MOC VTOL.2300(a)(2) Protection against likely Hazards for Fly-by-Wire flight control systems

• n/a found in: Small Category VCA (Revision 0) SC-VTOL (Oct 2024)

MOC VTOL.2300(a)(2) Protection against likely Hazards for Fly-by-Wire flight control systems n/a (a) Control Signal Integrity Perturbations, as referred to in this MOC, are described as signals that result from any condition that is able to modify the command signal from its intended characteristics. They can be categorised into the following categories: (1) Internal causes that could modify the command and control signals. These include but are not limited to: (i) loss of data bits, frozen or erroneous values, (ii) unwanted transients, (iii) computer capacity saturation, (iv) processing of signals by asynchronous microprocessors, (v) adverse effects caused by transport lag, (vi) poor resolution of digital signals, (vii) sensor noise, (viii) corrupted sensor signals, (ix) aliasing effects, (x) inappropriate sensor monitoring thresholds, (xi) structural interactions (such as control actuator compliance or coupling of structural modes with control modes), that may adversely affect the system operation or structural stability and integrity. (2) External causes that could modify the command and control signals. These include but are not limited to: (i) Lightning, (ii) EMI effects (e.g., electric engine interference, aircraft’s own electrical power and power switching transients, smaller signals if they can affect flight control, transients due to electrical failures), (iii) High Intensity Radiated Fields (HIRF) (iv) Single Event Effects (SEE) (3) Spurious signals and/or false data, that are a consequence of perturbations in either of the two categories above, may result in malfunctions that produce unacceptable system responses equivalent to those of conventional systems such as limit cycle/oscillatory failures, runaway/hardover conditions, disconnection, lockups and false indication/warning that consequently present a flight hazard. It is imperative that the command signals remain continuous and free from internal and external perturbations and common cause failures. Therefore special design measures should be employed to maintain system integrity at a level of safety at least equivalent to that which is achieved with traditional hydro-mechanical designs. These special design measures can be monitored through the System Safety Analysis (SSA) process provided specific care is directed to development methods and on quantitative and qualitative demonstrations of compliance. (4) An evaluation of the following should be conducted: (i) Theflight control system should continue to perform its intended function (even in a degraded mode) (ii) Any system in the aerodynamic loop which has a malfunction should not produce an unsafe level of uncommanded motion and should automatically recover its ability to perform critical functions upon removal of the effects of that malfunction. (iii) Malfunctions of systems in the aerodynamic loop should not adversely affect the ability to perform a safe flight and landing. (iv) Any disruption to an individual unit or component as a consequence of a malfunction, and which requires annunciation and crew action, should be identified to and approved by the Agency to ensure that: (A) the failure can be recognised by the crew, and (B) the crew action can be expected to result in continued safe flight and landing in the Category Enhanced or in a controlled emergency landing in the Category Basic. (v) An automatic change from a normal to a degraded mode that is caused by spurious signal(s) or malfunction(s) should meet the probability requirements associated with the functional hazard assessment (FHA) established per [VTOL.2510](#_DxCrossRefBm1877490363)(a), (e.g. a failure condition assessed as major should be remote). (vi) Exposure to a spurious signal or malfunction should not result in a hazard with a probability greater than that allowed by the criteria of [VTOL.2510](#_DxCrossRefBm1877490363)(a) and associated MOC. The impact on handling qualities and structural loads should also be evaluated. (vii) Interaction of flight control functions and actuator control loops (viii) The flight control system should operate appropriately when considering other systems. The applicant should ensure the compatibility of automatic functions that may dynamically interact or affect flight control in both normal and anticipated abnormal operating conditions and ensure that such interactions (either by aircraft response or by data transfer) do not result in inappropriate flight control responses. This should include any potential for adverse coupling of the dynamics of one automated flight function with another (e.g., coupling between automated power and flight control functions). (5) The complexity and criticality of the FbW flight control system (if utilised) necessitates additional laboratory testing beyond that required as part of individual equipment validation and software verification. (6) It should be shown that either the FbW flight control system signals cannot be altered unintentionally (i.e. what is received by the effector/actuator is what was transmitted by the computer), or that altered signal characteristics meet the following criteria: (i) Stable gain and phase margins are maintained for all flight control closed loop systems. Pilot control inputs (pilot in the loop) are excluded from this requirement. (ii) Sufficient pitch, roll, yaw and lift/thrust control power is available to provide control for continued safe flight and landing in the Category Enhanced or for controlled emergency landing in the Category Basic, considering all the FbW flight control system signal malfunctions that are not extremely improbable. (iii) The effect of spurious signals on the systems which are included in the aerodynamic loop should not result in unacceptable transients or degradation of the aircraft's performance. Specifically, signals that would cause a significant uncommanded motion of a control surface/effector actuator should be readily detected and deactivated or the surface motion should be arrested by other means in a satisfactory manner. Small amplitude residual system oscillations may be acceptable, if justified. (iv) Establishment of a Validation and Verification process for the development of the flight control monitors, for example following SAE ARP 6539 Validation and Verification Process Steps for Monitors Development in Complex Flight Control and Related Systems. (7) It should be demonstrated that the output from the control surface closed loop system does not result in any uncommanded, sustained oscillations of flight control surfaces/effectors. The effects of minor instabilities may be acceptable, provided that they are thoroughly investigated, documented, and understood. An example of an acceptable condition would be one where a computer input is perturbed by spurious signals, but the output signal remains within the design tolerances, and the system is able to continue in its selected mode of operation unaffected by that perturbation. (8) In the context of showing and demonstrating these system characteristics an accepted Means of Compliance includes: (i) Systematic laboratory validation which includes a realistic representation of all relevant interfacing systems, and associated software, including the control system components which are part of the lift/thrust system. Closed loop aircraft simulation/testing will be necessary in this laboratory validation. (ii) Laboratory or aircraft testing to demonstrate unwanted coupling of electronic command signals (over the spectrum of operating frequencies) and their effects on the mechanical actuators and interfacing structure. (iii) Analysis or inspection to substantiate that separation/segregation are utilised to minimize any potential hazards. (9) A successful demonstration of signal integrity should include all elements, which contribute to command and control signals to the "aerodynamic closed loop" that actuate the flight controls. The "aerodynamic closed loop" should be evaluated for the normal and degraded modes. Elements of the integrated "aerodynamic closed loop" may include for example; digital or analogue flight control computers, power control units, control feedback, major data busses, and the sensor signals including; air data, acceleration, rate gyros, commands to the surface position, and respective power supply sources. Autopilot systems (including feedback functions) should be included in this demonstration if they are integrated with the FbW flight control system. Compliance should be shown in conjunction with [VTOL.2510](#_DxCrossRefBm1877490363) and SC EHPS (Electric and Hybrid Propulsion System). (b) Pre-flight check A means should be provided to allow a check of full range of movement to their commanded position of all primary lift/thrust controls (i.e. pilot controls, control surfaces) prior to flight, or a means should be provided that will allow the pilot to determine that full control authority is available prior to flight. Some checks of the engine power and power control (e.g. engine RPM at least at idle thrust) should also be provided. Compliance should be shown in conjunction with the following requirements [VTOL.2425](#_DxCrossRefBm1877490511)(a), [VTOL.2435](#_DxCrossRefBm1877490515)(f) (g) and [VTOL.2615](#_DxCrossRefBm1877490514). (c) Precautions against maintenance error / incorrect assembly Experience has shown that maintenance errors should be assumed to occur and should be considered in the system design in order to reduce their likelihood. The flight control system should be designed to physically prevent incorrect assemblies having significant safety effects and/or critical repercussions (i.e. catastrophic, hazardous, or major). Distinctive and permanent marking should only be used if the prevention of incorrect assembly by design is impractical, and the Agency accepts the justification provided. Significant safety effects may include an out-of-phase action, reversal in the sense of the control, faults introduced due to improper rigging, interconnection of the controls between two systems where this is not intended and loss of function. (d) Flight Control Jams The aircraft, pilot controls and its movable control system and/or surfaces should be designed to prevent a jam from occurring (refer to ASTM F3232/F3232M-20 standard §4.7 and 4.8) and should be tolerant to any jam, as far as practicable, and demonstrate continued safe flight and landing in the Category Enhanced or controlled emergency landing in the Category Basic. This may include the need for jam alleviation means. The detachment of a part (e.g. control surface) should not be used as an alleviation means. (1) Definition of Jam: A jam is a failure or event such that a control (e.g. control surface), pilot control, or component is fixed in one position. Causes of a jam may include corroded bearings, interference with a foreign or loose object, control system icing, seizure of an actuator, or a disconnection that results in a jam by creating an interference. Jams of this type should be assumed to occur and should be evaluated at positions up to and including the normally encountered positions defined in (2) below. All other failures that result in a fixed control (e.g. a control surface), pilot control, or component are addressed via the safety analysis process in accordance with [VTOL.2300](#_DxCrossRefBm1877490411) and [VTOL.2510](#_DxCrossRefBm1877490363). Depending on system architecture and the location of the failure, some jam failures may not always result in a fixed control surface or pilot control. (2) Determination of Control System Jam Positions. The flight phases required to be addressed should cover all flight phases (e.g. vertical takeoff, transition, in-flight (climb, cruise, normal turns, descent, and approach), transition and, vertical landing). Additional phases specific to the aircraft, such as hover should also be considered. (3) Methodology: When showing compliance with [VTOL.2300](#_DxCrossRefBm1877490411)(a)(2), the applicant should: (i) provide a summary of the design features that are intended to prevent a jam from occurring, due to failure or physical interference (jam prevention means), (ii) provide a summary of the means by which a jam could be alleviated (jam alleviation means), Note: if credit is taken from a jam alleviation device (e.g. jam breakout or override, disconnect means, alternate surface control, alternate power source, or alternate cable paths), then the conditional probability of failure of the jam alleviation device, given that jam has occurred, should be less than 1 x 10-3. (iii) For each axis and flight phase: (A) determine the ‘normally encountered position’. This ‘normally encountered position’ is the maximum position resulting from reasonably expected manoeuvres, gust/manoeuvre load alleviation function commands and wind & gust conditions. As an example, assuming a jam to be approximately 1 x 10-6 to 1 x 10-7 per flight hour, a reasonable definition of normally encountered positions would represent the range of control surface deflections (from neutral to the largest deflection) expected to occur in 1000 random operational flights, without considering other failures, for each of the flight segments identified in the rule. This assumption should be supported by FMEA/SSA expected failure rates for jams. NOTE 1: If there is significant uncertainty regarding the control surface positions during 1000 random operational flights, it is acceptable to use the control surface stop or to propose another position based on conservative assumptions for acceptance by the Agency. NOTE 2: Similarly to NOTE 1 above, the 1000 random operation flights is based on the assumption of a jam to be approximately 1 x 10-6 to 1 x 10-7 per flight hour. This is actually dependent on the actuator technology, installation, aircraft manufacturer and supplier experience. The Applicant should therefore propose a conservative analysis to cover the risk that is foreseen. (B) evaluate the jam at positions up to and including the normally encountered position, and demonstrate continued safe flight and landing in the Category Enhanced or controlled emergency landing in the Category Basic including structural strength capability. NOTE 3: Only the aircraft rigid body modes need to be considered when evaluating the aircraft response to manoeuvres, wind/gust conditions and continued safe flight to landing. (iv) to identify the remaining possible jamming conditions, and demonstrate to the Agency that all precautions have been taken and that the probability of occurrence is consistent with the hazard classification. If it is needed, it should be discussed with and accepted by the Agency. NOTE 4: Compliance should be shown in conjunction with [MOC VTOL.2215](#_DxCrossRefBm1877490407) Flight Load Conditions for wind/gust conditions.