AGARD-AG-300 Vol. 12

04

ADVISORY GROUP FOR AEROSPACE RESEARCH & DEVELOPMENT

7 RUE ANCELLE, 92200 NEUILLY-SUR-SEINE, FRANCE

AUG 0195

AGARDograph 300

AGARD Flight Test Techniques SeriesVolume 12onThe Principles of Flight Test Assessment ofFlight-Safety-Critical Systems inHelicopters(Les Principes de l'6valuation, dans lecadre des essais en vol,des systemes indispensables 'a las6curite de vol des helicopteres)

This AGARDograph has been sponsored by the Flight Mechanics Panel of AGARD.

-NORTH ATLANTIC TREATY ORGANIZATION

IApproved iol publiJc !eiecaz%

Published August 1994

Distribution and Availability on Back Cover

AGARD-AG-300 Vol. 12

ADVISORY GROUP FOR AEROSPACE RESEARCH & DEVELOPMENT

7 RUE ANCELLE, 92200 NEUILLY-SUR-SEINE, FRANCE

AGARDograph 300Flight Test Techniques Series - Volume 12

The Principles of Flight Test Assessment ofFlight-Safety-Critical Systems in Helicopters(Les Principes de l'6valuation, dans lecadre des essais en vol,des syst~mes indispensables A las6curit6 de vol des h61icopt~res)

by

J. D. L. Gregoryformerly ofAeroplane and Armament Evaluation EstablishmentBoscombe Down, Salisbury, WiltsSP4 OJF England

This AGARDograph has been sponsored by the Flight Mechanics Panel of AGARD.

Accesion ForNTIS CRA&IDTIC TAB

Unannounced -lJustification .................................+ • North Atlantic Treaty Organization

-- -- Organisation du trait6 de IAtlantique Nord ByDistribution I

Availabiiity Co-":e

Dist Specia, I

A-1_

The Mission of AGARD

According to its Charter, the mission of AGARD is to bring together the leading personalities of the NATO nations in thefields of science and technology relating to aerospace for the following purposes:

- Recommending effective ways for the member nations to use their research and development capabilities for thecommon benefit of the NATO community;

- Providing scientific and technical advice and assistance to the Military Committee in the field of aerospace research

and development (with particular regard to its military application);

- Continuously stimulating advances in the aerospace sciences relevant to strengthening the common defence posture;

- Improving the co-operation among member nations in aerospace research and development;

- Exchange of scientific and technical information;

- Providing assistance to member nations for the purpose of increasing their scientific and technical potential;

- Rendering scientific and technical assistance, as requested, to other NATO bodies and to member nations inconnection with research and development problems in the aerospace field.

The highest authority within AGARD is the National Delegates Board consisting of officially appointed seniorrepresentatives from each member nation. The mission of AGARD is carried out through the Panels which are composed ofexperts appointed by the National Delegates, the Consultant and Exchange Programme and the Aerospace ApplicationsStudies Programme. The results of AGARD work are reported to the member nations and the NATO Authorities through theAGARD series of publications of which this is one.

Participation in AGARD activities is by invitation only and is normally limited to citizens of the NATO nations.

The content of this publication has been reproduceddirectly from material supplied by AGARD or the authors.

Published August 1994

Copyright © AGARD 1994All Rights Reserved

ISBN 92-836-1001-6

Printed by Canada Communication Group45 Sacrd-Caur Blvd., Hull (Quibec), Canada KJA 0S7

ii

Preface

Since its founding in 1952, the Advisory Group for Aerospace Research and Development has published, formerly throughthe Flight Mechanics Panel and latterly through the Flight Vehicle Integration Panel, a number of standard texts in the field offlight testing. The original Flight Test Manual was published in the years 1954 to 1956, and was divided into four volumes:

1 Performance2 Stability and Control3 Instrumentation Catalog, and4 Instrumentation Systems.

To cover developments in the field of flight test instrumentation, the Flight Test Instrumentation Group of the FlightMechanics Panel was established in 1968 and updated Volumes 3 and 4 of the Flight Test Manual via publications in theFlight Test Instrumentation Series, AGARDograph 160.

In 1978, the Flight Mechanics Panel decided that further specialist monographs should be published covering aspects ofVolumes 1 and 2 of the original Flight Test Manual, including the flight testing of aircraft systems. In March 1981, the FlightTest Techniques Group was established to carry out this task, the monographs of this series (with the exception of AG 237which was separately numbered) being published as individually numbered volumes of AGARDograph 300.

In 1993, the Flight Test Techniques Group, which had by then assumed responsibility for AGARDographs in both the 160and 300 Series, was changed from a Working Group (WG-1 1) to a committee of the Flight Mechanics Panel (the Flight TestEditorial Committee). In 1994, the Flight Mechanics Panel itself was disbanded, most of its functions (includingresponsibility for the Flight Test Editorial Committee) being assumed by the new Right Vehicle Integration Panel.

At the end of each volume in the AGARDograph 160 and 300 Series an Annex gives a list of volumes published in the FlightTest Instrumentation Series and in the Flight Test Techniques Series.

The present Volume (Vol. 12 of AGARDograph 300) is entitled "The Principles of Flight Test Assessment of Flight-Safety-Critical Systems in Helicopters".

Modem helicopters usually incorporate many engineering systems (including pilot-aiding systems such as autostabilisers andflight directors) which are essential to the safe and effective use of the helicopter. Where the helicopter can be endangered byfailure of a system (or of one of its units), that system is termed flight-safety-critical. In general, the use of those systemsshould not incur a higher probability of hazard to the helicopter than that considered acceptable from considerations ofstructural or mechanical failure.

In assessing the suitability of a helicopter for its intended mission(s), it has become increasingly important to consider theeffects of the various systems provided. In particular, assessments of the implications of systems performance and failuresderived from calculation and ground tests should be validated by flight tests. This paper seeks to establish the generalprinciples applicable to the testing in flight of any flight-safety-critical system, with emphasis on certification rather thansystem development. It does not deal with the testing of particular systems, but it is hoped that readers will find the principlesdescribed readily applicable to specific cases.

iii

Prefface

Depuis sa cr6ation en 1952, le Groupe consultatif pour la recherche et les realisations aerospatiales (AGARD), a public,autrefois par l'interm~liaire du Panel de la m6canique du vol, et ricemnient par celui du Panel conception int6gr6e desvWhicules spatiaux, un certain nombre de textes normatifs dans le domaine des essais en vol. Le premier manuel d'Essai envol a Wt publi6 entre les ann~es 1954 et 1956. Ce manuel est compos6 de quatre volumes, h savoir:

1 Performances2 Stabilit6 d'instrumentation3 Catalogue d'instrumentation4 Syst~mes d'instrumentation

Afin de couvrir les d6veloppements dans le domaine de l'instrumentation des essais en vol, le Groupe de travail surl'instrumentation des essais en vol du Panel de la m~canique du vol a W cr66 en 1968 et les volumes 3 et 4 du Manuel desessais en vol, sous la forme de la s6rie AGARDographie 160 sur l'Instrumentation des essais en vol ont Wt mis A jour.

En 1978, le Panel de la m6canique du vol a d6cid6 d'6diter d'autres monographies sp6cialisies, couvrant les volumes 1 et 2du Manuel des essais en vol initial, y compris les essais en vol des syst~mes de bord. Au mois de mars 1981, le Groupe detravail sur les techniques des essais en vol a Wt constitu6 pour mener A bien cette tdche. Les monographies dans cette s6rie, Al'exception de l'AG 237 qui porte un num6ro distinct, sont num6rot~es individuellement dans la s6rie AG 300.

En 1993, le Groupe de travail sur les techniques des essais en vol, qui dans l'intervalle, avait accept6 la responsabilit6 desAGARDographies dans la s6rie 160 et dans la s~rie 300, a chang6 d'appellation; le Groupe de travail WG-l 1 est devenu uncomit6 du Panel de la m~canique du vol (le Comit6 de ridaction des essais en vol). En 1994, le Panel de la m~canique du vollui-meme a Wt dissout et la plupart de ses fonctions (y compris la responsabilit6 du Comit6 de r6daction des essais en vol) ontWt reprises par le nouveau Panel conception int6gr6e des v~hicules a6rospatiaux.

A la fin de chacun des volumes dans les snines 160 et 300, une annexe donne la liste des volumes publics dans la snineInstrumentation des essais en vol et dans la s~rie Techniques des essais en vol.

Le prisent volume (Vol. 12 de l'AGARDographie 300) est intitul6 <<Les Principes de 1'6valuation, dans le cadre des essais envol, des syst~mes indispensables A la s6curit6 de vol des h~licopt~res>>.

Normalement, les h~licopt~res modemnes int~grent un certain nombre de syst~mes technog~niques (y compris des syst~mesd'aide au pilote tels que les centrales de stabilisation et les directeurs de vol) qui sont indispensables A l'emploi efficace de ceta~ronef dans les conditions de s6curit6 requises. Toutes les fois que l'h~icopt~re risque d'8tre mis en danger suite A une panned'un syst~me (ou de F'un de ses 6l6ments) le syst~me est d~sign6 «indispensable it la sicurit6 de volx». En g~n~ral, l'emploide ces syst~mes ne devrait entrainer une probabilit6 de dommages plus grande que celle consid&r6e comme 6tant acceptabledans le cas de d~faillances m6caniques ou structurales.

Lorsqu'il s'agit d'6valuer l'aptitude d'un h~licopt~re donn6 vis-?i-vis de sa future mission on missions, il devient de plus enplus important de consid6rer l'impact des diff~rents syst~mes privus. En particulier, les 6valnations des conniquences despannes et des performances des syst~mes, 6tablies sur la base de calculs et d'essais au sol, doivent 6tre valid~es par des essaisen vol. Cette communication a pour objet d'6tablir les principes g~n~raux applicables lors des essais en vol de toutsyst~me indispensable Ai la s~curit6 de vol, en mettant l'accent sur l'homologation de prif~rence an d6veloppement dessyst~mes. Elle ne traite pas d'essais de syst~mes sp6cifiqnes, mais il est A souhaiter que le lecteur pourra appliquer lesprincipes y d6crits A des cas sp6cifiques sans trop de difficult6s.

iv

Acknowledgementto

Flight Test Editorial Committee Members

In the preparation of the present volume the members of the Flight Test Editorial Committee listed below took an active part.AGARD has been most fortunate in finding these competent people willing to contribute their knowledge and time in thepreparation of this and other volumes.

La liste des membres du Comit6 de r6daction des essais en vol qui ont particip6 A la r6daction de ce volume figure ci-dessous.L'AGARD peut 8tre fier que ces personnes comp6tentes aient bien voulu accepter de partager leurs connaissances et aientconsacr6 le temps n6cessaire A l'61aboration de ce volume et autres documents.

Appleford, J.K. A&AEEIUKBever, G. NASA/USBothe, H. DLR/GECampos, L.M.B. IST/PODelle Chiaie, S. DASRSIITRussell, R.A. NAWC/USvan der Velde, R.L. NLR/NEZundel, Y. CEV/FR

R.R. HILDEBRAND, AFFTCMember, Flight Vehicle Integration PanelChairman, Flight Test Editorial Committee

Contents

Page

Preface iii

Preface iv

Acknowledgement v

1. Introduction of Basic Principles 11.1 Basic airworthiness principles 11.2 Application to systems 11.3 System performance testing 11.4 System failure testing 11.5 Principles of failure testing 2

2. The Principles in Operation 32.1 Analysis of failures by causes 32.2 Frequency of occurrence of failures and of failure states 42.3 Classification of failures by their effects 42.4 Criteria of acceptability 52.5 Factors affecting required and available intervention times 52.6 Acceptable risk levels 62.7 Current requirements relating to system failures 7

3. Procedure for Flight Testing 73.1 Specification of the system 73.2 System performance tests 73.3 System failure tests 73.4 Post-failure performance tests 8

4. Product of the Flight Test Programme 84.1 Flight envelopes 84.2 Piloting procedures 94.3 Recommendations for system improvements 94.4 Comparison of specified and achieved system performance 9

References 10

Figures 11

Annex 1 - Specifications and Requirements Al

Annex 2 - AGARD Flight Test Instrumentation and Flight Test Techniques Series A2

vi

1. INTRODUCTION OF BASIC system when operating correctly, but also thePRINCIPLES ability to survive failures of the system. Such

systems are referred to in this document as1.1 Basic Airworthiness Principles being 'flight- safety-critical'. Testing isIt is taken as axiomatic that helicopters must necessary to establish:operate safely and effectively. Helicopters are * the envelope of conditions within whichmechanical devices and, in mechanical terms, the system behaves correctly (ie systemthe quest for greater effectiveness (e.g. performance tests), andenhanced capability in respect of mass, speed, * what happens when failures occur withinmanoeuvrability and acceleration) is the systems (ie system failure tests).constrained by safety considerations (e.g. ofmechanical and structural integrity). Much 1.3 System Performance Testingdevelopment effort goes into extending the The system performance tests actually carriedflight envelope, without infringing mechanical out will depend, of course, upon the nature ofand structural stress limits, in order to provide the system. For example, a flight pathboth the structural and mechanical controller requires different tests from a rotor"performance" demanded by the helicopter's speed governor. However, fundamental to allrole(s) and an acceptable level of "safety". such testing is the principle of establishing the

envelope within which the system behavesHowever, failures can occur and it has been adequately. It may be desirable for a systemnecessary to recognise this fact in the way to operate over the entire helicopter flighthelicopters are operated and maintained. If the envelope but, if the system performance isstructural or mechanical integrity is impaired inadequate, it may be necessary to curtail theby a failure the result may be: flight envelope to match the system capability.

* immediately critical (eg if a rotor blade Equally, a system may be required to operatefails), only over part of the helicopter total envelope

• critical in the longer term (eg if cracking (an automatic approach system, for example)occurs in the fuselage) or, perhaps, but, again, it is necessary to define precisely

• not critical at all (eg if some the range of conditions within which thenon-structural fairing starts to crack, but does system will do its job properly. In assessingnot detach) the adequacy of a dynamic system there are

two fundamental properties that need to beFailures that are immediately critical and established. These are the authority and thewould entail loss of the helicopter must not be response of the system, which are analogous,allowed to happen in Service use. The relevant in flying qualities terms, to the range ofcomponents (e.g. rotor heads, blades, and control available and the responsiveness of thegearboxes) are therefore subjected to extensive aircraft to the controls.testing to determine their Safe Lives so that, inService, they can be changed before they fail. 1.4 System Failure TestingOther components whose failure is not Although an analogy can be drawn with theimmediately critical are monitored and testing of the structural and mechanicalrectified as required, the urgency of the repair elements of the helicopter (as illustrated in thedepending upon the criticality of the failure. right hand side of Figure 1), a special categoryThis classification of failure effects, and their arises in the failure testing of systems in whichtreatment, is illustrated in the left hand side of failure can give rise to a disturbance to theFigure 1. flight path. This is because corrective action

must be provided by the pilot rather than by1.2 Application to Systems the designer or by the maintenance crews onA similar reasoning can be applied to many of the ground. The following systems are typicalthe pilot-aiding (and some other) systems that of those in which piloting action is required toare increasingly used in most helicopters, counter the effects of failure:where the flight safety of the helicopter * Flying controls.requires not only the proper performance of the

2

* Engine and fuel control systems and Clearly, the tests conducted (and the criteria of

rotorspeed governors, acceptability applied to the results) must reflect* Automatic stabilizers, the specifications to which the helicopter has* Flight path control systems. been designed and built. However, it should* Cockpit displays, especially attitude be noted that, because of the complexities of

displays, flight directors and weapon aiming the man/machine interface, it is impossible todisplays intended to provide orientation or write a specification in respect of somemanoeuvre guidance. aspects, such as flying qualities, that will

* Systems having aerodynamic effects, guarantee a satisfactory machine. For thissuch as external flotation bags, de-icing reason, specifications dealing with such matterssystems, hoists, armament, or sling systems. are often better regarded as being advisory

rather than mandatory, and it is not unusual forClearly, a helicopter suffering a failure of such a feature which does not quite meet thea system should be able to survive both the applicable specification requirement to bemoment of failure and a subsequent period judged acceptable (and vice versa).sufficient to allow the flight to be completedor safely terminated. 1.5.2 Identification and Classification of

Failures.1.5 Principles of Failure Testing A preliminary theoretical study of eachThe test methods developed piecemeal to deal potentially flight-safety-critical system shouldwith specific, relatively simple, systems have be made to identify all possible failures, theirproved acceptable in the past. However, the consequences for the helicopter, and theirincreasing number and complexity of probabilities of occurrence. In conducting thissafety-critical systems require a more rigorous study it should be noted that:and systematic approach. In all such testing * Any system failure that affects the flightthere are fundamental principles that need to path is potentially flight-safety-critical.be recognised, and the primary objective of * A helicopter having suffered an initialthis paper is to define these principles, and failure is then in a 'degraded' condition whichdevelop a set of rules that can be applied to may present a new situation for the survival ofthe failure testing of any safety-critical further failures.helicopter system which relies on pilot * Failures whose probability of occurrenceintervention in the event of malfunction. can be shown to be sufficiently low can be

disregarded.The flight test programme must be sufficientlyrigorous to ensure that the helicopter's failure 1.5.3 Criteria of Acceptability.characteristics are identified and investigated In conducting the preliminary theoretical study,thoroughly, so that its safety and operational and when planning the flight tests, it iseffectiveness in Service use can be maximised. necessary to adopt some general criteria ofAt the same time, that programme must be acceptability, such as:conducted without unreasonable hazard to the * Definition of the failure rate that ishelicopter. The following paragraphs introduce accepted as being so low that such failures can(and offer some initial guidance on) the be excluded from consideration.principal aspects that must be considered. * Definition of the failure rates that are

acceptable for various classes of failure, e.g.1.5.1 Specifications. those whose consequences are, for instance,The design of a helicopter is governed by a innocuous, mission affecting, safety reducing,series of general and particular specifications, or dangerous. (This is a difficult topic: it issuch as: dealt with in Reference 2 but, inevitably, falls

* Specifications for individual systems. back on the procuring agency when the most* Specification for the helicopter, critical types of failure are being considered.)* General specification of required flying * The helicopter must remain controllable

qualities, such as those contained in after surviving a failure so that the flight mayReferences 1, 2 and 3. be continued or terminated in safety.

3

* A system failure may be regarded as a component in the electrical circuit. Hence in

survivable if it is considered that a typical analysing the failures that can occur within aexperienced pilot, unwarned and performing system it is not unreasonable to ask oneself thehis normal tasks, could intervene successfully question "what is the worst that this systemto counter the failure. can do to the helicopter?". The response

* If it is accepted that the pilot cannot might be, for an autostabiliser system, that thealways intervene successfully, then the maximum effect that the system can produce isprobability of his being unable to do so must a full-stroke maximum-rate runaway of any ofbe compatible with the acceptable loss rate. its actuators. The system might then be

judged satisfactory from the failure point of1.5.4 Preliminary Ground Tests. view if it were to be shown by flight test that,Where available, rigs and/or simulators should following an actuator runaway, the ensuingbe used to refine the theoretical studies of manoeuvre could be survived. This has been apotential failure cases and their recovery, and traditional way of treating autostabiliser andthus enhance the confidence with which "worst autopilot systems, and is still the basis ofcases" are identified for flight test. much engine failure testing.(Conversely, if the results of the flight testsshow that the fidelity of the rig/simulator is However, this method becomes less thanadequate, consideration should be given to satisfactory as systems become more and moreusing it for interactive investigation of failures complex and failures can produce aberrantwhich it would be impracticable to conduct in behaviour in more than one channel, or over aflight: an example might be simultaneous period of time. It is then necessary tofailure of two channels, whose probability of examine, by detailed theoretical analysis, theoccurrence is estimated to be too high to consequences of failure of each component indiscount.) order to identify those whose failure can

adversely affect the system. This procedure is,1.5.5 Scope of Flight Tests. of course, well known, and is commonlyWhile the scope of the flight tests will depend referred to as "failure mode and effecton the details of the particular system under analysis" or FIVEIA. In current rotorcraftinvestigation, the following must always be flying qualities specifications, such asborne in mind: ADS33C (Reference 2), manufacturers are

* The test programme must include the required to list all failures and their immediatecritical failures, although they should be and subsequent effects on flying qualities.examined initially in benign conditions. Such a FMEA needs to be comprehensive and

* The programme should establish the correct. It also needs to be usable. If allmost adverse conditions in which a critical initial failures are considered and subsequentfailure remains survivable, failures are not excluded the list is long and

* The flight tests of failures should aim at unwieldy. It is necessary for failures to bebeing representative of real operations, and categorised, so that the FMEA describes aavoid being a 'circus trick' performable only by manageable number of 'failure states' (asa highly skilled test pilot currently practised in required by ADS33C) rather than just a hugefailure testing. number of individual failures.

2. THE PRINCIPLES IN OPERATION Initially the FMEA is theoretical and the statedeffects on flying qualities are predictions.

2.1 Analysis of Failures by Causes. Normally, therefore, the FMEA is validated orFor flight test purposes, it is necessary to modified during development by rig tests ofassess failures in terms of their effect on the the system which simulate component failureshelicopter, although those effects are caused by and show what actually occurs. The rig testssome malfunction within a system. For also allow attention to be focussed closely onexample, a nose down divergence could be those areas that the FMEA suggests arecaused by a control system actuator being critical. Thus the analysis and rig testsdriven to full travel as a result of the failure of provide valuable guidance before flight

4

examination of critical aspects. Flight test Moderate or Severe, whose implications areremains essential since it is not unusual - a discussed below.realist might even say usual - for flight resultsto differ from rig results because of the 2.3.1 Failures producing Mild disturbance.difficulties of making a completely If a failure occurs that produces only a gradualrepresentative simulation. change in the flight path, this does not

immediately hazard the helicopter, but the pilot2.2 Frequency of Occurrence of Failures and should be warned that such a failure hasof Failure States. occurred. The warning could be of anyManufacturers are required by ADS33C to suitable type (eg visual or aural) provided thatcalculate the probability of failure states being the pilot gets the message in adequate time toencountered. There are two elements to this. avoid difficulties, such as running out ofThe first is the determination of frequency of height.occurrence of failures. The second is analysisof how often failures will lead to particular 2.3.2 Failures producing Moderateconsequences, since these will depend on disturbance.external factors such as speed, altitude, visual Here the motion of the helicopter provides acues, cg position etc. For its calculation it is cue for the pilot and it may well benecessary to know all the relevant variables supplemented by other cues such as instrumentand their frequency of occurrence. The indications, engine or rotor noise, or even anumber of possibilities can be very large and, specific warning. Such failures are no greatas with the FMEA, classification of effects is problem if the cues are good, the flightessential if the predicted frequency spectra are conditions are not too bad, and the change ofto be usable. flight path is not immediately critical, so that

the pilot can avoid difficult conditions.Again, theoretical estimates need to be updatedin the light of actual experience, since actual 2.3.3 Failures producing Severe disturbance.failure rates may differ from those predicted, Some failures can produce so rapid aand are liable to change with time as systems divergence that the helicopter can be at risk inbecome mature or as modifications are a few seconds, or even less. Here the pilotintroduced. must intervene very rapidly to contain the

situation, and such intervention preferably2.3 Classification of Failures by their Effects. should not entail the operation of cut-outs orThe two preceding paragraphs discuss failures switches that require separate actions. In someas they are seen by the design engineer, who circumstances the cues are not conspicuoussees a system 'from the inside'. The pilot, and the problem for the pilot can lie inhowever, is primarily concerned with what the recognising that a failure has occurred before asystem produces. This is true not only when critical situation has developed, even ifthe system is functioning correctly, but also - dynamic cues are supplemented by a warningor even especially - when it goes wrong. It (this can arise, for example, when the normalwould be very satisfactory if whenever a operation of an automatic mode involvesfailure occurred it produced a mild but clearly coarse changes of aircraft attitude such that therecognisable disturbance to the flight path so initial disturbance resulting from an autopilotthat the pilot was both aware of the failure and "runaway" is not obvious). In both theseeasily able to counter its effects. Although instances the pilot intervenes to restore themany failures are like this, the effects of some helicopter initially to a safe attitude and thenare so mild that they are quite likely not to be to a safe flight path. Sometimes, it isnoticed by the pilot. Other failures can occur necessary to control the flight path to avoid anwhose effects are severe enough to require obstacle, such as the ground if the helicopter isimmediate reaction from the pilot to maintain flying very low. Here the closeness of thecontrol of the helicopter. It is convenient to ground can curtail the time available forclassify the effects of failures as being Mild, successful intervention.

5

2.3.4 Failures producing Delayed although others are possible and might in somedisturbances. circumstances be appropriate. Clearly for aThese can arise if a failure occurs within a failure to be judged to be satisfactory thesystem that does not produce an immediate required intervention time must be less thaneffect, but does so later on if, say, a second the intervention time available. Figure 3, afailure occurs, or the system mode is changed. very simple example, shows how the 'required'(It should be noted that while such dormant and 'available' intervention times can be usedfailures must be considered during design and to define a limiting condition, in this case thetesting, from a pilot's viewpoint they do not maximum speed at which recovery is possible.exist because, until the second event occurs,there is no change to the aircraft attitude or 2.5 Factors affecting Required and Availableflight path). Such dormant failures, if they Intervention Times.subsequently produce a disturbance, can be 'Required' and 'available' intervention times areclassified as above by the severity of the affected principally by the flight conditions,disturbance, ie mild, moderate or major. A the aircraft/system characteristics and the levelfailed warning system is a dormant failure if of attention that the pilot is able to devote tothe pilot is unaware of it. This classification the flying task, as indicated below:of failures is summarised in Figure 2.

2.5.1 Flight Conditions2.4 Criteria of Acceptability. * VFR v IFR - In principle, if the visualFor the effects of a particular system failure to displays are adequate, then a failure inbe tolerable, it must be possible for the pilot to instrument flight is similar to one in visualrecognise the failure in any phase or condition flight. However, cockpit displays are seldomof flight in which it can occur, and to restore as reassuring as a view of the outside world,the helicopter to safe flight. The recovery and the process of recognition, diagnosis andaction should not require exceptional piloting recovery is often more difficult and lengthy inskill and, throughout the disturbance and instrument flight.recovery, the helicopter should remain within * Level v Manoeuvring Flight - Aits "never exceed" limitations and clear of the failure-caused perturbation in the flight path isground. more readily recognised in level flight than in

an automatic manoeuvre that itself is aIt is obviously essential that, following a succession of perturbations. Further, insystem failure, sufficient time is available for manoeuvres the margin between safe andthe pilot to recognise the effects of that failure unsafe flight attitudes can be reduced, whichand to initiate successful recovery action. The correspondingly reduces the time available forinterval between the failure and the pilot's intervention. These aspects are summarised inrecovery action is commonly called the Figure 4.'intervention time'. For any failure that can * Airspeed - The intervention timelead to a loss of control there is an interval available is often greatly reduced at the higherafter which successful recovery action is airspeeds (but other factors such as altitude,impossible; this interval is the 'available' weight and configuration can also haveintervention time. Equally there is an interval significant effects).that the pilot needs to recognise and initiate * Height - Proximity to the ground, or torecovery action; this is the 'required' other hazards, self-evidently reduces theintervention time. intervention time available.

In flight testing, where precise measurement is 2.5.2 Aircraft and System Characteristicsnecessary, it is usual to define the intervention * Poor Stabilisation - If the flight path istime as the interval between the start of the not smooth because the stabilization systemfailure (usually the initial movement of an does not work well, then this delays theactuator) and the start of the pilot's action (the recognition of failure-caused perturbations.first movement of the control). This definition However, if the system is so poor that ithas been successfully used for many years, requires the pilot occasionally to intervene,

6

then his close monitoring of the system will be through a flight director) it becomes verybeneficial. difficult to decide how often a failure is likely

* Cue Quality - Clear cues shorten the to lead to disaster. Whether it does or not

intervention time required, particularly if they depends on the nature of the failure, the flightgive an "instinctive" indication of the recovery conditions at the time, and the requiredaction to be taken. intervention time. This latter depends heavily

on the pilot's ability to cross-check between2.5.3 Piloting Actions what is happening and what ought to be

* Pilot Attention Level - A pilot who is happening and hence to recogniseattentively monitoring system behaviour will abnormalities.react more quickly than one who is bored byinaction or preoccupied with other tasks. Such complex situations can be dealt with by

* "Hands On" v "Hands Off " - Flying calculation. The principle is illustrated in"hands on" shortens intervention times, but Figure 5. The FMEA provides data on thethere are often occasions when hands are distribution of possible defects and failures.needed elsewhere than on the flying controls. The operational flight spectrum provides the

distribution of all possible flight conditions.2.6 Acceptable Risk Levels. The helicopter response to any failure isAchieved intervention times can be very small provided by theoretical computation supported- even effectively zero if the pilot is by flight test data. The consequent reaction ofmanoeuvring the helicopter when the failure the pilot can be described by a single (or, moreoccurs - or many seconds if the effect of the probably, by a distribution of) requiredfailure is obscured by a poor cue environment, intervention time(s) based on theoreticalADS33C for example specifies times between analysis and confirmed by flight test data.3 and 10 sec. Since the severity of a failure Thus from any set of initial conditions thedepends upon the factors described in para 2,5 recovery manoeuvre can be calculated.above, it is usually possible and necessary to Whether or not this is successful can bedefine a flight envelope or set of conditions determined by the application of a suitablewithin which the helicopter is safe in the event crash criterion (e.g. the helicopter hits theof failure. Outside this envelope there is a risk ground, or a critical load is exceeded).of disaster that increases with distance from Repeated calculations from different randomlythe 'safe' area. selected initial conditions will enable an

overall figure to be determined for the totalFor example, a helicopter might be safe in the number of survivable failures occurring forevent of a particular failure at speeds up to each one that causes a crash. Separately, the120 knots but be subject to increasing risk at system reliability data can provide thehigher speeds. Careful examination of this risk probability of failures occurring. These twoup to, say, 140 knots may show that it is very figures are the terms of the "crash equation"low when expressed as 'accidents per flying that enables the crash rate to be calculated,hour' - a figure of 1 x 10' perhaps. Whilst it namely:-is difficult to accept that accidents should beregarded as "normal", nonetheless the principle hours /failure x failures /crashhas found favour where the gain in operational hours /crashcapability is significant. In time of war, it isoften desirable for tactical reasons to use the To apply this method to a specific helicoptermaximum possible speed or the lowest and mission, many supplementary questionspossible altitude because of the reduced need to be answered, but the method has beenexposure to enemy fire, and overall helicopter used successfully. In particular, it allows thelosses may even be reduced despite a small trade-off to be made between operationalincrease in technical risk. capability and risk level from system failure,

and may show that accepting a slight increaseWith complex systems performing automatic in risk from system failure can produce suchmanoeuvres (or determining manoeuvres

7

an improvement in capability that overall risk 3.2 System Performance Tests.of loss in combat is reduced. These tests will exercise the system over the

relevant flight and environmental envelopes to2.7 Current Requirements relating to System see how it behaves. Its behaviour will beFailures. regarded as satisfactory if it enables theCurrent requirements are numerous, lengthy required performance to be achieved within theand detailed. Some subjects, such as flying constraints imposed by other applicablequalities or automatic flight control systems requirements, especially those in respect ofare extensively covered; others such as cockpit flying qualities. A primary objective of thisdisplays are less favoured. The continuing work is to see if there are any circumstances inemergence of new technologies makes it very which the system performance isdifficult to keep specifications up to date, and unsatisfactory. If the behaviour is bad enoughthis leads to their being inadequate in some it might be necessary to preclude operation inrespects such that it is possible for a helicopter that condition. It is essential that "worstto meet existing requirements but still be liable cases" be examined. If an aft cg position isto system behaviour or system failures that adverse, some flying must be done at aft cg.make it insufficiently safe. When this occurs If a volatile fuel is adverse, then try thethe certification or clearance authority needs to volatile fuel. One, or rather a few, words ofseek improvement to the system, introduce warning, however. It is possible to stack upspecial operating procedures, or restrict the adverse conditions so thoroughly, butoperation of the helicopter so that potentially unreasonably, that one shows that thedangerous situations are avoided. The Annex helicopter should not fly at all. Worst casesdiscusses principal current requirements. must be examined, but sensible judgements

must be made about them based on the overall3. PROCEDURE FOR FLIGHT TESTING probability of the worst case arising.

(NOTE: As stated in the Preface, this paper 3.3 System Failure Tests.seeks to deal with the flight testing of any Failures must be tested in flight and thisflight-safety-critical system. While the requires a method for 'injecting' failures intoprinciples will remain the same for all systems, the system. Providing this facility is oftenthe details of the tests will depend upon the quite difficult, and it merits consideration at aparticular system.) very early stage in the planning of a

programme. If the helicopter is to be seen to3.1 Specification of the System. be safe, then the tests must include the mostFor the system to be tested properly it is critical cases. However certain obviousessential that there be a clear understanding of precautions are necessary. It is sensible towhat it is supposed to do. This is usually start with easy cases and proceed progressivelywritten in the specification for the system. to critical ones. (Selection of the failures to beThis might be supplemented by a statement of tried in flight will be aided if an FMEA isrequirement, which tends to define an available and if rig tests or simulations haveoperational need rather than an engineer's been done. This is particularly desirable in thesolution. In particular, the required system case of complex systems, and can greatlyperformance must be stated, and the flight shorten the flight programme.) The objectiveenvelope within which this performance is to of the tests is to establish that failures can bebe obtained. If the formal specification is survived when the pilot intervenes after ainsufficiently explicit it may be necessary, for realistic intervention time, that is, that theflight test purposes, to devise supplementary intervention time required by the pilot is lesscriteria for system performance from rational than the available intervention time imposedconsideration of the intended operational by the system and the circumstances. A testusage. helicopter with dual pilot stations is highly

desirable, and is essential if the most rigoroustests are to be conducted safely.

8

Safety is enhanced in flight if the pilot is * loss of a particular functionwarned when the failure is to be injected and, * similar system performance but a higherin successive tests, consciously increases the susceptibility in the event of further failures.intervention time. In a progressive case it willthen be possible to make a good estimate of If the system performance is degraded thenthe maximum intervention time available operating close to the extremes of the flightwithout hazarding the helicopter. As part of envelope is likely to be unsatisfactory. If athis process it will be necessary to decide what function is missing then the implications ofconstitutes a safe recovery, taking into account this will need to be considered. These casesthe general criteria of acceptability introduced should be examined in flight, againin para 2.4. In a particular case a safe approaching critical conditions gradually. Ifrecovery might be defined as one in which the the system degradation means that thehelicopter does not exceed any of its "never helicopter is more vulnerable in the event of aexceed" limits: in another, it might be further failure, then it may be necessary todetermined by the height lost during recovery, conduct appropriate flight tests. It will

certainly be necessary to advise on the bestDetermination of a realistic intervention time course of action in view of the higher riskrequired is often difficult but may be necessary level in the degraded state.if there are no"requirements" that are bothrelevant and sound. For an operationally 4. PRODUCT OF THE FLIGHT TESTrepresentative required intervention time to be PROGRAMMEestablished in flight, the pilot must be unawarethat a failure is to be injected, and not be The principal products of the flight testuntypically practised at recognising failure programme may be summarised as follows:cues and taking appropriate control action. Apilot who has been engaged in a failure test 4.1 Flight Envelopes.programme is therefore not a good subject for Perhaps the most important outcome of the testtests of unwamed failures. In practice, it is programme is the investigation and subsequentnecessary to conduct most of the programme definition of the various flight envelopes thatwith one or two pilots, gradually approaching can be adopted for Service use, namely:critical cases and making the best estimates of * Normal Operation - The systemavailable and necessary recovery times. When performance tests will determine thethis has been done it is then possible to take performance of each flight-safety-criticalan unpractised pilot and subject him to system, including the effects on thatunwarned tests. The safety pilot must be performance of adverse conditions (e.g.completely familiar with the test that is to be turbulence, or high ambient temperature), somade and preferably should inject the failures. that the flight envelope over which theThe test points must be chosen with care. If characteristics of all flight-safety-criticalthey are too easy the results will have little systems remain satisfactory can be defined.value, if they are too difficult the risk increases Similarly, the failure tests will define the flightand the safety pilot is naturally inclined to envelope within which recovery is assuredintervene. Such tests are most relevant where from the effects of any failure (or combinationusable cues are not prominent and the of failures) whose probability of occurrence isconsequences of delayed intervention are insufficiently low to discount. By taking theserious, for it is in these circumstances that more conservative flight conditions indicatedsimulation most requires verification. This by these two envelopes, the flight envelope forwill serve as a check on the estimates made normal operation can be derived.from the previous test programme. * Flight with Degraded System - The tests

will indicate the advisability of curtailing the3.4 Post Failure Performance Tests. normal flight envelope following an initialFollowing a failure a system is degraded and failure. If the number of possible failures isthis is likely to appear as: large then it will be necessary to exercise some

* degradation of system performance

9

mental discipline to produce limitations thatare adequate and usable.

* Flight Envelope with Higher Risk

Levels - If it is considered desirable by theoperators of the helicopter, then someextensions to the permitted flight envelopecould be made with a concomitant reduction insafety. However, if this is done it is necessaryto be quite clear about the nature or degree ofthe higher risk levels, so that intelligentjudgements can be made about their use.

4.2 Piloting Procedures.A satisfactorily-completed failure testprogramme will yield realistic empiricalevidence on both the immediate action to betaken when a failure occurs, and theprocedures to be followed to identify thenature of that failure and the subsequentcorrective action to be taken. (There havebeen cases, for instance, of single governorfailures on multi-engine helicopters leading tothe shutting down of the wrong engine, whichsimple procedural checks would have avoided.)This evidence will be used to derivecomprehensive but concise emergencyprocedures for inclusion in the aircrew manual.Moreover, it may lead to the recommendationthat pilots should experience failures in flightas part of their training.

4.3 Recommendations for SystemImprovements.Recommendations for improvements are theinevitable outcome of a flight test programme.In the testing of a system that is flight safetycritical, it is specially relevant to consider ifmodification can improve the safety of thehelicopter operation.

4.4 Comparison of Specified and AchievedSystem Performance.For the helicopter and its operator this isprobably the least important product of theprogramme. It has, however, interest for themanufacturer. It determines whether he getspaid.

10

REFERENCES

1. US Air Force. Military Specification MIL-H-8501A Notice 1 dated B. Rotorcraft HandlingQualities.

2. United States Army Aviation Systems Command, St Louis, Mo. Aeronautical DesignStandard ADS-33C dated August 1989. Handling Qualities Requirements for Military Rotorcraft.

3. UK Ministry of Defence, London. Defence Standard 00-970. Design and AirworthinessRequirements for Service Aircraft. Volume 2 - Rotorcraft, Issue 1 dated 31 July 1984, toAmendment 8 dated December 1990.

4. Cooper G.E and Harper R.P. The use of pilot rating in the evaluation of aircraft handlingqualities. NASA TN D5153 dated 1969.

5. Hindson W.S, Eshow M.M and Schroeder J.A. A pilot rating scale for evaluating failuretransients in electronic flight control systems. AIAA-90-2827 dated August 1990.

Figure 1

oc

0>

ID u0 0-o (

LU - -

D D zu--4-- t Z L-

S0 E Uw a

:1 0~

CI Ou 0 JJ=- .J-=. 0 4--

0 - C Ol- - 0 -

__ __ __ _ 0_ _ _ _ _ _ 0 •ID wJ

[z HZ F-m ýLL - I

- a-z

D 0 > 0•ýU C: D

CL U

< z no LL

U

z~ C:

U 0 0

Uw

D >

UD -

F- I0 -0 CLC:

Et W E 04L- t: 0 C a)

H- zLU U LU

LU-F

H ILLU LU

H-

12

Figure 2

EFFECT OF SEVERE MODERATE MILD DELAYED

FAILURE DISTURBANCE DISTURBANCE DISTURBANCE DISTURBANCE

PRINCIPAL Angular Attitude Visual or AppropriateCUES acceleration, change, audible to disturbance

attitude acceleration warning when it occurs,

change ie as one ofother cases

PILOT Immediate, Rapid, through Restoration of As above

ACTION through flying flying controls safe flightpath

controls, to and/or cut-out following

restore operation warning

attitude

CLASSIFICATION OF FAILURES

13

Figure 3

Intervention time avaitablefrom the system Maximum

airspeed at

which recovery

is possible

TIME

N I

Intervention time

required by the pilot

AIRSPEED

EFFECT OF INTERVENTION TIMES ON LIMITING CONDITIONS

(ILLUSTRATIVE)

14

Figure 4

FACTORS AFFECTING INTERVENTION TIMES

MODE OF FLIGHT CUE QUALITY AGGRAVATING FACTORS

HOVER Good Poor hover holding

Very low height

STRAIGHT AND LEVEL Good Very high speed

TURNS Good High speed

Large adverse rot[ angle

TURN ENTRY + EXIT Fair Non-smooth change of

SPEED CHANGES condition

Large attitude changes

Large angular velocities

AUTOMATIC MANOEUVRES Probably Non-smooth changes of

eg Auto transition poor attitude

to and from hover Large variation of attitudeor ongutor velocity

Automatic target

trocking Very tow height

Notes:1 Very tow height is nearly atways adverse

2 "HANDS OFF" Flight increases intervention time3 Poor stobilisotion delays failure recognition

(unless it is so bad it requires frequent pilot

intervention)4 Low pilot attention level increases intervention time

15

Figure 5

FAILURE OPERATIONAL

MODE + EFFECT FLIGHT

ANALYSIS SPECTRUM

DEFECT FLIGHT

CONDITION

FAILURE I LIGHT

FAIUE COMPUTATION TESTSTATE

DATA

RELIABILITY RECOVERY

DATA MANOEUVRE

FAILURE CRASH

PROBABILITY CRITERION

HOURS PER FAILURES HOURSX PER

FAILURE PER CRASH CRCRASH

CRASH RATE CALCULATIONS(SCHEMATIC)

Al-i

ANNEX 1

Specifications and Requirements

1. SPECIFICATIONS * The total probability of encountering aSpecifications normally exist for specific specified moderate deterioration in flyingsystems and helicopters. They define what are qualities must not exceed specified values.the essential characteristics of the systems and * Failures of the flight control system,of the helicopter itself. They usually try to be (and the engine(s) and electrical system) mustas clear as possible in their definitions and meet specific requirements: for example, nosometimes even specify precisely what test single failure within the flight control systemmust be performed to demonstrate compliance, should cause dangerous or intolerable flyingHowever each new specification covers areas qualities.of technological or theoretical advance, and * Special Failures: these are failuresthese normally pose new problems in flight whose probability of occurrence is so remotetesting. that they can, with the agreement of the

procuring authority, be excluded from further2. REQUIREMENTS consideration.General requirements also exist for helicopterflying qualities. They have tended to focus on The requirement recognises multiple failures,the characteristics required of flight control flight path transients at failure, and degradedsystems (Reference 1). Recent standards have operation after failure. Pilot attention levelsextended their scope to include cockpit and delay times are also considered.displays and vision aids. The US documentAeronautical Design Standard 33C (Reference 2.4 Helicopter Response.2) is comprehensive and includes the following The required response to all control inputs istopics that are directly relevant to the flight specified.testing of critical systems.

2.5 Subjective Requirements.2.1 Multiple Flight Envelopes. Subjective terms are used in the document,

The Operational envelope is that required to but it is required that these be quantifiedperform the mission, whilst the Service before contract initiation.envelope is the larger envelope of which thehelicopter is capable. 3. RATING SCALES

The Cooper-Harper scale (Reference 4) for2.2 Degraded Visibility, Vision Aids and rating flying qualities is a part of theDisplays. vocabulary of any flight tester. It is usedTests are defined that assess the Usable Cue extensively in specification documents. AEnvironment when using vision aids and similar approach has been adopted by Hindson,displays. The contractor is required to define Eshow and Schroeder (Reference 5) to devisemanoeuvring envelopes for near-earth a rating scale for failure-induced flight pathoperation in poor visibility. The necessary transients. Both of these scales facilitatedetailed assumptions on pilot delays and sensible discussion of flight tests, they do notreaction times must be approved by the indicate how a flight test programme should beprocuring authority, conducted.

2.3 Failures. 4. SUMMARYThe contractor must identify all failure states In summary, it can be said that specificationswhich affect rotorcraft response or the usable remain complementary to this document. Theycue environment. These can then be treated in provide a wealth of information on systemone of three ways: performance characteristics, and valuable

guidance on how to treat system failures. In

A1-2

the more difficult cases they are unable to bespecific and require these to be either thesubject of agreement between the contractorand the procuring authority, or of definition bythe procuring authority. In either case the wiseprocuring authority will look to the flight testagencies since they are responsible forensuring safety in flight.

A2-1

ANNEX 2

AGARD Flight Test Instrumentation and Flight Test Techniques Series

1. Volumes in the AGARD Flight Test Instrumentation Series, AGARDograph 160

Volume TitleNumber Publication

Date

1. Basic Principles of Flight Test Instrumentation Engineering (Issue 2)Issue 1: edited by A. Pool and D. Bosman 1974Issue 2: edited by R. Borek and A. Pool 1994

2. In-Flight Temperature Measurementsby F. Trenkle and M. Reinhardt 1973

3. The Measurements of Fuel Rowby J.T. France 1972

4. The Measurements of Engine Rotation Speedby M. Vedrunes 1973

5. Magnetic Recording of Flight Test Databy G.E. Bennett 1974

6. Open and Closed Loop Accelerometersby I. Mclaren 1974

7. Strain Gauge Measurements on Aircraftby E. Kottkamp, H. Wilhelm and D. Kohl 1976

8. Linear and Angular Position Measurement of Aircraft Componentsby J.C. van der Linden and H.A. Mensink 1977

9. Aeroelastic Flight Test Techniques and Instrumentationby J.W.G. van Nunen and G. Piazzoli 1979

10. Helicopter Flight Test Instrumentationby K.R. Ferrell 1980

11. Pressure and Flow Measurementby W. Wuest 1980

12. Aircraft Flight Test Data Processing - A Review of the State of the Artby L.J. Smith and N.O. Matthews 1980

13. Practical Aspects of Instrumentation System Installationby R.W. Borek 1981

14. The Analysis of Random Databy D.A. Williams 1981

15. Gyroscopic Instruments and their Application to Flight Testingby B. Stieler and H. Winter 1982

16. Trajectory Measurements for Take-off and Landing Test and Other Short-Range Applications 1985by P. de Benque D'Agut, H. Riebeek and A. Pool

17. Analogue Signal Conditioning for Flight Test Instrumentationby D.W. Veatch and R.K. Bogue 1986

18. Microprocessor Applications in Airbome Flight Test Instrumentationby M.J. Prickett 1987

19. Digital Signal Conditioning for Right Testby G.A. Bever 1991

A2-2

2. Volumes in the AGARD Flight Test Techniques Series

Number Title PublicationDate

AG237 Guide to In-Flight Thrust Measurement of Turbojets and Fan Engines by the MIDAP 1979Study Group (UK)

The remaining volumes are published as a sequence of Volume Numbers of AGARDograph 300.

Volume Title Publication

Date

1. Calibration of Air-Data Systems and Flow Direction Sensors

by J.A. Lawford and K.R. Nippress 1988

2. Identification of Dynamic Systemsby R.E. Maine and K.W. Iliff 1985

3. Identification of Dynamic Systems - Applications to AircraftPart 1: The Output Error Approach 1986

by R.E. Maine and K.W. Iliff

Part 2: Nonlinear Analysis and Manoeuvre Design 1994by J.A. Mulder, J.K. Sridhar and J.H. Breeman

4. Determination of Antenna Pattems and Radar Reflection Characteristics of Aircraft 1986

by H. Bothe and D. McDonald

5. Store Separation Flight Testing 1986

by R.J. Amold and C.S. Epstein

6. Developmental Airdrop Testing Techniques and Devices 1987

by H.J. Hunter

7. Air-to-Air Radar Flight Testing 1992

by R.E. Scott

8. Flight Testing under Extreme Environmental Conditions 1988by C.L. Henrickson

9. Aircraft Exterior Noise Measurement and Analysis Techniques 1991by H. Heller

10. Weapon Delivery Analysis and Ballistic Flight Testing 1992

by R.J. Amold and J.B. Knight

1i. The Testing of Fixed Wing Tanker & Receiver Aircraft to Establish their 1992Air-to-Air Refuelling Capabilities

by J. Bradley and K. Emerson

12. The Principles of Flight Test Assessment of Flight-Safety-Critical Systems in Helicoptersby J.D.L. Gregory

At the time of publication of the present volume the following volumes were in preparation:

Flight Testing of Digital Flight Control Systems

by T.D. Smith

Flight Testing of Terrain Following Systemsby C.Dallimore and M.K.Foster

Reliability and Maintainabilityby J. Howell

Introduction to Flight Test EngineeringEdited by F. Stoliker

Space System Testing

by A. Wisdom

Flight Testing of Radio Navigation Systems

by H. Bothe and H.J. Hotop

Simulation in Support of Flight Testing

by L. Schilling

REPORT DOCUMENTATION PAGE

1. Recipient's Reference 2. Originator's Reference 3. Further Reference 4. Security Classificationof Document

AGARD-AG-300 ISBN 92-836-1001-6 UNCLASSIFIEDVolume 12

5. Originator Advisory Group for Aerospace Research and DevelopmentNorth Atlantic Treaty Organization7 rue Ancelle, 92200 Neuilly-sur-Seine, France

6. TitleThe Principles of Flight Test Assessment ofFlight-Safety-Critical Systems in Helicopters

7. Presented at

8. Author(s)/Editor(s) 9. Date

J.D.L. Gregory August 1994

10. Author's/Editor's Address 11. Pages

formerly of Aeroplane and Armament Evaluation Establishment 32Boscombe Down, Salisbury, WiltsSP4 OJF EnglandUnited Kingdom

12. Distribution Statement There are no restrictions on the distribution of this document.Information about the availability of this and other AGARDunclassified publications is given on the back cover.

13. Keywords/Descriptors

Helicopters ReliabilityFlight control systems Control systemsFlight tests MethodologyCritical system Safety engineeringCriticality

14. Abstract

Modem helicopters usually incorporate many engineering systems (including pilot-aidingsystems such as autostabilisers and flight directors) which are essential to the safe andeffective use of the helicopter. Where the helicopter can be endangered by failure of asystem (or of one of its units), that system is termed flight-safety-critical. In general, the useof those systems should not incur a higher probability of hazard to the helicopter than thatconsidered acceptable from considerations of structural or mechanical failure.

In assessing the suitability of a helicopter for its intended mission(s), it has becomeincreasingly important to consider the effects of the various systems provided. In particular,assessments of the implications of systems performance and failures derived from calculationand ground tests should be validated by flight tests. This paper seeks to establish the generalprinciples applicable to the testing in flight of any flight-safety-critical system, with emphasison certification rather than system development. It does not deal with the testing of particularsystems, but it is hoped that readers will find the principles described readily applicable tospecific cases.

This AGARDograph has been sponsored by the Flight Mechanics Panel of AGARD.

C0 0

0) In C) In -E E.

03 0 04 >m 0 toc ;~ 0

.> 0 U5 ~ ~

Cl 4E Ir.Ci 0O0-ý (1 0

0~4

~

0 M~ 4)

~~04u~ v*0 0

0~)~~ (00)~/> 0 cn m 0 0 0

3 -9 0

0 ~C C

0~4 0 C4)

0 0

0 ~ -- 0- _,-

C - -0 ;;. 4) 4

/2 0 ,0~

A4)- 4) ~0 c 0 0 ;-

.0 u C

>0 0) In0 0

0 5

-- 0 ZP - 04)

V) 0obho

0~ ~ 0 ýa 0 +

o4 04) 0 0- 0)~>

U w4 0 E 4<d0

0 0

u) .- 4, . U

0 0

4. C, 1-

o) C)

9CCs'r. ~ ~ C -il 0 C)

>O t =) -~ >,0>8

64 U 0 0 .C

0C , CIS o muC

o 16 ý -C -C! -C

4. (:) C)C r.) 9 0 -40

It) w o 0

p .- -D 0) Coltý~~ Q : UQ

CC) 0 " )

OCO CO CO-0

u -

u C13. C

m 040 U P4

0 q 00

0 '21 c

0 o , c

C C C )3 'A C

cl.0 04C

'- C)--ý )l

b) 0 bD 0o

-C d:9~ s -5 w 0 ý0

oO o ~ C 0/C

0W u ~CCCC ~ ~ -

a) 7= CO0=0C)- 0 C)L a:, 0 t ) C

m -0

C) -,) mO- > ~ ~C/C CO -*) C) 0 )

4 a

C- 0 0ý

CC/ C/C Cl 4, 41~C 0C C0

") C (0C a) g~C

-0 O >1 Z4 U 0 >2

0 (1)cl, ;, tlo 0 Im

NATO OTAN

7 RUE ANCELLE * 92200 NEUILLY-SUR-SEINE DIFFUSION DES PUBLICATIONS

FRANCE AGARD NON CLASSIFIEES

T61copie (1)47.38.57.99 e T6lex 610 176

Aucun stock de publications n'a exist6 A AGARD. A partir de 1993, AGARD d6tiendra un stock limit6 des publications associ~es aux cyclesde conf6rences et cours sp6ciaux ainsi que les AGARDographies et les rapports des groupes de travail, organis6s et publi6s ý partir de 1993inclus. Les demandes de renseignements doivent 6tre adress6es A AGARD par lettre ou par fax A l'adresse indiqu6e ci-dessus. Veuillez nepas telMphoner. La diffusion initiale de toutes les publications de I'AGARD est effectu6e aupr~s des pays membres de I'OTAN parl'interm6diaire des centres de distribution nationaux indiqu6s ci-dessous. Des exemplaires suppl6mentaires peuvent parfois 8tre obtenusaupr~s de ces centres (A l'exception des Etats-Unis). Si vous souhaitez recevoir toutes les publications de I'AGARD, ou simplement cellesqui concement certains Panels, vous pouvez demander i 6tre inclu sur la liste d'envoi de l'un de ces centres. Les publications de I'AGARDsont en vente aupr~s des agences indiqu6es ci-dessous, sous forme de photocopie ou de microfiche.

CENTRES DE DIFFUSION NATIONAUXALLEMAGNE ISLANDE

Fachinformationszentrum, Director of AviationKarlsruhe c/o FlugradD-7514 Eggenstein-Leopoldshafen 2 Reykjavik

BELGIQUE ITALIECoordonnateur AGARD-VSL Aeronautica MilitateEtat-major de la Force a6rienne Ufficio del Delegato Nazionale all'AGARDQuartier Reine Elisabeth Aeroporto Pratica di MareRue d'Evere, 1140 Bruxelles 00040 Pomezia (Roma)

CANADA LUXEMBOURGDirecteur du Service des renseignements scientifiques Voir BelgiqueMinist~re de la D6fense nationale NORVEGEOttawa, Ontario KIA 0K2 Norwegian Defence Research Establishment

DANEMARK Attn: BiblioteketDanish Defence Research Establishment P.O. Box 25Ryvangs All6 1 N-2007 KjellerP.O. Box 2715 PAYS-BASDK-2100 Copenhagen 0 Netherlands Delegation to AGARD

ESPAGNE National Aerospace Laboratory NLRINTA (AGARD Publications) P.O. Box 90502Pintor Rosales 34 1006 BM Amsterdam28008 Madrid PORTUGAL

ETATS-UNIS Forqa A6rea PortuguesaNASA Headquarters Centro de Documentagdo e InformaqdoCode JOB-1 AlfragideWashington, D.C. 20546 2700 Amadora

FRANCE ROYAUME-UNIO.N.E.R.A. (Direction) Defence Research Information Centre29, Avenue de la Division Leclerc Kentigern House92322 ChAtillon Cedex 65 Brown Street

GRECE Glasgow G2 8EXHellenic Air Force TURQUIEAir War College Milli Savunma Ba~kanliffi (MSB)Scientific and Technical Library ARGE Daire Ba~kanli•i (MSB)Dekelia Air Force Base AnkaraDekelia, Athens TGA 1010

Le centre de distribution national des Etats-Unis ne detient PAS de stocks des publications de I'AGARD.D'6ventuelles demandes de photocopies doivent &re formul6es directement aupr~s du NASA Center for AeroSpace Information (CASI)A l'adresse ci-dessous. Toute notification de changement d'adresse doit 8tre fait 6galement aupras de CASI.

AGENCES DE VENTE

NASA Center for ESA/Information Retrieval Service The British LibraryAeroSpace Information (CASI) European Space Agency Document Supply Division

800 Elkridge Landing Road 10, rue Mario Nikis Boston Spa, WetherbyLinthicum Heights, MD 21090-2934 75015 Paris West Yorkshire LS23 7BQEtats-Unis France Royaume-UniLes demandes de microfiches ou de photocopies de documents AGARD (y compris les demandes faites aupr~s du CASI) doiventcomporter la d6nomination AGARD, ainsi que le num6ro de s6rie d'AGARD (par exemple AGARD-AG-315). Des informationsanalogues, telles que le titre et la date de publication sont souhaitables. Veuiller noter qu'il y a lieu de sp6cifier AGARD-R-nnn etAGARD-AR-nnn lors de la commande des rapports AGARD et des rapports consultatifs AGARD respectivement. Des r6f6rencesbibliographiques completes ainsi que des r6sum6s des publications AGARD figurent dans les journaux suivants:

Scientific and Technical Aerospace Reports (STAR) Government Reports Announcements and Index (GRA&I)publi6 par la NASA Scientific and Technical publi6 par le National Technical Information ServiceInformation Division SpringfieldNASA Headquarters (JTT) Virginia 22161Washington D.C. 20546 Etats-UnisEtats-Unis (accessible 6galement en mode interactif dans la base de

donn6es bibliographiques en ligne du NTIS, et sur CD-ROM)

Imprimg par le Groupe Communication Canada45, boul. Sacrg-Cceur, Hull (Qudbec), Canada KIA 0S7

NATO -•- OTAN

7 RUE ANCELLE - 92200 NEUIL.LY-SUR-SEINE DISTRIBUTION OF UNCLASSIFIED

FRANCE AGARD PUBLICATIONS

Telefax (1)47.38-57.99 e Telex 610 176

AGARD holds limited quantities of the publications that accompanied Lecture Series and Special Courses held in 1993 or later, and ofAGARDographs and Working Group reports published from 1993 onward. For details, write or send a telefax to the address given above.Please do not telephone.AGARD does not hold stocks of publications that accompanied earlier Lecture Series or Courses or of any other publications. Initialdistribution of all AGARD publications is made to NATO nations through the National Distribution Centres listed below. Further copies aresometimes available from these centres (except in the United States). If you have a need to receive all AGARD publications, or just thoserelating to one or more specific AGARD Panels, they may be willing to include you (or your organisation) on their distribution list.AGARD publications may be purchased from the Sales Agencies listed below, in photocopy or microfiche form.

NATIONAL DISTRIBUTION CENTRESBELGIUM LUXEMBOURG

Coordonnateur AGARD - VSL See BelgiumEtat-major de la Force a6rienneQuartier Reine Elisabeth NETHERLANDSRue d'Evere, 1140 Bruxelles Netherlands Delegation to AGARD

R dNational Aerospace Laboratory, NLRCANADA P.O. Box 90502

Director Scientific Information Services 1006 BM AmsterdamDept of National DefenceOttawa, Ontario KIA 0K2 NORWAY

DENMARK Norwegian Defence Research EstablishmentDanish Defence Research Establishment Attn: BiblioteketRyvangs All6 1 P.O. Box 25P.O. Box 2715 N-2007 KjellerDK-2100 Copenhagen 0 PORTUGAL

FRANCE Forga A6rea PortuguesaO.N.E.R.A. (Direction) Centro de Documentagdo e Informaqdo29 Avenue de la Division Leclerc Alfragide92322 Chdtillon Cedex 2700 Amadora

GERMANY SPAINFachinformationszentrum INTA (AGARD Publications)Karlsruhe Pintor Rosales 34D-7514 Eggenstein-Leopoldshafen 2 28008 Madrid

GREECEHellenic Air Force TURKEYAir War College Milli Savunma Ba§kanligi (MSB)Scientific and Technical Library ARGE Daire Ba~kanlig'i (MSB)Dekelia Air Force Base AnkaraDekelia, Athens TGA 1010 UNITED KINGDOM

ICELAND Defence Research Information CentreDirector of Aviation Kentigern Housec/o Flugrad 65 Brown StreetReykjavik Glasgow G2 8EX

ITALYAeronautica Militare UNITED STATESUfficio del Delegato Nazionale all'AGARD NASA HeadquartersAeroporto Pratica di Mare Code JOB-100040 Pomezia (Roma) Washington, D.C. 20546

The United States National Distribution Centre does NOT hold stocks of AGARD publications.Applications for copies should be made direct to the NASA Center for AeroSpace Information (CASI) at the address below.

Change of address requests should also go to CASI.

SALES AGENCIESNASA Center for ESA/Information Retrieval Service The British Library

AeroSpace Information (CASI) European Space Agency Document Supply Centre800 Elkridge Landing Road 10, rue Mario Nikis Boston Spa, WetherbyLinthicum Heights, MD 21090-2934 75015 Paris West Yorkshire LS23 7BQUnited States France United KingdomRequests for microfiches or photocopies of AGARD documents (including requests to CASI) should include the word 'AGARD'and the AGARD serial number (for example AGARD-AG-315). Collateral information such as title and publication date isdesirable. Note that AGARD Reports and Advisory Reports should be specified as AGARD-R-nnn and AGARD-AR-nnn,respectively. Full bibliographical references and abstracts of AGARD publications are given in the following journals:

Scientific and Technical Aerospace Reports (STAR) Government Reports Announcements and Index (GRA&I)published by NASA Scientific and Technical published by the National Technical Information ServiceInformation Division SpringfieldNASA Headquarters (JTT) Virginia 22161Washington D.C. 20546 United StatesUnited States (also available online in the NTIS Bibliographic

Database or on CD-ROM)

Printed by Canada Communication Group45 Sacr4-Coeur Blvd., Hull (Qudbec), Canada KJA 0S7

ISBN 92-836-1001-6