The Art of the Helicopter John Watkinson - Karatunov.net

7.29 Fault tolerance
In feedback systems an error is amplified to operate a control. In normal operation this
makes the error smaller. However, if there is a failure the error does not get smaller. In
the case of an attitude stabilizer controlled by vertical gyro, if the roll attitude signal
from the gyro failed and went to an arbitrary value, this would result in a massive roll
error which would apply full roll control in an attempt to correct it. This is known as a
hardover and is an unfortunate failure characteristic of all feedback systems. In practice
equipment has to be designed to prevent hardover failures compromising safety. In
a simple approach the authority of the automatic pilot is limited so that it cannot
apply full control. Slipping clutches may be present in the controls so that the pilot
can overcome the incorrect forces and regain control. In more sophisticated systems
extensive monitoring is carried out. If a signal deviates from the range of levels in which
it normally operates, the signal may be clamped to a null value to prevent a hardover
and the autopilot will be disengaged.
In military helicopters natural parts failure is not the only problem. The designer has
to consider that the helicopter may come under fire and will take steps to allow control
to be retained despite a reasonable amount of damage. In practice this means retaining
control after hits from rounds of up to half-inch calibre.
The first line of defence is redundancy. Duplicated hydraulic systems are essential,
but it is important to run the pipes far apart so that a single round cannot rupture both
systems. The location of twin engines spaced widely apart in the Apache is another
example of this philosophy. Mechanical control signalling is vulnerable to small arms
fire as a single round can sever a pushrod. It is much harder to disable a multiply
redundant digital signalling system which takes different routes through the airframe
and where the processing power is distributed in small units all over the airframe. In
fact some attack helicopters use the mechanical signalling only as a failsafe in case
the fly-by-wire fails. Where control paths cannot be separated, as for example near the
pilot’s controls, the armour plating which protects the pilot will also be employed to
protect critical parts of the control system.
Redundant hydraulic actuators have the additional problem that the failed actuator
may be jammed due to impact distortion or a round lodged in the mechanism. In this
case the remaining actuator will be unable to move the jammed control. The solution
is to construct actuators with frangible pistons. In the event of an actuator seizure, the
working actuator can develop enough thrust to break the jammed piston free of the
actuator rod.
Where hydraulics are concerned, it is clear when a failure has occurred, and so it is
equally clear which actuator should retain authority. However, in electrical signalling
systems a failure in a signal processor could result in an entirely spurious voltage or
digital code being output. This could have any value over the whole control range.
If there are only two control systems it is impossible to know which is giving the
right answer. The solution here is triplication where there are three separate systems
comparing the actual position with the desired position. In this case a single failure will
result in one actuator drive signal being different from the other two. A comparison or
majority voting system can determine which signal is out of step and disable it.
As with the hydraulics, electrical power sources must be duplicated. Critical electrically
powered devices may be fed by multiple sources using blocking diodes. A voting
signal processor can take power from the battery wiring or from both generators. If
any power source fails its voltage will fall and the diode will reverse bias and block
any power drain so that power is still available with any one source still functioning.
Control 321