Degradation of control function – actuator rate limiting

Degradation in performance of a control function typically occurs when the power supply to a control surface actuator, mechanical or electrical, fails in some way. With the exception of some very small types, most helicopters feature powered control systems. The pilot moves the cockpit inceptors, and through a system of rods, bell-cranks, levers and pulleys (or computers and electrical signalling in a fly-by-wire system) the movement is transmitted to the input side of a hydraulic (or electro-mechanical) actuator. The output side of the actuator is connected to the non-rotating face of the rotor swashplate, which can be tilted or raised/lowered, transmitting signals through the rotating face of the swashplate and through the mechanical pitch link rods to the rotor blades. Three actuators are required on the main rotor to provide collective pitch, longitudinal cyclic and lateral cyclic pitch. The tail rotor normally requires only a collective pitch actuator. The high-reliability level required for rotor controls is usually achieved, ‘below the swashplate’, through redundancy of the mechanical or electrical actuation system. A dual-redundant hydraulic actuator would normally be supplied by two hydraulic systems, each providing 50% of the power. Failure of one of the supplies results in a degradation of performance, such that the maximum velocity and acceleration at which the control surface can be moved are reduced. The extent of the reduction depends on the pilot’s control inputs, since the same power system is typically driving collective and cyclic, but a straight comparison before and after failure would normally show a corresponding 50% reduction in maximum rate. This rather simple assumption is being used to establish the actuation power requirements in the preliminary design of the European civil tilt rotor aircraft as reported in Ref. 8.46. Degradation in the ‘predicted’ handling qualities, e. g., attitude bandwidth and quickness, can be derived from off-line analysis of the nonlinear simulation of the aircraft and its systems. The actuation rate at which the predicted handling falls into the Level 3 region establishes a minimum acceptable value corresponding to the transition from minor to major failure category (Fig. 8.44). Because it is likely that the predicted handling for several parameters is likely to degrade at the same time in this scenario, it is especially important to check the predictions by carrying out piloted tests using operational MTEs. The importance of this requirement is emphasized in Ref. 8.47, where the point is made that anything less than the same performance requirements as demanded in the MTEs for normal operational flight would lead to pilots relaxing their control strategy and consequently not really experiencing the adverse effects of degradation. While this might be possible in some or even most conditions, flight

Fig. 8.45 Control and responses in a hover turn manoeuvre

through heavy turbulence, recovering to a moving deck or a confined area in poor visibility may be unavoidable, hence some assessment of the likely consequences needs to be conducted.

Figure 8.45, from Ref. 8.46, captures this point perfectly. The data show results for two test pilots flying a tilt rotor aircraft in a 90° hover-turn manoeuvre to the ADS – 33 GVE performance standards. The actuation rate for the yaw control function, in this case provided by differential longitudinal cyclic pitch, was reduced incrementally until Level 3 ratings were awarded. The case shown corresponds to a reduced cyclic pitch rate of 3°/s. It can be seen that Pilot B flew the manoeuvre with an initial step control input, allowing the aircraft to slow gradually to the required heading with minimal closed-loop action. Pilot A, on the other hand, attempted to stop the yaw rate with a more abrupt input but immediately entered a pilot-induced oscillation. Over about 10 s the oscillatory pedal inputs increased to the stops with yaw rate building up to greater than 20°/s. The rate limiting on the cyclic pitch (differential longitudinal cyclic provides yaw control in hover) can be seen clearly in the lower-right figure. Pilot B returned an HQR 4 for this case, the same rating that both pilots had returned for the case with no rate limiting. Pilot B had continued to adapt his strategy as the system performance degraded to fly the task with moderate levels of compensation. Pilot A, with each new configuration, initially attempted the manoeuvre with a similar strategy, deliberately to focus on changes in handling. For the case shown, the pilot returned an HQR of 10 on the basis that he had to stop flying the aircraft (get ‘out-of-the – loop’) for several seconds. The aircraft had not, however, drifted outside the adequate performance limits on position and bank, only yaw angle, and arguably, a Level 3 rating would have been more appropriate. However, the pilot was holding right pedal on the stops for more than 5 s to bring the aircraft onto heading before coming out of the loop

and his impression was that he had, indeed, lost control. The rate limit on longitudinal cyclic was set at 4°/s, a very similar value to that defined for pitch control in the accel – decel manoeuvre. The full power actuation rate authority was actually set at 10°/s in this preliminary design study, 2.5 times the rate at which the Level 2/3 boundary had been predicted, hence giving an additional margin of safety for compensation in harsher environmental conditions.

Studying the effects of system failure brings home the importance and associated cost of safety in aviation, by far the safest sector in the transport industry. Ensuring that the effects of flight system loss, malfunction or degradation do not lead to a worsening of handling beyond Level 2 provides a major contribution to this safety. Players in this aspect of safety include regulatory bodies, requirements writers, design engineers, manufacturers, certification agencies, operators, maintenance engineers, training organizations and the pilots themselves; in other words, practically the whole aerospace community is involved. Nothing less than a total commitment to safety by the whole community will lead to an eradication of accidents resulting from system failures.

This brings us to the third situation where an otherwise Level 1 aircraft can be literally thrown into a degraded condition – by encountering severe atmospheric disturbances.