Two different approaches are used in the design
of the control loaders. An approach which uses a load cell and an inner force
loop is implemented in the electric and hydraulic high force loaders. The force
loop reduces the motor or actuator friction and motor or actuator inertia
reflected back to the flight controls. The static friction level of the motor
without the force loop is about 3.5 lb. measured at the top of a 20 inch stick.
The static friction level for the hydraulic actuator is about 2.5 lb. With the
force loop closed, this friction level is reduced to about 0.05 lb. which is
significant. Using the force loop around the electric actuator allows very high
gear ratios to be used in the actuator between the motor and the flight
controls. The electric actuator can therefore create very high forces at the
flight controls which equal those of a hydraulic actuator.
The low force loaders do not use a load cell, so the motor friction and inertia
are reflected back to the flight controls. The reflected friction is about 0.125
lb. per 10 lb. of maximum force at the controls. A 40 lb. maximum force in roll
results in 0.5 lb. of reflected friction from the motor. This reflected friction
(and also the reflected inertia) limit the gear ratio between the motor and the
flight controls and therefore limit the maximum force at the controls. The
single advantage of this approach is reduced cost.
Two quite different approaches are used in the
control loaders to model the flight control systems. For the low fidelity and
medium fidelity loaders, the flight control system is modeled as a stick with
all the forces applied at the base of the stick. No dynamics of the flight
control system are included in the model.
The low fidelity loader is designed primarily for light aircraft simulators. A
hinge moment calculation is done for each axis according to the following
equation:
Hinge Moment = (Gradient x Dynamic Pressure x Surface Deflection
+ Trim Coefficient x Trim Tab Deflection
+ Angle of Attack Coefficient x Local Angle of Attack
+ Damping Coefficient x Dynamic Pressure / Aircraft Velocity
+ Surface Deflection Rate)
The aircraft parameters such as control surface area, mean aerodynamic chord,
etc., are included in the gradient and coefficients in the above equation.
The hinge moment (see figure 1) is applied directly to the flight controls as if
the flight controls were directly connected to the surface and no cable or
linkage elasticity existed. The loader cannot simulate breakout, friction, or
stops due to the limited speed of the V-25 processor.
The medium fidelity loader is designed primarily for light aircraft simulators
or large aircraft with boost actuators driving the control surfaces. The limited
force output of the actuators limits the application to boost on conditions for
large aircraft. For light aircraft, the hinge moment calculation shown above can
be used, and the flight control system model is as shown; the flight control
system model is as shown in Figure 1. For large aircraft, a curve such as is
shown in Figure 2 can be implemented. The curve shown in Figure 2 can be varied
as a function of dynamic pressure if necessary. For either application, the
forces are applied directly to the stick, and no control system dynamics are
included in the model. Friction, boost actuators, and non-linear hinge moment
coefficients cannot be simulated due to the limited speed of the 486 processor.
The high fidelity loaders all use the same processor and the same model of the
flight controls. This model is a coupled mass model which includes all the
dynamics of the aircraft flight control system. Figure 3 shows a simplified
mechanical diagram of a flight control system. Figure 4 shows a block diagram of
this flight control system. This coupled mass model is used in the high fidelity
loaders. The processor used for these loaders is an AT&T DSP-32C which is fast
enough to allow an iteration rate of 3500 to 5000Hz. A Texas Instruments C30 DSP
can be used in place of the DSP-32C if the control loader software must be
written in ADA rather than C. The fast iteration rate allows stiff stops, sharp
breakout, stiff cable springs, and perfect friction models. The friction model
for these loaders does not allow any creep of the flight controls if a force
below the friction force level is applied to the controls. The controls remain
absolutely stationary until the applied force exceeds the friction force.
Collins APS-65 and APS-85 autopilots can be
interfaced to the control loading system through a hardware interface which
simulates the autopilot motors. This interface contains a motor simulator for
each axis which simulates the armature inductance, the armature resistance, the
motor back EMF, and the tachometer output voltage (APS-85 only). The APS-65 uses
the motor back EMF as a rate signal to close a rate loop around the motor. We
have delivered an APS-65 autopilot interface for use on an EMB-120 simulator.
All of the control loaders are
"ALL DIGITAL" control loaders.
Analog circuitry is kept to an absolute minimum. The only pots in the system are
those which are on the commercial parts used in the loaders. These pots should
need minimal attention during the life of the loaders. The power amplifiers have
eight pots, four of which are unused. The remaining pots are set as follows:
The ACD’s and DAC’s have offset and gain pots which should not need adjustment
over the life of the system. A 0.1% error in either of these pots is not great
enough to cause the loader to be out of calibration. The most critical
adjustment is the balance on the load cell and this adjustment is automatically
performed by the software. The software adjustment compensates for the offset of
the ADC which reads the load cell output. The offset of the ADC which reads the
position transducer will cause a shift in the center position of the flight
controls. This offset can be easily nullified with software by changing the
position of the position transducer. The offset of the DAC which drives the
power amplifier (or servo valve) is unimportant because of the high dc gain of
the servo. Errors in the gain pots for the ADC’s slightly change the gradient of
the force curve but a 1% change in the force which is not noticeable to a slight
gain inside the force loop. A 1% change in the DAC gain represents only a 0.1 dB
gain change.
Several safety features are built into the
control loader hardware and software. The PC has a 16 channel 12 bit ADC board
which is used to monitor all the critical voltages in the system. This board is
dedicated to the safety monitor function. This board also has discrete inputs
and outputs which are used to control and monitor various functions. As a safety
monitor, the PC performs the following functions:
1. Continuously monitors the power amplifier internal +15 and -15 volt power
supplies.
2. Continuously monitors the current output of each power amplifier and compares
it to the current command.
3. Continuously monitors the analog signals in and out of the DSP and compares
them to the values in the DSP. For example, the DSP may calculate a 1.0 volt
analog signal is converted by the 12 bit ADC back to a digital number which the
PC then compares with the 1.0 volt digital number in the DSP.
4. Continuously monitors the signals from the load cell, position transducer,
and power amplifier current for out of tolerance conditions. For example, if the
maximum voltage from the load cell were not to exceed 7.5 volts, the PC would
cause an abort if the voltage exceeded 7.5 volts.
5. Continuously monitors the manual abort switches in the cockpit and at the
instructor’s station.
Any anomalous condition detected by the PC as a result of the above described
monitor functions will cause the system to abort and shut down. The system
cannot be restarted until the abort condition is cleared and the instructor
presses the on/off switch. The above monitor functions are performed before the
PC turns the control loader on. An abort condition will inhibit turn-on of the
control loader.
Should an abort condition exist, an error code is sent to the host computer
indicating the cause of the abort condition.
When an abort occurs, the PC will wait two more iterations (for a total of
approximately 6 msec.) before shutting down the control loader. Checking the
abort condition more than once eliminates spurious aborts caused by noise.
THE FOLLOWING ACTION IS TAKEN TO SHUT THE
SYSTEM DOWN:
1. The PC drops the enable line to the power
amplifiers. This will shut down the amplifiers within approximately 1 msec.
2. The PC turns off the relay which supplies 110/220 volt power to the power
amplifiers. The power amplifier filter capacitors will bleed off within
approximately 2 seconds. (If a high current is being drawn from the amplifier,
this bleed off occurs much faster.) This relay is also turned off by the manual
abort switch and will not be turned back on by the PC until the abort condition
has been cleared and the instructor presses the on/off button to turn the system
back on.
The PC monitors the on/off switch on the instructor’s console and will turn the
control loader on only if no abort conditions exist, the DSP is running,
communication has been established with the host, and a valid data pack has been
received from the host. The on/off switch is a momentary push button, so the
latching is done in software.
The PC performs a reasonableness check on the data in the data pack from the
host. Should the data be unreasonable (eg., negative dynamic pressure), the
entire data pack is ignored, and an error code is sent to the host. The PC also
performs a checksum on the data pack from the host, and will not use a data pack
with an invalid checksum. The PC will return an error code to the host if the
checksum is invalid.
In addition to the active safety features built into the system, several passive
safety features exist:
1. If the host computer stops running, the control loader will continue to
operate normally using the last data pack transmitted from the host.
2. If the PC stops running, the control loader will shut down. Retriggerable
monostable multivibrators are used in the circuits which enable the power
amplifiers and the power relay which will disable the amplifiers and shut off
the power if the PC stops. Should these circuits fail, the control loader will
continue to operate normally using the last data pack transmitted from the host.
3. If the DSP stops running, the flight controls will center and remain centered
as long as the system is powered up.
Several levels of diagnostics are available in
control loaders. The high force, high fidelity loaders have software to
automatically balance the load cell, check the frequency response of the
actuator (both force and position from 1 to 100 Hz), and perform a morning
readiness test which drives the stick against a mechanical stop, verifies the
reading from the feedback transducer, and compares the motor current with the
load cell output. This provides a quick check that the position transducer, load
cell, power amplifier, and motor are all working properly.
The load cell balance needs to be done every 30 days. The balance procedure
takes about one minute per axis. A ten hertz sine wave is put into the stick to
break the friction, and the load cell output is filtered and nullified to zero.
The frequency response test uses a sweep oscillator to excite the loader. As the
frequency is swept from 1 to 100 Hz, the gain and phase of the response is
calculated at each frequency. The response of both the force loop and position
loop is measured. The measured response can be compared with a response taken at
the time the system was installed.
Some diagnostics are performed continuously. As part of the safety system, the
+15 and -15 volt power supplies used in the power amplifiers are checked
continuously. The DSP ADC’s and DAC’s are continuously monitored by the PC using
a 12 bit ADC board. Any out of tolerance condition causes the system to abort, a
diagnostic message is displayed on the CRT, and an error code is sent to the
host computer.
A test program for the control loader is provided which allows the loader to be
checked independently of the host computer.
Servos and Simulation will perform the required
non-recurring engineering to model the flight control system for a particular
aircraft. This modeling will be done based on data supplied by the customer. The
cost for this NRE varies between zero and $20,000.