other two have failed. However, if four channels are
used, the maximum hinge moment can be saLisfied with two actuators instead
of one, and as a result, each actuator will be exactly half the size of those
in the three-channel design. With smaller actuators, each channel will be
more compliant. However, stiffness now can be satisfied with tuo parallel
actuation channels, and the result is a system that is more rigid than the
three-channel system. A scheme of this type to improve stiffness may also
have a weight advantage.

Adding an independent damper. Several types can be considered.

OQe Is a quasi-servo damper channel similar to the a(tive servoactuators.
When the spool valve is closed, this damper provides an additional load
path with the stiffness characteristics of the active channels. WhAn the
valve is open, in response from the pilot oi AFCS, the quasi-servo acts as
a viscous damper.

Purv viscous fluid dampers are also used, and there are several
linear or rotary types which may be considered. They can be installed
parallel to the actuation channels or at any convenient location on a
a;urface such as on the hinge line. They absorb energy from high-frequency,
h;gh-amplitude vibrations and dissipate it as heat. If a damped surface
experiences considerable activity, throughout a flight, the damper may
absorb energy faster than can be radiated and create a high temperature
probhI em.

Adding an actuation stiffness compensation network. The basic

actuatot stiffness can be modified by introducing hydromechanical or
olectrical com~pensating networks within the actuator loop. In the most
.eneral case, this can be donzý by sensing load pressure, passing this signal
through a bandpass filter, and feeding this signal as positive or negative
feedback to the control valve.

164
3.2.7 Component design

3.2.7.1 Common requirements

3.2.7.1.1 Standardization. Where practical, contractor designed equipment

which has been approved for use in some models of aircraft shall also be
used in later model airplanes if the installation and requirements are
similar. Tolerances shall be such that interchange of any LRU with eny
other part bearing the same part number shall not require resetting if
parameters or readjustment of other components in order to maintain overall
tolerances and performance.

3.2.7.1.2 Interchangeability. Like assemblies, subassemblies, and replace-

able parts shall meet the requitements of MIL-I-8500 regardless of manufac-
turer or supplier. Items which are not functionally interchangeable shall
not be physically interchangeable unless specifically approved by the pro-
curing activity.

3.2.7.1.3 Selection of sperifications and standards. Specifications and

standards for necessary commodities and services not specified herein shall
be selected in accordance with MIL-STD-143.

3.2.7.1.4 Identification of product. Equipment components, assemblies,

and parts of flight control systems shall be identified in accordance with
MIL-STD-130.

3.2.7.1.5 Inspection seals. Corrosion resistaait metallic seals shall be

provided at all strategic locati:ns to indicate assembly inspection and any
unauthorized disassembly.

3.2.7.1.6 Moisture pockets. All components shall avoid housing designs

which result in pockets, wells, traps, and the like into which water, con-
densed moisture, or other liquids can drain or collect. If such designs
are unavoidable, provisions for draining shall be incorporated.

DISCUSSION

The standardization requirements are in keeping with standard Air Force

policy regarding the minimization of supply problems and cost, both for
equipment and for test and qualification. The use of tried and proven equip-
ment should result in higher reliability than with new designs, especially
during the early years of operation. The use of standard parts is also in
these interests.

All flight control components must be adequately identified to pre-

clude misuse, and strict adherence to inspectiou sealing must be held. The
consequences of maintenance errors or omissions can be catastrophic.

Close attention must be given to the avoidanice of moisture collections.

Many of the flight control co-nonents are exposed to subfreezing temperatures,
and can suffer serious perfort.. ace degradation due to accumulations of slush
and ice.

16S
3.2.7.2 Mechanical components. Mechanical components not covered by design
requirements specified elsewhere within this specification shall be designed
in accordance with applicable requirements in. Government and Industry
specifications, in the order of precedance specified in MIL-STD-143; in AFSC
Design Handbooks DH 2-1, DN 3B1, Mechanical Flight Controls; and DH 1-2,
General Design Factors; and the following:

3.2.7.2.1 Bearings. Flight control system bearings shall be selected in

accordance with AFSC Design Handbook DH 2-1, Chapter 6, Airframe Bearings,
and the following.

3.2.7.2.1.1 Antifriction bearings. Approved type ball bearings in accord-

ance with MIL-B-6038, MIL-B-6039, and MIL-B-7949 shall be used throughout
the flight control system, except as indicated in the following paragiaphs.
Bearing installation shall be arranged in such a manner that failure of the
rollers or balls will not result in a complete separation of the control.
Where direct axial application of control forces to a bearing cannot be
avoided, a fail-safe feature shall be provided.

3.2.7.2.1.2 Snherical bearings. Where space or other design limitations

pieclude the use of antifriction bearings, spherical-type, self-lubricating
plain bearings in accordance with MIL-B-81820, or spherical or special-type
all-metal bearing in accordance with MIL-B-8976 with adequate and accessible
provisions for lubrication, may be used.

3.2.7.2.1.3 Sintered bearings. Sintered type, or oil impregnated bearings

shall not be used in those parts of the flight zontrol systems which have
slow moving or oscillating motions. Fast moving rotating applications,
such as in qualified motors and actuators, are permissible. Bearings shall
conform to MIL-B-5687.

3.2.7.2.2 Controls and knobs. Aircrew controls shall be shaped and located
per the requirements of AFSC Design Handbook DH 2-2. Control knobs shall be
designed and spaced per the requirements of AFSC Design Handbook DH 2-2 and
MIL-K-25049.

3.2.7.2.3 Dampers. Each damper shall be completely defined by a detail

specification. Control stick dampers shall be designed so that they can
be overpowered by the pilot in the event of failure or malfunction. Damping
requirements for surface dampers shall be based upon the anticipated flutter
frequency, but the endurance requirements shall be based upon the same cri-
teria established for the surface control actuators. Detail design of
hydraulic dampers shall conform to the applicable requirements of MIL-C-5503.
All joints, connections, and bearings shall be designed to prevent the degree
of wear which can cause unacceptable freeplay.

3.2.7.2.4 Structural fittings. All structural fittings used in flight

control systems shall comply with the design requirements specified in AFSC
Design Handbook DH 1-2, Design Note DN 4BI, Design Requirements, and where
applicable, the de'fign considerations specified in Design Note DN 4B2,
Forgings and Castings.
3.2.7.2.5 Lubrication. Where applicable, lubrication fittings in accord-
ance with MIL-F-3541, MS15002-1 and -2, or NAS 516 shall be installed to
provide for lubrication in accordance with MIL-STD-838. NAS 516 fittings
are restricted to nonstressed areas only.

DISCUSSION

Where design limitations precluue use of ball bearings, the use of

prelubricated, shielded roller or needle bearings such as those of
MIL-B-3990 and FF-B-185 will require procuring activity approval.

Note that general hydraulic component design requirements are speci-

fied in 3.2.6.5 by reference to MIL-H-8775 and MIL-H-8890 and that general
high-pressure pneumatic compor''nt design requirements are specified in
3.2.6.7.1 by reference to M' -8564.

3.2.7.3 Electrical and electronic components. Electrical and electronic

components not covered by design requirements specified elsewhere within
this specification shall be designed in accordance with MIL-E-5400, NIJ-l-
7080, MIL-STD-454, MIL-STD-461, MIL-W-5088, MIL-M-7969, MI1-1-4-8609, and
the following:

3.2.7.3.1 Dielectric strength. Leakage current shall not exceed 10 milli-

amps when a dielectric stress voltagu of 1.200 volts, 60 Hz, is applied for
1 minute between insulated circuits and between circuits and case; and
there shall be no insulation breakdown. When 500 V DC is applied between
isolated circuits and the cas or connector shell for a period of 10
seconds, the resistance shall be at least 50 megohms. When a component
or connector has a lower design voltage limitation, the test shall he run
at an appropriate lower voltage as defined by the component spcil ik',t t1.

3.2.7.3.2 Microelectronics. When used, microelectronic devices snaliL

conform to the provisions of MIL-M-38510.

3.2.7.3.3 Burn-In. All electronic LRUs shall receive a minimum of 50 hours

burn-in operation and testing prior to assembly, or after assembly if such
is more meaningful, prior to installation. Performance after burn-in nial
be within specified tolerances.

3.2.7.3.4 Switches. The design of special electric/mechanical witches,

other than toggle switches, shall be subject to the approval of tLhe procur-
ing activity.
3.2.7.3.5 Fhermal desnuf electrical and electronic equipment. WhurevL, r
feasible, components shall be designed with heat-dissipating efficiency
adequate to allow simple conductive, radiation, and free convection cooling
utilizing the ambient heat sink to maintain the components within their
permi,-sible operating temperature limits. Operation under specified condi-
tions shall not result in damage or impairment of component performance.

.107
3.2.7.3.6 Potentiometers. Resistive variable voltage dividers shall not
be used in dynamic motion applicatioILs such as sensor outputs or feedback
output devices without specific approval by the procuring agency.

DISCUSSION

When selecting switches, the invulnerability to flight crew error

requirements of 3.1.9.6 must be considered, such as recognizing that the
selected positions of push1 button switches are not apparent.

The following recommendations should also be considered:

In the design of AFCS components, the minimum feasible number

of parts should be used and their size and weight minimized consistent with
other requiremento specified.

Modules or subassemblies should not be sma]ler than that required

to perform a single functior. (As an example, an amplifier or power supply.)

Modules inter,ded for field replacement should be so constructed

thal electronic parts oL connector pins are not exposed outside the frame
of the module.

Possible requirenments for complex test equipment and test pro-

cedures should Ie considered prior to adopting a modular design to ensure
that the requirements of 3.1.10.2 can be met.

Solid state devices are preferred over electror tubes and the
latter should be used only when they are the only means to meet the require-
ments for a speclific application.

The use of microelectronic technology should be considered on the

design of all systems/equipment. An objective appraisal of all ractors
concerning the systew/equipment design should De made with the view of
maximizing reliability and minimizing total cost of ownership, weight, and
space within the envelope of the other performance parameters of the design.

The separation of thermal design requirements, specified in this section,

and cooling requirements, specified in Paragraph 3.2.9.3.3, is to emphasize
that both the component design and its installation must be considered in
achieving resistance to thermal failure. The preferential list of design
techniques to waintain heat rise within operable limits as specified in
MIL-F-9490C are listed here for reference

The use of thermal characteristics of finishes, induced draft,

and ventilation by means of baffles, internal vents and louvers, and
packaging in heat dissipating fluids.

Air vents with adequate protection against climatic and environ-

mental service conditions to all exposed parts.

Forced cooling, if above means are still insufficient, or if a

significant reduction in overall size, weight, or failure rate can be
realized. Fans or blowers employed shall operate from the aircraft's AC
power supply.

168
 If heat diasipation requirements are such that the use of heat

exchangers, liquid, air blast, or evaporative coolants must be resorted to,

or must be provided in the aircraft installation, prior approval of the
procuring activity is required.

3.2.8 Component fabrication. The selection and treatment of materia]o

processing, and assembly, may be in accordance with established contractor
techniques, in lieu of the following requirements, upon approval by the
procuring activity.

3.2.8.1 Materials. When Government specifications exist for the type

material being used, the materials shall conform to these specifications.
Nonspecification materials may be used if it is shown that they are more
suitable for the purpose than specification materials. These matetials
shall have no adverse effect upon the health of personnel when used for
their intended purposes. This requirement shall be met for all probable
failure modes and in the required environments.

3.2.8.1.1 Metals. Metals used in flight control system components shall

be selected in accordance with the criteria and requirements specified in
AFSC Design Handbook DH 1-2, Design Note DN 7AI, Metals.

3.2.8.1.2 Nonmetallic materials. Nonmetallic materials shall conform to

the requirements specified in AFSC Design Handbook DH 1-2, Design Note
DN 7A2, Nonmetals.

3.2.8.1.3 Electric wire and cable. Electrical wire cables containing up

to seven conductors shall be constructed in accordance with MIL-C-27500.
Airframe wire bundles may be constructed in accordance with contractor
developed techniques provided such construction is approved i-ythe procur-
ing activity.

3.2.8.2 Processes
3.2.8.2.1 Construction processes. Heat treating, adhesive bondings,
welding, brazing, soldering, plating, drilling, and grinding of high
strength steels, materials inspection, castings, forgings, sandwich
assembli.es, and stress corrosion factors used in the fabrication of
flight control system components shall comply wvith the requirements
specified in AFSC Design Handbook DH 1-2, Design Note DN7BI, Construction.

3.2.8.2.2 Corrosion protection. All flight control system component parts,

except those inherently resistarnt to corrosion in the operational environ-
ments, shall. be finished per AFSC Design Handbook DH .- 2, Design Note
DNTB2, Corrosion.

3.2,8.2.3 Fabrication of electrical and electronic components. The

applicable requirements in AFSC Design Handbook DH 1-6 Design Note DN3Hl,
Electrical/Electronic Safety Design Considerations, relating to the fabri-
cation of e]ectrical and electronic components shall be met.

I 19
DISCUSSION

High quality materials and workmanship remain the key to the fabrica-
tion of dependable components. Use of proven and controlled processes,
such as specified above, are most important in reproducible quality manu-
facturing. Special processes should be clearly specified on the detail
drawings and the fabrication instructions.

3.2.8.3 Assembling

3.2.8.3.1 Mechanical joining. Individur.l parts may be mechanically joined

with removable fasteners, or by riveted or threaded connections, or by
qualified methods for permanent joining.

3.2.8.3.1.1 Joining with removable fasreners. All removable fasteners

shall be selected and used in accordance with the applicable requirements
specified in AFSC Design Handbook DH 1-2, Design Notes 4A], General Require-
ments; 4A3, Bolts, Nuts, and Washers; IA4, Screws; 4A5, Pins; and 4A6,
Other Fasteners except as follows:

a. Bolts smaller than 1/4 inch in diameter shall not be used to mnke
single-bolt connections or connections essential to proper functioning of
the component.

b. Each removable bolt, screw, nut, pin, or other removable fastener,

the loss of which would degrade operation below FCS Operational State III,
shall incorporate two separate locking or retention devices either of which
must be capable of preventing loss of the fastener by itself and retain it
in its proper installation with the other locking or retention device
missing, failed, or malfunctioning. Where self-retaining bolts are used,
their selection and installation shall be within the limitations of MS33602,
and only one type shall be used in any given system.

c. No self-locking nut may be used on any bolt subject to rotation in

operation unlesb a nonfriction locking devi-c is used in addition to self-
locking devi-e.

d. Lockbolts listed in AFSC Handbook DH 1-2, Design Note 4A5, Swaged-

Collar-Headed Straight Pins aiA Cellars, may be used fot fastening appli-
cations not requiring removal on the aircraft.

3.2.8.3.1.2 Joining with rivets. Rivets for all riveted joints shall be
selected and used in accordance with the requirements specified in AFSC
Design Handbook DH 1-2, Design Note 4A2, Rivets.

3.2.8.3.1.3 Threaded joints. All threaded joints shall be provided with

adequate wrenching and holding provisions for assembly and disassembly of
the joint before and after service use. Internal screw threads and external
rolled threads shall be in accordance with the thread form requirements
of MIL-S-8879. Pipe threads shall not be used.

3.2.8.3.2 Joint retention. All adjoining parts shall be secured in a

me'nner that will preclude loosening when subjected to internal or external
loads or vibration,

17()
3.2 .8. 3.2.1 Retention of t~ii ~.advd oiLu. n~- A IJ LIII J, iu 8l wil
vI Ii il I V
critical loads shall be posit ively locked Lii the avmldpos1it ion 'or that
load reversal at the threads is prevented. The use of Jain lockiluts alonev
is not a positive locking means unless lockwlred or othlerWise restrained.

3.2.8.3.2 ý2 Retention of reirovabie listieners . lUntess I VStrIa lmed 1 [0111 lI1o\'-

ing by the attachment of adjoining pa.rts, all reinovablu t'astenei s shiall he
positively locked in place. Self-locking exte~rnally threaded fast~eners
shall not be used except within the limitations specified _'i MS15981 , and
self-locking nuts shall not be utsed except within the liniftationls speoified
in MS33588. All other types shall1incorporate positilye locking nmeans Or
be safetied with Totter pins in accordance with MS24665, wb,-re tempei'a tutre.
and strength permit, or be safety wired. Cotter pluis and satety wiring
shall be installed in accordance with MS33540.

3.2,8.3.2.3 Use of retainer_ ring.,s. Retainei ri iigs, sha.l. i hot be used to

retain loaded parts unless the ring~s are positively confine~d by a mieanls
other than depending on internal pressure or external loads. They stint II
not allow freeplay which could result. inl structurally destriictivv act-ion
or fatigue failure of the retained parts or tailure )I gasIkets,. or packinlýs.
Where used, retainer rings shall be commeircial ly aval~:ilable'!)L tYp~es Wh iih cEI
be installed and removed with standard tools.

DISCUSSION

It is common practice to seLý1urc- fast enurs (i e..,bt .,~rw nuts,

pins, etc.) with a single locking device., Service expcrience. ha-s shown,
however, that due to maintenance, inanufaclturing, or- des,-ign l curst, it s innlc
locking device is not adequate for critical applIi catiosI LI 11 to
0 iiiinimbe
of instances of loss of fastener iit egr'itLy, it is consid L!red nu kces;sa ry to
require two separate locking devi~ces onl all reoii'ahiblIc fi stecoors IIill y
installation in which loss of a fastciner coul d cutci i ght St lfet '.*

one acceptable practice is, thle use kif st, If i et:ii ing
1mwtts wit 1i
cotter-pinned castellated nuts Installed as showni on MS)3 And. dt her
fasteners are also acceptable providing thfey meet th ieI q11 1elliilits il Lilt.l
ref erenc .1 AFSC Des ign handbook Iinc Iluditig ret oft 1 ont t)t t the i r- lock ing an d/orI
retention capabilities in all environnmenital cd tiniOmSSdc i attcd Wi th
their particular installation.

Miere lockbo its are used , iLiSijoul 1d hc1 cc ugh1 i co t aa r. t Il\d ,t Sinle,41
locking only, not close tolerance , and U,1n L V Use;d koni V inl Jo I It i tili cii
clampup is allowed.

Jam nuts may be used wit hout inc kwl e oir other rutent ion it-, appo IcIa-
tions which serve cLnly to preload threaided J oits, where ii iii~jpei't XonI
intervals are such as to preclude unalccelpt,')le Intl ruie r\c I es and X'hei e
backlash is acceptable. Where they are tl,.l to) pi event JoitI' ui SC,,,ne'ct ion,
they must be positively retained.

3.2.8. 3.3 Assembly of electronic, COnIpoWIL-Iltts

3.2.8.3.3.1 Electrical, and electronnic pi L monthwn. fLee.t ronl.[ part"

shall be mounted so that ease of _p~roducibility and niatotalniabilit\N is
assured. Whenever feasible, parts such as resistors, caprcitcrs, etc.,
shall be mounted in an even, regular, row-type arrangement. These parts
shall be mounted on a base so that the leads do not cross other leads or
connections. Heavy electronic parts and assemblies shall be solidly
mounted so that adverse affects when subjected to vibration and shock
will be minimized.

3.2.8.3.3.2 Shielding and bonding on finished surfaces. Nonconductive

oxides or other nonconductive finishes shall be removed from the actual
contact area of all surfaces required to act as a path for electric current
and from local areas to provide contiauity of electrical shielding or bond-
ing. All mating surfaces shall be clean and shall be carefully fitted, as
necessary, to minimize radio frequency impedance at joints, seams, and
mating surfaces. The resultant exposed areas, after assembly at such
joints or spots, shall be kept to a minimum.

3.2.8.3.3.3 Isolation of redundant circuits. Redundant circuits shall be

isolated from each other to preclude failure of one portion of the circuit
from affecting any other circuit.

3.2.8.3.3.4 Electrical connector installation. The number of electrical

connectors shall be kept to a minimum within the required limitations for
separation of redundant circuits. Connectors shall be mounted to preclude
nuisance warning indications and intermittent operation when subjected to
applicable temperature differentials, vibration, and shoczk. They shall be
polarized so that it is impossible to mismate them on a particular piece
of equipment.

3.2.8.3.3.5 Cleaning of electrical assemblies. All electrical assemblies

shall be thoroughly cleaned of loose, spattered, or excess solder, metal

chips, or other foreign material after assembly. Burrs and sharp edges
and resin flach shall be removed.

Isolation of reduneant circuits is mandatory to obtain the advantages

promised by using multiple signal paths. Generally, redundant channels of
the same control axis and electronic comparison model signals should not
utilize. coimnon or adjacent:

Connec tors
Cables or cable runways
Circuit cards

unless the design can be shown by demons.tration or analysis to meet the

appropriate isolation/separation requirements.

A high percentage of electronic equipment failures are due to the

improper choice and/or assembly of electrical connectors, and special
attention to their selection and applicat~ion is important.

The invulnerability requirements of 3.1.9 require wiring to be routed

with sufficient slack to prevent thermal contraction or expansion, vibration,
and flexure from causing damage' to the wire terminations and to minimize

172
.wo
noise pickup. They must also be routed away from hot parts, such as resis-
tors. Electrical shielding genorally must be installed on wire and cable
to minimize electrostatic and magnetic coupling.

3.2.9 Cmponent installation

3.2.9.1 Basic requirements. Flight control system components shall be

installed in compliance with the applicable requirements specified in ' SC
Design Handbook DH 1-6, Section 3J, Flight Control Systems, including Design
Note 3JX, Safety Design Check List, and as specified herein,

3.2.9.2 Locating components, System components shall be located to provide

direct routing of the control system signal and power transmission elements
(cables, rods, lines, wires, etc.) itt accordance with Design Note 331, Rout-
ing and Separation, only to the extent that the components and transmission
elements are not exposed to undue hazards.

3.2.9.3 Installation in fuel system areas. All component installations in

fuel system areas shall preclude the generation of sparks both during normal
operations and possible abnormal and failure conditions.

3.2.9.4 Electrical and electronic component installation. In addition to

the requirements specified in AISC Design Handbook DH 1-6, Section 3J, the
applicable requirements in Design Notes DN 3H1, Electrical/Electronic Safety
Design Considerations and DN 3H2, Installation Safety Objectives, shall be
met.

3.2.9.5 Electrical and electronic equipment cooling. If cooling augmenta-

tion is required, the installation of flight control electrical and elec-
tronic equipment cooling shall be integrated with the cooling provisions for
other electrical and electronic equipment. The requirements specified in
AFSC Design Handbook DH 1-6, DN 3HI, Temperature shall be met.

DISCUSSION
The foregoing requirements are in addition to those specified elsewhere
in the specification, primarily in 3.2.1 through 3.2.6. The following recom-
mendations regarding electrical and electronic equipment cooling should also
be considered:

Forced air 20ooling should be used only when natural cooling does
not provide sufficienc cooling or when a significant reduction in overall
size and weight can be realized. Exhaust and recirculating fans, blowers,
and pumps should be driven by brushless motors operating from the available
AC power sources.

For equipment thermally designed for use with external source

supplied cooling air, which may contain entrained water or other contaminants
detrimental to the equipment, precautionary measures should be taken to
avoid direct impingement on internal parts and circuitry by channeling or
use of heat exchangers. If this is impractical, the water and contaminants
should be removed from the cooling air by suitable removal devices.

173
 (1KlO
,1)rCL ( k.frgrait holdiotheue L.\ v~!
ptet whlaoii)bt ura Iod
3 Rt li II
wl jwt ocilaiii.lk' and doilul
__

fia tll S I II k sc-t I1' e by ro(tajr\yWl),; ire~l

kXCCept WhlCSpecifI kI'' t
SaI N, tin t o.(I t L- ap lv1
1, t.o other tYpos o f evxa In'1,
1 3 .2 -1 . I Li I-c:ratIL , fI' ;
P'i Io t Con11t I-oi1,f or CIOL Aircitaft, ur whecre mod I t ILed Lvy touclre.menris denioted
bY .III asteri Lsk spec it' ica 1)'y for rotatl V wing ai reC raI-i L Spec lal rot ary wling
Iletiu 1lanc anLd du
l1 1 1 reyitrememL
Ig s a rt as to I lmows
3.31 c odoa 1 FC pjei I nI
o I 111a
ic vcm iw *R.a wing ar c Ia ft
shiII ne t. the f1v i Ig (Io lt t: es r e(I u I remuminoI t ss p.oc it1.f 3 in, MlIm-F-8 330(1

?a kotinziii
IIt t ic (,FCS r I orlli.
111"11LiC o *I ic tt icude arid
hc~liI big Ioll'1-1 WC U Ti I esi SIeCC if i (Žd nth floigpiagaphi ap!A N UtWOO
LcOnd tLI ('1S 0 1 L i cLiJt 0 1 i tc ive p.IV kcon11t Li 1
t1)1LCh ,1 . Al11 Z1)1tI 1oah11
agituId es
an c11
ld
!tt u g t l Iine-s otI prtuL hIa tollo Inldlo ed(1by v'oI. iat ionls in1 kcollec-t Ive
pith ICi
I t tI.- I s!iI' Ia e -s spe~c i t I ed 1)N he O klii IIug IL mI'c t.

3. 3 1 A~
A L tt i id 0 !iowI J Itch oll
I anIld Now
, V i Lt ide hol
k0LIi( in11,1 II . t'A ,)Id
no d e thw at.t :itude, Ill calm air, sial1 1 be inainta Inied' wi bi thI H it ldgree of
Lhe r dc er t.-ieo at t it ud. Thme dvniamlibI.tequircinont s of 3. 1. 2. I'sha.1 1 be metO

'3. 3.2 2 Iliad0 i .1

hIldILI d Id. i _,Ss l C t
ht,-11e * I I t u)IiiAt t ic1 I I 1-glit COlt rol
Ik
l 11Ila in t11
Lin 111cad Ilog wi Lhi 1 +1 deOgrIe Cm COnUIi-Wded heIdItg inl f orwarid
lIight, at speeds aboive "10 int
Lid Ica-oilt, . Tia? iiictral tm shall iiOc overshoot
hI.II' ;e eC'
t
Oc rid i 1 bY 11"01- thanl 2-5 degree',s at speeds aibovve nO kniots. The
r oll1 rtcV , siki Ino11t e.\CeeeI i. 0 dvigrees ptAr seco'nd an oll 11: aece ie shall
no10t UeX kmLite 3,() detglkces pex~ second for Mil -F-83I WO~ CI ass it anld IlI Iýtr c raf II
i Lt Itiii o t lie10
)0Sý' Va1 1nc1
V o >11, -F --. i8 31oh CIasis I no L V\ vcrýji t t

3. J1 2 . I A I t I LLOdeC siktL .

3 . 3. 3.3.I darom L-r1

týti cI IIL t i de S
sv aJ Ib a io(1 . A [he I eip IiI I I eI ;e 1LS . 1 .3 1
k' I ) 5
Alia I I be met wheni tfime hll, I copt er i s o(lIL s Id e th groun70
l d It Vc Cta s d~e fiiied
t ot thIle spt.'e ifI' Ic betI i copter-

S. .i a at I e t _in 011Of 1 L.it udeO ibovc Lit oiICI Imi I li aIct uina I
Litc te
01 at1Pso lotC i.alt if ode iontvol m ode shn. 1 I he d,~ it I .. '
(iii' iii the
ýiipl l C tII.IL
l s -i t 1atm
;Vst lIl.'m Cd i ) 1n. Withial tbi'-ý lag.' thIi' c pe h l
'ont o II i nci caod aso
beteflit (It' ut.' I 1 ,l 1 hit
acitidC , Ain e1 ii

aIir1 wtit IcL iiVLi. flIat teLrLaIn' t +7 1*Lo0t f UlsenSOIi errorm.

fht i Ck.-I'ii~iV *Leqill I rI.U'Iue t, H Of t lIi.' I It it(it Ik Id 11;,-U,- 11 t- mimIA ImuI.'dCC

hIiC
f nr hIose StIeC I f Cd in 11 -I-F- 4Q 1)C . TFIIk' dY I. IiInIi ip eb-(II1
e1m1LI
It I o)r t he
hamiiet i ic ailt i tuiu 11 1o LIl iumoimle are17 d i SC 11,5i.
St telt e r 3.~

3 . 3. 2 . 4 hliivt- hol, Id . Yo' I- MI L -1'-8 ' 3(111 1as 11 1 i t Li1 l0 it io l 1 al II

h ni.'
na
lt a 111ed( wIthIIria I- tt 0 11 VS tha 1 1 2 10 Ct ) lUS 5'iil erL'ror oera
n teC pi.'r it, I .
Il 111. A It iIt ideL SlIa I I be l10l o i n:.t in[ oI f c t w it IiIn1
i.'ollktcI +5
 S11

feet over a 5 minute period. Where special mission requirements lctate,

the contractor shall estnailish further requirements, subject to procuring
activity approval.

3.3.2.5 Vernier control for hovering, *Vernier control shall be prorided

for accurate posit toning of-the-•-r"ra ft during hovering, unless control
commensurate wi t- iulti tmuw ace uracy requirements can he obtained with she
regular controlc.

DISCUSSIO.N

The hover hold and vernier control. for hovering are designed to pro-
vid, the capabtl Ity for accurato positioning of the aircraft and to minimire
the pilot's wcrkload for tasks such as precision placement of externally
carried cargo. The performance specified applies only to MPt,-F--83300 Class
II helicopters and requirements may vary considerably for o ther applications,
or for special mission requWements within a given class of helicopter.

No single value can be given for vertical or horizontal hold accuracy

for all aircraft In the hover-hoLd mode. The requirements for precision
hover accuracy for placement of cargo, for example, posed for the heavy
lift helicopter Would place unnecessary restriction on the design of the
FCS for aircraft not requirinrg this high degree of accuracy. In addition,
requirements for some Navv appl icat tons spec i a hover requi r emennt re I at i ve
to water velocity, for sonar use, rather than fixed in space.

Hover hold mode position accuracy is primarily dependent on accuracy

of the sensors used for reference. For example, if doppler velocity were
integrated to obtain position error, doppler drift would have to be less
than 0.10 knot to hold position within twenty feet for two minutes. Various
references may be uned such as integrated doppler velocity, inertial velocit\V
,
reference or visual ret . .cnce.

3.3.2.6 Grouraspced hold. *Whereo groundspeed hold is a system reqtiremnnt

provisions shall e made to insert groundspeed signals to th;o cyelic pitlch
and roll controls. After engagement of the ground speed hold mode, the
ground speed existing at the time of engagement shall be held in steady
flight in ca.lm iir withiin +3 knots.

DISCUSS ION

This requi rement haq been modified prom t hat specifled In 1I1 .- aQ440i:
to reflect a more realistic sYsLem tolervnce. Tthe tclerance to +1 knots
is applied to the sensed guouridspeed at the t line of en ga gement ald de not
include any sensor e rror. Reference to radar groundspeed sitiiulai1has been
deleted since other signal source may be used.

3.3.3 Special design l eguirement s*

3.3.3.1 Manual FCS design*

3.3. 3.1 . I Cont(rot feedback. *The control device mot ,,n a i force required
to accomplip sh staI 1 it\, a;:nd ('ontrol iotn:titat
ln sh;l I not he Iet 1 ccI
e d at
the aircraft's cockpit control. Force feedback shall be considered as not
reflected at the controls if the magnitude is less than half the breakout
force of the control with lowest breakout force. If other control device
motions are not to be reflected at the cockpit controls, the proposed
system shall be approved by the procuring activity. Full freedom of oper-
ation of cockpit controls shall be possible at all times stabilfty aug-
mentation is in use. Provisions shall be made in cockpit contro! motions
so that recovery from an augmentation actuation hardover 1i possible under
all flight conditions. The cockpit control position may shift under this
condition.

DISCUSSION

It is desirable that control force not be fed back to the pilot's

controls from the stability and control augmentation systems when he
normaliy controls the aircraft manually. Depending upon the mechanization,
however, even with aeries actuators, some force may be fed back, but it
should be minimized.

3.3.3.1.2 Feel augmentation. *The pilot and copilot shall have the capa-
bility of overriding the feel system at all times. Upon failure of the
feel augmentation system the control feel shall revert to a breakout force
and a force gradient versus deflection required by MIL-F-83300.

DISCUSSION

The purpose of the limitations 3n transients and failure mode motions

specified herein is to ensure that the short term response of the alrplane
does not get out of hand before the pilot can react. Values specified
herein for maximux acceptable transients are those which appear in MIL-
H-8501A. This specification requires three seconds "transient" time rather
thor, two seconds as for CTOL aircraft.

3.3.3,2 AFCS design. *Integration of the automatic flight control system

with the manual flight control system shall not cause the control feel to
depart from that specified in MIL-F-83300. Subsystems that trim control
forces to zero shall not introduce control transients that degrade flying
qualities.

3.3.3.3 Swashplate power actuators*

3.3.3.3.1 Redundancy. *Swashplate power actuators which are essetAtal to

flight of the aircraft shall be redundant. Where redundant actuatoes are
used, the control valves shall alý.o be redundant.

3.3.3.3.2 Jamming. *The swashplate power actuator in aircraft subject to

combat damage shall be jamproof. The threat shall be specified by the pro-
curing activity.

3.3.3.3.3 Frequency response. *The swashplate power actuator fre-

quency response shall be adequate to meet the flying qualities require-
ments of MIL-F-83300 when operated in series with the direct linkage
and rotating controls.

176
 lloss of swahhpl'atu cntiozK- it he::'t ~ ~ .-

tive control (thrust) and loss o- vehi. Ir a ' ! r-rnzl- -ata%:

Thus, particular attent Jon tc -"tqL tv o~ie~Ii'~i ee~
the design stage of the --. ra2h~p'&tr an.; "S. nw~.ri-
sarv on design to prevent ualtun.cti.ýns !r.-f --~urrtup; .i'c tv' zn-urvth lat
control i~be maintained in thtw event uak,!ur'.,,:.*i, dtvvl ~te ru
actuation of the swcshp.' t4eis ne!7estar- , jft*%.t 1'-
the actuators and val nde
shai ng rejeu*.an: s c.ýt,
from single nalfunction.

St ifonetss of the SUand oss

14- P 1t et _M. r..t,,.

wing aircraf t ~ltn te -s,: lator'-, 1'r.g ~., :

.r

rotor to tprtire sas.atte.

3.3.3.5 Fatigue lite dest~n r I 71:e=

safelite of 3W fcurs, e saepht ,r n is. -i ,.a -t- -w•.-n :o r a
minimum life of 1200whurts. l ive, -atigur
- & t7. - -
ent bench
watrng to testonrs ý,rasriaFadge.
thert st rainr surve.n e
are. faliht t'eaý:v a,r. I I -- t.s.'7

mined using actual bench tstnstrength-a! :iroc

33.3.:). Fail-saic. s h. :L.,~~¶ ~~~ ~.-..-,

be designed to safe-liie u a•'n - , :.1. :u.- ..- '
design shal be acrrfeven ,ethrough t- hr a "un-d.l"ant "I.. ;:,t-

c.tors the fatigue loadin .

'cf oor- ot dvnair-,. z-\ ,ttr 'n t. a : -
redundant itf a erronveeud%
- d,-:•np due ra §-.,t'r. ::," t- :orra
advertent acculul.of ion of
u .atigue d.ie..igs
.

DISCUSSION

Certain crit ical component s oi r,-tar,. w,:ng r.t1s

I'teas operate normallv zIndeT relativ~ely highi osciflatorv load odlition,.
These comphnents which are eighseri to fatigue boads shal 1 ý. designec -t
be fail-safe in addition to being des.gned tc sa.e-uite. This Is ne essar.
becausi of the desire not to "o%-:.r-deztgn, the compon-ents to kee-n we-ght
down, difficulty of assessing the impact on fatigue of vehicle naneuvering
at elevated load factors and the flight siafety i~pa,: Ml w Ifun~tions of
these components.

Failuren within the rotating systems of helicopters are critical with

regard to flic.,t safety, in fact, usually catastrophi. Systems have been
devised to masure the fatigue loadirg in the rotor or d.namic s.stem coin-
ponents and indicate to the pilot the degree of loading. These systems permit
operation of the aircraft continuously at conditions wherein loads generated

177,
 -. - y- : " ¾- :.u U: -W~r'net cSubiected to

u-=-, nthi'-mnnr Fat lgu

flut~
@:.w-v"- *-:?r;'.19'tsif they are operated
- . :.I-T
&7i,- ¶ Tr nov --t aeY a ince erroneous
- . -. * - '-' *~~%'ld result in operatt1,,n
± . - z-.;ir!ant . c-r provide

4 -V~
4!~j't~., or. of the redundant
-. - -.. ~ dLI!.: 4,w ercunu optrat ion in8c~O

-
.-- - - --- - - ,-ra ,-

*Sn 1 c iij I t'tr~i v 1 4 -iirc-r;'tt I er~iurnnt sIl

178
"4.0 QU.ALITY ASSURANCE

.1.I General requirenents

4.1.1 Methods for demonstration of ccmpliance. Flight control system cCU-

pliance with each of the appli-rable design requirements of this specifica-
tion or the FC(S 3pecitication defin.d by 4.4.2 shrll be verified u.;ing one
or more of the following methiods. Except where a specific method is
required, se-ection of the method of proof shall be made by the contractor
subject to concurrence of the procuring -ct!,ity.

DISCUSS ION

The basic philosophy usea for setting compliance demonstrbtion require-

ments allows judgment for selecting verification methods based on the unique
needs of each design requirement and each pro-urement. The contractor is
hest qualified to propose verificatitn methods based on his detailed know-
.edge of system design. Cost effecti'e and practical compliance demonstra-
tion procedures can only be established by integrating this contractor
knowledge with procuring activity desires.

w.l.l.i Ar&lyvsis. Compliance with requirements in cases wh4ere testing or

inspection oulld be hasardous or otherwise impractical may be verified
through analyses. These a" lyses may be linear or nonlinear and may include
piloted and nonpiloted simulat.4ons, as defined by the FCS developrment plan.

DISCUSSION

Several of the requirements included In 3.0 can only be verified by

analysis. Preliminary compliance demonstration for many more of the require-
z c,*.~-. 3. may
.... alz. be prvie tzhrugh anlais K'S dvello 0pm.wrt pl 'itn

(4.4.1) should reflect the contractor's plans for preliminary and final com-
pliance demotizt rat ion.

Requirements which will likely be demonstrated through analysis include-

Reliability and fiilure immunity

Invulnerabil it v

Maintainability

Operation in .urbulence

Gain margins at high frequencies and phase margins at all fre-

quencies.

The following analyses will likely be performed in a typical procurement;

Reliability and failure mode and effects analyses. Reliability and

failure mode and analyses will normally be performed to analytically demon-
strate that the FCS setsified the requirements of 3.1.6 and 3.1.7. When
required by the procuring activity, the Reliability Program Plan, defined by

179
4IL-STD-785, will be used to perfots these analyses. Reference 83 describes
the Tabular System Reliability -•nelysis, (TASRA) reliability prediction ap-
proach which was developed through a series of AFVDL resear h projects. The
contractor should consider use of TASRA for reliabilltv an~lyses.

Vulnerability analysis. An analysis will nor*al]o be performed

to aualytically demonstrate that the FCS meets the invulnerability require-
MenLs of 3.1.9. The contractor will normally establish and submit to the
procuring activity a Vu nerability Analysis Plan as part of the FLS develop-
ment plan which defined analyti~al procedures to be use%. for the vulnera-
bility analysis.

Maintainability analysis. An FCS maintzinability analysis will

normally be accomplished as an integral part of the overall system analysis.
This analysis and the aesociated ,aintainability Program Plan, prepared in
accordance with MIL-STD-470, and included as part of the FCS development
plan, will normally be used to analytically demonstrate that the requirements
of 3.1.10 are satisfied.

Sstem-safety analysis. Hazards analysis will normally be accom-

:Ilished as an integral part of tt:e overall system analysis. These analyses
.-Id the associated System Safety Propram Plat, included as part of the FCS
.!eveloprient plan, will normally analytically demonstrate that the require-
:-.ents of such paragraphs as 3.1.3.2., 3.1.) and 3.1.10 are satisfied. When
rcquired by the procuring activity, MIL-STD-882 will be used to define the
analytical procedures to be used for the safety analysis. When required by
t•he procuring activit:, a System Safety Program Plan (SSPP) in accordance
-itti MIL-STD-88? may be prepared. if a comprehensive system safety program
-_inot justified in a specittc procurement, a safety program meeting the
-,:,inimu acceptvible safety program reqairements of MIL-STD-882 may be prepared
,' the contractor subject to the appLoval of the procuring activity.

Operation in turbulence analysis. An analysis or simulation will

,.or-mally be pe: iormed to analytically demonstrite that the turbulence pene-
'iration iequirements of 3.1.3.7 are satisfied.

Stability Analysis. A stability analysis will normally be required

:o predict gain and phase margins at frequencies and flight conditions where
t-sting is impractical. Gain margins cannot be tested, for example, at or
_,ar 1.15 VL.

. 1.1.2 inspection. Compliance with requirements associated with referenced

.. n.mponenr specifications, the physical arrangement of parts, or the physical
r,,lationship of parts shall be verified by inspection of documentation or
nspection of the physical installation. Documentation may include documents
Thuwing the qualification status of components which have been qualified to
the requirements specifications, or drawings showing clearances or other
physical relationships. The FCS development plan shall define those require-
ments to be verified tn:-ough inspection. Unless otherwise specified in the
cokntract or purchase order, the supplier is responsible for the performance
0" all inspection requirements is specified herein. Except as otherwise
SLPe ctfied in the contract or order, the supplier may use his own or any other

180
fecilities suitable for the performance of the inspection requirements
specified herein. The Governmant reserves the right to perform any of the
inzspections set forth in the specification where such inspections are
deo-2ved necessary to assure supplies and services conform to prescribed
requiremnts.

DISCUSS ION

Many of the re|uirements in Section 3.0 are that components or sub-

systems, comply with component or subsystem specifications which may be
*ilitary specifications or contractor prepared specifications. Other
requirements are stated in terms of hysical arrangement or physical
clearances.

In the case of demonstration of compliance with other specifications,

tests may be conducted on the ce'ponent or tubsystem specifically for the
purpose. However, these tests are requirements of the component or sub-
system specification rather than MIL-F-9490. Compliance with MIL-F-9490
requirements can be verified by inspection of the qualificatior status of
component or subsystem.

In the case of requirements involving physical relationships. physical

itspection will provide the desired proof.

4.1.1.3 Test. To the maximu extent feasible, compliance with the quantita-
tive requirements of the FCS specification shall be demonstrated by testr.
Tests shall include the laboratory, airplane ground and flight tests deiined
in the FCS development plan.

DISCUSSION

Verification by test is the preferred metihod for demonstrating compli-

ance with requirements. Due to s'fety or cost considerations, many require-
ments cannot be demonstrated during flight testing. In some cases
analytically predicted trends are validated during flight at a critical or
representative set of flight (onditions and analysis trends are used to
extrapolate these validated analysis trends to show compliance at all flight
conditions not specifically tested.

Verification by ground or operational mockup testing is generally

preferred where flight testing is not feasible. However, as stated in 4.1.1
the specific method to be used for compliance demonstration is intended to
be selected by the contractor.

4.2 Analysis requirements. Where compliance with specification requirements

through analytical predictions is used, the contractor shall define the major
assumptions and approximations used and verify that the modeling and analysis
procedures used are conservative. Verificatlon shall normally require prior
use and validation through comparison wiLh flight, wind tunnel or ground
testing data. In all cases the contractor shall establish tolerances on

181
analyticai prelictions used tn demonstrate compliance with specification
requ2irements, Theme tolerances shall reflect antiilpated variations in
system or component characteristics such aa:

;i. Parameter,4 that change with temperature, Atmrspheric pressure and

o.-ther environirkntal facturs.

b. Parameters that change with fiilliresi ir manufacturing tolerances.

c. Parameters that critically iffect system performance or xtibility.

d. Parameters that are not accurately knovn (if thpv are significant).

c. Nrainwters that change as a result of aging or wier..

4.2.1 Piloted simulations. Piloted simulations shall be performed during

FCS development. As a minimum, the folowiig simulations shall bo accom-
pI ishtd:

a. Piloted simulations using computer simulatita of the FCS prior to

hardware avail ity.

b. lPloted ,Aimulations using actual FCS hardware prior to first

4.3 Test requirements.

4.3.1 General test requirements

4.3.1.1 Test witness, Before cc ducting a required test, the contractor

shall notify an authorized procurement activity repiesentative. An orienta-
tl:n briefing on- specific test goals and procedures shall be given procuring
activity observers prior to any required test sequer''e to be monitored by
an observer.

4.3.1.2 Acceptance tests. Appiopriate FCS acceptance tests will be defined

by the procuremtnt detailed specification.

4.3.1.3 Instrumentation. Ac-uracy if instruments ano test equipment used

to control or monitor test parameters shall have been verified since its
last use prior to initiation of the sequence of design verification tests.
All instruments and test equipmv.,% used in conducting design verification
tests shall:

a. Conform to laboratory standards whose calibration is traceable to

the prime standards at the U. S. Bureau of Standards.

b. Be accurate to within one third the tolerance for the variable to

be measured.

c. Be suitable for mearuring the test paremeter(s).

d. Be verified no less frequently than every 12 months.

182
 I
4.3.1.4 Test cond it ions. fhe ont rac tr sh114l e1tab ish operat io0tvA ve,-t
conditions which accurately represent system tn-servicv' usae throulh,,it
the applicable flight phase& and flight envelopes defii'ud I, accqrdan
with MIL-F-8785 or MIL-F-83300.

4.3.2 ;.hotatou. fvst-i

4.3.2.1 C nompent tests. All %zimpo.,entsshal1 b*- qualified tL, the .appit
.. able component specif...•ition by individual tesits, by ptrof ot similai it% t,
qualified component s whl,-h are qualified under conditions appitabl t,, tht,
specified opetatino. %'onditions, by testing in ixyatem dentgn yeý .t 1, .!
tests, or suitable cordinations of theme metho.ds. Component qual it i•,ot i r
requirements shall be based upon their use in the specitic vehicle and it,
associated environtaent, Environmental test mvthodt, and procedut,. sh.,'" '
selected from MIl.-STD-46I, or MIL-STD-810. The contractor shail ge,,iat,
additional methods and procedures where MiL-STD)-46I or Nil-ST'-810 Are.
inadequate for the planned a 4 rcratt usage. Wear lite 3.1.2
l•.ll bt.
demonstrated at the component level except w|vre system wear lite is r,,tv
meaningful due to component interact iot,.

I SCU SS LOA

Component test requirements are generally defirted hb the. Comwpw'ntot

specificatio~i* referenced herein and test meti.xods and procedures to he used
are generally defined in MIL-STD-810. For in~ivldual procurements these'
requirements and methods may be inadequate for either the etnvirotunent tc be
experienced or for the unique implementation uoied. Special or additton0l
tests or methods should be developed by the contractor and included ir the
FCS development plan or specitficatton. Among 'omponent tests normallv per-
formed are:

Vieýctrlc strength testt. Each circuit ,t elect-tical a:,ndic,-

tronic componens should he subjected to a test equivalent to the applica-
tion of a root mean square test voltage of three times the maximum (but not
less than 500 v.) surge d.c. or three times the maximum surge peak a.c.
voltage to which the circuit will be subjected under service conditions.
The test voltage should be of commercial frequency and should be applied
between ungcounded terminals and ground, and between terminals insulated
from each other, for a period of one minute. Test should be accomplished
at normal ground barometric pressure and no breakdown of insulation or ait
gap should occur. Circuits containing capacitors or other similar elec-
tronic parts which may be subject to damage by application of above voltagesv•
should be subjected to twice the surge peak operating voltage for the
specified period, If the maximum peak operating voltage is greater than
'00 v., the rms value of the test voltage should be 1.5 times greater than
the maximum peak operating voltage. Electrical and electronic components
should also be tested for resistance to air gap breakdown at the maximum
altitude specified in the altitude test.

Electro=ngntic interference limits. The flight control bystciTM

and components, both should be a sembled and arranged in a manner as speci-
fied in the system or component specification, with interconnecting cables
and supporting brackets representative of an actual installation. Provisions

183
should alo be made for inverting all components with respect to the
ground plane. or positioning in suci a&manner an to perait measurments
from the b%,ttom of al components. Measurement of radiated and conducted
interference limits should bw made in accordance with MIL-ST1-461 with the
system switchen, controls and components operated as in actual service.

Sand and dust. Each component, with simulated external connec-

tions attached, should be subjected to individudl tests Nefore and after
exposure. Any dust film or dust p4eretration should not result in 6
deterioration ot the performance of the component.

Fupnus. Equipment which has parts of organic material or other

materiials which may grow fungus. sihould be subjected to a fungus rtiistance
test. The component should be subjected to individual Cests before and
after exposure. Any fungus present should not result in a deterioration
of the performance or service life of the component.

Extreme tomperstture tests. Dynamic operation using expectvd high

and low temperature anv tesperature shock should be verified on all coupon-
ents sub.ect to binding cr malfunction ri-sulting frow:

(1) [)i.ferential expansion or contraction of mating parts

(2) Deterioration of lubrizant

(3) Deterioration of hydrauLic fluid

(4) Deterioration of any type seal ;..vice

(5) Deterioration of electrical part

(b) Altered hydraulic or electrical characteristics

(7) Change in performance funct!..n

The component should be subjecced to individual tests before, during and

after exposure. From these tests and a visual examination there should be
no evidence of damage or deterioration which will prevent the covmponent
from meeting its operational requirements.

Humidity and corrosion and icing. Components Pubject to failure

due to corrosion, entrance of moisture, or formation of ice should be given
humidity tests and salt spray tests. In addition, if ice formation might
be detrimental to the equipment, an icing test should be conducted as follows:

(1) Cool tvst itemu to -12 degrees C (10.4 degrees F) or lover.

(2) Reduce ambient air pressure to simulate 40,000 feet pressure

altitude and maintain for at least 15 minutes.

(3) Increase ambient air pressure to ground level by introducing

warm moist air at a temperature of at least 49 degrees C (120 degrees F)
and a relative humidity of 95 (+5) percent. Continue circulating warm
moist air until the test item temperature is at least 5 degrees C (41 de-
grees F). Item 1, 2, and 3 constitute one cycle of testing. Twenty-five

184
 7d

cycles should be performd to determine ate'ptabilitvir, 11 wingt PA,

five cycles. the text Item shal, be fstitlonallv hq'-hed vhilre it A I."
degree C (10.' degree* F) temerature. At the concluiri'n •! thwe ,v .,.
&nd following the functional check, the equt'ptr•nt xhoiild 4P exeitnrd t.,t-
evi'deruce of inteirnsl usisture. corromion, or ot her de. t,.,

Altitude. Electrical equipment And other !I gtlit ,,ont?,' .st vi

Atems which may be adverselv at fected by hilgh-a It
tt|i e o ý,rrat ion -shoau d if,
tested. A percentage of the total lif& test -%, Iep. ,ontisateTit with *etv
vice requirements tif the component, but not I4,2s t|,an .r 'er, ent, •',•t' tt
conducted at the high-Altitude condition.

Vibration. she, k and acceleration. All equipsent sut,l'j, t tI

failure or a&lfunction due to vibrat ion, ahoi k , or htIII, Aa-,' rrat tonf 11hk; d
be tested.

Combined temprature - altitude tests (,osp..nent; .ind .. Nwtemp-. ,&'-

ject to leakage or which may experience cooliner prohbomm. shu~d bt s4,ýi,, teA
to combined temperature - altitude tests.

Copjp~ne t eil trst 1onA. ('4mp.nent s wtit~ I a-fe ,auhjiv t tt wi'.i

fatigue, or other deterioration due to zmAlge. should ,e life tv'tei ukin1er
realistic environmental coniit.ions for a nuttqer of cv las reprerent.at tlv '
the desired lift expectancN of the compoiient. In most ,aaeS, 'le tt+,t
requirements ark' defined in Government wpec it icationa, but ?tAhould he
revised to reflect actual expected usage. Hydraulic .'omponents %hculJ bN
tested while usiný; hydraulic fluid itt a .vpt,'al flet . nvro'nment ;1.,id
cleanliness level.

System life testinA. The meciionlcal porti, n- of the ,,,fi'lct.' F(S.

such as pulleys. cable rods. torque tutcs. con.rol sticks , ,tvc.'l .t,,
should be tested as a complete Avstem. It iN c',,nSidr,,d th.,t the h,
1 •t w.iv
to do this is in a o, splete system nkckurp in which lo..ds, rel.tti,, !i, in.,
and locations, and other characteristic.. are re..list!c.

Miscellaneous tests. Equipment which is L.sted so thtt it is

subjected to rain, sunshine, and sand and dust shall he tested ac,.-ordingl!.
Components failing a service condition rest AhoulJ tIk be resuohw ed tor
test wtthout furnishing comlete informittion on 'he korrective .t. cion t1ken
subsequent to the failure. This iraforistion shrild 1it furnished to the
prccuring activity or in the test report, deperJin ,,*Ain locition ,t ttsting.
Depending upon the nature of the failuret encountered and correctilve aic'tion
required and at the option of the procuiring icti\itv, the rework or modifi-
cations accomplished should islso Se incorporated ih,to the othet test stm-ItNs.
Acere rework or modificatiou tmy
&N con- idered as sutficicnt to affect per-
formance under the other service condit on tests already completed at the
option of the procuring activity, these tests should be repeated in the,
specifled order.

Components to be used under a particulcr category of service

application, which have previously been subjected to and accepted under
the requirements of a lower, or Ics severe category application, either as
an individual component or as a component of the same or a different s\-tim.
should be subjected to a rerun of those service condition tests which
vary with category of service applicat.ion.

185

_.._ _. _ _ I
 i, Iuib-t i 'na.A NK'k kui1 aLnd p.tkuiiti tvpt p. Where one .iA the Iirstt
xi-Pianen in a rw%. Brle*a of alrcraft wvill not be Avalaialf for extenpive
tt'4 ~tr Ig FC'ý j't br to flight lit that woodel , an operatitonal wickup
fttile
w-f I,h funct bonaliw Iv tat it Ac v and d-enaaical Iv dtipl Icaten the flIg1ht cont-
tt k pistem ohal1 1 he ~oont rut ~ed. ~or easnet ial atd fl1ight Phase rasent lal
I igtt o'ntri an accurate elect rIca reprremntat ion nhal I al'so e pro-
i ddt- Iroduc.t ion cot 11turat ton , oponents sallh 1 he listed for Ali. flight
o'ntrto Pi~vtem pirts. And thi, hydraulit- %vatcV' *hall be~ compatible with
'411.-H4-S440 test requitrumwnts. Primar% Aircraft structure need not he dupl'*-
.. td tuowrket. production .- ontlturat ion mount inw i'rackets ishall he used
and %hall bt' attacheod tv strticture which winumlatest actuail mounting coppli-
~AitV. Met Imn itAI tosponent oFA the FCS %shal Ib e duplicated dimeens ion&ally.
It!tiA and ,oap Ii ane Mf t 'ýight -ontrto i urf ACCi' shal I e dupi I I at ed or
.4-uratveb simulatwd. The operatiomnal mockup shall he coupled with a com-
puter Pilaulatiour of aircrafc, 'harsctertsttc-a And external Inputs to the
Iiptit "'ntrol SvattzM. The tolloving minim~um test ing ithall be conducted
Oil t ht opet.t ltioA I 1ft'k kit:' "t Other .appr,-prlifr t est ! ac lilt v wher Approved
tN the pro'curing .ict ivitv.

At. lo.'%'r ,eupplv v~ari.Itlcn teistr to Je-itvntrate' stist.-actorv operation

* ve: tilt tangit' ol iilow.-blv varl.4t ions SP41-t lied In the appl icable ontrol
owet "t' ti.ti' ret ert'nctd In ...

1.Svste'n tat ig..t testsa (where svater inistal lat ion grometry or dynamic
!ýaricteitlatts
!LAre cr1itici tto tatigur life) in .at:cordaince with MIL-A-AM7
to :eftinstrAte compli-ince with the requiremerits ot 1i.1. 1.. The duty cvcle
required %hall he establishee4 hb thie contractor is representative of flight
vnd ground usage,

Sta-bilitvt margin t~eltts to 'V.ritV thosae requirements of 3.1.3.e'

ý.hi h clin he verit~ild bv test usitig an ..ircr.a! t sitnulat ion or the opera-
on. a1 mck up., bu t wh ich cannot be ecornomlicllv *r aýatelv det' 'nstrated in
iiight,

d. lest s to determiane the ~eircts ,I single At d mult iple failures

o.n pertormance, safe~ty. mtsission comp! ot ion reltab ilIityv, and the develop-
~etof emergencv piocvdures to c7ounteyat't the effects of failureb..
e'. Mis-cel laneous tests to deft-nstrate Ft'S performanc~e, Antd compat I-
villit among FCS svistemsa and with intertacin)4 svstems.

t.S%,t em wv.ar Ililt 3.1.1.2 where compo.nent wear li fe is interactive.

i SCL', [ON

The operational ML'Ckul is.a tool used tor validation of the flight
,ontrol system design prior to tfirst flight and is also a u';eful tool in
711ght control development. The r.1re nearly this tool functionally
tesembles the flight vehicle instillation, the greater the confidence level
it, the test reskilts. Ideally. an airframe with a flight control sy'stem
~ns~eledand with aircraft 'light dvnamics simulated would he the mockuip.
se ot ain airframe for the operatitonal mockup, such as described in Refer-
ence 1., is beceiming more pcpuI.alr--es--pecia1Iv where the FCS ..rframe inter-
.4ctior. is expetted tc he complex.
 Inclusion or exc lusion ot meatis lot, b imulat ioll t uo'it I~01%2Ult act. ilelki-
dynamic h~ng. mumrnts Is depe~ndent upoti spec if ic us~age and should be Just i-
fled by the contrtictor. Where alt-ciatt st rue.ttur.l cor-pl Elt-k'i 1% siultilated
i n lI eu o f aiLr frame pa rts, 'er i f i -at i oi shou I d be est al1,1sht d by t lit c oll-
tractor through a detailed analysis o? oomp1liatict,

The specififed tests imiv lbc pit-r ,o itu110d hild 1V idkal 1V 0 V , W1ivIC I'~
f V,1i e
-A single test may sat isfy mult ilble requi t-ement s. Fo r e~xaripIe , st1,tiuct:u ra I
strength and rigidity May be verified during performatnce tresponse) tvmt
and fatigue requirements may be verified as a pairt of endurance tes.ting.
Note' that the specified minimuin tests init he performed on alterniltu te~sL
facilities when approved, Separate component li fv/lovdixoý test ing, for
example, may be justifiable In some cases.

When performing power supply varlt.-Iion testsa, eadi.I coimponent should be

tested individually or assembled, or both, itito a svst ou in at mau~ier as,,
specified in the component or system specification. Rated elect-t co'!
htydraulic~s and other rt'quired power sources should be appli ed and al I~l -
bration sett ings placed at maximum rated posit ions. Afteri complet ion of
the warmup period, the power sources should be varied and u'oduiated,
Lhroighout their specified limit~s. No steadv state or transient. woiLkihat ionl
char-es in the power source.*withtin p~et miSSibl ei mis , S11011111 caulSe a
variation or modulation in the systemi's performai~nce whi~h may result ill
undesirable or unsatisfactory operation. With rated power applied, the
system's switches, controls and components thould be operated as in actual
service. Observation of the rated power source should note no variatton or
modulation of the power source beyond permissahie operational limits uiehn
the system is operated against load condiftionS varying from no load to full
loiad conditionsa.

Fat igue tests mav be accompiIshted hVcvin 011o i-'jsou Si\

for feedbaulck prsystremspletetnI

vnrfieeo
should be as thet
oprtoflmcu ort'
fatenuepracticag, this
"prpriactce alternouated se ainlethe Fcol bde tuhe
fascenorseetois and
MIctuat7 orftgetstineluiredmontse Noperatoa mockupre
eltiminue terror included
alinkthes cnalticolspedictin. u onuiert

signficate mathemodelsusetda the analyticall predictiost and the opea-gl

tionafedbcku syrtins aroul obervediie onrther frpqenyrational mor other
r? etests should beal pef i raedtoidentify tencompo4 snenthewhich haredwarpersuc
modselsods Olcthonise copndnt acutre ientiuied.o the coprraspondin mocth
moelsmicane berorrnctued andth analyticalmri predictions ruef
Lonoed. ait
adonher ofathe mjorelusespoblm assoperateona mwctu ihse evaluaniont oWhere
sinrecn
eiffectse-
withien the aC.Th~cntaltctr
phoudictionincldte opera-~ic
oretdtestsshudb oefrsmultin to vdertify ptheicmoet to
whricrmanre andoer v

evaluate system compatibility.

 For essential and flight phase essential controls, tl'e follwing
mockup tests of AYCS BIT and, failure reversion capability shomild be con-
sidered:

Overtemperature test of AFCS computers, panels, ind sensnr3 ;p

evaluate the BIT capability of detecting failures induced by progressive
overheating.

Wire hardness failures (shorts between wires and ground and open
circuits) to evaluate BIT capability to detect wirinig damage/failures.

The main objective of these tests Is not necessarily to make Individual

components less vulnerable to hazards or enemy action. Rather, the primary
objective is to ensure that true rediindancy exists by verifying that indivi-
dual failures in each channel (1) are detected, (2) are remedied, and
(3) are uot the cause of multichannel failures.

4.3.2.3 Safety-of-flight tests. Prior to first flight, sufficient testing

shall be accomplished to ensure that the aircraft is safe for flight. These
shall be defined in the FCS development plan and shall include, but not be
limited to, the following:

S4.3.2.3.1 Component safety-of-flight tests. All system components shall

successfully demonstrate oetisfactory performancE and satisfactory operation
under the environmental extreizes expected in the flight test program. Certi-
fication that a compcpent is safe for flight because of prior qualification
and use on enother aircraft may be allowed provided that the component
design Is identical to the previously qualified part in all significant
respects and that -t-, capability trcoPrat ur.er all conditions specified
for its new appi"l-t.on has been pr'vr".

4.3.2.3.2 S_ybtem safety-of-flight tests. The z:mplete system Shall suc-

cessfully pass all of the operational mockup tests specified in 4.3.2.2
prior to first flight except that only 20 percent of the required fatigue
life demonstratior need be completed.

4.3.$: Aircraft around tests. Prior to first flight the following minimum
testing shall be perfcrmed.

a. Gain margin tests to demonstrate the zero airspeed 6 dB stability

margin requirements of 3.13.6 for feedback systems depending on aero-
dynamics for loop closure and to demonstrate stability margins for nonaero-
dynamic loops° Primary and secondary structure shall be excited, with
special attentitin given to areas where feedback sensors are located with
loop gains increased to verify the zero airspeed requirement.

b. Functional, dynamic and static tests to demonstrate that all FCS

eqnipment items bre properly installed and that steady state responses meet
FCS specification requirements. These tests shall include integrated FCS
and te't instrumentation as installed on the prototype airplane. Compli-
4 oscillation requirements of 3.1.3.8 shall
ance with the app] .ctable residual
be demonstrtLeL

188
 c. Electromagnetic interference (EMI) tests to demonstrate compliance
with the requirements of 3.2.5.4.1. Measurement of interference limits
shall be made in accordance with MIL-STD-461 and MIL-E-6051

d. An integrity test to insure soundness of coWonents and connec-

tions, adequate clearances, and proper operation in accordance with MIL-
A-e867.

DISCUSSION

The intent of paragraph 4.3.3.a Is to insure that no structural coup-

ling exists between the aircraft struLcure and the flight control system
(structural resonance). This phenomena occurs when there is sufficient gain
in the flight control system such that structural modes sensed by the FCS
sensors are reinforced through the loop closures in the FCS, i.e., a 180
degree phase lag exists at the particular structural mode frequency between
the sensor and the flight control surface. This results in a sustained
oscillation at the structural frequency. The problem can be eliminated by
(1) locating sensurs in the vehicle so as to minimize the effects of either
structural mode slopes or accelerations sensed by rate or acceleration
sensors respectively in the structure (phase stabilization), (2) designing
electrical filters to reduce the gain at these frequencies (gain stabiliza-
tion), (3) reducing the total system gains, or (4) various curb.nations of
the above. Structurai coupling problems can also arise due t'U local insta-
bilities within the actuator mounting structure or mechanical linkage, and
will be discussed in closed-loop limit cycle tests. The first two solutions
are usually pursued more vigorously than the latter. The third approach
can compromise aerodynamic performance that the closed-loop FCS is expected
to enhance.

Data on structural characteristics at the various sensor locations are

usually obtained from flutter analysis or .nalytical structeral anrlysis.
It is very desirable to record flight control sensor outputs during ground
vibration or flutter tests. These characterigtics are a function of the
structural stiffness and inertia, hence they vary with fuel loads, stores,
and configuration changes, such as gear and flap position, or wing sweep.
In general, system design considerations and ground test requirements for
elimLiating structural resonance can be treated for two classes of aircraft.
These classes are large aircraft with structural mode frequencies starting
in the 2 - 5 Hz region, and small aircraft with structural mode frequencies
starting in the 8 - 12 Hz region. Several examples of how this problem has
been addressed in both large and small aircraft will be discussed.

The intent of paragraph 4.3.3.b is to insure that the nonlinearities

existing in the closed loop flight control system do not cause perceptible
limit cycle oqcillations to occir in flight. The phencmena occurs when the
phase margin of the flight control system reaches zero degrees (180 degrees
of phase lag in the system), and sufficient threshold is available for the
closed-loop system to react to this amount of phase lag between the sensors
and the control surfaces. The problem can be alleviated by phase compensa-
tlon in the mechanical and/or electrical portirns of the systems. The pur-
pose of introducing lead compensation in the system is so that a sufficiently

189
high gain can be naintained to produce thu desired -orniance. Addition -
ally, statically unstable vehicles require a tainim, sain level to insute
vehicle .tab il it y.

'lhe systt in gain level and frequency of 1-1e

1 :ýS, 1 let 1C0lS can hbe
roughly •stimated by performing a rool locus -)r similar clcsedoloop 4nalvsis
using both rigid and flexible inputs for the control Jerivatives. Thl's
analysis should he performed at the maximum closed-loop total loop gain that
would be realized in flight. The reason for -onducting both rigid and flex-
ible control power analysis is that the actual control power of the surface
will fall between the two values at the limit cycle frequency. Once these
gain and phase margins have been established, the results should then be
checked on the aircraft or equivalent flight control simulato. (iron bird),
using tile actual hardware that the aircraft will use, with the exception
of the gyroscopes and accelerometers, which are usually eas!er to model
than to "torque" the actual hardware. fhese gala margin checks should be
conduuted using the results of the ground vibration tests for the flexible
model of th. airframe and the structural filtering used in tile control loops.
The dusirahility of using the structural data becomes more critical for the
larger aircraft because the limit cycle frequencies usually occur in the
same rogions as structural frequencies. The gain and ihase compensation
networks then be.conre more critical for the larger aircraft with lower fre-
quency structura! ilodes. Two general classies ot limit cycle can exist in
the flight control system, and each can be investigated on the aircraft or
on the iron )ird simulaLor. The first is a low amplitude oscillation that
occurs as a result of nonlinearities about the null position such as hyster-
esis, It has been the subject of much documentation such as references (48)
lifting bodies, (7) TWFL\D I. and (87) rwE.AD II. The second limit cycle
occurs as a result of system saturation such as actuator rate limiting aid
is extl.ýmelv important when investigating thu characteristics Lof statically
unstable vt-ihjcl,.,tand the kmniqpe ,ontrol 1iws required for stabilization
throughout tile flight envelope.

A typical p!ot of what can be expected from thest tests is shown below
in Figure 17b. The plot shows tile limit cycle amplitude (&4 is stabiliza-
tor deflection; Kq a q is control system gain times pitch rate ampl~tude)
and frequency plotted as a function of total loop gain (Kq is the control
system gain; M,6, the aerodynamic gain). Ideally, with a linear control
s,,1 tem, no limit cycle would occur until. tile loop gain equailled the gain
necessary for critical stability, i.e., the 180' phase lag point on a fre-
quenc\ response plot or tile crossing of thetWaxis on a root locus diagram.
However, due to nonlinearities at low amplitude, the phase lab, is excessive
causing a divergent oscillation until the aml, itude of oscillation reaches
the point where the effect of the nonlinearities is reduced and a stable
limit cycle occurs as showan on the lower port ion of tile curve. Increasing
the value of the loop gain increases the amplitude if the stable limit cycle
and the corresponding frequency of oscillation. As the linear stability
limit is approached, the amplitude of oscillatli,,r. rapidly increases forming
a knee in the amplitude plot and the frequency falls off. The zero ampli-
tude line and the linear stability limit line represent the limiting case
for a completely linear system. For very large Inputs such as sharp stick
raps su'ficient to cause rate limiting, system saturation will produce addi-
tional phase lag in the control loop causing large amplitude, lower fre-
quency, sustained oscillations to occur. Typically, the large aimplitude

190
 I'

S!.Inea stability limit

(LA)

IIa
KqAq, tz

I ,' ,)0

Figure 17D. Typical limit cycle ground ttst characteristics

saturation points, as shown by the (LA) point in the figure, usually occur
at a significantly lower gain than the small amplitude divergent points.
Altbough a large implitude input is required to saturate the system at the
lower gain values, the input magnitude required to satulr"ate the system
gradually decreases as the gain increases. Thus in the gain range between
the large amplitude saturation point and the small amplitude limit cycle
divergent point, a moderate size input could be sufficient to saturate the
system. These large amplitude, saturation type instabilities should be
taken into consideration when establishing flight boundaries. This phe-
nomena has been addressed in depth in the (A-7 DFCS) Digital Multimode
Flight Control System program and the results will be included in the Final
Technical Report for that program.

Examples:

Several recent flight control programs, both developmental and produc-

tion, have addressed the phenomena of limit cycle and structural resonance.
Problems encountered and solutions will be briefly touched upon in an attempt
to shed light on understanding how to deal with the problems successfully.

191
Lifting Bodies - X-24A. M2F2. HL-10

Structural resonance and limit cycle tests were conducted on these

vehicles prior to first flight at NASA Flight Research Center (RFC). Ground
testing techniques and data results are given in reference 48. A six db
margin was used on theme tests. A first order aerodynamic model was used
for the limit cycle testing. A rather interesting observation is the phase
lag contribution of various components of tht flight cnntrol elements as
determined by recording vatious points while conducting limit cycle tests.
This data is shown in figure 10D.

L r"it (¢leampliude, Ouput tfrom" /Outout fro

KQC6. 0" j urtace / mehaeni•a /
/ output from'
to / sa$
S •ervo

1, 20 X) 40 'v ,
KQMbe per Se(

Figure 18D. Typical limit cycle ground test rharacteristics of the pitch SAS
of the BL-10 lifting body at various po4t-b within the system

TWeaD I (F-4c)
Several problems were encountered with both limit cycl and structural
resonance in flight. Reference 7 documents the problems that were experi-
enced and their solutions. The ground structured resonance tents vwre per-
formed after structural resonance was encountered in flight. The gyros were
relocated and several modifications were made to the structural filters in
the forward paths of the CAS. A six db gain margin was the criteria that
was used in the on-aircraft ground tests (no iron bird was available). Once
the proper filter configuration was found, no further problems were encoun-
tered. Limit cycle problems were also encountered in flight. These problems
were present throughout the program, and were due to improper operation of
the adaptive pitch gain changer. The on aircraft ground limit cycle tests
were conducted by simulating the gyroscope and using the first order approxi-
mation for airframe dynamics.

TWeaD II - (YF-4C)

This was a high, fixed gain system that required extensive ground devel-
opment and evaluation testing to alleviate limit cycle and structural reso-
nance problems. A complete description of tests that were conducted and the
results are discussed in detail in reference 87. Some significant test
results are noted. A double notch filter was required in the pitch axis to
allow a sufficient fixed gain to be maintained. Placing lead compensation
in the forward path to eliminate limit cycle allowed the uaximum fixed gain

192
to be increased by a factor of five. All store loads flown were ground
teuted for structural resonance and a six db gain margin was maintained.
The roll and yaw axes were cross-coupled, but first order decoupled aero-
dynamic transfer functions were used to conduct ground roll and yaw limit
cycle tests. In-flight limit cycle tests were conducted in all three axes
to validate the ground tests. These tests were performed to determine if
any lateral-directional cross-coupling wrs present that would not show up
in the decoupled ground tests. Frequency response tests on the structural
filters showed that the transfer iunctions varied with input amplitude,
indicating non-linearities in the electronics did exist although no problems
were encountered in-flight.

B-52 Controlled Configured Vehicles (CCV)

The extensive on-aircraft ground tests of the Ride Control System (RCS)
and yaw damper implementation accomplished prior to beginning the series of
B-52 CCV flight tests are described in reference 44. A block diagram shottfta
the mechanization of these ground tests is presented in Figure 19D. As
originally designed, the RCS did not satisfy the six db gain margin require-
ment on the ground, due to excessive high frequency (40 to 50 Hz) feedback
gain. This problem was easily corrected by adding a high frequency attenua-
tion roll off filter to the onboard analog computers.

C-5A

System performance tests including hAS control characteristic tests were

perform,•d on the iron bird. Ground vibration ana frequency response tests
were conducted on the aircraft. I
Iron bird system stability evaluations resulted in detecting unacceptable
low damping in the aileron-apoiler system. Excessive slop in the aileron
servo attach points on the iron bird and the means of simulating surface
inertias were suspected of loading the servos differently than actual air
loads. For these reasons, no modifications to the servo system were incorpor-
ated prior to gaining experience on the aircraft. The rudder servo assembly
also exhibited low damping characteristics when sharp pedal commands were
given. This was traced to lack of structural stiffness of the lower rudder
actuator backup structure. The backup structure on both the iron bird and
aircraft was stiffened to eliminate the problem.

The only structural coupling problem encountered in the aircraft grcund

vibration tests was in the pitch cuntrol system. This instability was due to
a coupling between the inboard elevator rotational frequency, the pitch aug-
mentation computer mounting rack frequency and the 17 Hz symmetrical aircraft
modes. The problem was corrected by stiffening the mounting rack and chanig-
ing the pitch SAS body bending filters. Because of test schedule commitsV';ats,
ground frequency response testing was not conducted on the first production
ship until after flight 8. Testing was initiated due to detecting aileron
servo system instability during step Input commands of the BITE test sequence.
The frequency response data verified the low damping exhibited by the aileron
servos. The source of the stability -roblem was found to be positive struc-
tural feedback as a result of a basic incompatibility between follow-up geo-
metry and the structural deflection of the aileron hinge line. A negative
structural feedback linkage was designed which solved the problem.

193

I-
 U -l

I '
"" ZU-i
0...-J
I = I I

xL
C4~

- it.7P.
-' I.- w z

w to

194
C-5A Active Lift Distribution Control System (ALDCS)

System functional performance tests and frequency response tests were

conducted on the iron bird. Aircraft ground testing of the ALDCS prior to
first flight Included ground vibration tests and a comprehensive ground fre-
quency response test program including gala variations to verify the six db
gain margin stability criteria. The prototype development progra-m wam
highly auccessful, resulting in no significant design modifications as a
result of ground or flight test.

Structural Coupling Effects. Structural bending modes can cc~uple

through the CAS feedback to cause high frequency structural oscillations.
To reduce the probability of this from occurring, special techniques were
used. There art three vibrational modes in both the longitudinal and direc-
tional axes. Theme mode shapes vary slightly with fuel state. The effect of
first bending mode is reduced by location of the acceleration and rate sensors.
The accelerometers are located close to the vibrational mode of the first
bending mode and the rate gyros are located at the antinode. The effects of
the second bending modes were reduced by the addition of second order "notch"
filters in the computation network. It was assumed that the third bending
mode vaq of a small enough magnitude that it would not couple with the control
systeur., so no compensation was added.
Longitudinal Structural Coupling. During set up of Iron bird testing, it
was discovered that the stabilator actuators a~nd its backup structure coupled
with the flight control system at the atto's natural frequency (natural
frequency is approximately 27 Hertz which is close to one of the longitudinal

lgwsadded in series to the notch filter, and the loop gain was reduced
by/3.This eliminated the oscillation but degraded the longitudinal short
peiddamping itt the low altitude high speed part of the flight envelope.
Duiginitial flight testing, it was decided that this degradation was
unacceptable and had to be improved. A new structural filter was designed
thtprovides the same or better phase margin at the longitudinal short period
control f- >quencies, and the same Or greater attenuation at the 27 Hz struc-
tural mode frequency, as the original notch filter cascaded with the 40 radian
lag filter. The original notch filter was conceived in anticipation of a
need to attenuate signals at the first vertical bending mode. Sensor loca-
tion, however, adequately isolates system response from that mode, so that
filtering in the 8 Hz region proved unnecessary. This filter is a double
lag with a break frequency of 60 radians per second and solved the structural
coupling problem. Flight test results have shown that this filter success-
fully eliminated any structural oscillations and retained the original short
pericd damping capability of the GAS system.

Directional Structural Coupling. During initial ground tests on the

aircraft, it was determined that a structural feedback vibration could be
excited at 29.C Hertz (third bending mode) with abrupt inputs, like lowerihng
the gear. The structure? filter was modified to move the notch to 29 Hertz
and to provide an additional 27.7s radian per, second lag. This gave about
30 db attenuation at this structural I~uency (29 Hertz) and cured this
problem.

195
 As the low altitude high speed part of the flight envelope was being
opened up it was discovered that with the "new" filter the first bending
mode (7 Hertz) was excited. As a result of this, a third filter was
developed which changed the notch from 29 Ha to 7 He and changed the lag
from 27.75 to 59.4 radians per second. This had the effect of attentuating
the signal by 15 db at the first bending mode, while retaining 10 db attenu-
ation at the third bending mode. Neither of these changes had any effect
on -he Dutch roll damping mode. They have been flown successfully over
ýne entire flight envelope.

F-4 SFCS

Stability tests were condocted on the SFCS Phase hIA secondary and
ptitnary actuator configuration installed in the iron bird. Limit cycle
01c'Alations occurred at 16 P, which were stabilized by increasing the
siffness of the fixture between the primary and secondary actuation as
vell as adding a stiffner to the bulkhead behind the secondary actuator.
rhis prompted similar testing on the aircraft. Structural resonance, fre-
quency response, and limit cycling testing was conducted. No limit cycles
were detected in the lateral and directional axes for loop gains up to
:.2db above nominal. The limit cycle amplitude increased to one degree
p)eak-to-peak stabilator deflection for Phase IIA testing and 0.3 degree
ior Phase lIB testing as the pitch loop gain was increased to 11 db above
nominal.

During flight, a limit cycle oscillation occurred in the pitch axis

at 23 Hz during right sideslips in the Power Approach (PA) configiaration
(0lll trailing edge flaps with gear down) at 170 knots and 10 K feet altitude
with the control system in mediumn gain. A review of the F-4 airframe dynam-
.- indicated that the stabilator and extended flaps both had a rotation mode
frequency of 23 Hz. The presence of the flap rotation mode of 23 Hz was
tl-ought to be significant by virtue of the gyro location in the left hand
wing root just forward of the flap. A notch ftlter centered at 23 Hz was
,1d'ded in the forward path of the longitudinal flight control system that
eliminated the problem. However, excessive stabilator actuator oscil-
!,ory loads were observed during high angle-of-attack maneuvers that
re•;ulted in moderate and heavy buffet. A deeper notch filter centered at
2ý Hz was installed to eliminate the problem.

Frequency response and limit cycle tests were successfully accomplished

OP Lhe iron bird full scale flight controls test stand. Structural resonance
,ud limit cycle testing was conducted on the aircragt in accordance with the
pr•cedures described in NASA TN D-6867 (Reference 48). Adequate stability
margins were demonstrated for the pitch and yaw axes. The pitch axis wan
,taiiilized with a 9.5 Hz notch filter and reducing the bandwidth of the
ý,-,o;ndary actuator from 100 to 50 radians/sec. The yaw a•is, per se, did
not. require any structural filter. Howev3r, an 8 Hz notch filter was incor-
p'mrated to reduce coupling between the 8.6 Hz lateral fuselage bending mode
ain yaw rate feedback that tended to reduce damping. In the roll axis,
r,,.round structural resonance tests indicated an adequate gain margin. However,
continuing analysis of structural dynamics/control system compatibility checks,
usig ftutter analysis witb active controls represented predicted that a

196
potential instability existed under cettain flight conditions due to an
interaction between the approximately 7 Hz wing bendinS moment and the roll
augmentation system. Furthermore, the limit cycle gain margin was judged
insufficient, particularly with wingtip missiles off, considering that the
large aeroelastic correction for the roll control derivative might not be
fully applicable. For these reasons, a cautious in-flight evaluation was
decided upon. At 0.8 Mach, 15 K altitude, with the 20 Hz notch filter end
the roll gain set at 30% of normal, very lightly damped wingtip oscillations
at 7 Hi occurred. The roll notch filter was changed from 20 Ha to a stag-
gered 7 Hz/8.5 Ha notch, and a 20 Hz lead term was removed from the feUd-
back compensation. The latter, in effect was equivalent to adding a 20 Hz
lag filter and was intendid to stabilize the 19 Hz mode. The modified
filters gave fully sr!isfactory results. The subject of interaction between
the control augmentation system and airframe dynamics on the YF-17 is
addressed in Referencz 86.

A summary of the flight control system ground test ixperience discussed

in pvevious paragraphs is presented in Table lID.

As can be seen, various ground testing methods can be used for evaluat-
ing stability margins. Test methods should be proposed by the contractor
based on the charztetist'cs of the system. The important consideration is
that the requiremuents for ground stability ari limit cycles are satisfied,
and that fligl.t &sfetyiL.assured for the fcllovwi;g flight tests. There
flight tests are, of course, the logical means for d&monstrating performance.

197
 C *0
4. 10 111 m

*q a "4 It

0~ Ao '1 41. 1) 41u

-4 ai -4 -4,

0 ý ý"0) '41 1
61
( 1 toF w- tv w %
;94K
-~4. X -4
.0 A0
C
17 "4
~ x
E
:0
u
0'-
3
A.W '0 C L 0 0) V-4
toJ khi CL cc CL Oh.. w

1
E-~ lw C .

tA
.. V42 4
-4- %6w.0
-aCC --4
i .00 ,- .
b.-4hi4 i Wh C4 U
I ,.0
.0 4 "4 (m 41 -. 4i ý4 "4 0 0

4- 00
"4i 40 c'. C'.'
u 1.CC

o ZCnt e z4
%6.

1-4U

0 6j5

5
-

0-4
0444 ,60 -4-e
h-
198
4.3.4 Fli.ht tata. Flight tests shall be conducted, as defined in the
FCS development plan, to deionstrate compliance with requirements where
compliance cannot reasonably be demonstrated by other tests or analyses.
The design and test condition guidelines tabulated in MIL-F-8785 shall bi
considered in establishing the flight teat plan. Flight test data shall
be used to verify the analytical trends predicted and shall be compared
to the performance and desigr requirements of the FCS specification. Coa-
parable data trends shall be required for verification where anlytical
data is used to extend or extrapolate flight test data to show compliance.
In iddition, tests shall be conducted to assure that the flight control
system, in all operational states, does not violate the flutter requirements
of MIL-A-8870.

DISCUSSION

Table XV of MIL-F-87855 gives general guidelines for flight test

conditions to be used for evaluation of handling qualities. Flight teats
for demonstration of compliance with this specification (MIL-F- 0 490) will
be concurrent with those required by MIL-F-8785. Test data requirelentN
may be identical or tandem.

Gain margins are required by 3.1.3.6 for airspeeds from 0 Lo 1.15 VI..
During flight test gain margin predictions should be verified for all
flight speeds up to VL in critical flight configurations. Verification
will normally require comparalle trends between flight test data and analy-
tical predictions. Complete flight test checks of gain margins would be
costly and are not recommended. Sufficient gain margin flight test data
points should be generated to validate the analytical trends u"ed to predict
margins.

4.4 Documentation. FCS data submittal and approval requirements for each
specific model aircraft shall be in accurdaict w•th the contract requirements.
The data shall be furnished in accordance with appropriate line items of
the Contractor Data R_.,!irements List (DD Form 1423). Tvpical information
and data items are listed in this section.

4.4.1 Fliaht control system development plan. A flight control system

development plan shall be prepared by the contractor for approval by the
procuring activity. This plan shall be revised and updated at intervals as
apecifiec by the procuring activity until it is mutually agreed that r)
further revision is required. The plan shall include a minimum of:

a. A detailed milestone chart showing the interrelationship between

phases of deve'opment work to be accomplished. Design reviews &hall be
identified and scheduled and an outline of the progressive design verifica-
tion process to be used by the contractor shall be included. Starting and
completion data for all work items and due dates for all reports shall be
identified.

b. A FCS synthesis and analysis plan describing the general approfch

and analytical procedures to be used. Analyses planned to generate require-
ments for the FCS specification shall be described.

199
!rv c. A vivification plan defining the means sele**ted by the contractor
for verifying that tac design meets each of the requirements of the FCS
specification. Verification means shall be specifically correlated with
each specification requirement.

d. Flight safety, reliability, maintainability and vulnerability

analysis plans to include a description :f the t:nalytical or other means
selected by the contractor for design ve-ification in these areas.

e. A functional mockup test plaut including the test procedures to be

used and a listing of requirements to be satisfied by each test.

f. A around test plan and ground test procedures defining the ground
tests and functional checks to be performed priot to flight.

g. A flight test plan and detailed flight test procedures. Each

procedure shall be correl.Led wits ine or more requirements of the FCS
spec if icat ion.

DISCUSS ION

This series of plans is meant to make available the contractor's plan-

ning and intended development process to the procuring Lctivity early in
the development. The verification plan is a key means whereby the con-
tractor interfaces with the procurkng agency. As a part of the verification
plan, a description and tabulation of means to be used to verify each of the
requirements of the flight control systeiau specifation nf 4.4.2 must be
submitted. Table IIID is a tabulation of typical verification lscans.

The verification means of Table HID indicate the typica 4 means to be

used to verify requirements. The contractor will be required to prepare
detail descriptions of the planned verification for eacL requirement con-
tained within the FCS specification of 4.4.2. In different ptocurements,
different verification means may be used to verify the same requirement.
Only through interaction between the contractor and the procui'ing activity
can practical verification means he established for uniqu, requirements in
each procu:'ement. By updating the FCS development plan and the included
verification plan at intervals, thi'. interaction should occur and practical
vvrification means should be ident4.fied.

'.4.2 Flight control system specifiction. The contractor shall prepare

a flight control system sn,'ification incorporating:

a. Applicable general system, implementation, and test requirements

of this specification.

b. Special requirements of the procurement air vehicle detail speci-

fication.

c. Special requirements determined by the contractor, as required by

the general specificat~on.

A preliminary FCS specification shall be prepared within 90 days of contract

award and progressively u,,da'ed as requirements are finalized.

200
 TABI.F IlID
TYPICAL, VERIFICATION MEANS

BENCH GROUND FLIGit'T

REQUIREMENT ANALYSIS SIMULATION INSPECTION TEST TEST rFST

3,1.1 X X X
3.1.2 X X X
3.1-3 X X x x x
3,1,4 X X X X X
3.1.5 X X X X X
3.1.6 X x
3.1.7 X
3.1.8 X X X X
3.1.9 X X X X x
3.1.10 X X X X
3.1.11 X X X
3.2.1 X X X X X
3.2.2 X X X
3.2.3 X X X
3.2.4 X X X X
3.2.5 X X X X X
32.6 X X X X
3.2.7 X X
3.2.8 X
3.2.9 X
3.3 X X X X X X

4.4.3 Design and test data requirements. 1f applicable design data are
available the contractor shall, in lieu of preparing new desipa data, use
these available data supplemented by sufficient information to substantiate
their applicability.

4.4.3.1 FCS analysis report. A report describing FCS analysis shall be

prepared using an outline prepared by the contractor, subject to procuring
activity approval. This report shall be initially prepared immediately
following the preliminary FCS analysis and synthe3is and periodically
updated throughout the development period. The final update shall include
as a minimum:

a. Design requirements and criteria used during the FCS analysis

and synthesiq.
b. Block diagrams of the FCS. These diagrams shall include transfer
or describinj functions and indicate normal control paths, redundancy,
manual overrides, emergen,-y provisions, location and type of sensors anu
control device used.

201
 "c. A general description of the FOS. The various modes of operation
shall be described and the theory of operatinn discussed.
d. Discussions of unusual or difficult design features and problems.

e. A description of the stability and performathce of the FCS and i

comparisor. of system characteristics with the requirements of the YCS speci-
fication. Data shall be presented for both linear, small perturbation
analyses and for nonlinear simulations or analyses which consider nonlin-
earities such as actuator rate, electronic amplifier saturation, and
actuator position limits. Where analytical predictions are used to satisfy
specification requirements, the assumptions, analytical approximations and
the tolerances placed on these analytical predictions by the contractor
shall be documented and justified.

f. Results of the FCS flight safety, reliability, maintainabIlity and

vulnerability analyses. The reliability analysis rusults shall include a
detailed listing of possible failu. modes. The approach and souices of
data used shall be discussed and the results compared to and correlated
with requirements of the FCS specification. Analytical methods used shall
be documented and justified by the contractor.

g. A general control system layout or series of layouts showing

control surfaces, actuation systems, feel systems, pilot's controls and
control panel organization. Means of providing redundancy and emergency
provisions shall be illustrated. Layouts shall -nclude wiring schematics
for all electrical and electronic portions of the FCS and attendant elec-
trical, hydraulic, and pneumatic power inputs to the FCS.

h. A description of piloted simulations performed, as required by

4.2.1. Where piloted simulation data is used to verify specification
requirements, the simulator and flight configurations simulated shall be
described and the data compared to and correlated with the requirements of
the FCS specification..

i. Mathematical models of the FCS, the unaugmented airplane and other

data required to allow the procuring activity to independently simulate tile
FCS at any point during or following the aircraft development process.
Mathematical models, block diagrams, stability and performance data and
layouts shall be updated following flight tests to incorporate modifica-
tions made r- i*:ing testing.

4.4.3.2 FCS qualification and iaspection report. The contractor shall

document results of inspections used to demonstrate compliance with require-
ments of the FCS specification. Where inspection of component qualification
status dccumentation is used to verify compliance with the FCS specifica-
tion, the contractor prepared component specification shall be submitted as
a par, of the FCS inspection report.

4.4.3.3 FCS test report. A report describing and correlating tests per-
formed and datn generated to verify requirements of the FCS specifications
shall be prepared by the contractor. This report may be prepared in
volumes and shall include a minimum of:

202

,. . . .. ~ .ja . , - -- . 1t~
 a. A detailed description of the operational mockup including part
numbers aad the test conditions under which data was generated and a com-
parison of the PCS specification. Inclusion or exclusion of control sur-
face aerodynamic hinge moments, simulation of aircr-aft structural
compliance in lieu of airframe parts or use of other approximations in
nperational mockup construction shall be justified. All discrepancies or
corrective actions 'arising from operational mockup testing shall be
reported.

b. A description of the airplane ground tests performed and data

generated and a discussion of any system adjustments or modifications
required to satisfy requirements of the FCS specification.

c. A comparison of flight test data with requirements of the FCS

specification and a description of the airplane configurations and flight
conditions tested. Modifications to the FCS made during the flight test
phase to meet FCS specification requirements shall be documented and justi-
fied.

DISCUSSION

The do'cumentation defined in thie preceeding paragraphs is considered

required for a major production aircraft development. For other programs,
such as advanced developments, prototype aircraft, experimental aircraft
and off-the-shelf aircraft buys, the procuring activity may waive much of
this documentation or may be satisfied with alternate pertinent documenta-
tion.

In procurements requiring developmnent uf an automatic landing system,

extensive documentation is normally required describing the all weather
landing system. A typical set of documentation includeb:

All weather landing sy stem description. The system description

should describe in detail the all weather landing system with particular
emphasis on the redundancy and monitoring techniques used. Interface with
other airplane systems should be discussed.

All weather la-ading failure analysis. The failure analysis docu-

mentation should:

(1) State all significant failure effects and the probability

of a hazard due to each and combinations of these failures.

(2) List all predictable failures and errors which can result in
significant effects.

(3) Describe precautions taken to reduce probability of serious

failures; e.g., separation of wiring bundles and power from different gener-
ator sources.

(4) Record estimates of the probability of a failure or combina-

tion of failures to show that this probability is acceptable in terms of the
probability of a hazard due to the failure. Sources and criteria used as a
basis for the estimates of these probabilities should bc' indicated. The

203
frequency and scope of system checks required and effects of frequency of
check on probabilities of undetected and dormant railures should be pre-
sented.

(5) State the procedures taken to enaure high reliability of

maintenance action where this action is a rerit-cal featitre in the safety
assessment.

(6) Describe the method used to e',aluate crew response required

to counteract failures. Delay times to reccgnition of a warning or fail-
ure and to subsequent corrective action sho'ild be included.

All weather landing performance analysis. The all weather land-

ing system simulation should be described. A detailed account; of the cal-
culation of normal dispersion should be included, together wi,:h an assessment
of the risk of a hazard due to use of the system. In addition, results of
the flight test documentation program, showing the normal performance under
failure-free conditions and the effects of significant failures should be
included. Correlation of flight test results to simulator ar.d/or analysis
results should be discussed.

All weather landing safety assessment. The safety assessment

documentation should sunmarize procedures developed and analyses completed
which show that the system meets all safety requirements. It should also
show that the stated procedures are suitable for use by crews of represent-
ative ability and should ensure safe operation under normal and failure
conditions.

All weather landing operational and maintenance procedures. All

operational and maintenance procedures required to attain the specified
performance and safety should be detailed. The operational procedures should
include the nature and frequency of any inflight tests of the system, and
the corrective action required following a failure or warning. The mainten-
ance procedures documentation should identify the nature and frequency of
periodic tests of the individual units of the system to detect dormant fail-
ures or out-of-tolerance components within the system. Specific instructions
for maintenance or troubleshooting to clear faults should be given to ensure
that the airplane is dispatched with A safe operational system. The main-
tenance procedures should also specify the type and calibration status of
equipment to be used by maintenance crews.

204

. J
 5.0 PREPARATION FOR DELIVERY

5.1 Packaging requirements. In the event of direct purchases by cr ship-

ments to the Government, the packaging shall be in accordance with the
contract or the approved component or subsystem specification, as appli-
cable. Components shall be delivered complete, tested, and ready for
installation.

6.0 NOTES

6.1 Intended use. This is a general requirements specification applicable

to flight control systems and is based upon service experience to date.
Deviations to the requirements of the specification may be granted following
presentation and approval of substantiating data.

6.2 Procedure for requesting deviations. The Tzeulremcnts of MIL-STD-480

shall be met. Substantiating data shall be in .he form of test, simulation
or analytical data generated by thi contractor during design tradeoffs.

6.3 Reordered equipment or second source procurement. Where models or

drawings oi components of systems are furnished by the procuring activity
on a contract to facilitate interchangeable construction, or where procure-
ment is for equipment to provide interchangeable use with equipment
previously procured, and the requirements for interchangeability contradict
the current requirements of one or more MIL specifications, the contract
requirements for interchangeability govern.
6.4 User's guide. A background information and user's guide, AFFDL-TR-74-
116, provides explanations of and justification for the requirements of
this general specification.

6.5 Abbreviations

AFCS Automatic Flight Control System

BIT - Built-in-Test
CDRL - Contractual Data Requirements List
C.G. - Center of Gravity
CTOL - Conventional Takeoff and Landing
EFCS - Electrical Flight Control System
EMI - Electromagnetic Interference
EMP - Electromagnetic Pulse
FCS - Flight Control System
g - Gravitational Constant
LRU - Line Replaceable Unit
MFCS - Manual Flight Control Syst=m
MIPS - Motor-Pump-Servoactuator Package
TAS - True Air~speed
VOR - Very High Frequency Omnidirectional Range
V/STOL - Vertical/Short Talreoff and Landing

6.6 Definitions

Airspeeds. Airspeeds referenced within this specification are as

defined in either MIL-F-8785 or MIL-A-8860. MIL.F-8785 defines airspeeds
associated with flying qualities and MIL-A-8860 defines airspeeds related
to loading and flutter.

205

==--=== "" "-

 Alert height. A height (100 feet or less above the highest elevation
in the touchdown zone), based upon the characteristics of the aircraft and
the particular airborne Category III system above which a Category III
approach would be discontinued and a missed approach executed if a failure
occurred in oue of the required redundant operational systems in the air-
craft or in the ground equipment.

All weather landing system. An all weather landing system includes

specifically all the elements of airborne equipment and more generally
includes the ground-based equipment necessary for completion of the all
weather landing. All weather landings comprise the operations and proced-
ures required to conduct approaches and land.ings during Category II and III
visibility conditions defined by the International Civil Aviation Organi-
zation.

Automatic flight control system. See 1.2.1.2

Automatic landing system. A landing system which provides automatic

flight control to touchdown or to touchdown and beyond.

Built-in test (BIT). Integral onboard testing devices which enable

rapid isolation on the ground of a faulty Litie Replaceable Unit (LRU)
(either manual or automatic), without removing the LRU from the aircraft.
Usually a warning of malfunction is given by an external device on the LRU.

Category I operations. An instrument approach procedure which prnvides

for approaches to a decision height (DH) of not less than 200 feet and
visibility of riot less than 1/2 mile or RVR (Runway Visual Range) 2500 feet
(RVR 1800 feet with operative touchdown zone and runway centerline lights).

Category II operations. An instrument approach procedure which provides

approaches to minima of less than DH 200 feet/RVR 2400 feet to as low as DH
100 feet/RVR 1200 feet.

Category Mlia operations. Operations with no decision height limita-

tion, to and along the surface of rhe runway with external visual L-eferer.ce
during the final phase of the landing and with runuay visual range not less
than 700 feet.

Category IIIb operations. Operationls with no decision height, to and

along the surface of the runway with runway visual range not less than 150
feet and with reliance on the system for part or all of the rollout along
the runway and with external visual reference for guidance along the taxi-
way.

Category IlIc operations. Operation with no decisipa height, to and

along the surface of the runway and taxiways wit"'ut reliance on external
visual reference.

Channel. The term describing a single signal or control path within a

deviLe or system that may contain many paths. A channel is an entity within
itself and contains elements individual to that channel. A model may be used
as a reference channel in a detection-correction system.

Classes. Airplane classes are defined using the MIL-F-8785 definitions

for the following classes.

206

"-|--'. .. . . .. . .
 Class I Small, light airplanes such as
Light Utility
Primary trainer
Light observation

Class II Medium weight, low-to-medium maneuverability

airplanes such as
Heavy utility/search and rescue
Light or medium transport/cargo/tanker
Early warning/electronic countermeasures/
airborne command, control, or communi-
cations relay
Antisubmarine
Assault transport
Reconnaissance
Tactical bomber
Heavy attack
Trainer for Class I'

Class III Large, heavy, low-to-medium maneuverability air-

planes such as
Heavy transport/cargo/tanker
Heavy bomber
Patrol/carly warning/electronic counter-
measures/airborne command, control, or
communications relay
Trainer for Class III

Class IV High-maneuverability airplanes such as

Fighter/interceptor
Attack
Tactical reconnaissance
Observation
Trainer for Class IV

Where MIL-F-83300 applies, the corresponding MIL-F-83300, Class I,

II, or III or IV applies.

Comparison monitor. A dF~vice which compares signals and warning out-

puts from two or more sources and provides its own signal to indicate that
the two or more outputs are within or outside specified tolerances.

Control wheel (stick ) steering. An AFCS mode which permits pilot

manual control inputs to be introduced into the system through the wheel or
stick when the AFCS is engaged and controlling the airplane.

Damping ratio. The equivalent second order viscous damping ratio. The
critical damping ratio is defined as unity.

Decision height. Decislon height, with respect to operation of air-

craft means the height at which a decision must be made during an ILS
(Ixtatrument Landing System) or PAR (Precision Approach Radar) instrument
approach to either continue the approach or to execute a missed approach.

207
This height Is expressed in feet above runway datum altitude and for
Category 11 ILS operations, the height is additionally expressed as a
radio altimeter reading.

Dual load path. A type of passive paralleling wherein two separate

load carrying paths exist. Each load path is capable of carrying suffi-
cient load such that failure of either member will not jeopardize system
performance.

Electrical flight control system (EFCS). A flight control system

wherein one or more axes of vehicle control is, at one point or another,
completely electrical. Non-electrical backup or other reversion means may
exist. Electrical flight control is commonly referred to as fly-by-wire,
especially where the application is either manual or essential.

Essential FCS. See 1.2.3.1

Eytremeby reote. The probability of an event occurring which, although

theoretically possible, is not expected in the life of an individual air-
craft. For the purpose of this specification, the extremely remote proba-
bility for a specific aircraft is defined as numerically equal to the maximum
aircraft loss rate due to relevant FCS material failures specified in 3.1.7.

Failure. The inability of an item to perform within previously speci-

fied limits.

Failure rate. The number of failures of an item per unit measure of

life (flights, time, cycles, events, miles, etc.) as applicable for the item.

FCS operational states. See 1.2.2

Firmware. A set of binary machine language instructions stored in
read-only memory in a computer for the purpose of providing a step-by-step
control of the processor.

Flight control system. See 1.1

Flight alrector subsystem. A subsystem which provides the pilot a dis-
pliy of actual ond desited flight parametets. When operating in a flight
director mode, thc pilot's task is to minimize the difference between the
displayed actual anO desired values through control actions.
Flight envelopes. Flight envelopes referred wLthin this specification
are defined in MIL-F-8785 and MIL-F-83300.

Flight phase essential ICS. See 1.2.3.2

Fully-powered control system. See power-onerated control

Inflight monitoring. Continuous automatic monitoring of system per-

formance, normally performed inflight a3 a safety check.

Manual flight control systt-m. See l.k 1.1

208
 Nonaerodynamic loops. Inner feedback loops within an FCS which do
not rely on aerodynamics for loop closure. Examples include AFCS servo
loops and actuator feedback loops.

Noncritical FCS. See 1.2.3.3

Power-boosted control. A reversible control wherein pilot effort is

exerted through mechanical linkages and is boosted, directly in proportion
to the input, by a power source.

Power-operated control. An irreversible control wherein the pilot,

through mechanical linkages or other means, actuates a power control package
to control an aerodynamic surface or other device.

RAndom failure. kny failure whose occurrence is unpredictable in an

absolute sense which is predictable only in a probabilistic or statistical
sense. Random failures are those which cannot be attributed to wearout,
defective design, or abnormal stress, and can occur at any time within the
equipment's useful life.

Redundancy. A design approach such that two or more independent fail-

ures, rather than a sizl3le failute, are required to produce a given undesir-
able condition. Redundancy may take the form:
a. Providing two or more components, subsystems, or channels,
each capable of performing the given functions.

b. Monitoring devices to detect failures and accomplish annunci-

ation and automatic disconnect or automatic switching.

c. Combination of the two above features.

Relevant failure. Any random or normal wearout failure occurring in

service prior to end of specified service life when the equipment is properly
operated within design load and environmental limits. A normal '*Yearout fail-
ure is relatively improbable on a new part, but undergoes a relatively rapid
rise in probability of occurrence after an extended period of service (oper-
ating hours or calendar time). Wearout is typical of seals, bearings, motor
brushes, fatigue-critical structure, etc. A realistic system reliability
computation must include proper allowance for such failures wherever Lhey
are not avoided by scheduled replacement/overhaul procedures in service.

Reversion. The capability to revert to a backup or alternate control

from the normal control means. The alternate control may use mechanical or
electrical signal transmission and powered actuation.

Software. A set of instructions intended to be stored in progranmable

memory of a computer for the purpose of providing step-by-sLep control to
tit proces&'or. This includes source program instructions requiring assembly
or compilation as well as binary machine language instructions.

Turbulence cumulative exceedance probability. The cumulative proba-

bility of experiencing turbulence at an intensity equal to or exceeding a
given level. This 2robability accounts for both the probability of encounter-
ing turbulence and the distribution of the RMS intensity of the turbulence,
if encountered.
209
 Variable geometry control system. Those components and subsystems
which transmit control commands from the pilot(s) and which produce forces
and moments to change the aerodynamic configuration of the aircraft.
Variable geometry controls include those for changing wing sweep angle and
wing incidence angle, folding wing tips, deploying canard surfaces, and
varying the angle of the nose of the aircraft with the body.

6.7 Use of limited coordination opecifications. Limited coordination

Military Specifications may be used when such are in effect on the date
of invitation for bid or request for proposal. These specifications carry
prefixes, such as MIL-A-008860A (USAF) in lieu of MIL-F-8860 (ASG).

6.8 Identification changes. Asterisks are not uised in this revision to

identify changes with respect to the previous istue, due to the extensive-
ness of the changes.

210
II

REFERENCES

I. Chalk, C,, Neal, r., Harris, T., Pritchard, F., and Woodcock, R., "Background Information
and User Guide for MIL-F-8785B (ASG), "Military Specification -- Flying Qualities of
Piloted Airplanes", AFFDJ.-TR-69-72, August 1969.

2, Anderson, R., "A New Approach to the Specification and Evaluation of Flying Qualities,"
AFFDL-TR-69-120, June 1970.

3. Morton, D., Hoode, J., Minnick, G., Hartman, W., Hackford, R,, and Nickerson, T.,
"Analysis of Piloted Weapon Delivery," AFFDL-TR-72-105, 1973.

4. Franco, D., "lnflight Investigation of the Effects of Higher-Order Control System Dynamics
of Longitudinal Handling Qualities," AFFDL-TR-68-90, August 1968.

5, Quinlivan, R., "Multimode Flight Control Definition Study for Precision W;apon Delivery,"
AFFDL-TR-71-39, June 1971.

6. Hendrick, Bailey, Edinger, et al, "Design Criteria for High Authority Closed-Loop Primary
Flight Control Systems," AFFDL-TR-71-78, August 1972.

7. Rickard, R., and Gentry, J., "Development Testing of a High Gain Adaptive Control
Augmentation System Installed in an F-4C Aircraft," FTC-TR-TD-70-4. September 1970.

8. Rickard, R., and Powell, C., "Stability and Control Evaluation of an F-4C Aircraft with a
High-Gain Adaptive Control Aagmentation System," FTC-TR-71-17, June 1971.
9. Stapleford, R., McRuer, D., Hob, R., Johnston, D., and Heffley, R., "Outsmarting
MIL-F-8785B (ASG), The Military Flying Qualities Specification," STI-TR-190-1,
AD887637.

10. An --ion, C., and Walker, J., "A Stall Inhibitor System for the F-I I I," NAECON Papcr,
NAECON 1972 Record, pp, 222-226.

11. Robinson, A., "A Survey of Theoretical Dynamic Analysis Methods for Automatic Fight
Control Design," AFFDL-TrR-67-l47, March 1968.

12. Tomlinson, L., "SST Longitudinal Control System Design and Design Processes - Hardened
Stability Augmentation System," FAA-SS-73-1, June 1973.

13. AINC Report No. 417, "Guidance Material for the Design of an Air Transport Automatic
Flight Control System," April 1971.

14. Hall, J. C., "Automatic Aircraft Landing Systems," Presented at the IEEE International
Convention and Exposition, 20-23 March 1972.

15. Litchford, G. B., "Analysis of Cumulative Errors Associated with Category 11 and Ill
Operations with Requirements for Additional Research," NASA CR-I 188, September 1968.

211
16. Joflsofl, W. andi Mi.Ruer. H., "Development of a Category 11 Approach System Model."
NASA CR-2012, May 1972.

17, Newman. F. and Foster J., "Investigation of a Digital Aumtoinatic Aircraft Landing System in
Turbulence.- NASA TN-D-60@6, October 1970.

18. V'r(-TR.67-30, "Air Force Evaluation of fihe B-526 and 11IPrototype Stability
Augmentation andi Flight Control Systemn," February 1968.

19. Demipster, J-. Roger, K., "Evaluation of B-52 Structural Response to Random Turbulence
With Stability Augmentation Systems," Journal of Aircraft, Nov-Dec, 1967.

20. Rustenhurg, J. W., "Development of Tracking Error Frequency Response Functions andi
Aircraft Ride Quality Design Criteria for Vertical andi Laieral Vibration," ASD-TR-70-18,
January 1971.

21. Rustcnhburg, J, W,, -Ride Quality D)esign Criteria for Aircraft with Active Mode Control
Systems," ASD-TR-72-64, October 1972

2. International Organization for Standardization (ISO), "Guide l'or thle Evaluation of Human
E'xposure to Whole Body Vibration," Draf! International Standard ISO/DIS 2631, 1972,

2-3. Townsend, J., "Gust Alleviation anti Mode Suppression System De-sign Criteria," Boeing
W-37600-14, December 11969.

24. Holloway, R., and Brumaghim, S_, "Tests and Analyses Applicable to Passenger Ride
Quality of Large Transport Aircraft," Included within NASA I'M-X-2620, October 1972.I
25. Gordon~. C. and D~odson, R.,. "STOL Ride Control Feasibility St udy Technical Report".
NASA ('R-2276. July 1973.

26. Aerospace Medical Research Laboratory Miemo. Lt. Colonel Sturges to T. D. Lewis, Subject:
Recontimended Weighting Functions for Human Response to Vibration. dateLi 8 July IQ 94.

27. hloblet. F. M., ILffect of, Yaw D~amper on Lateral ('-lst LoJds inl l)esign of thle L-1l1ll
Trraiisport", Presented at the 37th Meeting of the AGARD Structures and Materials Panel,
October 1073.

28. Wykcs, J., Mori, A., and Borland, C., -B-I Structural Mode Control System." AIAA Paper
No. 72-772, presented at theL 4th Aircraft Decsign, Flight Test andi Operatiorns Meeting,
August 7-.), 1972.

29. Wykes, J., Moni, A., "Ani Analysis of' Flexible Aircraft Structural Mode Control,"
AFFDL-TR-65-190, June 1966.

30. Wvkes, J., andi McKnigflt. R., "Progress Report onl a Gulst Alleviation and Structural
D~ynamic Stabilit\ Atowmentation Sy stem (GASDSAS) D)esign Study," AIAA Paper No.
66-c9QQ, November 29 Decembcr 2, 1966.

212
31. Wykes, J, "Structural D)ynamic Stability Augmentation and Gust Alleviation of H'exih'.k'
Aircraft", AIAA Paper No, 68-1067, (ktolr 21-24, 1968.

32. Wykes, J., and Kordes, IF., "Analytical Design and Flight Tests of 'a Model S|pplre"sio
System on the XI-70 Aitilane," Proc'eedings of' AGARI) 34th Flight Mechanics Panel
Meeting, Marseilles, f'rancc, April 21 -24, 1969.

33, Mori, A., "B-I Structural Mode Control System I)'sign Consideration'.," ProceedingN of'
National Aerospace llectronics Conference, May 15-I 7%1972•

34. ldinger, L., Schenk, F., and Curtis, A, "Study of' Load Alleviation and Modek Suippr-e"sion
(LAMS) on the YF-I 2A Airplane," NASA CR-2158, D)ecember 1471.

35. Townsend, J. L., et al, "Feasibility of an Active Flutter Control IDvimonstration," Rhoing
D)ocument 1)3-8440, December 1Q70.

3o. Nissim, E., "Flutter Suppression Usijng Active Controls Based o•l the ('oncept of
Aerodynamic Energy," NASA TN D)-6199 I071.

37. McIntosh, S. C., "A Study of' the Application of' Model Suppressi' to i'hattcr ('ohtlol",
Stanford University SLIDAAR No, 450, January 1973.

38, Theisen. J,, and Rohinette, W., "Servo Control of Flutter," AIAA Struct ut';a D\s namics and
Aerolastic Specialist Cont'crence Proceedings." April 196), pp. 228-240,

39, Thompson, G. 0., "Active Flutter Suppression An Fmerging Technologp.," Journal ot

Aircraft. Vol. (, No. 3, pp, 230-235, March 1972,

40, Triplett, W. F., "A Feasibility Study of' Active Wing/Store IHutter ('ontrol," Journal of
Aircraft, Vol. (). No. 6, page 438, June 1972,

41. Townsend, J.. and Waltman, W., "Plivoting Wing Ride Smoothingil-lutter SAS A.nalyis,"
Boeing Document W3-8597, May 1971.

42, Moon. F-, and D)owell, I'., "The Control of Flutter I nstability in ;i ,iuI laitit
.ontiumt

System Using Feedba,:k," AIAA'ASII'I II th Structures. Struct ural l)ynamics and Materials
Confterence, Denveir. April 1Q70.

43. Rainey, A., Rtrhlin, C-. and Sa,..Iford, NI., "Active ('onwrol of' Aerolasit Rqpor.%"',-lPAcr
presented at the AGARI) Flight Mech anics Panel Synliosium on S' ibility and ('ontrol,
April 1972.

44, McKenzie, J. R., "B-5 2 ('Cntrol Configured Vehicle¢ Ride Control Analysis and Flight
Test," AIAA Paper No, 73-782, Presenlted at the AIAA 5th Aircraft RXvsign Flight Test and
Operations Meeting, A-igust 6-8, 1973.

45. Bergman, (G. and I'Backer, G., "Terrain Following Criteria," AFFDL-TR-73-135, April,
1974.

213
46. Btelka, ikavalok, Johnston and Reel, "Aircraft Flight Control Systems Field Fixpe•ience,"
AFFDL-TR-72-33, May 1972.

47, Larson, Helflinstine, Ackerman and Neirn.cyk, "F'light Control Reliability Fxperience on
Naval Tactical Aircraft," Presented to SAL Acimspaice Control and Guidance Systems
Committee, September 1972.

48& Painter, W. D. and Sitterk', G. J., "Ground and Flighit Test Methods for Determining Limit
Cycle and Structural Resonance Characteristics -,f Aircraft Stability Augmentation
Systems," NASA TN-D-6867, Jtkne i 972,

49, Hooker, D. S., et al. "Survivable Flight Control System Final Report", AFFDL-TR-73-105,
December 1973.

50. Poyneer. R. and Stockdale, C,, "Control Configured Vehicle Ride Control System
(C(CV-RCS)", AFF: L-TR-73-83, July 1973,

51. Perry, D., and Burham. J., "A Flight Simulation Study of Difficulties in Piloting barwe Jet
Transport Aircraft through Severe Atmuospheric Disturbances," ('.P. No, 90,5 (AD No.
813961), 1967.

52. IHoubolt, J. C., "Atmospheric Turbulence," AIAA Paper No. 72-219, Presented at the 10th
Aerospace Sciences Mecting, San Diego, California, Januar)' 17-14, 1972.

53. Gilbert, W. P., "Analytical Study of lEffcts of Autopilot Operation on Motions of a

Subconic Jet-Transport Airplane in Severe Turbulence," NASA TN May 1970.
S)l58l8,

54, Onstott, i-K, awnl Salwion, U., "Airplane Flying Charact-ristics in T*urbulence,"
AFFOL-TR-70- ! 4.-, Febluarv 197 1.

55. Porter, R. F.. "A Proposed Criterion for Aircraft Flight in Turbulence," NASA CR1 24834,
1971.

56. Rosenfel.I, t.,. and Matero. L, "Flight Control Diagnostics for Hligh Performance Aircraft,"
Grumman Report No, ADR07-05-69. I (AD No. 8789.-)), March 14Q0.

57. llook-,-r, D,. Kisslinger, R., Smith (.., Smyth, NI , "Survivable Flight Control System Interim
Report No. I - St.lies. Analysis and Approach," AFFDL-TR-71-20, May 1971.

58. Bird, D. K., "Flight Control System Mcchlanization," NAI-CON paper, NAECON '72
Record, PP 21 '-219.

S9, Tomlinson, L, R,, "Problems wid Solutions Related to the Design of a Control
Augmentation System for a Longitudinal Unsia bl, Supersonic Transport," AlAA Paper No.
72-871, Presented at the AIAA Guidance and Control Conference, Stanford. California,
August 14-16, IO72.

t60. lmfinger, J. and Fl nnigan, J., "Fly-By-Wire Technology." AIAA Paper No. 72-882,
Presented at the AIAA Guidance and Control Conference, Stanford, California. Au9gust
14-16, 1972.

214
61. Dects, D1.and Szaila, K., "13esign andk 1.lighlt Expericrce with a D~igital Fly-By-Wirc Control
System Using Apollo Guidance System hlardware onl a F-8 Aircraift," AIAA Paper No.
72-881 , Presentedl at the AIAA Guidance and Co~1Confetence Stanford, California.
August 14-16, 1972.

62. Kisslinger. R. and Lorenzette. R., "Thle Fly-By-Wire Approach to Aircraft Flying Qualities,"
NAFCON R~iper from tile 197 2 NAECON Record, pp, 203-2 10.

63. Campbell, J. U., "Uniq.ue Features of tile B-1 Flight Control Systems," AIAA Paper No.
72-872, August 1972.

64. Lorenzetti. C., Kisslinger, R., Smyth, MW,"Survivable Flighit Control System Program -
Simplex Actuator Package," AFFDL Technical Memo FG/ADPO-70-135, January 1971.

65. Amnies, Gerald E., "Survivable Fligh~t Control Systemi Inteim Report No. 1- Supplement t'.r
Hydraulic Power and Actuation Studies," AFFDL-TR- 71 -2c, May 1971.

66 Stakcup. ID., Coppola, P., Rinde, J., "Research and lDevclopmont of a Servo Actuator
Package for a Tactical Fighter Aircraft," AFFD)L-TR-69-l 2(, .imne 1970.

67. Yore, I". E-. "Rcquirements for MIin imumi Backup Ffliht Control Systemns',
AFFDL,-TR-70-48, October 1970.

68. Blatt, P. and Hall. J., "Concepts for Standaby Emergency Fcs," Unnumbered1 AFFDL
Interim Technical Report, February 1968.

6').

70.
Jenny, G. D., "Test anld lDevelopment of Flight Control Actuation System Components for
Military Aircraft," -FEDL-71 R-7 1-76, July 1971
"Ilydraulic System Survivability" SALS Aerospace Informm'ion Report, AIR 1083, October
I
1. 1969.

7L. Rodsig andW,"I-lihEvaluation of Controller for

Fuour Cocland Fighrtior
l Airlraf,
StbltyArlne"71.-R7-,Spebe
VrabFleT-1-6 90

74. Smiath P.J,

r, andSreaking STrlent
- adeendurncTetin
ti of - Aircraft
ois nurolCabld,
Mo

Na 19671.
AFFDG-TR-67-16,

75 Smith. P. L, "'Lvaluation of Nyon and Polvoletin Jacketed Aircraft Control Cables,"

ASi)-'rR-68-30, Nugust 1l)tig.

215
I.
.7" 7 . .. ... :.

76. Anonymous, "Electrical Interconuections for Fly-By-Wire Flight Control

Systems," AFFDL-TR-70-134, October 1970.

77. 'i.azek, J., Roberts, R. and Doggett, D., "Research into the Definition
and Demonstration of an Optimum Solid State Switching and $ultiplexir.
System for use in a Fly-By-Wire Flight Control System" AFFDL-TR-70-80,
June 1970.

78. Goldstein, S., Schreadley, d. and flazill, D., "lest and Development of
Flight Control Actuation System Components for Military Aircraft,"
AFFDL-TR-72-13, April 1972.

79. Mrazek, J., and Roberts, R., "Design, Development, and Flight Test of
Multiplexing Hardware for use in a Fly-By-Wire Flight Control System,"
AFFDL-TR-73-43, April 1973.

80. King, 0. and Ramsey, W., "Aircraft Electrical System Multiplexing,"

SAE paper presented at the National Air Transport Meeting, April 20,
1970.

81. Kumpitsch, R. and Sturges, D., "Liquid Metal Actuator Package Design
Study for a Fly-By-Wire FCS," AFFDL-TR-20-121, February 1971.

82. Verge, K., and Read, R., "Testing of a Pneumatic Servomechanism,"

AFFDL-TR-71-146$ February 1972.

83. Thatcher, R. K., vt' al, "Development of Unified Reliability Prediction

Techniques fot "'-:ght Control Sydtems," AFFDL-TR-70-81, June 1970.
84. Peterson, B., Krier, G., and Jarvis, C., "Development and Flight Test

of a Digital Fly-By-Wire F-8 Airplane," Paper presented a, the Society

of Fxpc.rimeital "est Pilots Symposium, September 28-30, 1972.

85. SAE, "Aerospace Recommended Practice Lightning Effects Tests on Aero-

space Vehicles and Hardware, Final Draft", SAE Committee AE4, Special
lask F. May 1974.

86. Arthurs, F., et al, "Inter.:ction Between Control Augmentation System

and Airframe Dynamics on YF-17," AIAA Paper No. 75-824, Presented at
AIAA Symposium, Denver, Colorado, 29 May 1975.

87. Carleton, D., Lawyer, R., and Powell, C., "Development and Evaluation
of Twead II Flight Control Augmentation System," FTC-TD-72-1,
November 1972.

216
 APPENDIX A

DERIVATION OF RELIABILITY REQUIREMENTS

FROM ACTUAL FIELD SAFETY EXPERIENCE DATA

A broad cross-section (over ten years) of pertinent aircraft accident and loss experience was
obtained on typical large multiengine aircraft, fighter aircraft, and helicopters from the Air Force
Safety and Inspection Center, Norton Air Force Base, California. Safety experience for the B-52,
C-135 and C-141 was examined to establish typical flight safety reliability requirements for
MIL-F-8785 Class III aircraft. The F-4 was selected as typical of MIL-F-8785 Class 1, 11 and IV
aircraft and the H-1, H-3, H-43, and H-53 experience is summarized as *ypical for helicopters. The
following summarizes pertinent flight safety experience on the above listed aircraft for the period
January 1962 through May 1973. Experience on aircraft introduced after January 1962 is from
year of introduction through May 1973.

B-52 Experience 1962 - May 1973

Major Accident Rate = l.100/100,000 flight hours

8.583/100,000 flights

Aircraft
Major Accidents Material Failure Total Acc. Destroyed
Primary Cause - 100,000 FH 0.275 0.175
100,000 Flights 2.145 1.365

By System
Airframe - 100,000 FH 0.125 0.100
100,000 Flights 0.975 0.780

Brakes - 100,000 FH 0.050 0.050

100,000 Flights 0.390 0.39C

Pneumatic 100,000 FH 0.025 0.025

100,000 Flights 0.195 0.195

Engine 100,000 FH 0.025 -

100,000 Flights 0.195 -

Flight Control 100,000 FH 0.025 -

100,000 Flights 0.195 -

Landing Gear 100,000 FII 0.025

100,000 Flights 0.195

B-52 experience covered 3,998,611 flight hours and approximately 512,642 flights.

217
"r . .I... . .. . ..-.

C-141 Experience 1964-May 1973

Major Accident Rate - 0.189/100,000 flight hours

1.439/100,000 flights

Aircraft
Total Acc. Destroyed

Major Accidents Material Failure

Primary Cause - 100,000 FH 0.108
100,000 Flights 0.822

By System
Airframe - 100,000 FH 0.054
100,000 Flights 0.411

Hydraulics 100,000 FH 0.027

100,000 Flights 0.206

Brakes 100,000 FH 0.027

100,000 Flights 0.206

C-141 experience covered 3,698,192 flight hours and approximately 486,604 flights.

C-135 Experience 1962-May 1973

Major Accident Rate = 0.923/100,000 Flight Hours

5.075/100,000 Flights

Aircraft
Total Acc. Destroyed

Major Accidents Material Failure

Primary Cause - 100,000 FH 0.154 0.066
100,000 Flights 0.846 0.363

By System
Airframe - 100,000 FH 0.022 0.022
100,000 Flights 0.121 0.121

Landing Gear - 100,000 FH 0.044 -

100,000 Flights 0.242 -

Engine - 100,000 FH 0.066 0.022

100,000 Flights 0.363 0.121

218
 Aircraft
Total Acc. Destroyed
Fuel - 100,000 FH 0,022 0.022
100,000 Flights 0.121 0.121
C-135 experience covered 4,552,143 flight hours and approximately 827,662 flights.

B-52/C-135/C-141 Combined Experience 1962 -May 1973

Major Accident Rate = 0.759/100,000 ~I~ght Hours

5.091/100,000 Flights

Aircraft
Total Acc. Destroyed
Major Accidents Material Failure
Primary Cause - 100,000 FH 0.180 0.082
100,000 Flights 1.204 0.547

By System
Airframe - 100,000 FH 0.065 0.041
100,000 Flights 0.438 0.274

Brakes - 100,000 FH 0.024 0.016

100,000 Flights 0.164 0.109

Engine - 100,000 FH 0.032 0.008

100,000 Flights 0,219 0.055

Landing Gear 100,000 FH 0.024

100,000 Flights 0.164

Fue - 100,000 FH 0.008 0.008

100,000 Flights 0.055 0.055
Pneumnatic 100,000 FH 0.008 0.008
100,000 Flights 0.055 0.055

Flight Control 100,000 FH 0.008

100,000 Flights 0.055

Hydraulics - 100,000 FH 0.008

100,000 Flights 0.055

The combined B-52/C-135/C-141 experience covered 12,248,946 flight hours and approximately
1,826,908 flights.

219

,.I
F-4 Experience - 1964 - May 1973

Major Accident Rate = 7.748/100,000 Flight Hours

12.398/100,000 Flights

Aircraft
Total Destroyed

Major Accidents Material Failure

Primary Cause - 100,000 FH 1.974 1.486
100,000 Flights 3.1i58 2.378

By System

Airframe - 100,000 F11 0.049 0.024

100,000 Flights 0.078 0.039

Landing Gear - 100,000 FH 0.292 0.049

100,000 Flights 0.468 0.078

Flight Controls - 100,000 FH 0.341 0.341

100,000 Flights 0.546 0.546

Fuel - 100.000 FH 0.170 0.170

100,000 Flights 0.273 0.273

Electrical - 100,000 FH 0.073 0.073

100,000 Flights 0.117 0.117

Hydraulic 100,000 FH 0.219 0.219

100,000 Flights 0.351 0.351

Ordnance - 100,000 FH 0.073 0.049

100,000 Flights 0.117 0.078

Instruments - 100,000 FH 0.024 0.024

100,000 Flights 0.039 0.039

Brakes - 100,000 FH 0.122 0.049

100,000 Flights 0.195 0.078

Pneumatic - 100,000 FH 0.073 0.024

100,000 Flights 0.117 0.039

Powerplant 100,000 FH 0.049 0.049

Components - 100,000 Flights 0.078 0.078

Engine - 100,000 FH 0.439 0.390

100,000 Flights 0.702 0.624

220
 Aircraft
Total Acc. Destroyed
Miscellaneous 100,000 FH 0.049 0.024
100,000 Flights 0.078 0.039
F-4 experience covered 4,103,851 flight hours and approximately 2,564,907 flights.

H-I Experience 1962 - May 1973

Major Accident Rate , 5.862/100,000 Flight Hours

8.091 /100,000 Flights

Aircraft
Total Destroyed
Major Accidents Material Failure
Primary Cause - 100,000 FH 1.83' 1.832
100,000 Flights 2.528 2.528
By System
Flight Control - 100,(OO FH 0.183 0.183
100,000 Flights 0.253 0.253
Hydraulics - 100,000 FH 0.183 0.183
100,000 Flights 0.253 0.253
Powerplant 100,000 FH 1.099
Components - 100,000 Flights 1.517 1.517
Engine - 100,000 FH 0.366 0.366
100,000 Flights 0.505 0.505
H-I experience covered 545,796 flight hours and approximately 395,504 flights.

221
 l I,

H-3 Experience - 1963 - May 1973

Major Accident Rate 5.637/100,000 Flight Hours

10.203/100,000 Flights

Aircraft
Total Acc. Destroyed

Major Accidents Material Failure

Primar,' Caus' - 100,000 FH 0.752 0.511
100,000 Flights 1.360 0.925

By System
Powerplant 100,000 FH 0.752 0.511
Components - 100,000 Flights 1.360 0.925

H-3 experience covered 266,075 flight hours and approximately 147,002 flights.

H-43 Experience- 1962 - May 1973

Major Accident Rate = 7.231 /100,000 Flight Hours

7.158/100,000 Flights

Aircraft
Total Acc. Destroyed

Major Accidents Material Failure

Primary Cause - 100,000 FH 1.534 0.657
100,000 Flights 1.518 0.650

By System
Flight Controls - 100,000 FH 0.219 0.219
100,000 Flights 0.216 0.216

Engine - :00,000 FH 1.314 0.438

100,000 Flights 1.301 0.434

H-43 experience includes 456,362 flight hours and approximately 460,971 flights.

222
H-53 Experience - 1966 - May 1973

Major Accident Rate = 3.644/100,000 Flight Hours

8.091 /100,000 Flights

Aircraft
Total Acc. Destroyed

Major Accidents Material Failure

Primary Cause - 100,000 FH 0 0
100,000 Flights 0 0

H-53 experience included 82,316 flight hours and approximately 37,079 flights.

H- ,'i -3/H-43/H-53 Combined Experience 1962 - May 1973

,Accide. ate = 6.145/100,000 Flight HoursJ

7.976/i 00,000 Flighits

Aircraft
Total Acc. Destroyed

Major Accidents Material Failure

Primary Cause - 100,000 FH 1.407 1.037
100,000 Flights 1.826 1.345

By System
Engine - 10.000 FH 0.592 0.296
100,690 Flights 0.769 0.384

Powerplant 3,000 fl-i 0.592 0.518

Components - i00,000 Flights 0.769 0.672

Flight Controls - 100,000 FH 0.148 0.148

100,000 Flights 0.192 0.192
Hydraulics - 100,000 FH 0.074 0.074
100,000 Flights 0.096 0.096

The combined helicopter experience includes 1,350,549 hours and approximately 1,040,566 flights.

Although the F-I 11 is not considered typical of USAF fighter operations, the experience is included
here for information. The rates are not considered in Figures A-I through A-3 but are shown
individually in Figure A6.

223
F-ill Experience 1965 -May 1973

Major Accident Rate - 13.391/100,000 Flight Hours

36.825/100,000 Flights

Aircraft
Total Acc. Destroyed
Total Major Accidents Material Failure
Primary Cause - 100,000 FH 6.003 3.694
100,000 Flights 16.508 10.159

By System
Flight Controls - 100,000 FH 1.847 1.385
100,000 Flights 5.079 3,809

Airframe - 100,000 FH 1.385 0.924

100,000 Flights 3.809 2.539

Air Cond. 100,000 FII 0.924 -

Pressurization - 100,000 Flights V1~39

Landing Gear - 100,000 FH 0,462 0.462

100,000 Flights 1.270 1.270

Engine - 100,000 FH 0.462 -

100,000 Flights 1.270

Fuel - 100,000F H 0,462 0.462

100,000 Fligh'ts 1.270 1.270

Ordnance- 100,000 FH 0.462 0.462

100,000 Flights 1.270 1.270

Figure Al depicts the accident rates in~ terms of 100,000 flight hours, and illustrates how the
accident experience on the aircraft measured falls into three distinct safety levels.

Figure A2 portrays the same information measured in terms of number of flights, rather than flight
hours. Helicopter and large aircraft experience is more closely aligned when measured in number of
flights.

Figures A3, A4, and AS illustrate the potential and actual aircraft loss rates due to material failure
in individual aircraft systems.

For the purpose of this report, aircraft systems are as defined in Air Force Inspection and Safety
Center Manual 127-1 (AFISCM 127-1) dated 1 January 1972. Flight control system includes the
flight control surfaces, control and actuation, electro-hydro-mechanical components, automatic
flight control, but not the power source systems, or portions thereof.

224
 .0
c 44

suo a aoo otsaaa

_________
 rE

IC

-iiriowIo/uao
C4N

226
Go

IIO

00

04 Lo

-L __ _ --------

I' ii
~~aD

qv Ln
-
m~
0C

227
04

AO0
Q4n

228I
 C4C

cqQ

co) LO
cl UM

229n

. . . .. ...
 r0-4
"T4

DAM _ 0

"U E-Ic
v-4 O

E-4 -4

C40o

P44

23
.wpm,,

APPENDIX B

METHODS OF DETERMINING COMPONENT OR SUBSYSTEM RELIABILITY

INCREASES REQUIRED TO COMPENSATE FOR BLIND REDUNDANCIES

In the DISCUSSION of Paragraph 3.1.7.1, Reliability - Flight Safety, it was noted that it will not
always be possible to determine that all subsystems and components are failure-free and operable
before each flight. Therefore, since the basic reliability requirements, Q(t)F.S., are stated in terms
of the probability of aircraft loss due to FCS failure during single flights of specified duration, it is
necessary to properly compensate for such blind redundancies.

SOLUTIONS OF ELEMENTARY BLIND REDUNDANCIES

Redundant subsystems are usually analyzed on the assumption that all elements are
unfailed at the start of a missioni: hence subsystem failure generally involves the occrrence of two
or m. . independent failures during the same mission.

In many practical cases, there are one or more elements that are not checked between
missions and whose failure is not ordinarily detectable in flight unless other elements also fail. In
such cases, of course, the usual assumption that all elements are unfailed at the start of the mission
would lead to erroneous subsystem reliability predictions.

The two simplest cases are solved as outlined below.

Case I - Singe-Blind Redundanc'

Asslime two components A and B in parallel. Failure of A alone is not ordinarily

noticeable, and it is not considered feasible to check the true condition of A between flights.
Component A is, however, checked in a scheduled inspection at inteivals of T1 flight hours.

Failure of Component B is readily noticeable, and it will receive maintenance before

the next flight if failure is observed.

Consider one inspection interval of TI hours, during which time the aircraft flies n
missions of TM hours each. The subsystem fails if B fails and A fails either during the same mission
or during any earlier mission during the given inspection interval TI. The resulting average mision
reliability is derived as shown in Tatle BI.

231
 TABLE 8l
SOLUTION OF SINGLE-BLIND REDUNDANCY

Components A and B in parallel. Component A has constant hourly failure rate XA, and its
condition is checked only at intervals of T, hours. Compopent B has constant hourly failure rate
XB, and its condition is checked each mission. M;ssion duration is TM hours. TI/TM n = number
of missions flown during one T, inspection interval.

CLASSICAL METHOD APPROXIMATE METHOD

(Comiponent unreliability (Component unreliability
taken as I - e"XT) taken as XT),
Probability A fails during TM 1 - e'XATM XATM
Probability B fails during TM I - e'XBTM XBTM

Probability A and B both fail (I - e-XATMXl - XAXBTM 2

during first mission of interval e-XBTM)
T,

Probability subsystem fails (1 -e'KXATMXl1 - KXAXBTM 2

on the Kth mission, due to failure eX BTM)
of A at any time during the first
K missions combined with failure
of B during the Kth mission.
Total probability of subsystem n n
1(1 - eKXATM) , KXAXBTM 2
failure during the interval K=1I K-- 2
Tl= nTM (I - eXBTM) -(1+2+ .... +n)(XAXBTM)

XAXBTM2
ln+)
22
Average probability of sub- I E (1 eXATM) (2) T
system failure during one of n K• I
the above n missions: (2 XAXBTM 2
Q(t)SYS (0 -e'XBTM) = 2
(n+l)
- 2n XAXBTMT1
Case 11 - Double-Blind Redundancy

In this case, neither component is checked except at scheduled inspection intervals of

TI flight hours. The subsystem fails if both A and B fail during the interval T1 , The resulting average
mission reliability is derived as shown in Table B2

232
 TABLE B2

SOLUTION OF DOUBLE-BLIND REDUNDANCY

Components A and B in parallel, with constant hourly failure rates XA and XB, respectively. Failure
of either component alone is not noticeable. Components not checked in preflight. Both
components are checked at intervals of Tl hour. Mission duration is TM hours. TI/TM = n
number of missions flown during one T, inspection interval.

CLASSICAL METHOD APPROXIMATE METHOD

(Component unreliability (Component unreliability
taken as 1 - eXT) taken as XT)

Probability A fails during TI I - e'XBTI XATi

Probability B fails during T, I - e'XBTI XBTI

Probability A and B both fail (1 - eXATI) (1 - eXBT) XAXBTI 2

during rl

Average missionQe'XBTI)
unreliability (11 (1 - e&XATI) (I - eXT (1/ ) XAXBTI 2
= XAXBTMTI

In the typical practical case, the difference between the "Classical" and
"Approximate" methods per Tables 811 and B2 is trivial. If any of the XT products are fairly large
(say, 0.10 or more), the difference between the two solutions rmay become significant. The two
methods provide an upper bound and a lower bound, between which the true answer lies. The
"Classical" method is slightly unconservative, as it neglects the probability of two or more
subsystem failures during the same T, inspection interval. The "Approximate" method is slightly
conservative. A completely precise and rigorous approach yields such a cumbersome solution that it
is impracticable.

It is apparent from the "Approximate method" columns of Table BI and Table B2

that the single-blind redundance yields approximately half the subsystem unreliability of the
double-blind redundancy. The factor 2±1n approaches 0.5 for large values of n..
2n
TYPICAL. EXAMPLES

For a typical example of the three possible cases of no-blind redundancy, single-blind
redundancy, and double-blind redundancy in a simple, twoelement subsystem, consider the
following:

a. An actuating subsystem with two actuetors: one hydraulic and one emergency
pneumatic.

b. The maximum allowable failure rate for the subsystem is Q(t)syS = 9.0 x 10-8
failures/flight, considering,

233

.. .
.. ....
..
..
APO",

c. An average flight duraticn, of Tm = 1.5 hours.

d. A hydraulic actuator with a known failure rate of XH = 2.0 x 10-4 failures/hour

is used.

The reliability requirement for the pneumatic actuator, Xp, is solved for the three cases.

Case I, No-Blind Redundancy

Both actuators are checked prior to each flight:

Q(tm)p Q(t)SYS 9.0 x 10-8 = 3.0 x 10-4 failures/flight

Q(tnt)H 2.0 x 10.4 x 1.5
then Xp must be 3.0 x 104 = 2.0 x 10'4 failures/hour.
1.5

Case II, Single-Blind Redundancy

The hydraulic actuator is checked before each flight, but the pneumatic actuator is
checked only once a month; an inspection interval of T= 30 flight hours during which time the
aircraft flies n = 20 missions of TM = 1.5 hours each,

Referring to Table BI, Q(t)SyS D-1) XA . TM

2n Q(t)sYS
XA = (n'+) XB . TM .TI , and for this problem:

2n Q(t)nsYS 40 9.0 x 10-8

XH TM T, 21 2.0x10-4 1.5 30

Xp must be 1.9 x i0"5 failures/hr.

Case III, Double-Blind Redundancy

Both actuators are checked only once a month: an inspection interval of TI = 30 flight
hours during which time the aircraft flies n = 20 missions of TM = 1.5 hours each.

Referring to Table B2,Q(t)syS - XAXBTMT!

Q(t)sYS 9.0 x 10-8

XP! =TM T! 2.0 x 10-4 1.5 '30
Xp must be 1.0 x 10-5 failures/hour.

234