Technology Transfer and Lessons Learned

Flight-test results from the AFTI/F-16 program were exceptionally well-documented by NASA and widely published in technical papers,
memorandums, and presentations.[1197] These provide invaluable insights into the problems, issues, and achievements encountered in this rela­tively early attempt to integrate an asynchronous digital flight control system into a high-performance military jet fighter. As the definition implies, in an asynchronous flight control system design, the redun­dant channels run autonomously. Each computer samples sensors and evaluates flight control laws independently. Each separately sends com­mand signals to an averaging or selection device that is used to drive the flight control actuators. In this DFCS implementation, the unsynchro­nized individual computers can sample the sensors at slightly different times. Thus, they can obtain readings that may differ quite appreciably from one another, especially if the aircraft is maneuvering aggressively. Flight control law gains can further amplify these input differences, causing even larger differences between the results that are submitted to the output selection algorithm.[1198]

During ground qualification of the AFTI/F-16, it was found that these differences sometimes resulted in a channel being declared failed when no real failure had occurred.[1199] An even more serious shortcom­ing of asynchronous flight control systems can occur when the control laws contain decision points. Sensor noise and sampling variations may cause independent channels within the DFCS to take different paths at the decision points and to produce widely divergent outputs.[1200] This occurred on AFTI/F-16 flight No. 44. Two channels in the DFCS declared each other failed; the analog backup was not selected because simul­taneous failure of two DFCS channels had not been anticipated. The pilot could not reset the system, and the aircraft was flown home on the single remaining DFCS channel. In this case, all protective redun-

dancy had been lost, yet an actual hardware failure had not occurred. Several other difficulties and failure indications were observed dur­ing the flight-test program that were traced to asynchronous operation, allowing different channels to take different paths at certain selection points. The software was subsequently modified to introduce voting at some of these software selection points.[1201]