Fault tree analyses as a tool for flight control system architecture design

Woodward Inc. was tasked with evaluating several flight control rotorcraft requirements to derive an architecture that would best support those requirements. Each architecture was assessed using various models, including a fault tree model, to determine if failure rate allocations to the partitions would support the needed availability and safety performance. An optimal system architecture was developed that would meet regulatory compliance for system safety [1, 2] given constraints such as cost, weight, envelope, and complexity. System Safety was the primary driver considered in the development phase of the Fly-By-Wire (FBW) project. The designs consist of Flight Control Computer (FCC) electrical lanes that interface with main and tail rotor electrohydraulic servoactuators. The system concept designs evaluated involved traditional and hybrid architectural schemes for functional redundancy and operation. The options included duplex, triplex, quadruplex control channel redundancy and various combinations of electrical, mechanical, or hydraulic connections. A primary system safety analysis tool in the decision making process for the optimal system architecture in this application was the Fault Tree Analysis (FTA). The FTA model provided both a visual qualitative tool to validate proper system logic and a quantitative tool [3] to validate probability of Loss of Function (LOF) and Failure to Dispatch (FTD). While Woodward also applies this process to fixed-winged aircraft, the focus of this study was a FBW rotorcraft flight control platform (see Figure 1). The result of this study found that a hybrid Dual-Triplex architectural scheme proved optimal given the project constraints. This Dual-Triplex architecture consists of four FCC channels through triplex control lanes to dual electrohydraulic servoactuators.