Self-Adaptive Flight Control Systems

One of the more sophisticated electronic control system concepts was funded by the AF Flight Dynamics Lab and created by Minneapolis Honeywell in the late 1950s for use in the Air Force-NASA-Boeing X-20 Dyna-Soar reentry glider. The extreme environment associated with a reentry from space (across a large range of dynamic pressures and Mach numbers) caused engineers to seek a better way of adjusting the feedback gains than stored programs and direct measurements of the atmospheric variables. The concept was based on increasing the elec­trical gain until a small limit-cycle was measured at the control surface, then alternately lowering and raising the electrical gain to maintain a small continuous, but controlled, limit-cycle throughout the flight. This allowed the total loop gains to remain at their highest safe value but avoided the need to accurately predict (or measure) the aerodynamic gains (control surface effectiveness).

This system, the MH-96 Adaptive Flight Control System (AFCS), was installed in a McDonnell F-101 Voodoo testbed and flown successfully by Minneapolis Honeywell in 1959-1960. It proved to be fairly robust in flight, and further system development occurred after the cancellation of the X-20 Dyna-Soar program in 1963. After a ground-test explosion during an engine run with the third X-15 in June 1960, NASA and the Air Force decided to install the MH-96 in the hypersonic research air­craft when it was rebuilt. The system was expanded to include several autopilot features, as well as a blending of the aerodynamic and reac­tion controls for the entry environment. The system was triply redun­dant, thus providing fail-operational, fail-safe capability. This was an improvement over the other two X-15s, which had only fail-safe fea­tures. Because of the added features of the MH-96, and the additional

redundancy it provided, NASA and the Air Force used the third X-15 for all planned high-altitude flights (above 250,000 feet) after an initial enve­lope expansion program to validate the aircraft’s basic performance.[689]

Unfortunately, on November 15, 1967, the third X-15 crashed, kill­ing its pilot, Major Michael J. Adams. The loss of X-15 No. 3 was related to the MH-96 Adaptive Flight Control System design, along with several other factors. The aircraft began a drift off its heading and then entered a spin at high altitude (where dynamic pressure—"q” in engineering shorthand—is very low). The flight control system gain was at its max­imum when the spin started. The control surfaces were all deflected to their respective stops attempting to counter the spin, thus no limit-cycle motion—4 hertz (Hz) for this airplane—was being detected by the gain changer. Thus, it remained at maximum gain, even though the dynamic pressure (and hence the structural loading) was increasing rapidly dur­ing entry. When the spin finally broke and the airplane returned to a normal angle of attack, the gain was well above normal, and the sys­tem commanded maximum pitch rate response from the all-moving elevon surface actuators. With the surface actuators operating at their maximum rate, there was still no 4-Hz limit-cycle being sensed by the gain changer, and the gain remained at the maximum value, driving the airplane into structural failure at approximately 60,000 feet and at a velocity of Mach 3.93.[690]

As the accident to the third X-15 indicated, the self-adaptive con­trol system concept, although used successfully for several years, had some subtle yet profound difficulties that resulted in it being used in only one subsequent production aircraft, the General Dynamics F-111 multipurpose strike aircraft. One characteristic common to most of the model-following systems was a disturbing tendency to mask deteriorat­ing handling qualities. The system was capable of providing good han­dling qualities to the pilot right up until the system became saturated, resulting in an instantaneous loss of control without the typical warn­ing a pilot would receive from any of the traditional signs of impending loss of control, such as lightening of control forces and the beginning

of control reversal.[691] A second serious drawback that affected the F-111 was the relative ease with which the self-adaptive system’s gain changer could be "fooled,” as with the accident to the third X-15. During early testing of the self-adaptive flight control system on the F-111, testers dis­covered that, while the plane was flying in very still air, the gain changer in the flight control system could drive the gain to quite high values before the limit-cycle was observed. Then a divergent limit-cycle would occur for several seconds while the gain changer stepped the gain back to the proper levels. The solution was to install a "thumper” in the sys­tem that periodically introduced a small bump in the control system to start an oscillation that the gain changer could recognize. These oscilla­tions were small and not detectable by the pilot, and thus, by inducing a little "acceptable” perturbation, the danger of encountering an unex­pected larger one was avoided.

For most current airplane applications, flight control systems use stored gain schedules as a function of measured flight conditions (alti­tude, airspeed, etc.). The air data measurement systems are already installed on the airplane for pilot displays and navigational purposes, so the additional complication of a self-adaptive feature is considered unnecessary. As the third X-15’s accident indicated, even a well-designed adaptive flight control system can be fooled, resulting in tragic conse­quences.[692] The "lesson learned,” of course (or, more properly, the "les­son relearned”) is that the more complex the system, the harder it is to identify the potential hazards. It is a lesson that engineers and design­ers might profitably take to heart, no matter what their specialty.