Post by Calum on May 20, 2012 21:14:19 GMT 12
But didn't the Aussies have higher (and possibly unrealistic) expectations of the AFCS? Whereas the RNZAF simply see it as a digital form fit function match for the analogue ASE system?
Not really that simple. You can hardly call the digital AFCS a FFF replacement for the old analog system. It's clearly doesn't fit the definition of form fit or function. Plus you have to consider the CRE (configuration Role and environment that the aircraft it being operated in. In this case the 2nd pilot is now a TACCO whose primary function it operating the sensors/weapons, not as in every other operator, where the 2nd front seater is just another driver.
The report I've pointed to earlier covers it, (Since you're probably going to have to operate/fix it Phil, it's worth a read if you haven't already)
but to save everyone going through it I’ve picked out he parts that refer to the AFGC
Crucially, a new digital Automatic Flight Control System (AFCS) was developed for the SH-2G(A) to meet the RAN’s requirements.
Point of Difference
Its important to understand some of the differences between the SH-2G(A) flight control system and that of other versions of the Super Seasprite. All SH-2D, -F and -G models are controlled by the standard helicopter tail rotor and a unique system of servo-flaps – small aerofoils on the trailing edges of the main rotor blades which are used to alter the pitch of the blades. There is a direct mechanical linkage between the servo-flaps and the cockpit controls – the cyclic pitch and collective lever. The tail rotor also incorporates a mechanical linkage to the pilot’s foot pedals in the cockpit.
The system incorporates hydraulic boost to reduce the control forces, and the SH-2F and -G also have an analogue flight control computer known as the Automatic Stabilization Equipment (ASE) to improve handling qualities and automate the execution of standard manoeuvres. Although the SH-2G’s FCS was a single-strand, or simplex, system with no redundancy built in, it has served faithfully with the US Navy and other users for 1.1 million flight hours.
The ASE helps the aircraft maintain heading, Doppler airspeed, and barometric or radar altitude. With its dipping sonar, the Egyptian Navy’s SH-2G(E) (ordered during the early-1990s) also introduced a digitally augmented ASE able to fly an automatic approach to a coupled hover so that it could lower the sonar transducer into the water, maintain its position above the transducer based on measurements of the angle of the transducer cable, and then fly an automatic departure from the hover.?
The new all-digital AFCS for Australia’s SH-2G(A) variant replaced the old ASE with a Hamilton Sundstrand digital flight control computer whose software was written by Kaman. Although still a single-strand system this was intended to reduce crew workload still further, enhance the reliability and expand the functionality of the Super Seasprite flight control system. It was designed to fly the aircraft through an automatic approach to the ship or to a search-and-rescue hover, and fly it over a programmed course. It would also maintain set heading, altitude, and airspeed for point-to-point navigation. The flight control computer takes inputs from the SH-2G(A) Inertial Navigation System (INS), Global Positioning System (GPS) and Air Data Computer (ADC) among other sensors.
Although the new AFCS replaced the ASE, the flight control configuration remained the same, with a direct mechanical linkage between the servo-flaps and tail rotors and the collective and cyclic pitch controls and foot pedals in the cockpit.
The failure modes and lack of redundancy in the Super Seasprite’s hydraulic or ASE systems were never considered a problem because the pilot can fly the entire flight envelop without them, even though the control forces are higher – and it’s understood US Navy pilots would routinely do this for training purposes. In USN operations, had a fault occurred in either the hydraulic or ASE systems, the crew simply turned the system off and continued with the mission.
This was understood to include actuator ‘hard overs’ (an errant flight control actuator making an uncommanded move to an extreme position) that is reported to have occurred from time to time in US Navy service, though reportedly with little drama – the crew simply turned the system off and got on with the mission. But this occasional tendency became the cause of considerable concern to the RAN and the ADF’s airworthiness authorities, as we shall see.
Both US and Australian sources have confirmed the original contract for the SH-2G(A) accepted the premise that the original US Navy type certificate for the Super Seasprite and its flight control system was acceptable to the RAN at that time.
Grounded
Then came the bombshell: in May 2006 the new defence minister Dr Brendan Nelson announced the Super Seasprites were grounded indefinitely owing to safety concerns over the AFCS, and that their AMTC had been withdrawn.
In fact, they had been grounded since March following two AFCS failures, on 14 January and 14 March, which the authors understand from a senior Canberra source were followed by a third failure on 28 March. The cause and consequences of that third failure have not been revealed publicly.
The first two incidents were definitely caused by AFCS ‘hardovers’ – an AFCS failure resulting in the rapid movement of a flight control actuator to the end of its travel, which would not have been commanded by the system given the then-current flight conditions. This could be catastrophic, especially at low altitude if the pilot was already under a heavy workload at night or in poor visibility or if the aircraft was close to its power, weight and stability margins. And the new ITAS cockpit layout incorporated a new and much wider centre console: under certain circumstances when trying to take corrective action this could rob the pilot’s cyclic control (‘joystick’ in lay man’s terms) of the last six to eight inches of travel. Furthermore, because the cockpit was so cramped, the legs of larger pilots could actually foul the cyclic.
One of these hardovers was traced to a faulty circuit board which had shaken loose from its mounting in the AFCS computer. A more serious problem was a propensity for anomalies in the helicopter’s air data computer which fed incorrect signals to the AFCS.
Analysis by software engineers concluded that three incidents in just 1800 flight hours was an unacceptably high failure rate, especially when the severity of the hazard presented by such failures was judged to be potentially catastrophic.
The results of this investigation were presented to a software symposium held by the Directorate General of Technical Airworthiness (DGTA) in 2007 by engineer Helen Carson of the DMO’s Sea 1411 project office. A copy of Ms Carson’s presentation is available on the DGTA web site (see References); she did not speak to the authors.
Ms Carson found the potential severity of such incidents in the SH-2G(A) could also be compounded by several things. The AFCS specification relied on the pilot to mitigate AFCS failures . Flight testing by AMAFTU showed the pilot had insufficient control margin to recover the aircraft during a hardover; furthermore, anthropometric restrictions further reduced control authority. And AMAFTU considered that the recovery process recommended in Kaman’s own flight manual was ‘counter-intuitive’: it required the pilot to disconnect the AFCS via a ‘quick disconnect’ control and then recover the aircraft manually.
Coming 12 months after the tragic deaths of nine Australians in the Sea King helicopter crash on Nias Island in Indonesia, reports of what appeared to be a systemic flight safety problem with the Super Seasprite were extremely unwelcome. The grounding compounded a significant morale problem which already afflicted 805 squadron at Nowra. Indeed, following a visit to Nowra before the 28 March 2006 flight control anomaly, Defence Minister Brendan Nelson noted privately that he had found morale at 805 squadron as low as at its sister squadron, 817, which had suffered the fatal Sea King crash.
Nelson commissioned a complete review of the project from the RAN and DMO. According to senior sources, Nelson wanted to know three things: what it would take to ‘fix’ the Super Seasprite and what the implications of pursuing this course of action were for cost, schedule and capability; whether Defence could and should lower its requirements and take delivery of an aircraft more quickly with a reduced capability; and what it would cost to simply terminate the project.
The answers weren’t what anybody wanted to hear. It was possible to get the aircraft flying again under a Special Flight Permit, but to restore the SH-2G(A)’s type certificate, the DGTA required a complete re-design of the AFCS so that it conformed with modern airworthiness standards.
The first stage of the process needed the existing AFCS software to be re-written to comply with two military software quality and safety standards, MIL-STD-498 and MIL-STD-882C, and to ensure it didn’t act on invalid data from the sensors; the system itself was checked thoroughly to ensure that the data being fed into the flight control computer from sensors such as the air data computer were not themselves at fault. This took just over six months and $1 million, with a successful flight test by AMAFTU in February 2007.
The second stage required a complete re-design of the AFCS so that it complied with the civilian type certification standard for helicopters, FAR 29 (see below for a more detailed description). This was a far more challenging and searching program and required a complete re-write of the AFCS software to comply with the MIL-STDs cited earlier and also with a universally adopted software quality standard for avionics, DO-178B Level A; the AFCS as a whole would need to comply with FAR 29 and would require a DO-178B compliant software Health Monitoring Unit.
Why had this issue taken so long to emerge?
In fact, it had been bubbling away in the background since the late-1990s, waiting to present itself. The issue was essentially one of confidence in the ability of a single-strand flight control system to be adapted to meet new and more challenging performance and safety requirements than it was originally designed for.
It’s not unknown for electronic flight control systems and control actuators to display anomalies of one kind or another. For this reason most modern aircraft have multiple redundancy and graceful failure modes – that is, if one part of the flight control system fails there are back-ups: there is no way a single failure can affect the entire system. The RAN’s Seahawks have triple redundancy, or two back-ups, in their flight control systems. If some sort of anomaly or hardover occurs in one of these systems, the other back-ups ensure it doesn’t endanger the aircraft.
However, with the Super Seasprite’s single-strand system, hardovers had an immediate effect on the aircraft – reportedly, they could result in a rapid and extreme uncommanded roll, pitch or yaw.
Does this matter? In short, yes – but exactly how much it matters was the subject of heated debate by Kaman and the RAN.
Kaman’s position is based on the Seasprite family’s 1.1 million flying hour service record with the US Navy. According to one US helicopter industry veteran, “the standard mode of operation in the SH-2G community had always been to simply turn off or reset the flight control system when a fault occurred, and because it was accepted that the air crew was the mitigator in flight control computer problems, this issue was never an ‘issue’.”
Evidently, the rapidity of the onset of a problem was never such that the pilot couldn’t correct it in a safe and timely way. Indeed, there was at least one such failure at Kaman’s factory in Bloomfield during flight testing with an RAN test pilot aboard the aircraft: this reportedly resulted in an uncommanded pitch change which the pilot mitigated successfully.
According to a well-placed US source, at that time Kaman and the RAN agreed that it was a non-issue; in Kaman’s view it only became inflated into an ‘issue’ over time because of changes in the ADF’s airworthiness certification regime between the mid-1990s and the early 21st century.
Years after the event, Australian sources dispute this view. The air data computer anomaly known to have occurred at Bloomfield was reportedly dealt with as a ‘one off’; it wasn’t suspected that this could be part of a systemic issue with the AFCS, nor that the associated hazard could be magnified by changes in the aircraft’s weight and balance.
The RAN’s view is simple: the effects of an uncommanded control input, or the failure of a single-strand FCS, while the aircraft is close to its weight and power margins and manoeuvring somewhere near the edge of its flight envelope could be catastrophic. The effects could be compounded in the case of the SH-2G(A) by the two-man cockpit environment.
Imagine for a moment the aircraft is on autopilot under the control of the AFCS, hovering or flying slowly over the sea at 200ft or less at night, and conducting a surface search using its radar and FLIR. Because the crew consists of only two persons, the pilot will be part of the search operation, busy monitoring displays and sensors. To use the language of the US Navy Test Pilot School (whose rotary wing flight test manual draws heavily on that of the Empire Test Pilot’s School at Boscombe Down in England) his control of the aircraft will be ‘passive’, possibly even ‘passive hands off’, rather than ‘attentive’ – or ‘active’, when the pilot is actually flying the aircraft.
If an anomaly occurs which causes an actuator ‘hard over’ the pilot’s response may be too slow to save the aircraft before it hits the sea surface. It depends on how much warning the aircraft gives the pilot (so-called ‘rotorcraft response time’) and then how quickly the pilot recognises the problem and reacts to deal with it (‘pilot response time’).
A pilot in ‘passive hands off’ mode might take four seconds to notice a problem, decide what to do about it and then act. A pilot in ‘active’ mode might take less than 0.5 seconds. In extreme cases, an anomaly occurring at a critical point (for example, while trying to land the aircraft on a small flight deck at a high all-up weight) could still have catastrophic consequences, even if the pilot is ‘alert’ to changes in flight conditions and the status of the FCS.
To put that in context, a sudden and complete FCS failure on a helicopter hovering at 40ft could see it hit the water within 0.8 seconds if the pilot were unable to take corrective action in time.
To borrow a term from another part of the helicopter world, there is a so-called ‘avoid curve’ – a graph of airspeed against altitude: an aircraft on the wrong side of this curve lacks the combination of altitude and air speed necessary to recover from engine failure. The curve is affected by the aircraft weight and balance and factors such as ambient air temperature.
The same applies to the FCS: an irrecoverable FCS failure should not be possible within the helicopter’s flight envelope – and the flight envelope shouldn’t be constrained unduly by the need to protect the aircraft from the consequences of a single-strand FCS failure. Limiting the flight envelope by creating another ‘avoid curve’ to reduce the aircraft’s vulnerability to the consequences of a hardover wasn’t the answer – if a hardover happened on take-off or landing the consequences might still be catastrophic.
All that said, the wider SH-2G community has been operating its Super Seasprites under exactly these conditions without difficulty for two decades. Is Australia’s aircraft, or the way the RAN operates it, so different?
Yes it is: the US Navy flew its Super Seasprites with a three-man crew – the pilot was not required to do anything except fly the aircraft. He was not distracted by sensor management duties or other tactical concerns. But the SH-2G(A) was flown by a single pilot whose attention might be divided between flying the aircraft and managing part of the tactical task at hand.
Even allowing for the conservative views of some test pilots, this was the guts of the problem: put simply, the disagreement between the RAN and DMO and Kaman was over the likelihood of such an anomaly occurring, and the consequences.
Kaman’s firmly-held view (backed up by the service record of the SH-2 family in US Navy service and elsewhere) was that the likelihood of such a thing happening was extremely low, and that the consequences were relatively benign; it had been demonstrated repeatedly over many years that the pilot would have sufficient time under any circumstances to switch off the AFCS and take manual control.
However, the RAN was operating the SH-2G(A) in a completely different way, and planning to fly it at much higher all-up weights than the US Navy, so had a smaller power margin and therefore less room and time for recovery.
Furthermore, it was operating close to the limits of the lateral centre of gravity of the aircraft: ‘asymmetric’ flight with a 385kg Penguin missile hanging on one side of the aircraft would shift the centre of gravity towards that side. Any control difficulties caused by an AFCS problem or hardover would be compounded by the altered centre of gravity. And if a hardover occurred when the aircraft was flying at low altitude in a steep bank and close to the limits of its spiral stability, for example, again the RAN test community feared the consequences could be catastrophic.
To the RAN this was unacceptable. To Kaman, however, the RAN’s attitude was inexplicable: if the Super Seasprite flight control system had been good enough when Australia selected the aircraft back in 1996 (and had still been good enough for the US Navy at that time), why was it no longer good enough in 2006? Part of the answer lies in the paragraph above; another part lies in the type certification process the ADF expects its new aircraft to undergo.
I’ve got no axe to grind Phil, and I'm not a doomsayer but I am a realist. I just don’t consider the Seasprite a good aircraft.
But if the prices reported are accurate then it’s probably a good buy for the RNZN, assuming the airworthiness issues above have been addressed.
Also, if (when) they buy it they will end up with an orphan avionics system to support for the next 20 yrs…