Flight Control Systems - Irreversible

An irreversible flight control system is where there is not a direct mechanical linkage connection between the control lever in the flight compartment and the flight control surface. In an irreversible mechanical system, the control lever in the cockpit moves a spool valve on a hydraulic power control unit (PCU). A mechanical linkage drives the spool. The mechanical linkage will consist of a combination of bellcranks, pushrods, cable systems, pogos, summing linkages, etc. The design of a mechanical irreversible system is similar to the design of a reversible flight control system. The main difference will be the spool forces are better defined than surface hinge moments. Also, an artificial feel system is required for irreversible flight control systems. Variation in cable stiffness characteristics over environmental and operating ranges can also be critical since spool movements will be small. As a general rule, cable pretension values will be higher for an irreversible system (some commercial aircraft are in the 150 lb pretension range).

Irreversible flight control systems include both mechanical linkage controlled hydraulically powered PCUs and fly by wire systems. Today, most new irreversible systems are fly by wire. A description of fly by wire systems can be found in Flight Control Systems – Fly By Wire.

A simple example of a mechanical irreversible flight control system is shown in Figure 1. The system in Figure 1 shows a rudder system with bellcranks and pushrods connecting the rudder pedals to the hydraulic servoactuator (PCU). The bellcranks and pushrods form a series of four bar linkages. The artificial feel system shows a common approach – spring-loaded cam - for producing force feedback to the pilot. Since cables are not used in this example, the system will have good stiffness. Of course, system freeplay will need to very small. A summing link is used at the connection to the PCU.

Figure 1 Irreversible Flight Control System

Irreversible flight control systems are used on larger aircraft where the hinge moment (surface) loads are large and a person cannot supply enough force. Keep in mind that the input travel in the cockpit is limited by the amount of cockpit control travel and this becomes a limit on the maximum hinge moment available without additional power input.

Pilots require feedback forces when they fly (to emulate reversible system stick force per g characteristics and other natural aerodynamic force feedback). Therefore, artificial feel systems are installed in all irreversible flight control systems. Artificial feel systems are done through springs, pneumatic actuators or, in a few cases, hydraulic actuators. Springs loaded in compression are the most reliable and hence the most common. Artificial feel systems are always redundant (sometimes triple redundant) so that artificial feel is not lost after any single failure in an artificial feel system. A spring-loaded cam artificial feel system is shown in Figure 1.

Irreversible systems require hydraulic or electromechanical actuators. However, electromechanical actuators are only used in fly by wire systems (i.e., they are not mechanically controlled through linkages as can hydraulic actuators). The choice and number of actuators in turn drive the design of the hydraulic or electric power systems. The end result is a combination of increased size, cost and complexity of these systems. Hence, irreversible systems are generally more costly and complex than reversible systems. Assessment of system hazards and failure modes are therefore more involved for irreversible systems.

Hydraulic PCUs in powered flight control systems will typically have different operating modes. Some examples of different modes and features in PCUs can be found in Power Control Unit, Hydraulic - Description. Generally, these modes will address issues such as loss of a hydraulic power source, loss of a partner PCU (where 2 or more PCUs are connected to a single surface), loss of electrical control signal, jammed spool or other detected fault within a PCU. Typical modes are normal operation, bypass (where actuator follows surface with minimal resistance and no flutter damping protection), damped bypass (follows surface movement but with a hydraulic damping orifice for flutter protection), and locked or centering (actuator piston is held in failed or neutral position).

The most critical failure conditions within a flight control system are a surface runaway, jam, disconnection of a mechanical linkage, or loss of electrical/hydraulic power. To allow operation after these failures (perhaps degraded operation), various features are often included to allow some type of system operation after these failures. These include pogos (load limiters), shearouts, jam overrides, multiple hydraulic actuators with independent hydraulic sources and disconnect clutches.

In irreversible flight control systems, jam protection is provided by pogos, jam breakout mechanisms, shearouts, and disconnect clutches when dual flight control runs are used.

Pogos (or load limiters or bungees) are a very stiff spring installed in the system. Under normal operating loads, the pogo acts like a stiff pushrod in the system. However, if there is a jam downstream of the pogo, then with an increase in applied force to the mechanism the pogo will compress and allow other portions of the system to move. For example, if the cockpit control column provide control to dual elevator mechanisms and a jam occurs in one side of the dual elevator mechanism, then the pogo will compress in the side with the jam and the other side can continue to operate (albeit with higher forces applied at the control column). More details on pogos can be found in Mechanism – Pogo.

Jam breakout devices function similar to a pogo. A jam breakout device is shown in Figure 2. In Figure 2, the cam and link 1 are splined together and from a rigid part. The rigid cam/link1 part can rotate relative to the grey plate but is held in place by the spring force applied to the cam roller (through lever 1 and lever 2) that pushes the roller against the cam surface. In normal operation, the spring force will be sufficient to maintain the roller in the position shown with normal operating forces applied to the input pushrod. Under normal operation, the entire mechanism shown in Figure 2 - link1, cam, plate, lever 1, lever 2 and the spring cartridge - form a bellcrank and rotate together about point 0. If a jam occurs in either of the output links, the plate will be held fixed. When the plate is fixed, the mechanism upstream of the jam breakout device can move by applying enough force to push the roller out of the detent and compressing the spring. Another means to override a jam is to have a non-jammable spool in the PCU. This is usually done with a spool within a spool design, where the inner spool will move an outer spool if the inner spool becomes jammed within the outer spool. Higher forces will be required to move the outer spool in its sleeve. A spool in a spool configuration is a type of jam breakout mechanism.

Figure 2 Jam Breakout Device

As the name suggests, a shearout is a structural element, such as a pin or fastener, which is designed to fail (usually in shear) at a given load. Shearouts are normally used to protect against an overload in a system or part, but may be used to breakaway when a load occurs. Thus a shearout is used as means to limit the maximum load that may be seen in a system and allows a lower limit load design criteria to be used when structural sizing of parts.

Means to protect against disconnection failures include using a dual (redundant) mechanism, using multiple actuators on a surface or using lost motion devices. Using multiple actuators on a surface with dual control runs provides disconnection protection. For example, if one of the dual runs has a disconnection the other control run would be operational and would provide control to one of the actuators. Another feature that may be used for disconnection failures is a lost motion device. In a lost motion device, relative motion is allowed between 2 parts. Under normal operation, the two parts will not interact, but if a disconnect failure occurs then after an initial input motion to take up the slack, the two parts will engage and the system output will be driven (see Mechanisms – Lost Motion).

A disconnect clutch is mechanical clutch that connects two independent flight control runs. If a jam occurs in one of the flight control runs, then the disconnect clutch is pulled (opened) through either a handle or switch in the flight compartment which allows the non-jammed side to operate.

Figure 3 shows a generic, single axis flight control system with built-in redundancy features to address several critical failure conditions. The system shown in Figure 3 has a disconnect clutch at the control column and a pogo connecting the aft quadrants, which protects against a jam in either the pilot or copilots control runs. In addition, there are pogos in the linkage to each hydraulic actuator. These pogos would still allow control with a jammed servo in a hydraulic power control unit. Protection against the loss of a single hydraulic source is provided through separate hydraulic sources for each hydraulic actuator. Protection against a disconnection anywhere in the system is accomplished through dual systems – dual quadrants, dual cables runs and dual actuators.

Figure 3 Generic Flight Control System with Redundancy Features

Design considerations for reversible flight control systems can be found in Flight Control System – Design Considerations. A discussion of design requirements can be found in Flight Control Systems – Design Requirements.