The 728JET Flight Control System

Abstract

The 728JET aircraft is a 70 passenger transport airliner, corporate shuttle and executive aircraft. It is a low wing configuration with two turbofan engines mounted under the wing leading edges. The aircraft will make first flight during the first quarter of 2002 and will enter into service with Lufthansa in May 2003. (Status as per September 2001.)

This paper gives an overview of the 728JET Flight Control System configuration, functional requirements and architecture.

Full text

THE 728 JET FLIGHT CONTROL SYSTEM
U. Persson, C. Schallert
June 2001
Fairchild Dornier GmbH
P. O. Box 11 03, 82230 Wessling
1. SCOPE
The 728 Jet aircraft is a 70 passenger transport airliner,
corporate shuttle and executive aircraft. It is a low wing
configuration with two turbofan engines mounted under
the wing leading edges. The aircraft will make first flight
during the first quarter of 2002 and will enter into service
with Lufthansa in May 2003.
This paper gives an overview of the 728 Jet Flight Control
System configuration, functional requirements and archi-
tecture.
2. INTRODUCTION
The 728 Jet Primary Flight Control System (PFCS) is
hydraulically actuated on all surfaces with Power Control
Units (PCU) that are electrically signaled (Fly-By-Wire) by
electronic controllers without any mechanical backup
control. The PFCS consists of the following control surfa-
ces:
• LH (Left Hand) and RH (Right Hand) aileron surfaces
for roll control,
• three Multifunction Spoiler panel pairs that perform
roll assist, speed brake and lift dump functions,
• one Ground Spoiler panel pair that performs a lift
dump function,
• LH and RH elevator surfaces for pitch control and
• one rudder surface for directional control.
The Secondary Flight Controls consist of the wing leading
edge slats and the wing trailing edge flaps systems, which
provide high lift for take-off and landing, and a trimmable
horizontal stabilizer system for pitch trim control. The
aircraft is configured with
• one Krueger flap and four slat panels per wing,
• one inboard and one outboard single slotted fowler
flap panel per wing and
• one horizontal stabilizer surface.
All Secondary Flight Control surfaces are positioned by
electro-mechanical actuation systems, which are electri-
cally signaled. There is no mechanical back-up control
path.
Spoiler2
Flap
Aileron
Slat
THS
Rudder
Flap
Slat
Slat
Spoiler3
Spoiler4
Flap
Flap
Aileron
Slat
Slat
Slat
Spoiler4
Spoiler3
Spoiler2
Spoiler1
Spoiler1
Slat
Slat
Elevator
Elevator
Trimmable Horizontal
Stabilizer
Krueger Flap
Krueger Flap
FIG. 1: Confi
g
uration of the 728 Jet Fli
g
ht Control Surfaces
1

3. PRIMARY FLIGHT CONTROL SYSTEM
3.1. General
The PFCS consists of the following components:
• Cockpit Control System (CCS): The CCS consists of
the cockpit control wheels, control columns and pe-
dals for the pilot interface. These controls are fully
conventional in terms of operation. As all surfaces are
fully powered, there is no feedback of aerodynamic
forces, and artificial feel forces must be created. The
CCS modules create the required feel forces by the
use of springs, which gives a force linearly dependent
on the control input. A damping force is added also to
give the controls damping. The CCS modules contain
Rotary Variable Differential Transformers (RVDT)
which sense the control input positions.
• Control Electronics: The Actuator Control Electronics
(ACE) are analog electronic control units (P-ACE/S-
ACE) which excite and sense the CCS RVDT inputs.
The P-ACEs receive gain, stability augmentation and
force fight equalization commands (where required)
from the digital Flight Control Modules (FCM) via digi-
tal buses. The ACEs also report the status of the ac-
tuator control to the aircraft data bus system for crew
annunciation and for the Maintenance Computer
functions via the FCM.
• Actuators: All surface actuators are hydraulic PCUs
with an Electrohydraulic Servovalve (EHSV) of a jet-
pipe type. The aileron, elevator and rudder PCUs ha-
ve two modes of operation, the active mode or the
damped/standby mode. A solenoid valve as a first
stage and a mode control valve as a second stage
provide the mode control. The Multifunction Spoiler
(MFS) PCU has only the active mode and a locked
down mode if the EHSV current is removed. The
ground spoiler PCU is controlled by a solenoid valve,
which switches between the retracted and extended
positions.
3.2. Cockpit Controls
The cockpit control system provides the artificial feelfor-
ces, cockpit control position sensing using RVDTs excited
and sensed by the actuator control electronics, trim func-
tion in pitch and roll axis and a mechanical interface for
the autoflight system. These functions are packaged in
modules with mechanical connections to the pilot controls.
The roll axis CCS consists of the captain and first officer
control wheels. Each control wheel is connected via a
cable to one CCS roll control module. The two modules
are interconnected via a torque shaft. The torque shaft
has a disconnect unit which will disconnect the two modu-
les if a higher than normal interconnect torque occurs (in
the case of a mechanical jam in one CCS roll control
module). The CCS roll control module contains springs
and dampers to generate the control wheel forces that are
required for the artificial feel. An electromechanical trim
actuator moves the zero force position of the wheel, pro-
viding the trim function.
The pitch axis CCS consists of the captain and first officer
control columns. Each control column is connected via a
push-pull rod to one CCS pitch control module. The
modules are interconnected via a torque shaft. The torque
shaft has a disconnect unit which will disconnect the two
pitch control CCS modules, if one module jams and a
higher than normal interconnect torque occurs. The CCS
pitch control module contains springs and dampers to
generate the control column forces that are required for
the artificial feel.
The yaw axis CCS consists of the captain and first officer
pedals. Each pedal set is connected via push-pull rods to
an input shaft on the single CCS yaw control module. The
yaw module has two control input shafts which are inter-
connected via dual redundant interconnects. The CCS
yaw control module contains a spring and a damper to
generate the pedal forces that are required for the artificial
feel. An electro-mechanical trim actuator moves the zero
force position of the pedals, providing the trim function.
P-ACE
P-ACE Elevator
P-ACE
P-ACE
P-ACE
P-ACE
RVDT
sensors
RVDT
sensors
FCM
(analog section)
---------------------
(digital section)
FCM
(analog section)
---------------------
(digital section)
FCM
(analog section)
---------------------
(digital section)
FCM
(analog section)
---------------------
(digital section)
digital bus
system
analog
Aileron
Aileron
Elevator
Rudder
Spoiler
Spoiler
Spoiler
Spoiler
analog
analog
Cockpit
Controls
Cockpit
Controls
Cockpit
Controls
(Column,
wheel, pedals)
RVDT
sensors
Cockpit Control System
Electric Power
Distribution
System
Hydraulic Power
Distribution
System
FIG. 2: Primary Flight Control System Top Level Architecture
2
Deutscher Luft- und Raumfahrtkongress 2001
DGLR-JT2001-032
The 728 JET Flight Control System
U. Persson und C. Schallert

3.3. Surface Actuation
3.3.1. Aileron Surfaces
The LH and RH aileron surfaces are operated by two
Power Control Units (PCU) per surface in an acti-
ve/standby configuration. One PCU in active mode
controls the surface and the adjacent standby unit is in
damped mode. Switch-over takes place in the event of a
failure of the active control channel. The active unit is also
alternated between each flight to distribute wear and to
minimize failure dormancies. The aileron surface is not
mass balanced and is flutter critical. One actuator in dam-
ped mode is sufficient for flutter prevention.
The aileron PCU comprises an equal area piston and
responds to electrical inputs from the P-ACE. The P-ACE
receives an electrical position feedback from a dual chan-
nel Linear Variable Differential Transformer (LVDT) on the
main ram and a single channel LVDT on the EHSV slide.
Two absolute pressure sensors measure the generated
cylinder absolute pressure P, accumulator pressure while
in damped and hydraulic system supply pressures while in
active mode. The ram position feedback is used for loop
closure, and the EHSV valve position is used for monito-
ring of the EHSV by comparing the measured second
stage valve position with a model in the P-ACE. The pres-
sure sensors are of a strain gauge type and are used
during BIT testing of the actuator damped mode and ac-
cumulator performance. The sensors also provide hydrau-
lic supply status of the PCU to the P-ACE that is used for
the required switch-over function between the PCU pair in
the event of hydraulic supply failure. The aileron PCU has
two modes of operation, the active mode and the damped
mode. The PCU will be in the active mode with solenoid
current provided by the P-ACE and hydraulic supply pres-
sure above 1000 psi. In the damped mode sufficient dam-
ping for flutter protection is provided by directing the cylin-
der fluid through an orifice. With no hydraulic supply pres-
sure an accumulator on the PCU will provide sufficient
hydraulic fluid to maintain the damping for three hours.
The actuator is a fixed body installation to the wing rear
spar, and a dogbone link on the ram to surface interface
provides the required kinematics.
3.3.2. Ground Spoiler Panels
The inboard spoiler panels are operated by a single
Ground Spoiler PCU per panel. The PCU is controlled by
a solenoid, and with current provided from the controllers
the PCU will fully deploy the panel. With no current provi-
ded the PCU will hold the panel fully down. If the hydraulic
pressure is lost the actuator prevents the panel from going
up but will allow the panel to be blown down (ratchet down
mode).
3.3.3. Multifunction Spoiler Panels
The three outboard spoiler panels are controlled by a
single Multifunction Spoiler (MFS) PCU per panel. The
PCU has a normal operational mode and the locked down
mode in the event of an electronic controller failure when
EHSV current is removed. If the hydraulic pressure is lost
the actuator prevents the panel from going up but will
allow the panel to be blown down (ratchet down mode).
The MFS PCU comprises an unequal area piston and
responds to electrical inputs from the S-ACE. The S-ACE
receives an electrical position feedback from a single
LVDT channel on the main ram for loop closure. The
actuator will be commanded to retract if the EHSV current
from the S-ACE is removed as a result of a detected failu-
re or loss of electrical power to the S-ACE. In the event of
a hydraulic system failure, the PCU reverts to a ratchet
down mode which will allow the panel to be blown down in
the actuator retract direction but will not allow movement
in the extend direction. The MFS PCU is a rotating body
installation between the wing rear spar and the MFS sur-
face.
3.3.4. Elevator Surfaces
The LH and RH elevator surfaces are controlled by two
PCUs per surface in an active/active configuration. In the
event of a failure, one actuator is sufficient to control the
surface with a slightly reduced maximum surface rate. The
elevator PCU has two modes of operation, active and
damped mode. The elevator surface is not mass balanced
and is flutter critical. One actuator in damped mode is
sufficient for flutter prevention.
The elevator PCU comprises an equal area piston and
responds to electrical inputs from the P-ACE. The P-ACE
receives an electrical position feedback from a dual chan-
nel LVDT on the main ram, a single channel LVDT on the
EHSV slide and a single LVDT based pressure sensor
measuring the differential pressure ∆P between the cylin-
ders C1 and C2. Two absolute pressure sensors measure
the generated cylinder absolute pressure P, accumulator
pressure while in damped and hydraulic system supply
pressures while in active mode. The absolute pressure
sensors are of a strain gauge type and are used during
BIT testing of the actuator damped mode and accumulator
performance. The ram position feedback is used for loop
closure, and the EHSV position is used for monitoring of
the EHSV by comparing the measured second stage
valve position with a model in the P-ACE.
Each surface has two PCUs installed and both are nor-
mally active (Active/Active). Due to tolerances between
the adjacent PCU channels, the active/active configurati-
on generates a force-fight between the PCUs, which
needs to be controlled to an acceptable level. The force-
fight equalization function uses the difference between the
∆P data available from both PCUs on that surface (∆∆P)
to calculate a compensation command which is fed back
into the actuator control path for command augmentation.
The force-fight equalization is computed in the FCMs. ∆P
data to the FCMs and the equalization commands to the
P-ACEs are transmitted on the bi-directional PFCS data
bus system.
3
Deutscher Luft- und Raumfahrtkongress 2001
DGLR-JT2001-032
The 728 JET Flight Control System
U. Persson und C. Schallert

The elevator PCU has two modes of operation, the active
mode and the damped mode. The PCU will be in the
active mode with solenoid current provided by the P-ACE
and hydraulic supply pressure above 1000 psi. In the
damped mode, sufficient damping for flutter protection is
provided by directing the cylinder fluid through an orifice.
With no hydraulic supply pressure an accumulator on the
PCU will provide sufficient hydraulic fluid to maintain the
damping for three hours. The actuator is a fixed body
installation on the horizontal stabilizer rear spar, and a
dogbone link on the ram to surface interface provides the
required kinematics.
3.3.5. Rudder Surface
Three rudder PCUs in an active/active/active configuration
control the rudder surface. One PCU is sufficient to con-
trol the rudder during an engine failure at take-off. The
PCU has two modes of operation, active or standby mode.
The rudder surface is not mass balanced and is flutter
critical. One PCU in active mode is sufficient for flutter
prevention.
The rudder PCU comprises an equal area piston and
responds to electrical inputs from the P-ACE. The P-ACE
receives an electrical position feedback from a single
channel LVDT on the main ram, a single channel LVDT
on the EHSV slide and a single LVDT based pressure
sensor measuring the differential pressure ∆P between
cylinders C1 and C2. The ram position feedback is used
for loop closure, and the EHSV position is used for moni-
toring of the EHSV by comparing the measured second
stage valve position with a model in the P-ACE.
The three PCUs installed on the rudder surface are all
normally active (Active/Active/Active). Due to tolerances
between the adjacent PCU channels, the acti-
ve/active/active configuration generates a force-fight bet-
ween the PCUs, which needs to be controlled to an ac-
ceptable level. The force-fight equalization function uses
the difference between the ∆P data available from all
PCUs on that surface (∆∆P) to calculate a compensation
command which is fed back into the actuator control path
for command augmentation. The force-fight equalization is
computed in the FCMs. ∆P data to the FCMs and the
equalization commands to the P-ACEs are transmitted on
the bi-directional PFCS data bus system.
The rudder PCU has two modes of operation, the active
mode and the standby mode. The PCU will be in the acti-
ve mode with solenoid current provided by the P-ACE and
hydraulic supply pressure above 1000 psi. In the standby
mode sufficient damping is provided for on-ground gust
damping. Sufficient flutter protection is provided by a
single PCU in active mode by dynamic stiffness. The
actuator is a fixed body installation on the vertical stabili-
zer rear spar, and a dogbone link on the ram to surface
interface provides the required kinematics.
4
Deutscher Luft- und Raumfahrtkongress 2001
DGLR-JT2001-032
The 728 JET Flight Control System
U. Persson und C. Schallert

3.4. Actuator Electronic Control Architecture
There are two types of electronic controllers involved in
the control of the hydraulic PCUs. The Actuator Control
Electronic (ACE) units provide the basic cockpit control
input to actuator control. The controller for the aileron,
elevator and rudder actuators is named the Primary –
Actuator Control Electronic unit (P-ACE). The controller
for the multifunction spoilers is named the FCM/Spoiler
ACE (S-ACE). The P-ACE has an analog control path with
digital interfaces to provide higher level functions such as
gain scaling, stability augmentation, Built-In-Test and
status reporting of the P-ACE back to the crew annuncia-
tion system. Each P-ACE has two actuator control chan-
nels providing control of two actuators. In total 6 P-ACEs
are installed in the aircraft, distributed in different avionics
bays. The higher level function is provided by a digital
Flight Control Module (FCM) that is installed in the aircraft
avionics cabinets. The FCM to ACE communication is
provided by bi-directional digital buses. In total 4 FCM
modules are installed in the aircraft, distributed in different
avionics bays.
In Figure 3, the basic principle of an analog P-ACE provi-
ding the cockpit control to surface control function, and
the digital FCM providing the higher level functions is
shown. The left side shows the cockpit control module
(CCM) command inputs to the P-ACE. Figure 4 shows the
ACE internal actuator control path. The P-ACE provides a
rigging bias to eliminate the CCM mechanical installation
variations. Each surface command is processed through
Multi-point shaping curves and digitally provided scaling
gains, actuator force equalization and limits. The digital
scaling gains will be a function of speed and Mach. This
normal fail free mode of operation is named the “Augmen-
ted Direct Mode”. In the event of digital system or sensor
failures, default values based on the high lift system posi-
tion are provided. This mode of operation is named “Direct
Mode”.
A conventional EHSV control loop is used to process the
control command and to position the PCU and surface.
The main ram LVDT position is used by the loop controller
for position feedback. Electronic rigging capabilities are
also provided on this signal to eliminate mechanical instal-
lation variations. Electronic rigging is performed through
the onboard Centralized Maintenance System.
CCM analog ACE Surface
PCU
digital FCM
analog analog
dual PFCS
digital data bus
Aircraft data bus system
FIG. 3: Actuator Electronic Control Principle
digital
SA EHSV
Demod
Scaling
Command
Shaping
Curve
Direct Mode
Gain Direct
Mode
Limiter
+
+
analog
Demod
RVDT
RVDT Rig Bias Gain Scaling
Limiter Limiter
Augmentation
+
+
Variable
Limiter
Variable Limit
Limiter
LVDT Rig Bias
-
+
+
+
ACE PCU
Main Ram
LVDT
default default
FIG. 4: Actuator Control Path
5
Deutscher Luft- und Raumfahrtkongress 2001
DGLR-JT2001-032
The 728 JET Flight Control System
U. Persson und C. Schallert

4. SECONDARY FLIGHT CONTROL SYSTEM
4.1. Slat and Flap System Overview
High lift is provided by the wing leading edge slat and
trailing edge flap systems for take-off and landing.
The pilots can select between five different slat/flap confi-
gurations, as can be seen in TABLE 1. The selection is
made with the High Lift Command Lever (HLCL) or the
Emergency High Lift Switch (EHLS), located on the cock-
pit centre pedestal. The EHLS provides a redundancy to
the HLCL. Activation of the EHLS commands the configu-
ration 3 and takes precedence over the HLCL command.
The actual slat and flap positions, system status and
failure messages are displayed to the pilots on the Engine
Indication and Crew Alerting System (EICAS). A configu-
ration warning is generated to protect against a take-off
with the slats and flaps not configured correctly. The set-
tings of the stall warning and prevention system, the o-
verspeed warning and the speed tape indication on the
Primary Flight Display (PFD) are based on the actual slat
and flap positions. The position information is also used
by the PFCS to determine the default gains, augmentation
and surface deflection limits, when the control of the
PFCS is in the "Direct Mode" (refer to section 3.4).
Slat and flap motion is sequenced such that during exten-
sion the slats always move first and then the flaps follow.
During retraction the flaps move first and then the slats
follow. When commanded to retract from the configuration
4 to 3, the slats and flaps are operated simultaneously,
such that the aerodynamic drag is reduced quickly, and
the aircraft achieves a sufficient climb rate during a go-
around with only one engine operating. When comman-
ded to retract to UP, the slats start to retract as soon as
the flaps are within four degrees angle.
To protect against the consequences of inadvertent HLCL
or EHLS operation, the deployment of the slats and flaps
is inhibited if the airspeed is more than 5 knots greater
than the placard speed of the selected configuration. In
configuration 4, the flap position is automatically adjusted
to between 26° and 35° angle for airspeeds between 185
knots and 150 knots respectively. This flap load limiter
function protects the flaps from being overloaded.
The specific reliability and safety requirements are as
follows: An uncommanded motion of either system (runa-
way) must be extremely improbable, as well as an asym-
metric slat or flap deployment between the LH wing and
the RH wing. The loss of operation of both systems must
be extremely remote. The loss of operation of one system
- either slats or flaps - must be remote.
4.2. Trimmable Horizontal Stabilizer System
Overview
The aircraft pitch trim attitude is adjusted by the Trim-
mable Horizontal Stabilizer System (THSS), which moves
the horizontal stabilizer surface. The horizontal stabilizer
can be adjusted within -10° (aircraft nose up) to +5° (airc-
raft nose down) deflection angle.
Commands to move the horizontal stabilizer surface are
organized in three different modes, which are mutually
exclusive:
1) Manual mode: Pitch trim is commanded manually by
pressing the trim switches on the captain’s or the first
officer’s control wheel. The standby pitch trim swit-
ches on the centre pedestal in the cockpit are a re-
dundant manual control path. Engaging the standby
pitch trim cuts off any command from the control
wheel trim switches. Manual trim commands take
precedence over autopilot or augmentation trim
commands. In manual mode, the horizontal stabilizer
deflection rate is scheduled depending on the actual
airspeed to satisfy the aircraft handling quality requi-
rements.
2) Autopilot mode: If engaged, the autopilot has full
pitch trim command authority. It automatically adjusts
the pitch trim, such that the steady state control co-
lumn forces, which are held by the elevator autopilot
servo, are eliminated. The autopilot disengages, if va-
lid manual trim commands are present. The autopilot
can command any horizontal stabilizer motion up to
the airspeed scheduled deflection rate in the manual
mode.
3) Augmentation mode: The system defaults to the
augmentation mode, if the autopilot is disengaged
and no manual trim commands are received. The
augmentation mode comprises a mach trim, a down-
spring trim and a flap trim function. The downspring
trim increases the aircraft longitudinal stability, and
the mach trim emulates the nose down effect at high
mach numbers. During flap system motion, the air-
craft pitch attitude is automatically adjusted by the
flap trim function.
The horizontal stabilizer position, with respect to the full
range of adjustment, is displayed to the pilots on the
EICAS. There is no other horizontal stabilizer position
display and no scaled wheel. The EICAS also provides
system status and failure annunciations. The horizontal
stabilizer position range for take-off is marked with a
green band on the display. Additionally to the green band,
a take-off configuration warning is generated to protect
against a take-off in a mistrimmed condition.
Configuration Slat Angle Flap Angle Placard Speed Usage
UP 0° 0° NA Climb, Cruise, Descent
1 22° 0° 230 knots Holding
2 22° 15° 215 knots Take-Off
3 22° 20° 200 knots Take-Off, Go-Around, Landing
4 26,3° 35° 185 knots Landing
TABLE 1: Slat and Flap Settings
6
Deutscher Luft- und Raumfahrtkongress 2001
DGLR-JT2001-032
The 728 JET Flight Control System
U. Persson und C. Schallert

The specific reliability and safety requirements that the
THSS must fulfill, are as follows: Any uncommanded
motion of the horizontal stabilizer (runaway) or a loose
surface must be extremely improbable. The loss of hori-
zontal stabilizer trim operation must be remote.
5. SYSTEM ARCHITECTURE
5.1. Flap Actuation
Each flap panel is supported by two tracks and positioned
by one irreversible ballscrew actuator per track. The in-
puts of the actuators are interconnected through the me-
chanical transmission driveline and are synchronously
driven by the flap Power Drive Unit (PDU).
The fuselage mounted flap PDU comprises two electric
motors and brakes, a speed summing differential, a re-
duction geartrain and an output torque limiter. Each motor
is controlled and powered independently by one associa-
ted flap channel of the two Flap Slat Actuator Control
Electronics (FS-ACE). Flap system actuation at the nomi-
nal surface deflection rate is provided with dual motor
operation. Single motor operation is possible and gives
half of the nominal rate.
The ballscrew actuators convert the input rotation into a
linear motion driving the flap carriages along the tracks.
The actuators comprise force limiters, which prevent ex-
cessive load on the flap tracks in the event of a structural
jam. An activated actuator force limiter stalls the complete
flap system. The flap system is shut down if no movement
occurs while electric power is fed into the PDU motors.
Wing tip position resolvers are mounted on the most out-
board actuators for flap system position feedback, jam
monitoring and to protect against asymmetric flap de-
ployment. If the transmission fails during flap system
operation, an angular difference is detected between the
LH and RH wing tip position resolver signals, and the
system is immediately shut down. The disconnected part
of the flap system is held in place by the irreversible flap
actuators, which cannot be backdriven by the flap airlo-
ads.
The inboard and outboard flap panels of each wing are
mechanically interconnected. This interconnection provi-
des a redundant load path and is normally unloaded. In
the case of a flap actuator failure, the interconnection is
loaded and prevents excessive skewing of the affected
flap panel. A skewed flap panel is detected by flap skew
sensors (not shown in FIG. 5). The flap system is shut
down at this occurence and requires maintenance. The
purpose of the flap skew sensors is to annunciate any
actuator failure and prevent it from being a dormant condi-
tion.
Flap PDU
1
Up
2
3
4
Clutch
Gearbox
High Lift
Command
Lever
EMER HIGH
LIFT Switch
Dual
Wingtip
Position
Resolver
Irreversible
Ballscrew
Actuator Motor
Transmission
Driveline
To FS-ACE 2
Slat Channel
Flap Panel
Brake Brake
To Slat Channels
CAN BUS A
CAN BUS B
ARINC 429 IN
ARINC 429 OUT
ARINC 429 IN
C
T
R
L
M
O
N
To FS-ACE 1
Slat Channel
C
T
R
L
M
O
N
Mechanical
Interconnect
Deploy
FS-ACE 2
Flap Channel
FS-ACE 1
Flap Channel
MAU 2MAU 1
FIG. 5: Flap System Architecture
7
Deutscher Luft- und Raumfahrtkongress 2001
DGLR-JT2001-032
The 728 JET Flight Control System
U. Persson und C. Schallert

5.2. Slat Actuation
By architecture, the slat system is similar to the flap sys-
tem. Each slat panel is connected to the wing front spar
by two circular tracks and positioned by two rotary actua-
tors, one per track. The Krueger flaps move such that no
gap is left between the extended Krueger flap and the
engine pylon and nacelle, which improves the aerodyna-
mic performance. Like each slat, the Krueger flaps are
positioned by two actuators per panel. All slat and Krue-
ger flap actuators are interconnected and synchronously
driven by the fuselage mounted slat PDU.
The slat PDU is identical to the flap PDU, with each elect-
ric motor being controlled and powered independently by
one associated slat channel of the two FS-ACEs. The slat
system moves at the nominal rate with dual motor opera-
tion. Single motor operation gives half of the nominal rate.
All slat and Krueger flap actuators are equipped with a
torque limiter to prevent excessive loads in case a structu-
ral jam. Additionally, they are irreversible to prevent back-
driving of the disconnected part of the slat system after a
transmission failure has occured.
The wingtip position resolvers mounted to the left and
right outboard slat actuators are used for closed loop
position control and monitoring for jam and asymmetry.
There is no mechanical interconnection between the slat
panels. If one actuator fails, the airloads will cause the
affected panel to skew. The panel is still supported by the
remaining actuator. Both FS-ACE slat channels monitor
dedicated sensors to detect any skewed slat or Krueger
flap panel. If a panel skew is detected, the slat system is
shut down and requires maintenance.
8
Deutscher Luft- und Raumfahrtkongress 2001
DGLR-JT2001-032
The 728 JET Flight Control System
U. Persson und C. Schallert

5.3. Slat and Flap System Control
Slat and flap system control and monitoring is done by
two identical FS-ACEs, which have interfaces to the airc-
raft electrical and avionic systems. An FS-ACE consists of
two physically separated channels in one housing, one
channel for slat control and one channel for flap control.
Each FS-ACE flap channel independently performs closed
loop position control and failure monitoring of the flap
system. The same is true for the slat channels.
Each channel is subdivided into a control and a monitor
lane. The comparison of the commanded versus achieved
surface position and system failure monitoring is digitally
computed in both lanes. The control and monitor lanes
receive all relevant input data (HLCL RVDT signal, EHLS
signal, airspeed and left / right surface position sense, see
FIG. 6) independently. The airspeed is received via the
ARINC 429 Bus input. The computing processes are
dissimilar between the control and monitor lanes, such
that a hardware or software fault cannot commonly affect
both lanes and cause critical malfunctions, i. e., an un-
commanded motion.
The four slat and flap channels are linked to each other by
a dual CAN-Bus for cross communication of command
input and surface position data (HLCL RVDT signals,
EHLS signals, slat angle and flap angle). In order for one
channel to generate a drive command, both control and
monitor lanes independently compare the direct command
input with the inputs from the other three channels and
look for at least one matching signal.
When the control lane finds a signal that matches its
direct command input, it will apply power to the associated
PDU motor and release the brake. The motor is operated,
the brake kept open, and the system moves until the mo-
tion command becomes invalid, i. e., because the com-
manded position has been achieved or a failure is detec-
ted. The monitor lane will inhibit system motion by cutting
off the motor power and engaging the brake if it finds any
errors or disagrees with the system motion produced by
the control lane.
Each slat and flap channel transmits the surface position
via its ARINC 429 output. The surface positions are dis-
played in the cockpit and used to generate the overspeed
warning and to activate the stall warning and prevention
system. Since the surface position information is utilized
to perform these critical functions, it is independently
computed and verified by the control and monitor lane of
each channel.
All slat and flap channels are connected to different AC
and DC electric power busses for redundancy. DC power
is internally used in the FS-ACE channels for computation
and for releasing the respective brake. AC power is used
to drive the electric motor. Operation of one system - slats
or flaps - at half rate requires at least two channels supp-
lied with DC and one channel supplied with AC power.
This is still maintained after two independent failures of
electric power busses. In the case of a dual engine failure,
the Ram Air Turbine (RAT) is deployed to provide emer-
gency power on the AC and DC essential busses. One
slat and one flap channel will be powered, enabling
system operation at half rate.
FS-ACE1 FS- ACE2
SLAT CHANNEL
SLAT PDU
FLAP CHANNEL
Control Lane
FLAP PDU
MTR 1
BRK 1
DUAL CHANNEL
CAN BUS
ARINC 429
OUTPUT
FLAP DEPLOYED
Monitor Lane
FLAP CHANNEL
SLAT CHANNEL
ADA 80C3 86
80C386
80C386
ADA
ANSI C
ADA 80C186
80C186
ANSI C
80C386
ANSI C
ANSI C
ADA
80C186
80C186
HLCL RVDT #1
EHLS POLE 1
Position Sense 2
MAU ARINC 429 2
Skew Sense 4
HLCL RVDT #2
EHLS POLE 2
Position Sense 2
MAU ARINC 429 2
Skew Sense 2
HLCL RVDT #3
EHLS POLE 3
Position Sense
2
MAU ARINC 429
2
Skew Sense
4
HLCL RVDT #4
EHLS POLE 4
Position Sense
2
MAU ARINC 429
2
Skew Sense
2
Control Lane
Control Lane
Control Lane
Monitor Lane
Monitor Lane
Monitor Lane
MTR 2
BRK 2
MTR 1
BRK 1
MTR 2
BRK 2
ARINC 429
OUTPUT
SLAT DEPLO YED
AC & DC Ess Bus
BAT Bus 1 &
DC Ess Bus
AC & DC Bus 1
AC & DC Bus 2
FIG. 6: FS-ACE Key Inputs and Outputs
9
Deutscher Luft- und Raumfahrtkongress 2001
DGLR-JT2001-032
The 728 JET Flight Control System
U. Persson und C. Schallert

5.4. Trimmable Horizontal Stabilizer
The horizontal stabilizer surface (THS) is supported by
two hinges to the empennage. The Trimmable Horizontal
Stabilizer Actuator (THSA) rotates the THS around the
hinge axis and holds it in place. The left and right elevator
surfaces and actuators are mounted to the THS.
The THSA is a ballscrew type actuator, which is driven by
two electric motors. The motors are rotating the ballscrew
through a reduction geartrain. The two motors are stacked
and share a common shaft with an electromechanical
brake, which is power-off engaged.
Control and power supply for the motors is provided by
two separate, independent channels of the Horizontal
Stabilizer Actuator Control Electronics (HS-ACE). The HS-
ACE channels 1 and 2 are connected to different AC and
DC electric power sources for redundancy. Each HS-ACE
channel also controls a dedicated solenoid to release the
brake. The motors are operated in an active / standby
manner, which is exchanged every flight. This reduces the
risk of dormant failures being present and increases the
functional reliability of the system.
Each HS-ACE channel reads two position sensors, one
mounted on the THSA housing and one on the THS, for
control and feedback of the surface position and for sys-
tem jam monitoring.
When the THSA is not operating, the ballscrew is irrever-
sible by means of a no-back mechanism. The no-back
reacts the ballscrew torque created by the horizontal
stabilizer airloads into the THSA housing and hence into
the aircraft structure. This prevents creeping of the
horizontal stabilizer when exposed to airloads. The
electromechanical brake provides a redundancy to the no-
back.
The THSA is designed for critical structural integrity, since
a disconnected horizontal stabilizer surface renders the
aircraft uncontrollable. It features complete dual load
paths between the attachment to the aircraft stucture and
to the horizontal stabilizer. The primary path is normally
reacting all loads, while the secondary path is unloaded. If
the primary path fails, the secondary path is loaded and
holds the horizontal stabilizer in place. Under load, the
secondary path engages its friction and locking devices,
which will stall the THSA if it is attempted to trim. The
stalled condition of the THSA is annunciated to the pilots
and requires rectification by maintenance. This fail-freeze
philosophy prevents failures of the primary path from
being a dormant risk.
CAN BUS A
CAN BUS B
Standby
Trim Switch
THSA
Brake
down
up
down
up enable
Dual Load
Path
Ballscrew
Dual Load
Path Nut
Dual
Actuator
Position
Resolver
Brushless
DC Motors
Pilot
Trim Switch
Copilot
Trim Switch
CTRL
MON
No-
Back
Surface
Position
Resolvers
Gearbox
MAU 2
ARINC429 IN
down
up
THS
CTRL
MON
HS-ACE
Channel 2
HS-ACE
Channel 1
MAU 1 MAU 3
+5° (nose down)
-10° (nose up)
ARINC429 IN
ARINC429
OUT
AC & DC
Ess Bus
AC & DC
Bus 2
FIG. 7: Trimmable Horizontal Stabilizer System Architecture
10
Deutscher Luft- und Raumfahrtkongress 2001
DGLR-JT2001-032
The 728 JET Flight Control System
U. Persson und C. Schallert

5.5. THSS Control
Control of the THSA is performed by the HS-ACE. The
HS-ACE is derived from the FS-ACE and is identical
hardware, but different software. Like the FS-ACE, the
HS-ACE contains two physically separated channels in
one housing. Each of the two channels is capable of inde-
pendently controlling the THSA and moving the horizontal
stabilizer. Only one channel is in active control at a time,
the other channel is in standby mode.
The two HS-ACE channels are different hardware and
software. This dissimilarity ensures that no common mode
computing error can simultaneously affect both channels,
which improves the system reliability.
The two channels are linked by a dual CAN-Bus for cross
communication of trim command inputs and to coordinate
the active / standby status.
Each HS-ACE channel receives the trim switch com-
mands through discrete interfaces; the airspeed, the au-
topilot trim and mach trim commands through the ARINC
429 input busses. The autopilot or mach trim commands
are checked by each HS-ACE channel for their validity.
The other augmentation functions (downspring trim and
flap trim) and the trim rate schedule for manual trim com-
mands are computed by the HS-ACE channels. Each
channel reads one position sensor on the actuator and on
the horizontal stabilizer surface.
Each HS-ACE channel transmits the surface position and
the autopilot / mach trim command echo on an ARINC
429 output bus. The autoflight system uses the autopilot /
mach trim command echo from the HS-ACE channels to
verify that its trim commands are received and processed
correctly. If the autoflight system finds any errors or mis-
match between its commands and the echo, it will disen-
gage and stop commanding pitch trim. The autopilot will
also disengage if the HS-ACE echos back that it is re-
sponding to a manual trim command.
In each HS-ACE channel the control and monitor lanes
receive, process, and transmit the data independently. As
with the FS-ACE channels, the computing processes are
dissimilar between the control and monitor lanes, such
that a hardware or software fault cannot commonly affect
both lanes and cause critical malfunctions, i. e., a horizon-
tal stabilizer uncommanded motion.
If the control lane of the active channel receives a valid
trim command, it will apply electric power to its associated
motor and release the brake. The THSA is operated and
the surface moved until the trim command is removed or a
failure is detected. If the monitor lane of the active chan-
nel finds any errors or disagrees with the operation produ-
ced by the control lane, it will inhibit the motion by cutting
off the motor power and engaging the brake. After the
active channel is shut down by its monitor lane, it reverts
to the standby mode and hands over the control to the
other channel, which then reverts to the active mode.
HS-ACE
CHANNEL 2
CHANNEL 1
Solenoid 2
Solenoid 1
THSA
Motor 1
ADA
ADA
ANSI C
ANSI C
80C386
80C386
80C186
80C186
ARINC 429
OUTPUT
ARINC 429
OUTPUT
Surface Position 1
T
rim Switch Inputs 3
Actuator Position 1
Surface Position 2
MAU ARINC 429 2
T
rim Switch Inputs 3
Actuator Position 2
MAU ARINC 429 2
Monitor Lane
Monitor Lane
Control Lane
Control Lane
Motor 2
Brake
DUAL CAN BUS
AC & DC Ess Bus
AC & DC Bus 2
FIG. 8: HS-ACE Key Inputs and Outputs
11
Deutscher Luft- und Raumfahrtkongress 2001
DGLR-JT2001-032
The 728 JET Flight Control System
U. Persson und C. Schallert