The F-16 Integrated Servo Actuator needed fail-operative fail-operative control with dual-fault tolerance for electrical failures.[1] To do this each of the 3 servoactuators had 2 windings that could control the servo.[1] The levels for ISA failure detection was twice the level implemented in the flight computer, therefore the ISA would detect a failure after the main computer does.[1] This allowed the computer to correct for the first failure while the ISA corrects for the second failure.[1] The ISA requires 3 servoamplifier inputs for operation.[2] Therefore the 4th servoamplifier can be held in a standby condition to switch in the event of a servoamplifier failure.[1]. The ISA can also reject an incorrect control valve command and operate with undegraded performance following a failure.[2] The ISA uses hydraulic logic to monitor the output of the control valves.[2]
Serovamplifier monitors can sense a failure in a servo coil loop.[2] If any of these loops fail, it will be switched out and the 4th standby loop will be switched to the second control coil.[2]
If the control pressure from one of the control valves differs from the other valves, the monitors will provide pressure to the voting spool.[2] This voting spool will then shuttle to lock out the affected control.[2] If sufficient failures occur to cause the ISA position to disagree with the electronic mode, then the ISA command will be bypassed and the actuator centering spring will command a neutral position.[2]
Sources
- [1] The General Dynamics Case Study on the F-16 Fly-By-Wire Flight Control System.
- [2] “F-16 flight control system redundancy concepts.” Accessed: Sep. 09, 2024. [Online]. Available: https://arc.aiaa.org/doi/epdf/10.2514/6.1979-1771
Backlinks
[[F-16 Integrated Servo Actuator]]
[[Redundancy]]
[[T-38 Aileron Controls]]
[[Flip Flops]]