NASA/TP-2007-213475

Synthesis from Design Requirements of a Hybrid System

for Transport Aircraft Longitudinal Control

Volume II

Charles S. Hynes and Gordon H. Hardy

Ames Research Center, Moffett Field, California

Lance Sherry

Honeywell International Inc., Phoenix, Arizona

December 2007
The NASA STI Program Office ... in Profile

Since its founding, NASA has been dedicated to the CONFERENCE PUBLICATION. Collected

advancement of aeronautics and space science. The papers from scientific and technical conferNASA Scientific and Technical Information (STI) ences, symposia, seminars, or other meetings

Program Office plays a key part in helping NASA sponsored or cosponsored by NASA.

maintain this important role.

The NASA STI Program Office is operated by

Langley Research Center, the Lead Center for

NASA's scientific and technical information. The

NASA STI Program Office provides access to the

NASA STI Database, the largest collection of

aeronautical and space science STI in the world.

The Program Office is also NASA's institutional

mechanism for disseminating the results of its

research and development activities. These results

are published by NASA in the NASA STI Report

Series, which includes the following report types:

• TECHNICAL PUBLICATION. Reports of

completed research or a major significant phase

of research that present the results of NASA

• SPECIAL PUBLICATION. Scientific, technical,

or historical information from NASA programs,

projects, and missions, often concerned with

subjects having substantial public interest.

• TECHNICAL TRANSLATION. Englishlanguage translations of foreign scientific and

technical material pertinent to NASA's mission.

Specialized services that complement the STI

Program Office's diverse offerings include creating

custom thesauri, building customized databases,

organizing and publishing research results ... even

providing videos.

For more information about the NASA STI

programs and include extensive data or theoreti- Program Office, see the following:

cal analysis. Includes compilations of significant

scientific and technical data and information

deemed to be of continuing reference value.

NASA's counterpart of peer-reviewed formal

professional papers but has less stringent

limitations on manuscript length and extent

of graphic presentations.

• TECHNICAL MEMORANDUM. Scientific and

technical findings that are preliminary or of

• Access the NASA STI Program Home Page at

littp://www.sti.nasa.gov

• E-mail your question via the Internet to

help@sti.nasa.gov

• Fax your question to the NASA Access Help

Desk at (301) 621-0134

specialized interest, e.g., quick release reports, Telephone the NASA Access Help Desk at

working papers, and bibliographies that contain (301) 621-0390

minimal annotation. Does not contain extensive

analysis.

• CONTRACTOR REPORT. Scientific and

technical findings by NASA-sponsored

contractors and grantees.

• Write to:

NASA Access Help Desk

NASA Center for AeroSpace Information

7115 Standard Drive

Hanover, MD 21076-1320
NASA/TP-2007-213475

Synthesis from Design Requirements of a Hybrid System

for Transport Aircraft Longitudinal Control

Volume II

Charles S. Hynes and Gordon H. Hardy

Antes Research Center, Moffett Field, California

Lance Sherry

Honeywell International Inc., Phoenix, Arizona

National Aeronautics and

Space Administration

Ames Research Center

Moffett Field. California 94035-1000

December 2007
Acknowledgments

We thank Michael Heymann for suggesting the investigation of validity regions in state space, and for many

discussions. Charles E. Billin g s, William Bjorkman. James Franklin, Charles W. (Bill) Harper, Feng Lin, George

Meyer, and Everett Palmer reviewed the report and provided useful comments on both content and presentation.

We are grateful to them all.

Available from:

NASA Center for AeroSpacc Information National Technical Information Service

71 15 Standard Drive 5285 Port Royal Road

Hanover, MD 21076-1320 Springfield, VA 22161

(301)621-0390 (703)487-4650
TABLE OF CONTENTS

VOLUME II

LISTOF ACRONYMS ....................................................................................................................... ix

LISTOF SYMBOLS ........................................................................................................................... ix

APPENDIX A

THE STANDARD ATMOSPHERE

BASICEQUATIONS ....................................................................................................................... A-1

DEFINING PROPERTIES AND CONSTANTS ............................................................................. A-2

DEFINING EQUATIONS FOR THE TROPOSPHERE ................................................................. A-3

DEFINING EQUATIONS FOR THE STRATOSPHERE ............................................................... A-4

STANDARD ATMOSPHERE TABLE ........................................................................................... A-4

REFERENCES................................................................................................................................. A-6

APPENDIX B

ELEMENTS OF TRANSPORT AIRCRAFT DESIGN AND OPERATION

INTRODUCTION............................................................................................................................ B-1

LONGITUDINAL EQUATIONS OF MOTION .............................................. ............................... B-2

AERODYNAMICFORCES ............................................................................. ............................... B-6

Similarity in Fluid Mechanics ....................................................................... ............................... B-6

Aerodynamic Force Characteristics ............................................................. ............................... B-1 1

Aerodynamic Performance .......................................................................... ............................... B-13

ENGINEMODEL ........................................................................................... ............................... B-15

ThrustFunction ............................................................................................ ............................... B-15

ThrustCharacteristics .................................................................................. ............................... B-16

ThrustLimits ............................................................................................... ............................... B-18

ThrustLag .................................................................................................... ............................... B-19

AIRPLANE PERFORMANCE ....................................................................... ............................... B-22

Performance Envelope ................................................................................. ............................... B-22

CruisePerformance ..................................................................................... ............................... B-26

AirportPerformance .................................................................................... ............................... B-30

DesignOverview ......................................................................................... ............................... B-31

iii
APPENDIX B

ELEMENTS OF TRANSPORT AIRCRAFT DESIGN AND OPERATION (continued)

AIRPLANEOPERATION ............................................................................................................. B-33

Climb and Descent Operation ..................................................................................................... B-33

Trajectory Optimization .............................................................................................................. B-35

Operation Overview.................................................................................................................... B-37

AIRPLANE DYNAMIC RESPONSE ........................................................................................... B-38

Three-Degree-of-Freedom Model .............................................................................................. B-38

Simplified Models ...................................................................................................................... B-65

REFERENCES ............................................................................................................................... B-71

LIST OF FIGURES

Figure 13-1. Reference frames ........................................................................................................... B-4

Figure B-2. Aerodynamic force characteristics .............................................................................. B-1 1

Figure B-3. Variation of corrected thrust with corrected rpm ........................................................ B-17

Figure B-4. Variation of maximum thrust with Mach number ....................................................... B-18

Figure B-5(a). Thrust response block diagram ............................................................................... B-19

Figure 5(b). Acceleration limit logic ............................................................... ............................... B-20

Figure B-6. Thrust response to throttle steps .................................................................................. B-21

Figure B-7. Performance envelope ................................................................................................. B-25

Figure B-8. Variation of payload fraction with range .................................................................... B-30

Figure B-9. Performance envelope with vertical velocity contours ............................................... B-34

Figure 13-10. Longitudinal dynamical system ................................................................................ B-40

Figure 13-1 1. Elevator step response, 10 sec ................................................................................... B-48

Figure 13-12. Elevator step response, 60 sec ................................................................................... B-51

Figure 13-13. Elevator pulse response, 5 sec ................................................................................... B-54

Figure 13-14. Elevator pulse response, 60 sec ................................................................................. B-56

Figure 13-15. Elevator pulse response, 115 sec, 0 fixed after 4.65 sec, V > VMIN DRAG .................. B-57

Figure 13-16. Elevator pulse response, 2205 sec, y fixed after 2.7 sec, V > VMIN DRAG• ...........•••••• B-59

Figure 13- 17 Elevator pulse response, 115 sec, 0 fixed after 4.65 sec, V > VMIN DRAG ..................• B-61

Figure 13-18. Elevator pulse response, 885 sec, y fixed after 2.7 sec, V ':^ VMIN DRAG• ..................• B-63

Figure 13-19. Pitch step response, 5 sec, two degrees of freedom .................................................. B-66

Figure B-20. Pitch step response, 1 15 sec, two degrees of freedom . ............................................ B-68

Figure B-21. Path step response, 5 sec and long term, single degree of freedom .......................... B-70

LIST OF TABLES

Table 13-1. Transport Aircraft Performance Parameters ................................................................. B-12

Table B-2. Optimal Cruise Altitude ............................................................................................... B-27

Table B-3. Transport Aircraft Stability and Control Parameters .................................................... B-39

Table B-4. Elevator Step Response ................................................................................................ B-45

Iv
APPENDIX C

SYMMETRIC (COORDINATED) TURNING FLIGHT

GENERAL VECTOR FORCE EQUATION ................................................................................... C-1

Eulerian Angles for Path frame .................................................................................................... C-1

WeightComponents ..................................................................................................................... C-2

Kinematic Acceleration Components ........................................................................................... C-3

COORDINATEDTURNING FLIGHT ........................................................................................... C-5

KINEMATIC EQUATIONS FOR COORDINATED TURNING FLIGHT ................................... C-6

Eulerian Angles for Body Frame .................................................................................................. C-6

KinematicRelationships ............................................................................................................... C-7

KinematicApproximations ........................................................................................................... C-9

Limiting Flight Conditions for Transport Aircraft ..................................................................... C-10

ApproximationValidity .............................................................................................................. C-1 1

REFERENCES............................................................................................................................... C- 12

LIST OF FIGURES

Figure C-1. Spatial orientation of path frame ................................................................................... C-2

Figure C-2. Spatial orientation of body frame .................................................................................. C-6

Figure C-3. Orientation of body frame to path frame ....................................................................... C-7

APPENDIX D

ELEMENTS OF PROPOSITIONAL LOGIC

ELEMENTARY LOGICAL PROPOSITIONS........ ........................................................................ D-I

TruthTables .................................................................................................................................. D-1

LogicalOperations ........................................................................................................................ D-3

ElementaryLogical Theorems ...................................................................................................... D-4

COMPOSITE LOGICAL PROPOSITIONS .................................................................................... D-5

ELEMENTARY THEOREMS IN SYMBOLIC LOGIC ................................................................. D-6

LOGICAL SIMPLIFICATION OF COMPOSITE PROPOSITIONS ............................................. D-7

Simplification of Definition for PE (V) ........................................................................................ D-7

Simplification of Definition for PE (y) ......................................................................................... D-8

CONDITION-ACTION DECISION TABLES ................................................................................D-9

Simple Condition-Action Tables .................................................................................................. D-9

ModeSelection Tables ............................................................................................................... D-10

REFERENCES............................................................................................................................... D-12

v
APPENDIX D

ELEMENTS OF PROPOSITIONAL LOGIC (continued)

LIST OF THEOREMS (AFTER DROMEY) ................................................................................. D-13

Symbols...................................................................................................................................... D-13

Theorems.................................................................................................................................... D-13

LIST OF TABLES

TableD-1 .......................................................................................................................................... D -9

TableD-2 ........................................................................................................................................ D-10

APPENDIX E

STATECHART SEMANTICS

CONVENTIONAL STATECHART SEMANTICS .........................................................................E-1

State Transition Diagrams .............................................................................................................E-1

Hierarchical Statecharts .................................................................................................................E-2

AircraftImplementation ................................................................................................................E-4

MODIFICATIONS FOR SEQUENTIAL PROCESSING ................................................................E-5

Emulation of Continuous System Elements ..................................................................................E-5

Emulation of Discrete System Elements .......................................................................................E-6

Definitionof Time Step .................................................................................................................E-6

Violation of Broadcast Synchronization Convention ....................................................................E -9

Implications for Formal Validation ...............................................................................................E-9

A DETAILED IMPLEMENTATION EXAMPLE .........................................................................E-10

StatechartExample ......................................................................................................................E- l 0

Jackson Program Design Example ..............................................................................................E-12

REFERENCES................................................................................................................................E-16

LIST OF FIGURES

Figure E-1. State transition diagram

Figure E-2. Hierarchical statechart ...............................................................................................

Figure E-3. Real-time operating system .......................................................................................

Figure E-4. Flight control mode selection example ......................................................................

Figure E-5. Discrete emulation of continuous function ................................................................

Figure E-6. Modification of state machine for sequential implementation ..................................

Figure E-7. Jackson Data Structure Chart for mode control example ..........................................

Figure E-S. Jackson Program Structure Chart for mode control example ....................................

... E-2

... E-3

... E-4

...E-5

... E-6

...E-7

.E-12

.E-13

vi
APPENDIX E

STATECHART SEMANTICS (continued)

LIST OF TABLES

TableE-1 ..........................................................................................................................................E-11

TableE-1. ..........................................................................................................................................E-15

APPENDIX F

THEOREMS ON SYSTEM BEHAVIORAL PROPERTIES

PROOFMETHODOLOGY .................................................................................. ............................F-1

Objectives.......................................................................................................... ............................F-1

Approach......................................................................................................... ............................... F-2

Frameworkof Analysis ................................................................................... ............................... F-2

DEFINITIONS...................................................................................................... ............................F-3

Logicalsymbols ................................................................................................. ............................F-3

ElementaryTheorems ........................................................................................ ............................F-3

Symbolic Logical Propositions ....................................................................... ............................... F-4

ModeSelection Strategy ................................................................................. ............................... F-4

DragCondition ............................................................................................... ............................... F-5

ThrustCondition ................................................................................................ ............................F-5

Strategy for Setting Target Thrust .................................................................. ............................... F-6

SpeedRegulator .............................................................................................. ............................... F-6

Longitudinal Acceleration Limiter .................................................................... ............................F-7

HeightRegulator ............................................................................................. ............................... F-7

Definitionof H Mnx ......................................................................................... ............................... F-7

Subscripts........................................................................................................ ............................... F-7

Fixed Speed and Altitude Targets ................................................................... ............................... F-7

• Command Capture Axiom .......................................................................... ............................... F-8

• Command Hold Axiom .................................................................................. ............................F-8

PERFORMANCE DEGRADATION .................................................................... ............................F-8

LemmaA ........................................................................................................ ............................... F-8

LemmaB ........................................................................................................ ............................... F-9

Theorem I (Performance Degradation Theorem) ......................................... ............................... F-1 1

vii
APPENDIX F

THEOREMS ON SYSTEM BEHAVIORAL PROPERTIES (continued)

RECOVERY FROM ABNORMAL CONDITIONS ...................................................................... F-1 I

LemmaC ..................................................................................................................................... F-12

LemmaD ..................................................................................................................................... F-14

Initial Conditions for-APE (7) --,(PE (V) Recovery .....................................................................F-15

DynamicalAnalysis .....................................................................................................................F-16

Theorem 2 (—,PE (7) --,(PE (V) Recovery Theorem) ................................................................... F-17

ProofAutomation ........................................................................................................................ F-22

Theorem 3 (PE (7) (PE (V) Recovery Theorem) .........................................................................F-23

Theorem 4 (-,PE (y) (PE (V) Recovery Theorem) ......................................................................F-25

EFFECTIVENESS OF ALTITUDE COMMAND SUPERMODE ................................................F-26

Theorem 5 (Altitude Command Supermode Effectiveness Theorem) ........................................ F-26

CORRECTION OF A DESIGN OVERSIGHT ...............................................................................F-29

ErrorIdentification ...................................................................................................................... F-29

Strategy for Setting Target Thrust ............................................................................................... F-29

Correctionof Error ...................................................................................................................... F-30

Discussion.................................................................................................................................... F-30

CONCLUDING REMARKS ...........................................................................................................F-31

REFERENCES................................................................................................................................ F-31

LIST OF FIGURES

Figure F-1. Conditions for APE (y) —,(PE (V) Recovery ................................................................. F-15

LIST OF TABLES

Table F-1. Original Strategy for Setting Target Thrust .................................................................. F-29

Table F-2. Revised Strategy for Setting Target Thrust ....................................................................F-30

APPENDIX G

SELECTED TRANSPORT AIRCRAFT ACCIDENTS AND INCIDENTS

L-101 1, EVERGLADES, 1972 ........................................................................................................ G-1

B-767. SAN FRANCISCO, LATE 1980s ........................................................................................ G-1

B-737, DENVER, EARLY 1990s .................................................................................................... G-2

A-330, TOULOUSE, JUNE 1994 .................................................................................................... G-2

REFERENCES................................................................................................................................. G-3

viii
LIST OF ACRONYMS

AFS Autoflight system

ATC Air traffic control

CDU Control display unit

EAS Equivalent airspeed

EGT Exhaust gas temperature

EPR Exhaust pressure ratio

FAA Federal Aviation Administration

FMS Flight management system

ILS Instrument landing system

MCP Mode control panel

QSRA Quiet short-haul research aircraft

TAS True airspeed

VNAV vertical navigation

LIST OF SYMBOLS

English Symbols

a = a (H) Sonic velocity, ft/sec

aNLIM Normal acceleration limit, 3 ft/sec`

AR = b`/S Wing aspect ratio, dimensionless

b Wing span, ft

CL Lift coefficient, dimensionless

Cpp = Cpp (M) Parasite drag coefficient, dimensionless

dH/dt Rate of change of height H, ft/sec

(dH/dt)() Threshold rate of change of height H, 250 ft/min

dV/dt Rate of change of airspeed V, ft/sect

dy/dt Rate of change of flightpath angle y, rad/sec

D Drag, lb

e = e (M) Span efficiency, dimensionless

g Acceleration of gravity, ft/sect

H Height in Standard Atmosphere, ft

Ho Altitude deviation threshold, ft

AH Altitude error, ft

ly Pitch moment of inertia, slug/ft2

ix
LIST OF SYMBOLS (continued)

English Symbols (continued)

Kv Longitudinal acceleration limiter parameter, dimensionless

L Lift, lb

M = V/a Mach number, dimensionless

MY

Pitching moment, ft-lb

N Engine rpm (revolutions per minute), percent

PO

Standard sea-level barometric pressure, 2116.22 lb/ft2

q Rate of change of pitch angle 0, rad/sec

S Aircraft wing area, ft2

T Thrust, lb

T/6 = f (N, M) Corrected thrust, lb

V Airspeed, ft/sec

V I .; = Via Equivalent airspeed, ft/sec

W Aircraft weight, lb

W/S Aircraft wing loading, Ib/ft2

Greek Symbols

a Angle of attack, rad

7 Flightpath angle, rad

A7 Flightpath angle increment, 3 deg

7POT Trim (equilibrium) flightpath angle, rad

7sPEED Flightpath angle for airspeed control, rad

6 = p/po = 6 (H) Ambient pressure ratio, dimensionless

SELEV Elevator deflection, rad

ST Throttle position, rad

0 Pitch angle, rad

p„ Standard sea-level density, 0.00237691 sl/fr

a - p/po = 6 (H) Ambient density ratio, dimensionless

0 Bank angle, rad

x
LIST OF SYMBOLS (continued)

Subscripts

cMD Commanded

ExP Exponential law

LIM Limited

MAX Maximum

MIN Mll]Imun-I

Mc Minimum control airspeed

PAR Parabolic law

POT Potential (equilibrium or trim) conditions

REF Reference

SAFE Safety envelope limit

TGT Target

Logical Symbols

Equivalence Negation

Logical OR u Logical AND omitted

Implication ==>

xi
LIST OF SYMBOLS (continued)

Logical Conditions

VT = (VTGT ^ VMIN) VT2 = (VTGT > VMAX) 

VT3 = (VTGT < VMIN DRAG)

V I = (V < VMIN DRAG) V2 = (V < VTGT)

V3 = (V VTGT) V4 = (V > VTGT)

Gl -(y=0)

GT I = (yTGT YSAFI:) GT2 = (yTGT ^ YPOT TGT)

GT3 = (yTGT = YPOT TGT) GT4 = (yTGT > YPOT TGT)

GT5 = (yTGT G YPOT MIN) GT6 = (yTGT YPOT MAX)

Q = (yTGT ySPEED MIN) P = (yTGT ^ ySPEED MAX)

DC 1 = (YPOT MIN 0) PF I = (YPOT MAX - YPOT MIN)

TC 1 = (YPOT MAX G 0) TC2 - (YPOT MAX - 0)

TS I = (y G ySPEED MIN) TS2 = (Y > ySPEED MAX)

TT I = (YPOT TGT = YPOT MIN) TT2 = (YPOT TGT = YPOT MAX)

TT3 = (YPOT TGT YPOT MIN) TT4 = (YPOT TGT > YPOT MAX)

DPP = (PRIORITY = SPEED) PP = (PRIORITY = PATH)

PE (V) = — [P TT I ] — [Q TT2] PE (y) = --, (GT6 V I TS2)

H I = (HTGT < HSAFE) H2 ° (HTGT > HMAX)

NE I = [(GT2 v GT3) V4] [GT2 V31

NE2 = [(GT32 u GT4) V2] [GT4 V3]

Xll
APPENDIX A

THE STANDARD ATMOSPHERE

The aerodynamic and propulsive forces acting on an aircraft depend on the local pressure, temperature, density, and sonic velocity that prevail within the atmosphere in the region where the aircraft

operates. It is the purpose of the standard atmosphere to define representative values of these

properties as functions of altitude. It is assumed that the atmosphere is static, and rotates with the

Earth. For current subsonic transport aircraft, the range of interest extends from the surface to about

45,000 ft, while supersonic transport aircraft may operate at altitudes up to 70,000 ft.

BASIC EQUATIONS

The standard atmosphere (Anonymous, 1962) is defined by three basic equations. The hydrostatic

equation

dp= — pgdH (A-1)

relates, in differential form. the pressure p and the density p to the height H, where g is the gravitational acceleration. The equation of state for air as a perfect gas

p = p R T (A-2)

relates the pressure p and the density p to the temperature T, where R is the gas constant for air. The

third equation specifies the temperature variation with height, separating the atmosphere into two

regions within the altitude range of interest.

Troposphere

The lower region, which is termed the troposphere, extends from the surface to an upper limit

termed the tropopause at I 1 km, or 36,089 ft above the Earth's surface. Within the troposphere, the

temperature decreases linearly with height according to the equation

T 

T = T 0 

+ L H 0<_H<_HT (A-3a)

where the parameter L = dT/dH is termed the temperature lapse rate, To is the standard sea-level

temperature, and HT is the tropopause height of 1 1 km.

Stratosphere

Above the troposphere lies an isothermal layer termed the stratosphere, within which the temperature remains constant at the tropopause value

Ts =T

o

 + L H T

H > HT

(A-3b)

A-1
The sonic velocity a is related to temperature by the thermodynamic equation

a = c y R T) (A-4)

where y is the ratio of specific heats for air. Therefore, the sonic velocity is constant throughout the

stratosphere.

DEFINING PROPERTIES AND CONSTANTS

Primary Constants

The following parameters are taken as primary constants (Anonymous, 1962), with the values in

metric (SI) units regarded as the defining values:

g Gravitational acceleration at the Earth's surface at 45-deg latitude,

9.80665 m/sec 2 = 32.17405 ft/sec2

R Gas constant for air,

287.053 joules/kg-deg K = 1716.551 ft-lb/sl-deg R

y Ratio of specific heats for air, 1.40 (dimensionless)

Defining Properties

The following parameters are taken as defining properties for the standard atmosphere:

HT

Height of tropopause, l 1 km = 36,089.2 ft

L Temperature lapse rate dT/dH,

—6.5 deg K per km = —0.00356616 deg R per ft

Ppo

Standard sea-level pressure, 101325 n/m 2 = 2116.22 lb/ft2

(76 cm Hg = 29.9213 in Hg at temperature To = 14.6960 lb/in 2)

To Standard sea-level temperature, 288.15 deg K = 518.67 deg R

(15 deg C = 59 deg F)

Derived Quantities

The following parameters are derived from equations (A-2) and (A-4):

ao Standard sea-level sonic velocity, 340.294 m/sec = 1 1 16.45 ft/sec

p0 Standard sea-level density, 1.22500 kg/m 3 = 0.00237691 sl/ft3

A-2
DEFINING EQUATIONS FOR THE TROPOSPHERE

It will be convenient to normalize the temperature within the troposphere by dividing equation

(A-3a) by the standard sea-level temperature To, defining the dimensionless ratio 0:

0=T/To =1+LH/T 0<_H<_HT (A-5)

Eliminating p from equation (A-1) with the help of equation (A-2), and eliminating T with the help

of equation (A- 3a), the hydrostatic equation (A-1) can be put in the form

dp g dH

p R o+LH

which (neglecting the slight decrease of gravitational acceleration with height) can be integrated

upward from the surface to obtain

P g

In In 1+ 0<_H<_HT (A-6)

P0 LR To / L

Defining the normalized pressure by b = p/po and taking anti-logarithms, equation (A-6) becomes

-g/LR

b = P = 1+ H0 <_ H< H T (A-6a)

p O TO / L

Similarly defining the normalized density by 6 = p/po, the equation of state (A-2) takes the normalized form S = 6 0, so that. making use of equation (A-6a), the normalized density is found to be

-(I+g/LR)

6 - _ 0 -( ( +g/LR) = 1+ H 0<_H<_H

0 T 0 /L T

The normalized sonic velocity p = a/ao is found from equation (A-4):

a

μ = a = ^_ (1+LH/To ) 05H5 HT

(A-7)

(A-8)

0

A-3
DEFINING EQUATIONS FOR THE STRATOSPHERE

Eliminating p with the help of equation (A-2), the hydrostatic equation (A-1) can be put in the form

dp = — g dH

p RTs

which, since the temperature Ts is constant in the stratosphere (equation (A-3b)), can be integrated

upward from the tropopause to obtain

^ H—H

In E _ — T H > H T

(A-9)

PT RTs / g

In the normalized form, equation (A-9) becomes

H—H 8 = ST exp — RT / H > HT (A-9a)

s g

where S-r denotes the normalized pressure at the tropopause. The normalized temperature, density,

and sonic velocity in the stratosphere are given by the equations

T H

0. _ = 1+ T H > H s T T /L T

0 0

S H—H

6= b= T

exp - T H> H T

0 es RTs /g

H>HT

STANDARD ATMOSPHERE TABLE

(A-10)

(A-1 I )

(A-12)

Numerical Constants

Numerical evaluation of the constants in equations (A-1) to (A-12) results in the following values

for English units:

To — 518.67 deg R = _ 145,442 ft

L — 0.00156616 deg R / I't

A-4
g _ 32.1740.5 ft / sec 

LR (-0.00356616 deg R / ft) (1716.551 ft-lb / sl-deg R)

= 5.255913 (dimensionless)

Ts = 518.67 deg R + (-0.00356616 deg R /ft) (36,089.2 ft)

= 389.97 deg R

36.089.2 ft ) 5.255 913

8T = 1 – - = 0.223 359 (dimensionless) 145.442 I't

R Ts – t 1716.551 ft-lb/sl-deg R) (389.97 deg R) – 20,805.7 ft

g 32.17405 ft/sec/sec

Numerical Equations

With these numerical values, the equations for the normalized quantities become

e=1—

Hn

145,442 0<– H <– HT

Ts

0 = 6s = — = 0.751 865 H > HT

T

0

6=^1—

Hit

)5.255913

0<H<_HT

145,442

S = 0.223 359 exp ^– Hi, – 36,089.2 1 H > HT 20,805.7 J

Ht-(

4.255 913

6=^1– OSH<_HT 145,442

6

Hn – 36,089.2 = 0.297 073 exp ^– H > HT 20,805.7

p= ( 1– H n/ 145,422) 0S H<– HT

Ps O s = 0.867 107 H> HT

(A-5)

(A-10)

(A-6a)

(A-9a)

(A-7)

(A-11)

(A-8)

(A-12)

A-5
Tabulated Values

Evaluation of these equations for several selected altitudes between the surface and 45,000 ft results

in the following tabulated values. Comparison with the reference document (Anonymous, 1962)

shows agreement within 5 units in the last place.

STANDARD ATMOSPHERE TABLE FOR SIX SELECTED ALTITUDES

Sea-Level Properties

H, ft T,,, deg R p,,, II)/ft' p,,, AM3 a,,, ft/sec

0 518.67 2116.22 0.00237 691 1 1 16.45

Dimensionless Ratios

9- T/To S- p/p„ a' = p/po g- a/ao

5,000 0.965 622 0.832 047 0.861 669 0.982 661

10,000 0.931 244 0.687 702 0.738 447 0.965 010

15,000 0.896 866 0.564 339 0.629 235 0.947 030

25,000 0.828 110 0.371 089 0.448 116 0.910 006

35,000 0.759 354 0.235 302 0.309 872 0.871 409

45,000 0.751 865 0.145 546 0.193 580 0.867 101

REFERENCES

Anonymous: U. S. Standard Atmosphere, 1962. National Aeronautics and Space Administration,

United States Air Force, and United States Weather Bureau. U.S. Government Printing Office,

Washington, D.C., Dec. 1962.

A-6
APPENDIX B

ELEMENTS OF TRANSPORT AIRCRAFT DESIGN AND OPERATION

INTRODUCTION

The purpose of this appendix is to present a concise, tutorial overview of transport aircraft design

and operation for readers without this background. In particular, the review of aircraft dynamic

response presented in the final section of this appendix supports the discussion of dynamical system

properties in the main report. The treatment is at the level of an introductory course, starting from

elementary principles and using simplifying assumptions commonly used within the aircraft industry

during preliminary design. Readers desiring more detail can consult the references provided.

Only the longitudinal motions of the aircraft within its plane of symmetry are treated by this appendix, but these motions provide the basis for discussing aircraft performance and other reference

material needed for the main report. A nonelementary generalization of the longitudinal equations

for coordinated turning flight is presented in appendix C.

The plan of presentation for this appendix is as follows. After discussing simplified models for the

Earth, the atmospheric environment, and the aircraft structure, the three longitudinal equations of

motion for flight in still air are derived from Newton's second law. A brief discussion then shows

how those equations can be generalized to include the effects of wind and wind shear. The motion of

the aircraft is subject to aerodynamic and propulsive forces, which are analyzed next.

For simplicity, aerodynamic forces are discussed entirely from the experimental viewpoint, avoiding

the complexities of aerodynamic theory. Dimensional analysis is used to simplify experimental

results by identifying the nondimensional combinations of parameters that constitute Reynolds number, Mach number, and the aerodynamic force coefficients. Dynamic similarity based on these

nondimensional parameters enables the aerodynamic forces acting on full-scale aircraft to be predicted from the results of model tests. Aircraft lift and drag characteristics are presented, and a

generic aerodynamic model representative of large transport aircraft is developed.

Propulsive thrust is treated from an experimental viewpoint similar to that for aerodynamic forces.

Dimensional analysis provides the basis for correlating engine manufacturers' data gathered under

various altitude and temperature conditions, and a generic engine model is developed based on

NASA simulation models that is representative of the hig h-bypass-ratio turbofan engines installed

on current transport aircraft. The dynamic response of the engine to throttle control is specified in

block-diagram form.

The steady-state solution of the longitudinal equations of motion is then used to define the performance envelope of the aircraft. The selection of operating points within this envelope that optimize

performance is discussed. The Breguet range equation is derived, and a representative payload-vsrange diagram is constructed to show primary economic influences on design. Brief comments on

airport performance show the influence of wing loading and thrust loading as design parameters.

B-1
The selection of operating points for climb and descent is described, and the performance discussion

concludes with some comments on trajectory optimization for complete mission profiles.

In the final section, the dynamic response of the generic airplane to control is treated in some detail,

and simulation models are developed at three levels of dynamical fidelity. Simulation equations and

block diagrams are provided, and numerical simulation techniques are illustrated by using a widely

available spread-sheet package, enabling interested readers to perform their own dynamic response

calculations. In addition to providing results needed for the main report, it is hoped that such simulations may aid readers, especially those with flying experience, to gain an improved grasp of

transport aircraft dynamic response characteristics without requiring a detailed mathematical understanding of the nonlinear differential equations on which those response characteristics depend.

LONGITUDINAL EQUATIONS OF MOTION

The equations of motion for transport aircraft are obtained by application of Newton's second law to

a rigid aircraft subject to aerodynamic, propulsion, and gravitational forces. Six ordinary differential

equations result, three scalar force equations and three scalar moment equations. Because transport

aircraft are bilaterally symmetric and operate in symmetric (coordinated) flight with near-zero sideslip angles, the six equations of motion are decoupled to form a longitudinal set describing motions

in the plane of symmetry, and a lateral-directional set describing asymmetric motions. This appendix

treats only the longitudinal motions.

Earth Model

The Earth is represented as flat and nonrotating, with uniform gravity independent of latitude and

height (local tangent plane approximation). This simplified Earth model neglects the very small

contributions from Coriolis force encountered in great-circle flight over a rotating Earth, and from

centrifugal "weightlessness" force encountered in flight over a spherical Earth at high speeds

approaching orbital velocity, neither of which is of interest for control of subsonic transport aircraft.

Atmospheric Environment

For flight in still air, the atmospheric environment is completely specified by the properties of the

standard atmosphere, which describes the variations with altitude of ambient pressure, temperature,

density, and sonic velocity (app. A). After discussing the equations of motion for flight in still air, it

is shown how these equations can be generalized to include the effects of steady wind and those of

wind shear. The effects of atmospheric turbulence, which are usually studied by simulation employing suitably filtered random noise, are not treated here.

Aircraft Structural Model

Transport aircraft are not structurally rigid, but the natural frequencies of their structural modes

usually lie far above the frequencies of concern for control, justifying the approximation that elastic

structural deformations can be considered to take place instantaneously. This quasi-static approximation enables the airflow to be represented as acting on the deformed aircraft. The gyroscopic effects

of rotating engine machinery are omitted, and the control surfaces of the aircraft are assumed to be

actuated irreversibly, so that they involve no additional degrees of freedom.

B-2
Reference Frames

The frame of reference in which the aircraft motions are described could be taken as fixed in the

Earth, which under our assumptions is an inertial (unaccelerated) frame in which the Newtonian

equations are directly valid. Alternatively, the motion of the aircraft with respect to the Earth can be

described in a reference frame fixed in the aircraft itself (the body frame), with its origin located at

the aircraft center of mass and its three orthogonal axes aligned with the aircraft fuselage and wing

structure (fig. B-l(a)). It is essential to describe the aircraft rotational motions in the body frame to

avoid the appearance of the moments and products of inertia in the equations of motion as timevarying parameters.

For the translational motions of the aircraft, this report uses the path frame, which by definition is

fixed in the aircraft with its origin at the aircraft center of mass like that of the body frame, but with

one of its three orthogonal axes aligned with the aircraft velocity vector, and the other two normal to

it, as illustrated by figure B-1(b). Both the body-frame and path-frame descriptions include acceleration cross-product terms that account for rotation of the reference frame with respect to the Earth.

For wings-level flight, the orientation of the body frame relative to the Earth is specified by the pitch

angle 8 (fig. B-1(a)), and the orientation of the path frame relative to the Earth is specified by the

flightpath angle y (fig. B-1(b)). In still air, the angle of the body-frame longitudinal axis relative to

the airstream, which is termed the fuselage angle of attack (fig. B-1(b)), is given by the equation

a=6—y (B-1)

where the notation is

U Fuselage angle of attack, rad 6 Pitch angle, rad

y Flightpath angle, rad

Choice of the path frame for the translational motions is convenient from two viewpoints. First, the

force description is simplified because. by definition, the aerodynamic streamwise (drag) force and

the normal (lift) force are aligned with the axes of the path frame (fig. B-1(c)). Furthermore, normal

forces contributed by the propulsion system (that is, powered lift owing to thrust inclination) are

small in conventional transport aircraft and can be neglected, together with forces resulting from

interaction of engine efflux with aerodynamic flow. Therefore, both the aerodynamic forces and the

thrust are aligned with the path-frame axes, so that only the gravitational force requires trigonometric transformation.

Second, from the human-factors perspective, the pilot's primary control task can be regarded as the

moment-to-moment control of the aircraft velocity vector in such a way as to realize the mission

objectives summarized by the flight plan. During manual control, the pilot's task is facilitated by

providing separate control of each of the three components of the velocity vector (that is the

directional track angle, the flightpath angle, and the airspeed), and by eliminating dynamical

coupling between these elements. The parameterization resulting from choice of the path frame

contributes to these design objectives.

B-3
I Airstream

X Body

H

X Earth

Z Body

Z Earth

a) Earth frame and body

frame.

X Body

.A -

cx Tangential

X Earth

Normal

Z Earth

b) Path frame aligned with

velocity vector.

Airstream

L

T

c) Force equilibrium.

Figure B-1. Reference frames.

Equations of Motion

Under the assumptions just discussed, the longitudinal motions of the aircraft can be described by

the following three scalar equations (fig. 13-1(c)), which result directly from application of Newton's

second law to a rigid aircraft subject to aerodynamic, propulsive, and gravitational forces, and are

valid during straight (nonturning) flight in still air:

Longitudinal force equation: m aT = T — D — W sin YIN (13-1 a)

Normal force equation: m a N = L — W cos YIN (13-1 b)

d

Pitching moment equation: I , = M (B- lc)

Y dt Y

where the notation is as follows:

English symbols

aT Tangential acceleration, ft/sec2

aN Normal acceleration, ft/sec2

D Drag, lb

g Gravitational acceleration, 32.1741 ft/sec2

Iy Pitching moment of inertia, slug-ft2

L Litt, lb

m Aircraft mass, slug

My Pitching moment, ft-lb

q Pitch rate, rad/sec

T Thrust, lb

VIN Tangential acceleration, ft/sec

W Aircraft weight, lb

Greek symbols

YIN Inertial flightpath angle, rad

The kinematic acceleration a T in the direction of the velocity vector is equal to dV IN/dt, and the

normal (centripetal) acceleration aN toward the instantaneous center of rotation is given by the crossproduct VIN (d71N/dt). Furthermore, the aircraft mass m is equal to W/g. Making these substitutions,

B-4
and dividing the two force equations by the weight W, the longitudinal equations can be put in the

form

1 dVIN — T—D —sin yIN (B-2a)

g dt W

V► N dy'N = L —Cos 

YIN

(B-2b)

g dt W

I dq = M y, (B-2c)

A formal derivation of these equations using vector methods is presented in appendix C, which generalizes the equations for coordinated turning flight. It should be noted that, in still air, the airspeed

V coincides with the inertial velocity V IN , and the flightpath angle yrelative to the airmass coincides

with the inertial flightpath angle YIN.

Wind and Wind Shear

For a steady tailwind acting in the streamwise direction along the velocity vector, the airmass moves

uniformly with respect to the Earth, so that the airspeed V is related to the inertial velocity V IN by

the Galilean transformation

VIN = V + w (B-3a)

where the notation is as follows:

V Airspeed, ft/sec w Tailwind component of wind velocity, ft/sec

Because the tailwind is assumed to act in the streamwise direction, the flightpath angle y relative to

the airmass continues to coincide with the inertial flightpath angle Y IN . It can be seen that the substitution of equation (B-3a) into equation (B-2a) does not produce additional terms, since the time

derivative of the tailwind w vanishes for a steady wind.

If the airmass accelerates instead of moving uniformly, or if the wind field varies with altitude so

that the aircraft encounters changing winds during climb or descent, then substitution of equation

(B-3a) into equation (B-2a) causes an additional term involving the wind shear dw/dt to appear in

the longitudinal (streamwise) force equation:

1 dV_ T — D I dw

g dt

W — sin YIN g dt

(B-3b)

In an increasing tailwind, the wind shear term (1/g) dw/dt on the right side of equation (B-2a) acts to

reduce airspeed in the same way as a drag increase or a thrust reduction. Since the lift L in equation

(B-2b) is proportional to the square of airspeed, the loss of lift owing to reduced airspeed results in

B-5
downward acceleration, causing the aircraft to settle below its still-air path. Aircraft performance

can be severely degraded. Steady downdrafts have a similar performance-degrading effect on the

aircraft even though the airmass moves uniformly, because level flight relative to the Earth requires

climbing flight relative to the airmass.

In general, for flight in steady horizontal wind and steady vertical draft, the longitudinal equations

of motion remain unchanged in form, provided that the speed and flightpath angle are measured

relative to the airmass. The aerodynamic lift and drag forces and the thrust force are, of course,

referred to the airmass by their definitions. These forces will be examined in detail in the following

sections.

AERODYNAMIC FORCES

Similarity in Fluid Mechanics

The fluid forces acting on a submerged body such as an aircraft are related to the size and shape of

the body, its motion relative to the fluid, and to the physical properties of the fluid by a general

functional relation of the form

f (force, size, shape, motion, fluid properties) = 0

Size and Shape

Body size can be represented by a characteristic length such as the wing span of an aircraft or its

fuselage diameter. Its shape can be represented by dimensionless ratios such as the thickness/chord

ratio that characterizes an airfoil section. In addition to the geometric shape factors that remain fixed

for a given body, shape also involves the angle of attack of the body relative to the fluid flow, which

is defined by the angle between the velocity vector and a longitudinal reference axis fixed in the

bodv. such as the fuselage floor of an aircraft (fig. B-1).

Motion

In general, the motion of the body involves both its velocity and its acceleration relative to the fluid.

In steady motion the acceleration vanishes, and the forces depend only on the velocity of the body

relative to the fluid. If an aircraft maneuvers, the necessary force is generated by changes in the

aerodynamic pressures acting on its surfaces. In subsonic flight, these pressure changes are propagated throughout the flow field near the aircraft, and produce changes in the flow pattern that modify

the forces acting on the aircraft. Therefore, the total force depends in general (that is, in unsteady

flow) on the acceleration of the fluid as well as on its relative velocity.

However, if the aircraft maneuvers slowly enough, the resulting flow-pattern changes can be regarded as taking place instantaneously relative to the velocity changes of the aircraft, so that the aerodynamic forces depend only on the relative velocity of the fluid, and not on its acceleration. This

approximation, termed quasi-steady flow, is justified for transport aircraft by their- limited maneuvering capability.

B-6
Fluid Properties

The fundamental properties of a fluid that InllUence the forces acting on a submerged body are its

density, which influences inertia force, its viscosity, which influences fluid friction (shear) force,

and its compressibility, which influences elastic force. The compressibility of a fluid can be specified by giving the value of sonic velocity. Gravity is not involved, because the buoyancy force

resulting from gravity acts on a submerged body independently of its motion.

Functional Relation

Accounting for size, shape, motion, and fluid properties, the aerodynamic forces acting on transport

aircraft can be expressed symbolically by the following functional equation:

f (F, 1, V, p, v, a, a, body shape) = 0 (B-4)

where the notation is as follows:

F force, lb p density, slug/ft3

I characteristic length, ft v viscosity, slug/ft-sec

V relative velocity, ft/sec a sonic speed, ft/sec

a angle of attack, rad

The nature of this functional relationship can be clarified by dimensional analysis, which enables the

functional dependence of the aerodynamic force to be expressed in nondimensional form.

Dimensional Analysis

The Buckingham a theorem asserts that any function of r dimensional variables involving s fundamental quantities can be reduced to a function of (r — s) dimensionless groups (Bridgman, 1970;

Taylor, 1974). Since there are six unknown dimensional variables involving the three fundamental

quantities mass, length, and time in equation (B-4), it follows from the theorem that the functional

relation can be expressed in terms of three unknown dimensionless groups in the following way:

f (7r I, n,, 1L3, a, body shape) = 0 (B-4a)

where each of the three dimensionless groups tr,. n;,,, it, consists of a product of the dimensional

variables with unknown exponents.

In general, each group involves all except one of the dimensional variables. The choice of the variables in each group is arbitrary, but can be guided by heuristic knowledge. Since it is desired to find

the functional variation of the force F, it is included only in the first group n, to permit its later isolation. Since the force is known experimentally to depend weakly on the viscosity, the latter is

omitted from the first group in order to separate it from the force.

Thus the variables chosen for the first group n, are F, V, p, 1, and a. Denoting their unknown exponents by the symbols i, j, k, and n. dimensional homogeneity requires that the dimension of the

product (F V' p-' I k a°) must vanish. In terms of the fundamental physical quantities mass M, length L,

and time T, the dimensions of the quantities appearing in this product are as follows:

B-7
I n

Dim F = NIL Dim V' = L' Dim p- = MJ Dim a = Ln

T- T L T

By substituting these dimensions into the first product, the following dimensional equation is

obtained:

ML L' M' Lk Ln = M° 0 T° (B-4b)

T T' L3 ' T"

Collecting terms and equating exponents in equation (B-4b) results in the following system of linear

equations in the unknown exponents:

1+j=0 1+i+k+n-3j=0 2+i+n=0 (B-4c)

There are three equations in the folll" unknown exponents i, J. k, and n. Solving for i, j, and k in terms

of n results in the solution

i=-2-n j=-1 k=-2

With these exponents, the n i product becomes

n

(F V-2-n p-1 1 -2 a n ) =

^ (

a) (B-4d) pV-1- V

Since both the factors F/pV2 12 and a/V are nondimensional, they correspond to the n l and n2 groups.

Removing both of the variables F and a from the third dimensionless product 7C3, it becomes

(V' p' l k a"'). The dimensions of the quantities appearing in this product are

m

Dim V' = LI Dim p l = MI Dim I k = Lk Dim 1) _ (B-4e)

T L 121T 111

Solving the dimensional equation in the manner just illustrated to obtain the exponents i, j, and k in

terms of m, the 713 product is found to be

m

)=( pvl

Defining the dimensionless quantities n i , n2 , and ?13 to be

C H =2F/pV`12

M=V/a Re =pV1/u (B-5)

B-8
the functional relation (13-4a) becomes

f (CF, (X, M, Re, body shape) = 0 (B-6a)

Equation (B-6a) can be solved for CF to obtain the nondimensional force equation

Cj: = g ((x, M, Re, body shape) (13-6b)

in which the form of the function g is entirely unrestricted by the dimensional analysis.

Force Coefficient

The nondimensional quantity CF = 2 F/p V2 1 2 is termed the coefficient of the aerodynamic force F.

The quantity 1'- represents a characteristic area that is taken as the frontal area for bodies such as

fuselages and as the wing planform area S for wings and for complete airplanes. The important

quantity p V2/2, which is termed the dynamic pressure, corresponds to the kinetic energy of a unit

volume of air moving at velocity V. The factor of 2 is introduced for convenience without changing

the nondimensional nature of the force coefficient.

Mach Number

The quantity M = V/a is termed the Mach number. It represents the ratio of the inertia force acting

on a fluid element to the elastic force resulting from the compressibility of the fluid. For flight at

Mach numbers less than about 0.3, air can be considered "incompressible'; that is, its density is

nearly constant in fluid flow. At such low Mach numbers, elastic forces are unimportant, so that the

Mach number can be dropped from the functional relation 13-6(b).

Reynolds Number

The quantity Re = pV 1/v is termed the Reynolds number. It represents the ratio of the inertia force

acting on a fluid element to the viscous force. At sufficiently large Reynolds numbers, it is found

experimentally that the force coefficient depends weakly on Reynolds number, which can therefore

be dropped from the functional relation. It is not that viscous effects are unimportant at high

Reynolds number, but that they become insensitive to changes in Reynolds number at the large

values characterizing flight of transport aircraft.

Force Equation

For a given aircraft of known wing, tail, and fuselage shape, the aircraft shape factor is constant and

can also be dropped. By combining the definition of force coefficient with the functional relation

(B-6b) and dropping the Reynolds number and body shape factors as just discussed, the force equation is finally obtained in the form

F = ( p 2 )S CF (a, M) (B-6c)

B-9
The primary airplane force coefficients used in this report are the lift coefficient C L and the drag

coefficient C D, which are defined by specializing equation (B-6c):

L=( p V2 )SCL (a,M) D=( py^ )SCD(a'M) (B-6d)

Moment Equation

Aerodynamic moments acting on an aircraft result from the distribution of aerodynamic forces over

the aircraft surface. By carrying out a similar dimensional analysis with the pitch rate q included as a

separate motion variable, it can be shown that the pitching moment My (equation (B-2c)) can be

expressed in the nondimensional form

M^ _ ( p

V' )S c C M ((x, qLT / V, M, SF, SSTAB) (B-6e)

where c is the wing chord and C M is termed the pitching moment coefficient. The elevator deflection

8L provides pitch control, and the stabilizer deflection SsTAe provides the pitching moment required

for pitch equilibrium (trim) with the elevator faired (Sr; = 0). The pitch rate has been expressed

nondimensionally by multiplying it by the tail arm LT and dividing by the airspeed V. This nondimensional pitch rate corresponds to the change in angle of attack at the horizontal tailplane, which

contributes most of the damping in pitch. For simplicity, pitching moment contributions owing to

thrust are omitted from equation (B-6e).

Dynamic Pressure

An alternate form of the dynamic pressure p V-'/2 can be obtained as follows. Substitute the relation

p = p/RT from the equation of state, where p denotes the ambient pressure, T the ambient temperature, and R the gas constant (app. A). Then substitute V = M a from equation (B-5) to obtain the

relation

( pV2 )=(RT) M2 a--

In a compressible fluid, the sonic speed a is given by the relation a' = ysRT (app. A), where ys

denotes the specific heat ratio (ys = 1.40 for air). With this, the dynamic pressure becomes

( p V^ )= 2` p M 2

(B-6f)

This result could have been obtained directly from the dimensional analysis by choosing pressure

and temperature as fluid properties instead of density and sonic velocity.

B-10
0 0.05 0.10

M <- 0.6

0 10 20

1.50

1.00

-0.50

c

d

U

0 0.50

v

Dynamic Similarity

Because the Mach number and Reynolds number together determine the force ratios acting on each

fluid element, they determine the streamline pattern of the flow around a body such as an aircraft. If

a model having the same shape as an aircraft is placed in a wind tunnel far from the tunnel walls and

tested at the same angle of attack, Mach number, and Reynolds number as those prevailing for the

aircraft in flight, the streamline pattern of the flow around the model will be geometrically similar to

that of the flow around the aircraft. The lift and drag coefficients measured for the model will then

be identical to those for the aircraft (equation B-6b).

This condition of dynamic similarity provides the basis for scaling up the forces measured during

model testing to estimate those acting on the aircraft in flight. The economy of effort resulting from

use of the nondimensional functional relation (B-6a) instead of the dimensional form (B-4) is

impressive. A similar economy of description results from use of the nondimensional parameters in

dynamical modeling and simulation.

Aerodynamic Force Characteristics

The functional forms of the lift and drag coefficients for representative transport aircraft are illustrated by figure B-2, which shows the variations of these coefficients with angle of attack and Mach

number.

Fuselage angle of attack (deg) Drag coefficient

a) Lift curve b) Drag polar

Figure B-2. Aerodynamic force characteristics.

B-1 1
C -

C =C + I) L

DP nARc

(B-7c)

Lift

It can be seen that the variation of lift coefficient with angle of attack is nearly linear for angles of

attack below the stalling angle, which decreases with increasing Mach number (fig. 13-2(a)). Therefore, it can be represented by an equation of the form

CL = (dCL/d(x) (a — (xo) (B-7a)

where m denotes the angle of zero lift, and the lift-curve slope dC L/doe depends on Mach number.

The lift-curve slope can be approximated for transport aircraft by the equation (Shevel1, 1989)

dCL — 27c AR (B-7b)

du 2+1.03AR(1+tan gy A—M^)

where A is the angle of wing sweep and AR is the wing aspect ratio defined in the next section.

Equation (B-7a) is valid for angles of attack less than the stalling angle, for which the lift coefficient

takes on its maximum value C L MAX (fig. 13-2(a)). Representative parameter values for transport aircraft can be found in table 13-1.

TABLE B-1. TRANSPORT AIRCRAFT PERFORMANCE PARAMETERS

N1 _< 0.6 Wing flaps and landing gear retracted

CL MAX = 1.30 CDP = 0.0150 AR = 7.2 e = 0.83

CL MIN DRAG = 0.53 (L/D)MAX = 17.7 Vr MAX = 400 kt

Maximum Midcruise Maximum Normal

takeoff weight landing landing

weight weight weight

W/S, lb/ft '" 150 125 110 90

T/W (static) 0.25 0.30 0.34 0.42

VESTAL,,, kt 184.6 168.5 158.1 143.0

VE MIN DRAG, kt 289.0 263.9 247.5 223.9

Drag

The variation of drag coefficient with lift coefficient is approximately parabolic over the range used

in airline service (fig. 13-2(b)). Therefore, it can be represented by an equation of the form

B-12
where CDP and e depend on the Mach number for M > 0.6 (fig. B-2(b)). The parasite drag represented by CDP is due primarily to skin-friction drag independent of lift.

The second right-hand term of equation (B-7c) represents lift-dependent drag termed induced drag,

which corresponds to the rate of increase of kinetic energy in the trailing vortices that form in the

wake of the aircraft. The dimensionless aspect ratio AR is defined by AR = b `/S, where b is the wing

span and S the wing area. The Oswald span efficiency factor e accounts for the differences between

practical wings and a hypothetical wing of the same span with elliptic spanwise distribution of lift,

for which induced drag is known theoretically to be minimum and the efficiency factor e to be unity.

Representative values of AR and e for transport aircraft can be found in table B-1.

Aerodynamic Performance

The aircraft lift and drag characteristics determine several parameters that are important for aerodynamic performance.

Level-Flight Performance

For steady level flight (dV/dt = d7/dt = 0), equation (B-2a) shows that the thrust T must equal the

drag D. Similarly, equation (B-2b) shows that the lift L must equal the weight W. Expressing the

lift in coefficient form (eq. (B-6d)) and using the alternate form for the dynamic pressure q,

(eq. (B-6f)), the lift equation for steady level flight can be put in the form

L=(ys pM2 /2)SCL =W (B-7d)

Solving this equation for M and expressing the atmospheric pressure p in the nondimensional form

6 P0) (eqs. (A-6a), (A-9a)), the Mach number required for steady level flight is found to be

M= (?/7^ p) (W/S) (l/CL ) _ ( 2/7s PO) ( W/S) 0/CL )

(B-7e)

The important parameter W/S is termed the wing loading. Physically, the wing loading represents

the weight supported by each unit area of wing surface. Representative parameter values can be

found in table B-1. Similarly, by expressing the dynamic pressure ryas pV 2

/2 and solving the lift

equation for the airspeed V, the airspeed required for steady level flight is found to be

V = V(21p) (W/S) (I/C L ) _ V(2/p)) ) (W/S/6) (I/CL ) (B-7f)

Stall

The stalling airspeed VSTALL is found by substituting the maximum lift coefficient into equation

(B-7f):

STALL (2/pp) (W/S/(J)/CL MAX (B-7g)

B-13
Representative values of the parameters CLMAx and VsTALL for transport aircraft can be found in

table B-1.

Lift/Drag Ratio

The ratio of lift to drag L/D is an important figure of merit for aerodynamic performance. Since it

follows from the definitions (B-6d) that this ratio is the same in coefficient form as in dimensional

form, it can be seen from figure B-2(b) that the point of maximum L/D is determined by the tangent

line from the origin with smallest slope. The corresponding angle of attack can then be found from

figure B-2(a).

In dimensional form, the parasite drag corresponding to the first right-hand term of equation (B-7c)

is defined from equation (B-6d) to be Dr = (p V2/2) S CDP, and similarly the level-flight induced

drag corresponding to the second right-hand term is

D i =(p V2 /2)SCL ^/nARe=(p V'/2)S[W/(pV-/2) S]2/7rARe

or

Di = I (W/S)/(p V 2 /2)] [W/7rAR e]

Thus Dr is proportional to V 2 , and D I to 1/V2 . Clearly, the total drag D = Dr + D i takes on its minimum value at some intermediate airspeed that will be termed VMIN DRAG.

Minimum Drag

For M <_ 0.6 where the parasite drag CDP and the span efficiency e are independent of Mach number,

this minimizing airspeed could be found by differentiating the total drag D with respect to the airspeed V. Alternatively, the lift coefficient corresponding to minimum drag can be found by differentiating the ratio CD/CL obtained from equation (B-7c) with respect to CL . This minimizing value is

found to be

CL MIN DRAG — AR e C DP ) (B-7h)

By analogy to equation (B-7g), the level-flight airspeed for minimum drag is then

VMIN DRAG — V(2 1p o )( W/S/(Y)/CL MIN DRAG (B-71)

Since for steady level flight D = L/(L/D) = W/(L/D). minimizing the total drag D maximizes the

lift/drag ratio L/D = CL/CD -

By substituting CL MIN DRAG into equation (B-7c), the minimum value of the drag coefficient

CD MIN DRAG is found to be

C D MIN DRAG CDP + 11 AR e C DP /7I AR e = 2 C DP (B-7j)

i

B-14
Equation (13-7j) shows that, at the speed for minimum drag, the parasite drag and the induced drag

are equal. Representative values of CL MIN DRAG, V MLN DRAG, and (L/D)MAX for transport aircraft can

be found in table B-1.

Equivalent Airspeed

The equivalent airspeed VE is defined as the product of the true airspeed V and the square root of the

nondimensional density ratio 6 = p/po (app. A), so that equation ( B-7f) becomes

V = V (2/po) (W/S)/C L

(B-7k)

Expressed in terms of the equivalent airspeed, the stalling speed (equation (B-7g)) becomes

V fi. STALL ::-(2/p U )(W/S)/C (B-71) L MAX

Equation ( B-71) shows that, in terms of equivalent airspeed, the stalling speed is independent of

ambient density, and therefore independent of altitude. The same is true for VMIN DRAG (eq. (B-7i)).

By substituting M = V/a, a = ao ^0, and 6 = ^(8/0) (app. A) into equation (B-7k), the relation

between equivalent airspeed and Mach number is found to be

V,, =v,i(T= Ma[-^G]=Mao J [ ( 6 /0) 1 =Ma o -^6 (B-7m)

where ao = 1 1 16.45 ft/sec = 661.48 kt.

Since the dynamic pressure g, is defined by pV2 /2 = P() = PO VE2/2, structural loads depend on

the square of VI;. At low Mach numbers, the equivalent airspeed VF is approximately the same as

that measured by the aircraft pitot-static system for display to the pilot.

ENGINE MODEL

Thrust Function

The engine thrust can be regarded as a fluid force acting on a submerged body (that is, the engine

itself within its nacelle), so that the thrust is related to the size and shape of the engine, its motion,

and the physical properties of air as its working fluid by a functional relationship of the same kind as

that for the aircraft itself, as discussed previously. Representing the size by a characteristic length

that can be taken as the diameter of the inlet, and taking the rotational shaft speed as a separate

motion variable and pressure, temperature, and viscosity as fluid properties, the thrust can be

expressed symbolically by the following functional equation:

f (T, D, V, N, p, T,, v, shape) = 0 (B-8)

B-15
N=51+0.56T 0<_ 8 <96% T

(B-8c)

where the notation is as follows:

T Thrust, lb p,, Ambient pressure, lb/ft2

D Inlet diameter, ft Ta Ambient temperature, deg R

V Airspeed, ft/sec v Viscosity, slug/ft-sec

N Rotational speed, rev/min (rpm)

The shape factor can be regarded as a large number of dimensional ratios that, taken together,

entirely determine the complex internal geometry of the engine, including all its rotating machinery.

By applying dimensional analysis to equation (B-8), it can be shown (Hill and Peterson, 1992) that

the thrust can be expressed in nondimensional form by the equation

T , = f M, ND , Re, shape

p D- ysRT

(B-8a)

Since the sonic velocity is given by a = 4ysRT;, (equation (A-4), the nondimensional rotational speed

ND / ^ysRT, can be regarded as a measure of the Mach number at the tips of the turbine blades. Just

as for the aerodynamic force functions, it is found that, at the high Reynolds numbers characterizing

engine operation, the thrust is nearly independent of the Reynolds number Re, which can therefore

be dropped from the functional equation.

For a given engine, the inlet diameter D and the shape factors are fixed constants that can also be

removed from the functional equation. Introducing the dimensionless pressure and temperature

ratios 8 ° p/p, and 0 = T,,/To (app. A), the thrust can be expressed by the equation

6=f^M. JO (B-8b)

where the standard sea-level values of pressure and temperature po i and To have been removed.

Equation (B-8b) is useful for correlating engine manufacturers' data gathered under various conditions in flight with the static thrust measured under standard sea-level conditions. The quantity T/6 is

termed the corrected thrust, and the quantity NNO is termed the corrected rpm.

Thrust Characteristics

Turbofan engines are characterized by their bypass ratio, which is the ratio of the mass airflow

passing through the fan to that passing through the core engine. Bypass ratios of 5 to 6 are representative of the engines in use on current transport aircraft. The variation of corrected thrust with corrected rpm typical of such engines during steady-state operation under static conditions (M = 0) is

illustrated by figure B-3, which is taken from a NASA-Ames simulation model. Neglecting details

such as the minor disturbance owing to compressor bleed-valve operation (fig. B-3), this thrust

variation can be represented nondimensionally by the empirical equations

B-16
(To/TsT )/8 = 0.765 [(N/,FO)/100] — 0.34

(T ) rlT,T

)/8 = 17.47 [ 1 — N/rO)1100],

+ 4.04 [(N/J)/ 1001 — 3.07

51 %<— NNIO < 75% (13-8d)

75% <— N/ .v'o 5 100% (13-8e)

where the throttle setting 8r and the rpm N are expressed in percent of maximum, T O/6 denotes the

corrected static (M = 0) thrust, and TsT denotes the manufacturer's rated thrust. The maximum available thrust is taken as 97% of rated static thrust to account for installation losses (Shevell, 1989).

The variation of nondimensional corrected thrust with Mach number at constant corrected rpm can

be approximated by the empirical equations

(T/TST )/8 — [T()/TST)/S] [ 1 — 1.224 M + 1.398 M 2 ] M < 0.3 (13-8f)

(T/TsT )/8 

= [V' T)/6] [0.874 — 0.385 M] M >— 0.3 (B-8g)

where the nondimensional corrected static thrust (To/Ts T)/8 is given by equations (13-8d), (13-8e).

The characteristic decrease of thrust with increase of Mach number results from momentum loss in

the airstream entering the engine owing to deceleration within the inlet, which is termed ram drag.

9000

8000

E 7000

m

Q 6000

i^N

5000

L_

N

0 4000

m

m

av 3000

0

U

2000

Corrected installed gross thrust

versus corrected core speed

• Sea level to 15.000 ft

• No hp bleed (HPBLC = 0)

• 31 6 tan bleed

t-'2 = [1+0.2 M2] HAMB

Mach

Bleed valve number 0

operation

1000

Note: TG = 0 for N2s = 0

0

65 70 75 80 85 90 95 100

Corrected high rotor speed (N2! H2), % rpm

Figure B-3. Variation of corrected thrust with corrected rpm.

B-17
0.8

0.6

U

ro

N

N

0.4 S

0.2

0

0 0.20 0.40 0.60 0.80 1.00

Mach number

Figure B-4. Variation of maximum thrust with Mach number.

Thrust Limits

Equations (B-8d) and (B-8e) do not apply to the maximum available thrust TMAX except at sea level,

because at maximum thrust the physical rpm, not the corrected rpm, must be held fixed at its maximum value. With the physical rpm held constant, the corrected rpm varies with altitude, increasing

according to equations (B-8d) and (B-8e) as the nondimensional temperature ratio 0 decreases with

height until it reaches its minimum value in the constant-temperature stratosphere (table A-1). The

resulting variation of thrust with Mach number is illustrated by figure B-4 for five altitudes ranging

from sea level to 45,000 ft.

The variation of maximum thrust illustrated by figure B-4 is given by the empirical equations

(T MAX /TST )/b = 0.970 — [1.187 — 7.737 (0 " — 1)] M

M < 0.3 (B-8h)

+[1.356 — 8.840 ( 0-112 — 1)] M2

(TMAX /TST )/8 = 0.848 — 0.373 M

+ (0.796 + 2.433 M) (0 - ^^-- —1)

The (0

-1/2 — 1) temperature factors in equations (B-8h) and (B-8i) account for the increase in thrust

owing to the increase in corrected rpm. This temperature factor, which is constant at about 15%

within the stratosphere, approximately compensates the thrust loss owing to ram drag, so that for

M >— 0.3 the maximum thrust is nearly independent of Mach number at 35,000 ft and 45,000 ft

(fig. B-4). Other engine limits such as turbine temperature limits (which are not represented in

figure B-4) may limit available thrust under some conditions.
Thrust Lag

The throttle of a turbine engine controls the rate at which fuel is admitted to the combustion chamber, which must be limited within the fuel control to avoid excessive turbine temperature during

engine acceleration. The resulting limitation of available shaft torque combines with the inertia of

the rotating parts to cause a characteristic lag in the response of rotational shaft speed (rpm) to a

throttle command. For correct physical modeling, a dynamical lag function should be applied to the

shaft rpm to represent the effects of fuel-control limiting and rotational inertia, and the thrust should

then be calculated from this lagged rpm according to the nonlinear equations (B-8c), (B-8d), and

(B-8e).

However, for simplicity the lag function can be applied directly to the thrust commanded by the

throttle, provided that the time constants and rate limits involved are adjusted to represent the actual

lag in the thrust function correctly. Such an adjusted lag function is illustrated by the block diagram

of figure B-5, which is taken from a NASA-Ames simulation model. It can be seen that the thrust lag

is represented by a critically damped second-order system that is equivalent to two first-order exponential lags in cascade, each with a characteristic time constant of 0.5 sec.

The thrust response to abrupt full-throttle step commands, including the effects of the acceleration

and rate limiters (fig. B-5), is illustrated by figure B-6(a). It can be seen that, starting from at least

85% rpm (50% thrust), the thrust response is crisp, reaching full thrust in slightly more than 2 sec.

Thrust command Acceleration limiter Rate limiter

T

v

Gs._.._S!..A+ ^* L ())ENGs C L1 L2 U)ENG

/) TG

TG

25ENG

Engine respoonse characterisitcs

• (t)ENG = 4.0 rad/sec. 4ENG = f .0

• Limiters:

Acceleration

• Upper limit L3 = FCN( T G, . TG

) See logic diagram, figure B-5b. i ss i for rules on use of this limiter.

• No lower limit

Rate

• Upper limit Ll = 0.0925 • TGMAXI}}

TG MAX = ( TG16AMB)MAX C)AMB

• Lower limit L2 = -0.020 ' TG MAX)

Figure B-5(a). Thrust response block diagram.

B-19
Note:

1. A = TGssi - TGi

2.T'_

TG

^ 'IAMB 6AMB MAX

3.Repeat for each engine. i = 1, 2, 3, 4

4.(TG16AMB)MAX Defined by figure B-3

Enter

Exit

Figure 5(b). Acceleration limit logic.

With initial rpm below 78% (30% thrust), fuel limiting increases the lag substantially, with about

8 seconds required to reach full thrust when starting from idle. The thrust response to abrupt

reduced-thrust step commands is illustrated by figure B-6(b).

The degrading effect of thrust lag on control of airspeed is most critical during landing approach,

when the need for precise airspeed control is greatest. During landing approach, extension of landing

gear and wing flaps reduces the lift/drag ratio to about 7 (not represented in table B-1). For a wing

loading of 1 10 lb/ft2 at landing weight, about 26.5% of maximum thrust is required for steady flight

on a standard three-degree approach flightpath angle (equation B-2(a)). It can be seen from

figure B-6 that thrust response would then be somewhat degraded.

B-20
100% ..........................

(6420)

5000 70°x°

(4491

M

a

4000

(3 50%

~ 321C N

3000 L

~ 30% Step thrust commands

zoaQ 

(1926) at i = 2 sec, from initial

level to 1Q0'%°

7000

100% (6420) Step thrust commands

att=2sec

6000

Conditions:

Mach 0.1 with 10°o bleed

7000

6000

1000 (642)

0

0

 10% Conditions:

Mach 0.1 with 10°6 bleed

z 4 6 a 10 12 14

t, sec

a} Acceleration

5000

N

70°0(4491)

L

4000

C7

50°.% (3210)

LH

2000 30°^b (1926)

lQOo

Fuel chop

0 2 4 fi 8 10 12 14

t, sec

b) Deceleration

Figure B-6. Thrust response to throttle steps.

^ 3000

B-21
AIRPLANE PERFORMANCE

Performance of an aircraft in steady flight is determined by the steady -state (equilibrium) solution

of the streamwise and normal force equations (B-2a) and ( B-2b). For simplicity, flight in still air is

assumed. However, as noted previously, the equations of motion remain unchanged in form for

flight in a steady wind, provided that the speed V and the flightpath angle y are measured with

respect to the airmass (eq. (B-3)). In still air, the airspeed V and the aerodynamic flightpath angle y

coincide with their inertial counterparts. In equilibrium flight, the longitudinal acceleration dV/dt

and the normal acceleration V(dy/dt) must vanish, so that, denoting the equilibrium (trim) flightpath

angle by ^'TRIM, the force equations become

'.'ill = (T — D)/W (B-9a)

and

COS ^'TRIM L/W (B-9b)

Expressing the lift, drag, and weight forces in coefficient form (equations (B-6c), (B-6d)), the force

equations become

sin ^'TRIM — W — C ^' (B-9c)

w

and

C

COS ^'TRIM C ( B-9d)

W

where Cr = L/qS, CI, = D/qS, and Cw = W/qS, and the dynamic pressure T is defined as usual by

^- pV2/2, or alternatively by q - yspM `/2 (eq. (B-6f)).

Assuming for simplicity that the drag characteristic of the aircraft can be represented by a parabolic

polar curve ( Shevell, 1989), the drag coefficient Co is given by:

C IS = CnP + C r 2 /1[ AR e (B-7c)

Performance Envelope

The performance envelope of the aircraft is determined by the variation of ^'TRIM with equivalent airspeed or with Mach number, which can be calculated as follows. Substitute equation ( B-7c) into

equation ( B-9c):

sin ^'TRIM — W — Cr l ^ _ CI nAR e

(B-1 Oa)

w w

B-22
Substitute equation (B-7c) into equation (B-1 Oa) to eliminate C:

sin YTRIM — W — 

C DP

— 7>:AR e 

Cos^YTRIM (B- lOb)

W

With the identity cost YTRIM = 1 — sin' YTRIM, equation (B-1 Ob) becomes

T

sin YTRIM 7>rAR e sin -YTRIM — W — CW — 

nAR c

(B- lOc)

w

With Cw = W/qS and 9,= po VI; 2/2, equation (B-10c) becomes, finally,

I W/S _ T _ CDP 2

1 W/S

tiln YTItIM 7LAR e p 0 Vu

-' ^2 sin- YTRIM W W/S pOVE /2- 7LAR e pOVE_^2

( B-1 Od)

For convenience, the notation is repeated as follows:

English symbols

A = a(H) Sonic velocity, ft/sec

AR = b'`/S Wing aspect ratio, dimensionless

b Wing span, tt

C DP = CDP (M) Parasite drag coefficient, dimensionless

e = e (M) Span efficiency, dimensionless

H Height in standard atmosphere, ft

M = V/a Mach number, dimensionless

N Engine rpm, percent

po Standard sea-level barometric pressure, 21 16.22 lb/ftz

q1 Dynamic pressure, Ib/ft2

S Wing area, ft2

T/8 = fn (N, M) Corrected thrust, lb

VI = V^(T Equivalent airspeed, ft/sec

W/S Wing loading, lb/ft'

Greek symbols

6 = p/po = 8(H) Ambient pressure ratio, dimensionless

yTIZIM Trim (equilibrium) flightpath angle, deg

Po Standard sea-level density, 0.00237 691 sl/ft3

6 = p/po = 6(H) Ambient density ratio, dimensionless

B-23
Equation (B-10d) gives the variation of the equilibrium (steady-state) flightpath angle yTRIM with

equivalent airspeed VE, with the thrust T (or, alternatively, engine rpm N) as parameter. It can be

seen that, at a known height H in the standard atmosphere (app. A) and at a selected equivalent airspeed VI ., and with known aircraft parameters T/W, W/S, C DP , AR, and e, equation (13-1 Od) is quadratic in sin 7TRIM and can be solved for yTRIM in closed form. The following parameter values are

representative for a transport aircraft climbing with maximum thrust at sea level at the minimumdrag airspeed (table 13-1):

W/S = 150 lb/ft' CDP = 0.0150 AR = 7.19 e = 0.83

V = 487.9 ft/sec VE = 289.1 kt M = 0.437 T/W = 0.1765

With these parameter values, equation (13-1 Od) becomes

sin 7TRIM — 0.028 286 sine yTRIM — 0.1200 (13-1 Oe)

The numerical solution for sin yTRIM is 17.6766 ± 17.5562, or, since the property sin (•) <_ I rules out

the positive sign,

sin 7TRIM = 0.1204 yTRIM = 6.92 deg

Since yTRIM is small, the exact result differs trivially from the approximation obtained by neglecting

the small sin'` yTRIM term. At this climb angle and airspeed, the lift coefficient, the drag coefficient,

the lift/drag ratio, and the rate of climb are found for reference to be

CL = 0.53 C D = 0.0298 L/D = 17.7 dH/dt = 3524 ft/min

Repeating the calculation over the airspeed range of interest and plotting yTRIM against VE or M

(eq. (B-7m) defines the contour for maximum thrust, which forms the upper boundary of the flight

envelope. The contour for minimum (idle) thrust forms the lower boundary. Contours for intermediate values of thrust can be added as desired to complete the diagram for the aircraft performance

envelope (Innis, Holzhauser, and Quigley, 1970).

A second set of contours corresponding to constant pitch attitude can be constructed in the following

way. Solve equation (B-9d) for the lift coefficient

CL =: cos yTRIM = ( W/q S) cos yTRIM (B-1 Of)

which determines the lift coefficient for any point (VE, yTRIM) within the flight envelope, since yTRIM

is given by the ordinate and the dynamic pressure q' is determined by the abscissa V E or M. Now, the

lift coefficient is related to angle of attack by equation (B-7a), which can be solved to find the angle

of attack corresponding to the selected point. With both the flightpath angle yTRIM and the angle of

attack a known, the pitch attitude 0 can be found from equation (13-1)

B-24
H=a+y (13- 1)

which is valid for wings-level flight.

A representative flight envelope is illustrated by figure B-7. The left-hand boundary corresponds to

the stalling speed, or to the minimum-control speed. The right-hand boundary is determined by

structural limits at low altitude, and by compressibility (Mach) effects at high altitude. The upper

and lower boundaries are determined by the maximum and minimum thrust limits, respectively, as

noted previously. Because at any fixed throttle setting (constant engine rpm) thrust decreases with

speed (eqs. (B-8f) and (B-8g)), the thrust contours take on their maximum values Of 7T•RIM at airspeeds slightly below the speed for minimum drag.

During manual flight, the pilot controls pitch with elevator and engine rpm with throttle. It can be

seen from figure B-7 that the steady-state solution of the force equations (B-2a), (B-2b) for any

combination of control inputs is determined by the intersection of the pitch and rpm contours corresponding to those control inputs. The desired steady-state solution will be termed the target operating

point. The next sections discuss the selection of operating points within the performance envelope so

as to optimize climb, cruise, and descent performance.

W1S = 150 Ib/sq ft T1W = 0.25

10.0000

D

e

5.0000 0

a--

^.

Sea level

Idle RPM

• Lvl flt RPM

• 100% RPM

.... Pitch -3°

•• " •"A " • ". Pitch 0°

• ----4- . Pitch +3°

O Pitch +6"

Pitch +9°

-.^p....- Pitch +12 ^^`..^•^•.^••a'"^..s..^

— 5.0000 , I

, , , i , F , , , !

175 200 225 250 275 300 325

Equivalent airspeed. kt

Figure B-7. Performance envelope.

i

350 375 400

B-25
Cruise Performance

Optimization of cruise performance is a dominant influence in the design of transport aircraft,

reflecting the importance of economic factors. Selection of the cruise operating point, which is based

on maximizing specific range, is examined first.

Specific range

The specific range is defined as the distance flown in still air per unit weight of fuel consumed,

which is found by dividing airspeed by the fuel flow rate:

sr = dR/dF = (dR/dt) / (dF/dt) = V/(dF/dt) = V/c T (B-11 a)

where the notation is as follows:

F Fuel quantity, lb dF/dt Fuel flow rate, lb/hr

R Range, nautical miles (nm) T Thrust, lb

sr Specific range, nm/lb V Airspeed, knots (nm/hr)

c Specific fuel consumption. Ib/hr per lb thrust

Since cruise operation takes place in steady level flight, lift must equal aircraft weight and thrust

must equal drag (eqs. (B-2a), (B-2b). and (B-7c)). The fuel flow rate is proportional to thrust, so that

dF / dt = c T = c D = c L / (L/D) = c W/(L/D) (B- IIb)

By substituting equation (13-1 1 b) into equation (B-1 1 a) and putting V = M a (eq. (B-5)), the specific

range equation can be put in the form

sr = (a/c) M (L/D) (1 /W) (B-1lc)

Since at any fixed altitude the sonic velocity a is constant (eqs. (A-8) and (A-12)), and since for simplicity the specific fuel consumption c is assumed constant. equation (13-1 1 c) shows that maximizing

the specific range requires maximizing the nondimensional product M(L/D).

If the Mach number is restricted to lie below M = 0.6, in the range where compressibility drag is

unimportant and an analytic representation of the drag polar is available (eq. (B-7c), then by expressing M as a function of the lift coefficient CL (eq. (B-7e)), the product M(L/D) could be maximized

by differentiation with respect to CL (compare equation (B-71i)). However, such a result would be

invalidated by the restriction to M <_ 0.6, because the maximum M(L/D) product is reached for

M > 0.6 in the range where compressibility effects on drag are important. For the drag characteristics

illustrated by figure B-2, it can be shown by numerical optimization that the product M(L/D) takes

on its maximum value at M = 0.825, C L = 0.46. For these conditions, the lift/drag ratio is 15.8 and

the product M(L/D) is 13.035.

B-26
Optimal Altitude

Since most transport aircraft operation takes place in the stratosphere where the sonic velocity a is

constant (eq. (A-12)), for simplicity the variation of a at slightly lower altitudes is neglected. Since

the specific fuel consumption c has already been assumed constant, equation (B-1 1 c) shows that

maximum specific range is obtained for maximum M(L/D) independent of altitude. With the maximizing values of M and CL known, equation (B-7e) can be solved for the parameter (W/S)/6, which

will be termed normalized wing loading:

(W/S)/b = ( ,YS P() M'/2) C L

(13- 12a)

Numerically, since ys = 1.40 for air and po = 2116.22 lb/ft-' (app. A), for an aircraft with the drag

characteristics illustrated by figure B-2, and for M = 0.825, C L = 0.46 at the point of maximum

M(L/D), equation (13-12a) becomes

(W/S)/6 = (0.7) (21 16.22) (0.825)' (0.46) = 463.8 lb/ft 2(13- 12b)

This equation shows that, to maintain the normalized wing loading constant as the aircraft weight is

reduced by fuel consumption, the aircraft should climb to a higher altitude at which the normalized

pressure 8 is reduced proportionately. To illustrate this process, several representative combinations

of wing loading and cruising altitude are tabulated in table B-2, relating the altitude to the normalized pressure 8 by solving the standard atmosphere equations (A-6a) and (A-9a) for the altitude H.

The corresponding equivalent airspeed V E is given by equation (13-7m).

TABLE B-2. OPTIMAL CRUISE ALTITUDE

W/S Ib/ft2 ---

' 150----- - - -

125 100

-- -

75

S 0.323 415

-------------------------------------------------------------------------------------------------------------

0.269 513 0.215 610 0.161 708

H, ft 28,110 32,110 36,824 42,809

VE, kt 3103 2833 253.4 219.5

Fortunately, as Shevell points out (Shevell, 1989), the altitude optimum is broad, so that nearmaximum specific range can be achieved without adherin g * closely to the optimal altitude. In

practice, the optimal altitude is approximated by a step-climb procedure.

Maximum range

Since the aircraft weight is reduced as fuel is consumed, so that dF = - dW, in differential form

equation (B-1 1 a) becomes

dR=srdF= -dW

Eliminating the specific range sr with the help of equation (B-1 lc), this becomes

dR = (a/c) M (L/D) (-dW/W) (13-13a)

B-27
Provided that the parameters a, c, and M(L/D) remain constant, equation (13-13a) can be integrated

to obtain the range:

R = (a/c) M (L/D) In (Wo/WF) (13-13b)

where WO denotes the initial weight and W I: the final weight. Equation (13-13b) is known as the

Breguet range equation. In practice, the integration interval is broken into small weight intervals

representing about 1 hour of flight. Within each interval, the integrand parameters can be taken as

constant with good accuracy.

Since WF = WO — Fo = WO (1 — Fo/Wo), where Fo denotes the initial fuel load, the range equation

(13-13b) can be put in the form

R =(a/c) M (L/D) In [WO /(1 — F/WO)] (13-13c)

The parameter F O/Wo is termed the fuel fraction (of the total weight Wo). Similarly defining the

payload fraction by WF/WO and the structure fraction by Ws/Wo, the fuel fraction is given by

Fo/Wo = I (WI,/W0 + Ws/WO ) (B-13d)

where WF is the weight of the payload and Ws that of the empty aircraft with no fuel and only the

crew on board.

Economic influences

To illustrate economic influences on design, the range performance is calculated from equation

(B-13c) for a representative transport aircraft. The following parameter values are assumed for a

maximum-range flight with maximum payload, but with fuel quantity limited by maximum takeoff

weight:

WrIWu = 0.20 WS/WII = 0.46 F /W0 = 0.34 c = 0.65 Oh/hr)/Ih

Allowing for fuel reserves equal to 8% of the zero-fuel weight and for climb and maneuver fuel

equal to 2.45% of the takeoff weight (Shevell, 1989), the fuel fraction available for cruise becomes

(F OI /Wo ) CRUISE 

= 0.34 — 0.08 (0.20 + 0.46) — 0.0245 = 0.2627

Assuming for simplicity that optimal cruise altitude is maintained and that cruise takes place in the

stratosphere, for which (app. A)

a = p ao = (0.867 101) (11 16.45 ft/sec) = 573.6 kt

B-28
the range is given by

R = (573.6/0.65) (0.825) (15.8) In [ l /(1— 0.2627)] (13- 13c)

or

R = 11,500 In 1.3563 = 3505 nm

for maximum payload and maximum takeoff weight.

Assume now that the fuel tanks can be filled to capacity without exceeding the maximum takeoff

weight limit by exchanging half the payload for additional fuel, so that the payload fraction becomes

Wr/Wo = 0.10 and the fuel fraction becomes F OB /Woi = 0.44. Repeating the calculation as before,

( ) / o )cRUJSE = 0.44 — 0.08 ( 0.10 + 0.46) — 0.0245 = 0.3707

and

R = 1 1,500 In [ 1 /(1— 0.3707)] = 5326 nm

with maximum fuel and half the maximum payload.

Finally, assume that the fuel tanks are full with F O , /Wo = 0.44, but that it is desired to ferry the aircraft without payload. After reducing the takeoff weight 10% by removing the half payload of the

previous case, the fuel fraction becomes F OB /Wog = 0.44/0.9 = 0.4889 and the structure fraction

becomes Ws/W„ = 0.46/0.9 = 0.51 1 1. Repeating the calculation,

( F0 / Wo )CRUISE 

= 0.4889 — 0.08 (0 + 0.5 l 11) — 0.0245 = 0.4235

and

R = 1 1,500 In [ 1 /(1— 0.4235)] = 6334 nm

The additional thousand miles of range relative to the case with half payload results entirely from the

reduction of weight.

These results can be summarized in the form of a payload-vs-range diagram (fig. B-8). Despite the

errors resulting from several simplifying assumptions, this diagram gives a good estimate of the

range capabilities of transport aircraft designed for medium to long (transcontinental) range. Very

long range (intercontinental) transports would have a somewhat larger fuel fraction and a smaller

structure fraction, while short range transports would have a smaller fuel fraction, a larger structure

fraction, and a much larger payload fraction.

The sensitivity of operating economics to payload requires that cruise performance be balanced

appropriately with airport performance during the design process, since airport performance (discussed in the next section) limits the maximum takeoff weight. Because the specific range depends

on both aerodynamic and propulsion efficiency factors, as already discussed, and because the structure fraction is an inverse measure of structural efficiency, the payload-vs-range characteristic can be

regarded as a bottom-line indicator of design excellence.

B-29
Optimal cruise altitude Mach number 0.825 LID 15.8

sfc 0.65 ibfhr per lb thrust

Range

Maximum payload capacity ^( 3505 nm

0.20

c

0

U

ZC

a Maximum takeoff weight Range

0 5326 nm

a

0.10

Maximum takeoff fuel capacity \

Range

6334 nm

I

0

0 1000 2000 3000 4000 5000 6000 7000

Range, nautical miles

Figure B-8. Variation of payload fraction with range.

Airport Performance

In addition to the optimization of cruise performance just discussed, a second dominant influence on

transport aircraft design is the need for adequate airport performance, which is subject to safety

requirements imposed by the Federal Air Regulations.

Takeoff field length

The distance X required to accelerate from rest to a speed V X under constant acceleration aX is given

by the well-known formula X = V X2/2aX . The lift-off speed V X is nominally 1.2 VsTALL. With the

stall speed given by equation (B-7g), V X becomes

VX = 1.2 VSTALL 1.2 _I(21p) (W/S)/CL MAX (B-14a)

Disregarding drag and assuming still air for simplicity, the acceleration during the takeoff ground

run is obtained by substituting D = 0 and y= 0 into equation (B-2a):

a X = dVIN /dt = (T/W) g (B-I4b)

Since thrust decreases with speed during the ground run (equations (B-8d) and (B-8f)), the thrust

available at 0.7 V X should be used in equation (B-14b) to obtain the average acceleration (ShevelI,

1989). By substituting equations (B-14a) and (B-I4b) into the formula for constant-acceleration

distance, the takeoff distance required to reach lift-off speed is found to be

B-30
X = ► 1.44 (W/S)/CL MAX ]/pg (T/W) _ ( 1.44/pg) t((W/S)/(T/W))/CL MAX I

(B- 14c)

Despite the errors introduced by simplifying assumptions, it is found that actual takeoff distances are

roughly proportional to the bracketed quantity in equation (B- 14c), which is widely used within the

industry to predict takeoff performance during preliminary design. Even after accounting for the

failure of one engine as required by the Federal Air Regulations, the bracketed quantity serves as a

field-length correlation parameter with surprising accuracy (Shevell, 1989).

Climb Gradient

To ensure safe obstacle clearance after takeoff, the Federal Air Regulations specify the minimum

climb gradient (tan 7) that must be demonstrated both with and without failure of one engine. With

the aircraft drag D and weight W known, the thrust loading T/W necessary to achieve the required

steady climb gradient is found by solving equation (B-2a) for T/W with dV IN /dt = 0:

T/W = D/W + sin 7REQ (B-15)

With the thrust loading T/W fixed by the climb gradient requirements, equation (B- 14c)shows that

the takeoff field length is then proportional to the wing loading W/S.

Landing Field Length

Although the takeoff is essentially a Newtonian process, landing is much more dependent on pilot

technique. The Federal Air Regulations require that a generous safety factor (67%) be added to the

demonstrated landing distance to account for uncertainties. An additional 15% is added for wet

pavement, and an additional safety factor results from prohibiting the use of reverse thrust during

flight-test demonstrations of landing distance. Fortunately, landing field lengths are almost always

shorter than takeoff field lengths, so that landing distance is seldom safety-critical.

Design Overview

Taken together, the desired cruise performance and the necessary airport performance determine the

major elements of transport aircraft design. Readers wishing to supplement the following brief

comments with more detailed discussion can consult Shevell's 1989 text (Shevell, 1989), which

draws on the author's experience as an industry designer to provide an especially clear account.

Readers desiring discussion of operational matters involving pilot technique can consult Davies's

classic Handling the Big Jets (Davies, 1969), which draws on the author's experience as chief test

pilot for the Air Registration Board (U.K.) to provide an interesting discussion of jet transport flying

qualities. Davies's treatment of airworthiness matters is authoritative.

Design for Cruise Performance

Considering first the major design elements determined by optimization of cruise performance, the

parasite drag CDP is proportional to wing thickness, and to the total wetted area of the wing, fuselage, and tail. Induced drag is determined primarily by the wing aspect ratio AR, and by wing taper

and twist, which determine the span efficiency factor e. Compressibility drag at cruising speed is

determined primarily by the airfoil shape and by the angle of wing sweep.

B-31
Design for Airport Performance

The major design elements determined by the required airport performance are the wing loading

W/S and the thrust loading T/W. As already noted, the thrust loading is determined primarily by the

engine-out climb gradient required for safe obstacle clearance after takeoff. Representative thrust

loadings lie near T/W = 0.25 at maximum takeoff weight, slightly less for four-engine aircraft and

slightly more for twin-engine or three-engine aircraft to compensate for their larger engine-out thrust

loss. Since the induced drag dominates the total drag characteristic at takeoff speed, the engine-out

climb gradient of twin-engine aircraft is often improved by increasing the aspect ratio, enabling the

required thrust loading to be decreased. Increasing the installed thrust would increase engine weight

and cost, and could degrade the specific fuel consumption during cruise if the required cruise thrust

were less than about 80% of the maximum thrust available at cruise altitude. Cruise thrust requirements seldom size the engine.

With the thrust loading fixed by climb gradient requirements, the takeoff field length is proportional

to the wing loading W/S (eq. (13-14c)), as already noted. As increased thrust becomes available

through engine development, economic pressure for increased payload tends to increase maximum

takeoff weight proportionately, while maintaining thrust loading constant. If sufficient structural

growth capability ("stretch") is available, wing loading increases significantly as later models of the

aircraft enter airline service, until practical field length limits are reached. As a rough guide, shortrange transports are designed for ranges of 1000 to 2500 nm and takeoff field lengths of 6000 to

8000 ft, with wing loadings up to 120 lb/ft`. Medium- and long-range transports are designed for

transcontinental ranges of 2500 to 5000 nm and takeoff field lengths of 8000 to 10,000 ft, while very

long range transports are designed for intercontinental ranges of 5000 to 7000 nm and takeoff field

lengths of 10,000 to 12,000 ft, with wing loadings near 150 1 b/ft'`.

Balance of Design Factors

A successful transport aircraft design results from balancing competing requirements. To maximize

the M(L/D) product in cruise, the aerodynamicist would like long, thin, highly swept wings with

small surface area, and the smallest practical tail.

To reduce wing structural weight and provide space for fuel tanks, the structural designer would like

short, thick wings, and prefers small sweep angles to avoid problems with structural flexibility.

Resolution of the conflicts between aerodynamic and structural designers for subsonic transport

aircraft usually results in wing thickness about 10% of chord, aspect ratios in the range of 7 to 8, and

sweep angles of 25 to 35 degrees.

To reduce avionics weight and cost and to improve reliability, avionics and flight control designers

would like a large tail that avoids the need for stability augmentation. Resolution of their conflict

with the aerodynamicists is not yet clear, although transport aircraft with near-neutral natural stability are currently in service, and designs that would be unstable without augmentation are being

proposed.

To mitigate the operational penalties for engine failure and avoid the need for extremely high engine

reliability for over-water flight, the propulsion designer would like several small engines, but

reducing the customer's maintenance costs favors two large ones. This conflict seems likely to be

resolved in favor of large twin-engine designs by steady improvement in engine reliability.

B-32
As noted previously, the payload-vs-range characteristic of a transport aircraft is a primary economic

indicator of the capability of the aircraft for its intended purpose, and therefore constitutes an overall

measure of its design excellence. The factors just discussed determine the major elements of each

transport aircraft design. The following section discusses operation of the aircraft so as to minimize

overall time and cost.

AIRPLANE OPERATION

Climb and Descent Operation

The climb and descent operation of transport aircraft is often optimized so as to minimize total fuel

consumption for each flight. For climb, thrust is reduced slightly from takeoff thrust in order to

extend engine life. This reduced thrust setting is termed maximum continuous thrust. Idle thrust is

used for the descent. With the thrust setting determined, climb and descent trajectories are optimized

by selecting the appropriate airspeeds.

Climb

Three different airspeeds may be selected for climb, the choice depending on the quantity to be

maximized. If climb gradient is to be maximized for obstacle clearance after takeoff or for some

noise-abatement procedures, the airspeed for best angle of climb can be obtained from the performance envelope diagram (fig. B-7). As noted previously, the airspeed for best angle of climb lies

slightly below the speed for minimum drag. (Since minimizing drag also minimizes the rate of fuel

consumption, the speed for minimum drag is also the speed that maximizes the time of flight available with a fixed fuel quantity, which is termed endurance. For example, the speed selected for

holding lies near the speed for minimum drag.)

Since the vertical velocity dH/dt is equal to V sin y, the airspeed for best rate of climb lies above that

for best angle of climb. The former airspeed can be found graphically by adding dH/dt contours to

the performance envelope, as illustrated by figure B-9. The airspeed for best rate of climb lies at the

point for which the contour for maximum continuous thrust is tangent to the hyperbolic dH/dt

contours (fig. B-9).

It can be seen that, as available thrust decreases with altitude, the speed for best rate of climb is

reduced, approaching the speed for best angle of climb as the aircraft approaches its ceiling, where

7MAx = 0. In practice, the maximum altitude is usually determined by the need for a small amount of

reserve thrust, which is necessary to enable the aircraft to maneuver. It can be shown that, for coordinated turns, the increased lift required is found by dividing the lift for wings-level flight by the

cosine of the bank angle (app. C). The resulting increase of induced drag (eq. (B-7c)) must be

compensated by increased thrust to avoid loss of airspeed during turns. Independent of excess thrust,

the aircraft's ceiling is limited by stalling or by Mach buffet, because for fixed weight and Mach

number the lift coefficient increases with altitude as atmospheric pressure decreases (eq. (B-7c)).

B-33
W/S = 150 Ib/sq ft T/W = 0.25 Sea level

10.0000 ..................

60 ft/sec

40 ft/sec

a^

5.0000

............. ................. _ ...................

80 ft/sec 10` ^-^ M

100% RPM

dH/dt = 20 ft/sec

Level flight RPM

v

rn

c

ti

r

m

_a

s

rn

u.

0

dH/dt = -20 ft/sec

Idle RPM

e i ` dH/dt 40 ft/sec•'

-55,0000 I 1 t , 4 a- IF I I I I 1 1 1 1

175 200 225 250 275 300 325 350 375 400

Equivalent airspeed, kt

Figure B-9. Performance envelope with vertical velocity contours.

The climb airspeed that minimizes total fuel consumption lies above that for best rate of climb, since

the distance traveled during the climb is directly proportional to the climb speed, while the vertical

velocity is reduced only slightly at speeds somewhat higher than that for best rate of climb

(fig. B-9). In practice, transport aircraft usually climb at constant equivalent airspeed at low altitudes

and constant Mach number at high altitudes. Shevell gives the following schedule for a high-speed

climb for the DC-10 series 10 aircraft (Shevell, 1989):

Altitude, ft 0-10,000 10,000-27,880 > 27,880

VIAS or M 250 kt 340 kt 0.85 M

At the "cross-over" altitude of 27,880 ft, at M = 0.85 the equivalent airspeed is 321.4 kt (eqs. (B-7m)

and (A-6a)). The pilot's indicated airspeed (IAS) is 19 kt higher than the equivalent airspeed in this

case because of the effect of compressibility on the aircraft pitot pressure.

The time to climb is found by evaluating the integral

t = fdH/(dH/dt)

over the altitude range of interest. It is found that the initial climb to the optimal cruise altitude tends

to require about 30 minutes, independent of aircraft weight.

B-34
Descent

As already noted, idle thrust is used for descent. The residual thrust at idle can be neglected. With

T = 0, equation (B-9a) shows that the descent angle is proportional to D/W, so that the distance

traveled during descent is maximized by minimizing drag. Therefore, the descent airspeed is usually

near the speed for minimum drag.

The descent gradient is found by dividing equation (B-9a) by equation (B-9b), which results in the

equation

tan 7TRIM = (T — D)/L = (0 — D)/L = — I/(L/D) (B-16)

Since the angle of descent is small, the lift is approximately equal to the weight (equation (B-9b)).

With L/D = 17.7 for M <— 0.6 (table B-1), the descent gradient is 1/17.7, or, since 1 nm equals

1852 m or 6076.1 ft, the gradient is 6076.1/17.7 = 343.3 ft/nm. Therefore, the distance traveled per

1000 ft of descent is 1000/343.3 = 2.91 11M/ 103 ft. In practice, it is found that 3 nm per 1000 ft is a

good estimate of the descent gradient for most transport aircraft.

Trajectory Optimization

Optimization of climb, cruise, and descent by the methods just discussed does not, in general, result

in the best complete flight profile from takeoff to landing, for two reasons. First, the methods presented have concentrated on minimizing fuel consumption and fuel cost for a fixed range, but have

not considered the cost of time. It is immediately obvious that combining the cost of time with fuel

cost to form a weighted total cost that is to be minimized will lead to scheduled speeds higher than

those that minimize fuel cost alone.

Second, independent optimization of the climb, cruise, and descent flight segments does not necessarily result in optimization of the complete flight profile. In particular, optimization of the cruise

segment has assumed that cruising flight should take place at the optimal cruise altitude. This

assumption is correct for long flights that are dominated by the cruise segment, but for shorter flights

it is found that optimization of a short cruise segment may not determine the optimal profile for the

entire flight. Indeed, since about 30 min is usually required for climb to the optimal altitude, as

already noted, very short trips may not contain any cruise segment whatever. Thus the classical,

quasi-steady optimization methods presented previously can be regarded as approximations valid for

long flights dominated by the cruise segment when fuel cost dominates the total cost.

Modern Optimization

The modern approach to trajectory optimization. which accounts specifically for interaction between

climb, cruise, and descent segments, is accomplished by application of optimal control theory based

on calculus of variations (Erzberger and Lee, 1978; Lee and Erzberger, 1980; Erzberger, 1982). Fuel

savings of 2 to 3 percent can be achieved for short trips, for which quasi-steady approximations are

especially inaccurate. Although the modem approach leads to a mathematically complex problem

that lies beyond the scope of this appendix, the following brief comments indicate the problem

formulation. Readers desiring a detailed treatment can consult the references provided.

B-35
The cost function J to be minimized consists of the sum of the fuel cost and the time cost integrated

over the time of flight:

J = f TiME (f dF/dt + t , ) dt (B- l 7a)

where fc and t, are the unit costs of fuel and time and F denotes fuel quantity. Time is now replaced

as the independent variable in equation (B-17a) by the total energy of the aircraft. This energy-state

approach to performance optimization recognizes that the total energy of the aircraft is increased not

just by climbing, but also by accelerating to cruising speed. The resulting cruise energy is dissipated

during descent and landing. The objective of optimization can then be regarded as the increase and

decrease of total energy in the most desirable way; that is, at least cost (Shevell, 1989).

Specific energy— The total specific energy e of the aircraft per unit weight is the sum of its potential

energy and its kinetic energy:

e = H + V2

/2g (B-17b)

where H denotes altitude, V denotes airspeed, and g denotes gravitational acceleration. Differentiating equation (B-17b), the specific energy rate is given by

de/dt = dH /dt + (V/g) (dV/dt) (B-17c)

Substituting dH/dt = V sin y, equation (B-17c) becomes

de/dt = V [sin y+ (1/g) (dV/dt)] (B-17d)

Recognizing the bracketed quantity in equation (B- l 7d) as the quantity (T — D)/W = sin 7TRiM

(eqs. (B-2a) and (B-9a)), the specific energy rate becomes

de/dt = V (T — D)/W = V sin 7TRiM (B-17e)

By replacing time as the independent variable using the transformation dt = de/(de/dt), equation

(B-17a) becomes

J = fC f ENERGY 

(dF/dt)/(de/dt) de + t C f ENERGY 

I /(de/dt) de (B-17f)

The integration limits in equation (13-17f) are the initial and final values of specific energy, which

are found from the initial and final altitudes and airspeeds using equation (B- 17b), and the maximum

energy, which is discussed next.

Numerical optimization— It is now assumed that the optimal trajectory, which minimizes the cost

function J, consists of, at most, three segments: ( I ) a climb segment characterized by monotonically

increasing specific energy, (2) a constant-energy cruise segment, if any; and (3) a descent segment

characterized by monotonically decreasing specific energy. Within each segment, the scheduled

B-36
airspeed is selected numerically so as to minimize the cost function at each energy level. The optimal thrust schedule can be determined numerically in the same way, but it is found that using

maximum continuous thrust for the climb and idle thrust for the descent is nearly optimal.

The climb segment begins at the initial energy and ends at the maximum (cruise) energy, and the

descent segment begins at the maximum energy and ends at the final energy. The maximum energy

increases with range until the optimal cruise energy is reached, as determined from equation (13-17b)

for the optimal cruise altitude and speed. For shorter trips without a cruise segment, the maximum

energy is determined by the desired total range.

Graphical optimization— Shevell presents a relatively simple graphical treatment of the minimumtime and minimum-fuel climb trajectories that provides insight into the nature of the optimal solutions (Shevell, 1989). The corresponding descent problems could be handled in the same way. For

supersonic aircraft, it is shown that energy-state methods have decisive advantages over classical

methods for trajectory optimization, defining entirely different trajectories that are much more

efficient.

Operation Overview

The planned trajectory of a transport aircraft in space and time can be determined almost entirely by

the considerations of optimization just discussed, which determine the selection of operating points

within the aircraft performance envelope and the schedules of airspeed and thrust to be employed.

Appropriate trajectory-planning optimization algorithms are incorporated within the flight management systems on board current transport aircraft. However, the minimization of cost is also subject

to external constraints imposed by Air Traffic Control (ATC) to provide separation from other air

traffic. In the absence of such external constraints, trajectories can be selected to achieve the unconstrained optimum determined by the methods just discussed. As traffic density increases, optimality

must be sacrificed to a greater or lesser extent as required for separation. In heavy traffic situations,

feasible trajectories can be determined almost entirely by traffic constraints, leaving little freedom

for optimization.

The global problem of optimizing trajectories subject to traffic constraints is extremely complex,

involving, in principle, the trajectories of all aircraft operating within the worldwide air traffic control system. Global optimization must consider criteria related to system capacity and safety, in

addition to the costs borne by aircraft operators. These problems are currently being addressed at the

research level (Erzberger and Nedell, 1989; Erzberger, Davis, and Green, 1993).

Current research indicates that efficient global optimization will require exchange of trajectory

specifications between airborne and ground-based computers. With concurrence of pilots and air

traffic controllers, profile negotiation algorithms will be iterated until convergence is achieved

(Green, Den Braven, and Williams, 1993). It is hoped that future development of well-coordinated

airborne and ground-based systems will enable significant increases in system capacity, improvements in operational safety, and reductions in cost.

B-37
AIRPLANE DYNAMIC RESPONSE

The dynamic response of a transport aircraft to elevator and throttle control depends on the initial

operating point within the aircraft performance envelope. Operating points are selected to realize the

flight profile summarized by the flight plan, as already discussed. Each operating point corresponds

to a steady-state solution of the equations of motion for specified elevator and throttle control inputs,

and the transitions from one operating point to the next correspond to transient solutions of the

equations of motion. Flying-qualities criteria based on pilot evaluation define what is meant by wellshaped responses, which enable smooth, rapid capture of the desired (target) operating point during

manual control.

The following sections examine dynamic response by means of simulation (that is, by numerical

solution of the equations of motion) at three different levels of dynamical fidelity, and interpret various flying-qualities criteria that guide stability and control aspects of aircraft design. Automatic

systems should be designed to achieve response shapes similar to those desired for manual control,

since from the flying-qualities viewpoint it can be taken as axiomatic that behavior that is difficult to

anticipate is difficult to monitor. Readers who wish to skip the details of the simulation calculations

can turn immediately to the discussion in the section "Aircraft Response Characteristics."

Three-Degree-of-Freedom Model

At airspeeds below M = 0.6, compressibility effects are unimportant, as previously noted. In this

speed range, the aircraft lift coefficient is a linear function of angle of attack (eqs. (B-7a) and

(B-7b)), and its pitching moment coefficient can be represented as a linear function of elevator and

stabilizer deflections and of pitch rate, which is proportional to tail angle of attack (eq. (B-6e)).

For M <_ 0.6, the drag coefficient is a nonlinear function of lift coefficient (eq. (B-7c)), and the

dimensional aerodynamic forces and moments are nonlinear functions of airspeed (eqs. (B-6d) and

(B-6e)). At higher Mach numbers, compressibility effects would contribute other Mach-dependent

nonlinearities.

Stability and Control Parameters

For simplicity, it is assumed that the aircraft is initially trimmed in level flight in still air at the

minimum-drag airspeed. The trim condition is specified by the steady-state solution of the equations

of motion (B-2a), (B-2b), and (B-2c). The stabilizer is adjusted to balance the total pitching moment

with the elevator faired (6, = 0). Representative parameter values for a transport aircraft at normal

landing weight at 15,000 ft can be found in table B-3, which also shows how the various partial

derivatives vary with airspeed, VMO denoting the minimum-drag speed. Estimation of these parameters, which makes use of available transport aircraft data, lies beyond the scope of this appendix.

Readers desiring a more detailed discussion can consult standard engineering references dealing

with aircraft stability and control (McRuer, Ashkenas, and Graham, 1973). For simplicity, small

contributions to the aerodynamic forces and to the pitching moment have been neglected. With these

assumptions, the dynamical system corresponding to the longitudinal equations of motion (B-2a),

(B-2b), and (132c) can be represented by the block diagram of figure B-10(a).

B-38
TABLE B-3. TRANSPORT AIRCRAFT STABILITY AND CONTROL PARAMETERS

(1/Iy) aM/ab, _ + 3.61 (V/VMD) 2 rad/sect per rad = + 3.61 (V/VMD)2 deg/sect per deg

(1/Iy) aM/ao = — 3.03 (V/VMD)2 rad/sect per rad = — 3.03 (V/V MD)2 deg/sect per deg

(1/Iy)aM/a(d(x/dt) _ — 0.554 (V/V MD ) rad/sec` per rad = — 0.554 (V/VMD) deg/sect per deg

(1/I Y )aM/aq = — 1.66 ( V/VMD) rad/sect per rad/sec = — 1.66 (V/VMD) deg/sect per deg/sec

(1 /W)aL/a8, _ — 0.97 ( V/VMD),

g's per rad = — 0.0169 (V/VMD)2 g's per deg

(1 /W) al-/au = + 8.65 (V/V MD)2 g's per rad = + 0.151 (V/VMD)2 g's per deg

g/V = 0.0675 (VMD/V) rad/sec per g unit = 3.87 ( VMD/V) deg/sec per g unit

(x; _ — 4.84 deg atrim _ + 1.7825 deg VMD = 476.39 ft/sec

(1/W) T 0.07058 (1/W) aT/a(V/VMD) =-1/71.387

(1/2) (L/D)MnX = 0.028 286 g = 32.174 ft/sect

Block Diagram

The simplified block diagrams of figures 13-10(b), 13-10(c), and B-10(d) are discussed later, and

should be ignored for the present. In figure B-10(a), the solid lines denote parameters appearing in

the equations of motion, starting with the elevator and throttle control inputs at the left. The arrows

indicate the sequence of computation. Each block indicates that the quantity entering that block is to

be multiplied by the parameter within the block. Addition of signals is indicated by small circles

containing a plus sign, with subtraction denoted by minus signs adjacent to the appropriate arrows.

Time integration of the quantity entering a block is indicated by an integral sign within the block.

The symbol D within a block denotes a one-frame delay. (In the spread-sheet implementation to be

described, delayed quantities are taken from the previous row of the spread-sheet table.)

Terminology

It can be seen that the increment of total pitching moment M contributed by the elevator deflection

6, is specified by the parameter amlm , which is termed elevator effectiveness. Similarly, the contribution of elevator deflection to the tail download, which reduces total lift, is specified by the

parameter aL/ab,. The contribution of angle of attack to total pitching moment is specified by the

parameter aM/aa, which is termed static stability. The contribution of pitch rate to total pitching

moment is specified by the parameter aM/aq, which is termed pitch damping. The contribution of

angle-of-attack rate to total pitching moment owing to down wash lag at the tail is specified by the

parameter aM/a(da/dt). The primary contribution to total lift is that owing to the wing, which is

proportional to the lift-curve slope specified by the parameter aL/aee. Representative numerical

values of these parameters, which are marked on figure 13-10(a), can be found in table B-3, as

already noted.

B-39
8STAB OM

r)SSTAB

MO

T

rT q

V -1.66 ()TRifu1

im

VMD

dq

V IY0 dt

M

q 1 H. deg

1.0

D

drx

3.61 ^)M c)M 3.03 <^M dt

O 1) t^Lie r)Ci [)(1 H -

-0.554

8e. deg V

Uw u. deg

-^ 

V MD VMD Q OG fi-

(Xi

-0.0169 ^r1 d^ 0,151 X) 1)

e

V_a

g dt

W0 P ® V IVID g

dt

w VMD V VMD OE

1.0 3.87

cos ad

IL

deg

O

^T•'f' ENGINE

-` MODEL ^

TTRIM• Ib LT T/w 0,07058

WO

w

1.0 Dw

_ 1 riT

71.387 r)(V/VMD}

VMD

T-D 1 dV dV

w dt V, ft/sec

w ^— ^UD)MAX f•)2 VIVID 476.39

D I / W 0.028 286 1)

1/2

Dp / w

(^D}MAx O2 VrVMD

0.028 286

a)

Figure B-10. Longitudinal dynamical system.

B-40
^e Second-order system

—^ PITCH High bandwidth

Time lag - 0.7 sec

6.t

First-order system

ENGINE PATH Medium bandwidth

Time lag - 1.7 sec

T

V First-order system

SPEED Low bandwidth

Time lag >> 1.7 sec

b) Three-degree-of-freedom model.

0

8T ^

I

—" ENGINE PATH

T

V

LEED

c) Two-degree-of-freedom-model.

l7

TV

SPEED

d) Single-degree-of-freedom model.

Figure B-10. Longitudinal dynamical system (concluded).

Functional Description

The arrangement of the block diagram of figure B-10(a) follows certain conventions related to

physical significance. It can be seen that each of the forward paths leading from the elevator and

throttle control inputs 8, and 8r on the left through the integrators to the controlled variables (that

is, the pitch angle 0, the flightpath angle y, and the airspeed V) is drawn from left to right in the

diagram. The other paths drawn from right to left represent feedback that modifies the forces and

moments generated by the control inputs. Considering the forward paths first, the path at the top of

the diagram leading from the pitching moment summation point (marked EM in the diagram) to the

pitch angle 0 on the right corresponds to the solution of the pitching moment equation (B-2c)

dq/dt = M/Iy (B-2c)

since integrating equation (B-2c) twice yields the equation

0 0T RIM + f CI dt OTRIM + f f(dq/dt) dt = BTRIM + f f(MAY ) dt

B-41
Similarly, the forward path at the center of the diagram leading from the lift summation point

marked EL to the flightpath angle 7 on the right corresponds to the solution of equation (B-2b) III

form

7 — 7TRIM + f (gN) [L/W — cos 7] dt

where yTRIM vanishes for initialization in level flight. At the bottom of the diagram, the forward path

leading from the streamwise force summation marked (T — D)/W to the airspeed V on the right

corresponds to the solution of equation (B-2a) III form

V = yTRIM + f b [(T — D)/W — sin 7] dt

where VTRIM = VMIN DRAG = V MDTo derive the angle of attack feedback, the fuselage angle of attack a is formed according to

equation (B-1):

a=8-7 (B-1

The aerodynamic (wing) angle of attack is obtained by correcting for the wing incidence angle a;

between wing and fuselage. The angle of attack feedback contributes to the total pitching moment

EM through the static stability parameter aM/aa, and contributes to the total lift EL through the liftcurve slope aL/aa. Numerically, the pitching moment of inertia ly and the weight W are included in

these parameter values. As already noted, the time derivative of angle of attack da/dt contributes to

the total pitching moment EM through the downwash lag parameter aM/a(da/dt).

At the bottom of the diagram, the airspeed V is fed back to determine the drag/weight ratio D/W as

follows. Expressing this ratio in coefficient form with the help of equation (B-7c),

D/W = C D /C W = C DP /CW + (CL /CW ) CL /n AR e

Normalizing by the minimum-drag lift coefficient CL MIN DRAG = CL MD,

D/W =

L MMD ) LMDMD/CW ) + (CL/CW) (CL MD/n ARe) (CL/CL MD)

According to equation (B-7j),

C DP /CL MD = (C D MIN /2)/ CL MD = ( I/2) (D/L) MIN = ( I /2)/(L/D) MAX

Also, CL MD/CW = (V/VMD )- (eq. (B-7f)), and CL/CW = L/W. Therefore,

D/W = (1/2) (V/V MD) 2 /(L/D) MAX + ( 1/2) (L/W) (VMD/V)`/(L/D)MAX

B-42
where the first term on the right represents the contribution of parasite drag and the second term that

of induced drag, as shown in the block diagram. The remaining airspeed feedback modifies the

thrust according to equation (B-8g), which is valid for M >— 0.3 (V >_ 187.9 kt).

Numerical Integration

The equations of motion can be solved numerically to determine the dynamic response of the aircraft

to any physically realizable elevator and throttle control inputs. If this solution is carried out in real

time, it can provide the basis for piloted simulation. Two numerical integration methods commonly

used for real-time simulation are second-order Adams- Bashforthprediction with Adams-Moulton

correction. or for simplicity, A dams- Bashforth prediction alone (Press et al, 1986). These secondorder prediction-correction methods, which are based on the well-known trapezoidal rule, are much

more accurate for smooth input functions than first-order numerical methods such as Euler integration, and they are also more accurate than higher-order prediction-correction methods for impulsive

inputs such as landing gear loads at touch-down. High-accuracy methods such as fourth-order

Runge-Kutta integration (often available in computation libraries) are too slow for real-time simulation because they require more function evaluations (which must, in general, be performed by timeconsuming table look-up). The integration time step should be made as short as practicable, since

excessive step length degrades accuracy and numerical stability.

In practice, step lengths of 25 msec are representative for transport aircraft simulation. The following sections describe dynamic responses calculated with 25-msec time steps, as implemented by

means of a widely available general-purpose spread-sheet package. The Adams-Bashforth prediction

method is illustrated by example. The response of the aircraft to an abrupt change of elevator deflection, termed an elevator step, is calculated first. To ensure physical realizability, the mathematically

discontinuous step is shaped by multiplying it by a half-period cosine bell of 0.5-sec duration, which

is representative of an abrupt pilot control input.

Calculation of Elevator Step Response

The quantities to be calculated are the aircraft state variables, which are the outputs of the four integrators shown in figure B-iO(a). It may be seen that these four quantities are pitch rate, pitch angle,

flightpath angle, and airspeed.

Pitch response— Since the pitch response has the widest bandwidth and the shortest time scale, pitch

rate and pitch angle are calculated first. The first step is to sum the contributions to total pitching

moment, dividing by the moment of inertia I N- to obtain the pitch acceleration dq/dt (point A in

figure B-10(a)). Since the aircraft is assumed to be in equilibrium (trim) initially, the initial pitchingmoment contributions from pitch rate q and angle-of-attack rate doe/dt both vanish, and the stabilizer

deflection SsTne is adjusted so as to balance the contribution from angle of attack. The pitch acceleration dq/dt at point A corresponds to that on the left side of the pitching-moment equation (B-2c).

Next, the pitch rate q at time t = 0.025 sec (point B in figure B-IO(a)) is found by Adams- Bash forth

prediction.

B-43
If the pitch acceleration were known at time t = 0.025 sec, then the desired pitch rate could be found

by numerical integration of equation (B-2c) using the trapezoidal rule:

q i — q0 + J , (dq/dt) dt = q0 +[(dq/dt) i + (dq/dt)0 ] At/2 (B-18a)

where the subscript 0 denotes the time t = 0, the subscript I denotes the time t = 0.025 sec, and At

denotes the 0.025-sec time step. Since the pitch acceleration (dq/dt), is not known, the AdamsBashforth prediction method estimates it by linear extrapolation:

(dq/dt), = (dq/dt) 0 + [(dq/dt)0 — ( dq/dt)_ l ] (13-18b)

where the subscript —1 has the obvious significance. Collecting terms and substituting equation

(13-18b) into equation (13-18a), the pitching velocity q, becomes

q I = q0 + (3 At/2) (dq/dt) 0 — (At/2) (dq/dt) t (B-18c)

Applying the Adams-Bashforth integration formula (13-18c) to the first time step, for which both

(dq/dt)_ i and (dq/dt)o vanish by the assumption of initial equilibrium, the pitching velocity after the

first step at time t = 0.025 sec is found to be

q i = 0 + (3 At/2) (dq/dt) 0 = (3/2) (0.025) (0.0889) = 0.0033 deg/sec

Next, the pitch angle at time t = 0.025 sec (point C in figure B-10(a)) is found by evaluating the

second integral, again using the Adams-Bashforth prediction formula. By analogy to equation

(B-18c),

01 = 00 + fol q dt = 00 + (3 At/2) q0 — ( At/2) q_t

where 00 = 1.7825 deg (table B-3), and both qo and q 1 vanish by initial assumption. The pitch angle

0 1 at time t = 0.025 sec (point C) is found to be

0 1 = 1.7825 + (3/2) (0.025) (0.0033) — (1/2) (0) = 1.7826 deg

This completes the: pitch response calculation for the first time step. The results are summarized by

table B-4. It can be seen that, with certain exceptions, the columns of the table correspond to the

lettered points A, B, and C identified on figure 13-10(a), and that each row corresponds to one time

step.

B-44
Pitch Pitch Fltpath

rate angle rate

deg/sec deg deg/sec

0.0000 1.7825 0.0000

0.0000 1.7825 0.0000

Fltpath

angle

deg

0.0000

0.0000

Angle of

attack

deg

1.7825

1.7825

0.0033

0.0151

0.0389

0.0774

0.1332

0.2079

0.3025

0.4175

0.5523

0.7061

0.8772

1.0632

1.2614

1.4684

1.6807

1.8943

2.1052

2.3092

2.5022

2.6803

2.8431

2.9924

3.1287

3.2526

3.3648

0.0016

0.0063

0.0137

0.0235

0.0350

-0.0476

-0.0607

-0.0736

-0.0854

-0.0955

-0.1030

-0.1074

-0.1078

-0.1039

-0.0950

-0.0809

-0.0613

-0.0361

-0.0053

0.0309

0.0707

0.1121

0.1549

0.1991

0.2442

0.0001

0.0003

0.0007

0.0014

0.0024

-0.0038

-0.0055

-0.0075

-0.0098

-0.0123

-0.0149

-0.0177

-0.0204

-0.0229

-0.0252

-0.0270

-0.0283

-0.0289

-0.0287

-0.0274

-0.0252

-0.0218

-0.0174

-0.0119

-0.0052

1.7827

1.7834

1.7851

1.7883

1.7933

1.8008

1.8112

1.8251

1.8429

1.8650

1.8917

1.9233

1.9600

2.0019

2.0488

2.1007

2.1572

2.2181

2.2828

2.3508

2.4217

2.4950

2.5706

2.6479

2.7267

7826

7832

7844

7868

7909

1.7970

1.8057

1.8176

1.8331

1.8527

1.8768

1.9057

1.9397

1.9790

2.0236

2.0737

2.1289

2.1892

2.2542

2.3234

2.3965

2.4732

2.5531

2.6360

2.7215

3.4656 2.8094 0.2903 0.0026 2.8068

3.5557 2.8994 0.3370 0.0116 2.8878

3.6356 2.9913 0.3843 0.0218 2.9695

3.7058 3.0848 0.4320 0.0332 3.0516

3.7668 3.1798 0.4799 0.0458 3.1340

3.8191 3.2759 0.5280 0.0596 3.2163

3.8632 3.3730 0.5760 0.0746 3.2984

3.8995 3.4710 0.6239 0.0908 3.3802

3.9285 3.5695 0.6716 0.1082 3.4614

3.9506 3.6686 0.7189 0.1267 3.5418

3.9663 3.7679 0.7658 0.1465 3.6215

3.9759 3.867.5 0.8122 0.1674 3.7001

3.9799 3.9670 0.8579 0.1894 3.7776

3.9786 4.0665 0.9031 0.2125 3.8539

3.9724 4.1657 0.9475 0.2368 3.9289

TABLE B-4. ELEVATOR STEP RESPONSE

Three Degrees of Freedom

Elev Pitch

Time dell accel

sec deg deg/s/s

-0.025 0.000 0.0000

0.000 0.000 0.0000

0.025 0.025 0.0889

0.050 0.098 0.3446

0.075 0.218 0.7471

0.100 0.382 1.2773

0.125 0.586 1.9129

0.150 0.824 2.6293

0.175 1.092 3.4002

0.200 1.382 4.1986

0.225 1.687 4.9966

0.250 2.000 5.7670

0.275 2.313 6.4834

0.300 2.618 7.1213

0.325 2.908 7.6579

0.350 3.176 8.0738

0.375 3.414 8.3523

0.400 3.618 8.4809

0.425 3.782 8.4505

0.450 3.902 8.2567

0.475 3.975 7.8991

0.500 4.000 7.3817

0.525 4.000 6.8014

0.550 4.000 6.2483

0.575 4.000 5.7184

0.600 4.000 5.2115

0.625 4.000 4.7271

0.650 4.000 4.216 4 9 

0.675 4.000 3.8245

0.700 4.000 3.4053

0.725 4.000 3.0071

0.750 4.000 2.6291

0.775 4.000 2.2711

0.800 4.000 1.9323

0.825 4.000 1.6124

0.850 4.000 1.3107

0.875 4.000 1.0268

0.900 4.000 0.7601

0.925 4.000 0.5101

0.950 4.000 0.2761

0.975 4.000 0.0576

1.000 4.000 -0.1458

Elev

deft

deg

0.000

0.000

0.025

0.098

0.218

0.382

0.586

0.824

1.092

1.382

1.687

2.000

2.313

2.618

2.908

3.176

3.414

3.618

3.782

3.902

3.975

4.000

4.000

4.000

4.000

4.000

4.000

4.000

4.000

4.000

4.000

4.000

4.000

4.000

4.000

4.000

4.000

4.000

4.000

4.000

4.000

4.000

B-45
TABLE B-4. ELEVATOR STEP RESPONSE (concluded)

Three Degrees of Freedom

Time Airspeed Long Normal Airspeed Airspeed

change accel accel ratio

sec kt g g kt

-0.025 0.00 0.0000 0.0000 282.25 1.0000

0.000 0.00 0.0000 0.0000 282.25 1.0000

0.025 0.00 0.0000 -0.0004 282.25 1.0000

0.050 0.00 0.0001 -0.0016 282.25 1.0000

0.075 0.00 0.0001 -0.0035 282.25 1.0000

0.100 0.00 0.0002 -0.0061 282.25 1.0000

0.125 0.00 0.0003 -0.0090 282.25 1.0000

0.150 0.00 0.0004 -0.0123 282.25 1.0000

0.175 0.00 0.0005 -0.0157 282.25 1.0000

0.200 0.00 0.0007 -0.0190 282.25 1.0000

0.225 0.00 0.0008 -0.0221 282.25 1.0000

0.250 0.00 0.0009 -0.0247 282.25 1.0000

0.275 0.00 0.0010 -0.0266 282.25 1.0000

0.300 0.00 0.0011 -0.0277 282.25 1.0000

0.325 0.00 0.0011 -0.0279 282.25 1.0000

0.350 0.00 0.0012 -0.0268 282.25 1.0000

0.375 0.00 0.0011 -0.0245 282.25 1.0000

0.400 0.01 0.0011 -0.0209 282.26 1.0000

0.425 0.01 0.0009 -0.0158 282.26 1.0000

0.450 0.01 0.0008 -0.0093 282.26 1.0000

0.475 0.01 0.0005 -0.0014 282.26 1.0000

0.500 0.01 0.0003 0.0080 282.26 1.0000

0.525 0.01 -0.0001 0.0183 282.26 1.0000

0.550 0.01 -0.0004 0.0290 282.26 1.0000

0.575 0.01 -0.0008 0.0400 282.26 1.0000

0.600 0.00 -0.0012 0.0514 282.25 1.0000

0.625 0.00 -0.0017 0.0631 282.25 1.0000

0.650 0.00 -0.0022 0.0750 282.25 1.0000

0.675 0.00 -0.0027 0.0871 282.25 1.0000

0.700 0.00 -0.0032 0.0993 282.25 1.0000

0.725 0.00 -0.0037 0.1116 282.25 1.0000

0.750 0.00 -0.0043 0.1240 282.25 1.0000

0.775 -0.01 -0.0049 0.1364 282.24 1.0000

0.800 -0.01 -0.0055 0.1488 282.24 1.0000

0.825 -0.01 -0.0061 0.1612 282.24 1.0000

0.850 -0.02 -0.0068 0.1735 282.23 0.9999

0.875 -0.02 -0.0075 0.1858 282.23 0.9999

0.900 -0.02 -0.0082 0.1979 282.23 0.9999

0.925 -0.03 -0.0089 0.2099 282.22 0.9999

0.950 -0.03 -0.0096 0.2217 282.22 0.9999

0.975 -0.04 -0.0103 0.2334 282.21 0.9999

1.000 -0.04 -0.0111 0.2449 282.21 0.9998
Flightpath response— The flightpath response is calculated next, because its bandwidth is wider

(and its time scale shorter) than that of airspeed. To begin the calculation of flightpath response, the

lift contributions from angle of attack and from elevator deflection are summed to obtain the total

lift, and divided by weight to find the load factor L/W (point D). After subtracting the cosine of the

flightpath angle y to form the normal acceleration (V/g) (dy/dt) (equation (B-2b)), the normal acceleration is multiplied by g/V to obtain the flightpath rate dy/dt (point E). Finally, the flightpath rate

is integrated using the Adams-Bashforth formula (13-18c) to obtain the flightpath angle 'yat time

t = 0.025 sec (point F). To complete the calculation, the angle of attack a (point G) and angle-ofattack rate da/dt (point H) are updated to time t = 0.025 sec using equation (B-1):

al = 0 1 — 7 1(d(x/dt)I = q — (dy/dt)l

The wing (aerodynamic) angle of attack (point 1) is found by subtracting the fixed wing incidence a;

(table B-3) from the fuselage angle of attack a. This completes the calculation of the flightpath and

angle-of-attack responses for time t = 0.025 sec.

Airspeed response— The airspeed response is calculated last, because it has the narrowest

bandwidth and the longest time-scale. The thrust is evaluated first. It is assumed for simplicity that

the throttle setting and engine rpm are constant, so that thrust is a function of Mach number (or

airspeed) and of altitude (eqs. (B-8d) and (B-8e)). Next, the lift coefficient is found from the load

factor L/W calculated previously (eq. (B-6d)), the drag coefficient is found as a parabolic function of

lift coefficient (eq. (B-7c)), and the dimensional drag force is found as a function of drag coefficient

and airspeed (eq. (B-6d)). The excess thrust T — D is formed and divided by weight to obtain the

quantity (T — D)/W (point J). After subtracting the sine of the flightpath angle y to form the normalized longitudinal acceleration (1/g) (dV/dt) (eq. (B-2a)), the latter quantity is multiplied by g to

obtain the dimensional acceleration dV/dt (point K). Finally, the acceleration is integrated using

the Adams-Bashforth formula (13-18c) to obtain the airspeed V at time t = 0.025 sec (point L).

The airspeed ratio V/V M n is now updated throughout the simulation using the airspeed at time

t = 0.025 sec, completing the response calculations for the first time step. The results thus far are

tabulated in the first three rows of table B-4.

By repeating the entire calculation for 199 subsequent time steps, the first 5 sec of the response of

the aircraft to the specified elevator step is tabulated. The calculations were performed in a few seconds by a Microsoft Excel 3.0 spread-sheet package running on a Macintosh llsi computer. The

dynamic response of the aircraft to any other desired elevator control input could be calculated in a

similar way. The resulting parameter variations are illustrated by figure B-1 1, which is discussed

next.

Aircraft Response Characteristics

The dynamic response characteristics of the aircraft are presented in the form of time histories,

that is, by the variations of the primary response variables with time. The variations of pitch rate,

pitch angle, flightpath rate, flightpath angle, and angle of attack in response to a nose-up step in

elevator deflection are illustrated by figures B-1 1(a) and B-1 1(c), and the associated variations of

airspeeed relative to its initial value and of longitudinal and normal acceleration are illustrated by

B-47
figure B-||(b). Figure E\-||(d) shows the dynamicvariation of flightpath angle with equivalent

airspeed in the same form us that ofthe performanceenvelope of figure B-7.

------ Pitch rate Three degrees of freedom

15.000 Pitch angle

Flightpath rate

Flightpath angle

10.000

Elevator deflection

^

^

^ 5,000

umm

-oMou000 2.000 *.noo *oon 8.000 10.000

Time. sec

Three degrees of freedom

- Airspeed change

-5zw ----

L) -/o,0o

-1s.00

-

-~

/ --`

_

' $ouuu

| ^

| o,2»no s

o

-20,00 -0.2500

oMo xMo *.000 6.000 0000 10,000

Time. sec

b\

Figure B'1 1. Elevator Step response, 10 sec.
rn

c

v 5

L

a.

L

LL

Elevator deflection Airspeed fixed (short-period approximation)

15.000

- - - Pitch rate

Pitch angle

-- - - - Angle of attack

.............. Flightpath Flightpath rate

10.000 — — Flightpath angle

rn ^

n---------- - ------

d 5.000

a

0.000

-5.000

0.000 2.000 4,000 6.000 8.000 10.000

Time. sec

10

C)

Three degrees of freedom

0

200,00 210.00 220.00 230.00

Equivalent airspeed. kt

d)

Figure B-11. Elevator step response, 10 sec (concluded).

B-49
Elevator step response characteristics— It can be seen from figure B-1 1 that the angle-of-attack

response (fig. B-1 1(a)) and the resulting normal acceleration (fig. B-1 1(b)) and flightpath angle rate

(fig. B-1 1(a)) responses all have the same form as that of the initial step in elevator (fig. B-1 1(a)),

but exhibit a time lag of about 1.7 sec relative to the elevator control input. Therefore, elevator

deflection commands normal acceleration. One of the oldest and most important flying qualities

criteria specifies the pilot stick force per g. Desirable values are 6 lb/g for stick-equipped highperformance aircraft, and 30 to 40 Ib/g for transport aircraft equipped with wheel and column.

Figure B-1 1(a) shows that, after an initial transient of about 2.5 sec, pitch rate becomes equal to the

(constant) flightpath angle rate. Therefore, elevator deflection commands pitch rate. Since both pitch

angle and flightpath angle become parallel, steadily increasing ramp functions in the medium term

after the initial transient, figure B-1 1(a) shows that flightpath angle can be controlled by means of

pitch angle. During almost all flying, the fundamental control task is control of the flightpath; control of the aircraft pointing attitude should be regarded as a means to that end. The exceptions are

takeoff and landing, for which the attitude is important in itself to avoid scraping the tail or an

engine nacelle, or landing on the nose gear.

The lag of normal acceleration and flightpath rate relative to elevator deflection, which is inversely

proportional to lift-curve slope, characterizes each aircraft. Since after integration the flightpath

angle response exhibits the same lag relative to that of pitch angle, which is directly visible to the

pilot, control of flightpath angle requires compensation by the pilot for this characteristic lag. The

small initial reversal noticeable in the flightpath response (see the normal acceleration time history

in figure B-1 1 (b)) results from the increase of tail download owing to elevator deflection, which

reduces total lift. This reversal contributes to the total lag of the flightpath response relative to pitch,

and can degrade the flying qualities of some transport aircraft configurations with small tail arms,

especially during high-bandwidth maneuvers such as landing flare that require rapid response. To

summarize, flightpath follows pitch with a time lag that characterizes the aircraft.

At time t = 5 sec an equal and opposite elevator step is applied, which returns the elevator to the

faired position (fig. B-1 1(a)). After the elevator control is neutralized, the pitching motion damps out

smoothly without significant overshoot, and the pitch angle stabilizes in about 2 sec. In the long term

after 7 sec, it can be seen that the aircraft holds the pitch attitude approximately constant. Therefore,

neutral elevator commands constant pitch angle.

These well-shaped, well-damped responses characterize transport aircraft considered to possess

good flying qualities, which facilitate rapid, precise manual control of pitch attitude. These desirable

response characteristics provide the motivation for rate command, attitude hold control augmentation, which can be used to improve the flying qualities of aircraft not possessing desirable natural

response characteristics.

The substantial increase in flightpath angle relative to its initial equilibrium value produces negative

longitudinal acceleration according to equation (B-2a), which is illustrated by the inverse correlation

of longitudinal acceleration infigure B- 11(b) with flightpath angle in figure B-1 1(a). This sustained

longitudinal deceleration integrates to cause airspeed decay (fig. B-1 1(b)). The resulting lift loss

(eq. (B-6(d)) produces the slight droop in pitch angle and flightpath angle visible in figure B-11(a)

B-50
for times after 7 sec. If the thrust were adjusted so as to hold airspeed fixed, the pitch angle and

flightpath angle would remain constant in the long term (fig. B-1 1(c)).

The variation of flightpath angle with equivalent airspeed during the first 10 sec is illustrated by

figure B-1 1(d). It can be seen that the initial trajectory in the (V, y) plane is vertically upward in the

short term, rounding over to the left in the medium term and becoming roughly horizontal in the

long term.

Figures B-1 2(a), (b), and (c) illustrate extension of the time histories of figure B-1 1 to include one

minute of the response. The most striking feature of figure B-12 is the sustained long-period oscillation of pitch angle, flightpath angle, and airspeed, which is termed the phugoid oscillatory mode. It

can be seen from figure B-12(a) that the angle of attack remains nearly constant throughout the

phugoid oscillation.

The elevator steps of figures B- 11 and B-12 are representative of large, coarse maneuvers such as

glide-slope capture at the start of a landing approach. The small, precise modulations of flightpath

angle needed for glide-slope tracking can be achieved by means of elevator pulses, which are

discussed next, after presenting an interpretation of figures B-1 1 and B-12 from an alternative

viewpoint.

Three degrees of freedom

15.0000

Pitch rate

Pitch angle

1 0.0000 ^ ,--.^

5.0000

c '^

p 4 --..---.. a — k. .—^... ,.. ...« ,.. ..,. ... ..,--._—

0.0000 _....a... i i _ _ < e A _ _ a_ _ t a. J a. j J

5.0000

Point of flightpath rate°

—10.0000

0.000 10.000 20.000 30.000 40.000 50.000 60.000

Time, sec

a)

Figure B-12. Elevator step response, 60 sec.

rn

cu

Q1

c

Q

B-51
-30.00

-4o.00

0 10.000 20.000

I I I I

I I I I I I . I

i --0.5000

30.000 40.000 50.000 60.000

Time, sec

b)

Three degrees of freedom

Mach number

.038 0.49 0.42 0.44 0.46 0.48 0.50

10.0000

5.000

0

U-

-5.000

-10000

190.00 200.00 210.00 220.00 230.00 240.00 250.00

Equivalent airspeed, kt

C)

Figure B-12. Elevator step response, 60 sec (concluded).

Three degrees of freedom

40.00 0.5000

30.00 Airspeed change .......... ......... ... .............

Long acceleration

20.00 .............. Normal acceleration 0.2500

10.00 - - - - -

C:

M 0

0

W

-10.00

-20.00 -0.2500

B-52
Frequency dornain- In addition to the time-domain representation of the aircraft dynamical system

made explicit by the block diagram of figure B-10(a), there is a complementary frequency-domain

representation that is discussed in this section. This frequency-domain representation provides an

alternative view of aircraft dynamic response that should be of interest to readers familiar with simple electrical filters, and also motivates the simplifications of the dynamic model to be discussed

later. The discussion begins by simplifying the block diagram of figure B-10(a).

It can be seen from figure B-10(a) that a forward path leads from the elevator control input to the

pitch angle output. A direct path then continues from the pitch angle through the angle-of-attack

feedback to the lift summation point marked Y-L. When considering total lift, the pitch angle

contribution to angle of attack can be regarded as a forward path contribution from elevator control,

although the flightpath angle contribution to angle of attack is a feedback signal. The second

contribution of elevator control to total lift via the tail download is much smaller than the wing lift

contribution, and is neglected for simplicity in the present frequency-domain treatment.

By representing only the forward path from the elevator control input to the pitch angle and then

continuing to the flightpath angle and airspeed outputs, the dynamical system of figure B- 10(a) can

be separated into its essential elements, as illustrated by the simplified diagram of figure B-10(b). It

can be seen that the forward path leading from the throttle control input through the engine model to

its thrust output, and then to the airspeed output, has been treated in the same manner as elevator

control. In figure B-10(b), the same feedback structure as that in figure B- 10(a) is implicit.

From the frequency-domain viewpoint, each of the elementary dynamical systems corresponding to

the blocks in figure B-10(b) can be regarded as a first or second order low-pass filter that acts on its

input signal just as the corresponding electrical filter would, smoothing the input signal by filtering

out its high-frequency components and imparting a characteristic time lag. Numerically, this

characteristic lag is the time required for the exponential response to an abrupt, mathematically

discontinuous input step to reach 63 percent of its steady-state value. As indicated on the diagram

(fig. B-10(b)), the second-order pitch filter has the widest bandwidth and the shortest lag, the firstorder path filter and the second-order engine filter have intermediate bandwidth with a lag in the

order of 2 sec, and the first-order airspeed filter has the narrowest bandwidth and the longest lag.

The dynamic effects of these filters on the response to an elevator step can be seen in figures B- I I

and B-12, which have already been discussed from the time-domain perspective. Regarding the

elevator deflection time history illustrated by figure B-1 1(a) as a long pulse formed by the two equal

and opposite steps discussed previously, it can be seen from figure B-1 I (a) that the pitch filter

smooths this elevator pulse and extends its time duration, with a characteristic overshoot of the

steady-state value and a heavily damped oscillation that results from its second-order nature. The

path filter- then acts on the pitch angle input signal, smoothing it heavily to generate the flightpath

angle signal. The overshoot in the pitch-angle signal is filtered out, but serves to quicken the flightpath response so as to make its lag relative to pitch less noticeable than it would be in the absence of

pitch overshoot.

The first-order speed filter then acts on the flightpath angle signal to generate the airspeed signal

(fig. B-1 i(b)). The airspeed signal is smoothed too heavily for its dynamics to be visible on the short

B-53
time-scale of figure B-1 1(b), but the long-period phugoid oscillation seen in figure B-12 results from

the long lag of the speed filter, which couples dynamically with the pitch filter and the path filter by

means of the implicit feedback paths to generate the phugoid oscillation.

The same kind of frequency-domain analysis could be applied to the response of the aircraft to a

short elevator pulse, which is discussed in the next section from the time-domain perspective. The

frequency-domain viewpoint is addressed again later to enable further simplifications of the dynamic

model.

Elevator pulse response at airspeeds above the speed for minimum drag— The first 5 sec of the

response to a short (1 sec) 1-deg elevator pulse that pitches the aircraft nose-down is illustrated by

figure B-13. The figure shows that, in the medium term after 2.5 sec, both pitch angle and flightpath

angle remain constant after decreasing by about 1/4 deg relative to their initial values. This 1-deg

elevator pulse is representative of the control inputs required to achieve small, precise changes in

flightpath angle during high-precision tasks such as glide-slope tracking. The associated airspeed

increase (fig. 13-13(b)) is too small for the resulting lift increase to affect the pitch angle, flightpath

angle, and angle-of-attack responses seen in figure B-13(a).

Three degrees of freedom

2.0000

1,5000

- -• Pitch rate

Pitch angle

1.0000

Flightpath rate

rn — — Flightpath angle

m

ai 0.5000 Angle of attack

m

a

Elevator deflection

0........ .... .,< .......................................................^

r-

'^ i

–0.5000 t %•

–1.0000

0 1.000 2.000 3.000

Time, sec

a)

Figure B-13. Elevator pulse response, 5 sec.

4.000 5.000

B-54
Three degrees of freedom

0.50 0.0400

Airspeed change

0.40 

----- Long acceleration

Normal acceleration 0.0200

................. .

0.30 =--

0

D)

C N

.0 C

U _ 3

Q3

/ LT

CS

^ 0.20 -0.0200

Q

0.10 -0.0400

- .; I , 1 -0.4600

1.000 2.000 1000 4.000 5.000

Time. sec

b)

Figure B-13. Elevator pulse response, 5 sec (concluded).

However, extending the time histories of figure B-13 to include 60 sec of response, as illustrated by

figure B-14, reveals the characteristic phugoid oscillation seen previously in figure B-12. Pilots

suppress this phugoid oscillation by applying elevator control so as to stabilize pitch angle. This

pilot control input can be approximated by holding pitch angle fixed for all times after 4.65 sec, as

illustrated by figure B-15. (The time 4.65 sec was selected by choosing a time before the phugoid

response has developed significantly, and for which the pitch rate vanishes.) It can be seen from

figure B-15(a) that stabilizing the pitch angle completely suppresses the phugoid oscillation. As the

airspeed increases because of the sustained longitudinal acceleration resulting from the decrease in

flightpath angle (fig. 13-15(b)), the long-term increase in lift causes the flightpath angle to increase

(fig. 13-15(a)). With pitch fixed. the angle of attack decreases, reducing lift until the decreased lift

resulting from the angle of attack decrease equilibrates the increased lift resulting from the airspeed

increase. In the long term, it can be seen that the flight condition becomes stable, with the aircraft in

equilibrium at the higher airspeed. It should be noted from figure B-15(a) that, with pitch stabilized,

most of the initial flightpath increment is destroyed by the long-term response, almost nulling the

effect of the control input.

B-55
Three degrees of freedom

2.5000

2.0000

1.5000

-----------------

............. . .................

- ------------------------------------

........................................................ Pitch rate

Pitch angle

1.0000 .............. Flightpath rate

Flightpath angle

0.5000 - - - - - Angle of attack ai

rn

C — — — — — — —

0 -------------- —— ------- -----------

T

-0.5000

-1.0000

-1.0000

0 1.000 2.000 3.000 4.000 5.000

Time, sec

a)

Three degrees of freedom

1.00 0.0200

........

..... ..........................

0.50

.......... .............

- - - - - - - - - - - - .......... - 0

...........

...............

0 -0.0200

Airspeed change

0.50 Long acceleration -0.0400

Normal acceleration

-1.00 -0,0600

0 10.000 20.000 30.000 40,000 50.000 60.000

Time. sec

b)

Figure B-14. Elevator pulse response, 60 sec

B-56
^

o

1,0000 Pitch angle

Flightpath rate

Flighipath angle

^

CL

^

1.00

n

^

Pitch angle fixed after 4.65 sec

»--'»M|mDRAG

eoouo

Angle of

| ^

att ack

-----------------------------—stable

--_---_________________________

1.5000

V

Flightpath

A- angle

stable

-0.50oo

o 20.000 *umm 60m00 80.000 100.000 120.00

Time, sec

a)

Pitch angle fixed after 4,65 sec

o -oosnn

o 20.000 40m00 60.000 80,000 100m00 120,000

Time. sec

ID)

Figure B'15. BeV8t0[ pulse [88DODSe. 115 S8C. 0 fixed after 4.65 S8C, V V"|m oRAn-
0.44

0.1000

mm

d

rn

cm

L

m -0.1000

a

.c

rn

LL

-0.2000

0.45

222.00 224.00 228.00

Equivalent airspeed, kt

C)

0.46

240.00 230.00

-0.3000

220.00

Pitch angle fixed after 4.65 sec

Mach number

Figure B-15. Elevator pulse response. 115 sec, Of ixed after 4.65 sec, V >_ VM,N DRAG (concluded).

If the pitch angle is controlled so as to maintain this flightpath increment fixed, the response of the

aircraft is illustrated by figure B-16. The figure shows that, in the medium and long term after time

2.7 sec (selected for vanishing flightpath rate), the flightpath angle remains fixed. Figure B-16(a)

shows that a slow decrease in angle of attack is required to hold flightpath angle fixed. With path

angle fixed, the time history of pitch angle (not illustrated) has the same form as that of angle of

attack. Again the aircraft stabilizes in the long term just as for fixed pitch (compare figure B-15),

although a much longer time is required to reach equilihrium. (The very long 10-sec integration step

used after time 5 sec was selected for computational convenience in the spread-sheet implementation. With these smooth functions, trials with shorter steps showed no significant error owing to the

long step, and in any case, the final equilibrium condition is independent of the trajectory by which

it is reached.) The variation of tightpath angle with airspeed illustrated by figure B-16(c) consists of

an initial vertical segment and a final horizontal segment without visible rounding, a consequence of

the effect of the large airspeed change on the scaling of the abscissa.

B-58
50.00

40.00

30.00 ai C

c

L

U

a

m

d

CL 20.00

a

10.00

0.0050

0.0040

0.0030

c

7

t7

0.0020

0.0010

Flightpath angle fixed after 2.7 sec

2.0000

Flightpath angle

1.5000 ti

----- Angie of attack

1.0000

rn

m

rn ^

c `.

Q 0.5000

Angle of

----- --- -_-_--- -__- - -- -- attack

10 sec integration step stable

0

-0.5000

0 500.000 1000.000 1500.000 2000.000 2500.000

Time, sec

a)

Flightpath angle fixed after 2.7 sec

0 [ i0

0 500.000 1000.000 1500.000 2000.000 2500.000

Time. sec

b)

Figure B-16. Elevator pulse response, 2205 sec, y fixed after 2.7 sec, V ^! VMIN DRAGB-59
0.50 0.52

—0.2000

250.00

—0.3000

220.00 260.00

0.46 0.48

230.00 240.00

Equivalent airspeed, kt

0.44

0.1000

rn

d

mmc

ro

is —0.1000

a

t

rn

LL

Flightpath angle fixed after 2.7 sec

Mach number

C)

Figure B-16. Elevator pulse response, 2205 sec, y fixed after 2.7 sec, V >_ V MIN DRAG (concluded).

For fixed flightpath angle (horizontal segment of figure 13-16(c)) lift is equal to aircraft weight

(eq. (B-2b)), so that the normal forces are in equilibrium during the whole time after the path is fixed

at 2.7 sec. The longitudinal acceleration resulting initially from the decrease in flightpath angle is

sustained until it is equilibrated by the increase of parasite drag owing to the airspeed increase

(fig. B-16(b)). The airspeed increase required to reach equilibrium of the longitudinal forces can be

determined from the performance envelope, such as that illustrated by figure B-7. The point of final

equilibrium is defined by the intersection of the appropriate constant-rpm contour with the horizontal I ine corresponding to the fixed flightpath angle. To summarize, figure B-16 shows that, in the

region above the speed for minimum drag, the flightpath can be controlled by means of pitch control

alone, with thrust setting (rpm) fixed. It is otherwise below the speed for minimum drag.

Elevator pulse response at airspeeds below the speed for minimum drag— If the elevator pulse

is reversed in sign so that the aircraft pitches nose-up, its response with pitch fixed after 4.65 sec is

illustrated by figure B-17. It can be seen that, after accounting for the elevator sign reversal, the

response is similar in form to that for the nose-down elevator pulse (compare figure B-15). In

particular, figure B-17 shows that, with pitch fixed, the aircraft stabilizes in the long term at an

airspeed slightly below the speed for minimum drag.

B-60
Pitch angle fixed after 4.65 sec

2.5000

Angle of

attack

stable

2,0000 ------------------------------

'ti1.5000

0

-0.5000 L

0

0

Pitch angle

Flightpath rate

Flightpath angle

Angle of attack

.......... ...................... ........ ............. . .. . .......

20.000 40.000 60.000 80,000 100.000 120.000

Time. sec

a)

Pitch angle fixed after 4.65 sec

OMOO

rn

ai 1.0000

rn

0.5000

Airspeed change

-1.00 Long acceleration 0,0600

.... ... Normal acceleration

ai -2.00 0.0400

rn

-3.00 0.0200

-4,00 ................. .11 ...... I I ........................ 1-.-

------------

- - - - - - - - - - -

1 sec integration step

— - - - - - - - - — - - 0

-5.00 1

1 . I I I t I I I I I I I I , I , I .

1 -0.0200

0 50.000 100.000 150.000 200-000 250.000

Time. sec

b)

Figure B-17 Elevator pulse response, 115 sec, 0 fixed after 4.65 sec, V < VMIN DRAGB-61
0.44

0.3000

0.2000

mv

w

rn

c

L_

m 0.1000

it

L

O>

LL

0.45

221.00 222.00 223.00

Equivalent airspeed, kt

C)

—0.1000

220.00

0.46

224.00 225.00

Pitch angle fixed after 4.65 sec

Mach number

Figure B-17 Elevator pulse response. 115 sec, Of ixed after 4.65 sec, V <_ VM,N DRAG (concluded).

In contrast, if pitch is controlled so as to hold the flightpath angle fixed after 2.7 sec, the response of

the aircraft is illustrated by figure B-18. it can be seen that the aircraft never reaches a stable equilibrium of longitudinal forces. The longitudinal deceleration owing to the initial increase in flightpath angle is sustained by the contribution of induced drag, which as previously noted increases with

decreasing airspeed (fig. B-18(b)). The result is that, with both flightpath angle and thrust setting

held fixed below the speed for minimum drag, the airspeed decreases (fig. B-16(b)) and the angle of

attack increases (fig. B-16(a)) until the aircraft stalls. The time history of the pitch angle required to

hold the flightpath fixed (not illustrated) has the same form as that of angle of attack (fig. B-16(a)).

The important conclusion is that, below the speed for minimum drag, the flightpath angle cannot be

controlled by means of pitch control alone with thrust setting fixed.

By making thrust adjustments that compensate for the increase of induced drag (eq. (B-2a)), the aircraft can be stabilized at a target (V, y) operating point below the speed for minimum drag. On the

performance envelope chart of figure B-7, such a target operating point is defined by the intersection

of the horizontal line corresponding to the selected flightpath angle with the vertical line corresponding to the selected airspeed. It can be shown that, below the speed for minimum drag, such points are

points of unstable equilibrium. To verify this property, note that displacement to a slightly lower

airspeed by some disturbance would result in airspeed divergence to the stall, just as that illustrated

by figure B-18. Therefore, below the speed for minitnum drag, active control of thrust is required for

stability, with significantly increased pilot workload during manual control.

B-62
0

-20.00

-40.00

C

—60.00

z:

d

Q

Q -80.00

-100.00

0.0800

-0.0100

-0.0200

0

2

C

c^

Flightpath angle fixed after 2.7 sec

15.0000

----- Angle of attack Stalling

— — Flightpath angle angle of

attack

r

r

10.0000

i

i

rn ^

z7

rn ^'

c

4

^^

5.0000

4-sec integration step

0 t-- — — — — — — i ^77 — — — — — — -

0 200.000 400.000 600.000 800.000 1000.000

Time. sec

a)

Flightpath angle fixed after 2.7 sec

-120.00 I ' -0.0300

0 200.000 400.000 600.000 800.000 1000.000

Time. sec

b)

Figure B-18. Elevator pulse response, 885 sec, yfixed after 2.7 sec, V ^! VMIN DRAGB-63
Flightpath angle fixed after 2.7 sec

Mach number

0.28 0.30 0.32 0.34 0.36 0.38 0.40 0.42 0.44 0.46 0.48

0.4000 I f i

Stalling

equivalent

0.3000 .,.­,...a

-0.1000

140.00 160.00 180.00 200.00 220.00 240.00

Equivalent airspeed, kt

C)

rnmn

ai 0.2000

rn

c

m

L

t].

0.1000

t77

LL

Figure B-18. Elevator pulse response, 885 sec, 7 fixed after 2.7 sec, V >_ VMIN DRAG (concluded).

The pilot technique actually used for glide-slope tracking below the speed for minimum drag, such

as for aircraft carrier landing approach, can be discussed by referring to the performance envelope

chart of figure B-7. It can be seen that any target operating point can be defined by the intersection

of the contour corresponding to the selected thrust setting (rpm) with that corresponding to the

selected pitch angle. Since all points within the performance envelope are points of equilibrium, the

forms of these contours imply that. in the long term, flightpath angle can be controlled by means of

thrust. If flightpath angle is varied by 1/4-deg increments for glide-slope tracking by adjusting thrust,

while pitch angle is held fixed, then figure B-7 shows that the resulting airspeed excursions are small

in the long term. These small airspeed excursions can be controlled as necessary by adjusting pitch,

and the time histories of figure B-17 show that the resulting response is stable. In practice, pitch

control is coordinated with thrust in order to obtain more rapid flightpath response than that resulting

from thrust modulation alone.

Pilots often refer to the airspeed region below the speed for minimum drag, in which total drag is

dominated by the induced drag contribution, as the "back side of the drag curve," and to the control

of flightpath angle by means of thrust and control of airspeed and angle of attack by means of pitch

as "back-side technique." The region below the speed for minimum drag is also termed the region of

reversed command, since above that speed path is controlled with pitch and speed with thrust, as

already discussed. In order to limit the increase in pilot workload required for thrust coordination

below the speed for minimum drag, flying qualities criteria for manual control specify the maximum

slope (that is, dy/dV) of the constant-rpm contours in the neighborhood of the target operating point

B-64
(fig. B-7). Pilot workload can be reduced significantly by means of an autothrottle. The characteristic differences in dynamic response above and below the speed for minimum drag just discussed for

manual control also have fundamental significance for the choice of feedback loop structure within

such automated systems.

Automated control systems— In particular, referring to the three primitive control modes discussed

in the main report, the loop structure chosen for the y-V Command mode feeds back path error to

pitch control and speed error to thrust control. In the y-V Command mode, active thrust control

enables stability to be achieved both above and below the speed for minimum drag. If the thrust

saturates so that active thrust control is no longer available, then the y-V Command mode is invalid,

and one of the other two primitive modes must be selected.

The loop structure chosen for the V Command mode feeds back speed error to pitch control, while

thrust (rpm) remains fixed. The resulting response is qualitatively similar to that illustrated by

figures B-15 and B-17, so that the V Command mode is stable both above and below the speed for

minimum drag, although the path is not constrained.

The other primitive mode available when thrust is saturated is they Command mode, which feeds

back path error to pitch control while thrust remains fixed. Above the speed for minimum drag, the

resulting response is qualitatively similar to that of figure B-16, so that the y Command mode is

stable, although speed is not constrained. Below the speed for minimum drag, the response in the

y Command mode is qualitatively similar to that of figure B-18. It has already been noted that this

response is unstable. If they Command mode were engaged below the speed for minimum drag, the

resulting airspeed divergence could lead to a potentially catastrophic stall. Therefore, flight safety

requires that the associated mode selection logic must prevent its engagement under these invalid

conditions. It is clear that the dynamical behavior illustrated by figures B-15, B-16, B-17, and B-18

is of fundamental importance for the design of automated control systems.

Simplified Models

The remaining task is the development of simplified dynamic models; simplification is facilitated by

returning to the frequency-domain viewpoint discussed previously. Since the three filters for pitch,

path, and speed i Ilustrated by figure B- 10(b) act in cascade, the bandwidth of the response signal at

any point in the diagram is dominated by the bandwidth of the lowest-bandwidth filter upstream of

that point. Stating the same property in time-domain terms, the high-frequency fluctuations present

in the pitch angle signal at the output of the pitch filter are not observable in the flightpath response,

because these high-frequency details are filtered out by the heavy smoothing of the path filter that

lies immediately downstream of the pitch filter. Similarly, intermediate-frequency fluctuations

present in the flightpath signal at the output of the path filter are not observable in the airspeed

signal, because they are filtered out by the extremely heavy smoothing of the speed filter. These

summary statements are justified by the detailed discussion of the time histories of figures B-1 1 and

B-12 presented previously.

Two- Degree-of-Freedom Model

It follows that little change in the flightpath and airspeed signals would result if the pitch angle

signal were drastically simplified. For the aircraft response to the short nose-up elevator pulse illusB-65
trated by figure 13-13(a), if the details of the pitch overshoot and oscillation are neglected, the pitch

response can be approximated by a pitch step shaped by a cosine bell. It was pointed out previously

that the pilot shapes the elevator control input so as to obtain just such a pitch response, thereby

enabling small, precise changes in flightpath angle in the medium term and suppressing the phugoid

oscillation in the long term. If the pitch angle thus specified is regarded as the control input, then

the dynamical system can be represented by the two-degree-of-freedom model illustrated by the

simplified block diagram of figure 13- 10(c). (Throttle control, which is not treated in the examples

selected for this appendix, would add another degree of freedom for thrust, so that the system of

figure B-10(c) would have a total of three degrees of freedom.) The response of this two-degreeof-freedom model to the nose-up elevator pulse of figure B-13(a) is illustrated by figures B-19

and B-20.

Pitch step response — In figure B-19(a), the actual pitch time history of figure B-13(a) is approximated by a step shaped by a 0.5-sec cosine bell. The magnitude of this pitch step is chosen so that

the initial pitch angle and that at time 4.65 sec coincide on the two charts. It can be seen that the two

pitch-angle time histories are nearly coincident over the medium term after 3 sec. Furthermore, the

angle of attack responses seen in the two charts also match fairly well in the medium term. The two

flightpath-angle responses match fairly well over the whole 5-sec interval, with errors that do not

exceed about 0.1 deg anywhere. Comparison of figure B-19(b) with figure B-13(b) shows that the

longitudinal acceleration and airspeed responses match very well over the whole 5-sec interval (note

the expanded airspeed scale).

Two degrees of freedom

2.0000

1.5000

1.0000

m

0.5000

rn

c

Q

0

-0.5000

-1.0000

1.000 2.000 3.000 4.000 5.000

Time, sec

a)

Figure B-19. Pitch step response, 5 sec, two degrees of freedom.

B-66
Two degrees of freedom

.50 r 0.04

.40

Y-----_..----------- - ----------

N

C

l9 L

v

N

C

CL .20

d

10

01

0 2

Time, sec

Airspeed change

----- Long acceleration 0.02

.......... Normal acceleration

------------------------

 0

N

^ C

C7

-0.02

-0.04

i -a.o6

3 4 5

b)

Figure B-19. Pitch step response, 5 sec, two degrees of freedom (concluded).

When the time interval is extended to 115 sec, comparison of figure B-20(a) with figure B-15(a)

shows that, in the medium and long term after 5 sec, the two-degree-of-freedom approximation is

nearly exact for both angle of attack and flightpath angle. Comparison of figure B-20(b) with

figure B-15(b) shows that the same is true for longitudinal acceleration and airspeed. Therefore, if

one is interested chiefly in the flightpath angle and airspeed responses to pitch control, it is evident

that the two-degree-of-freedom model rill serve very well.

Discussion— In particular, this demonstration justifies use of the two-degree-of-freedom approximation for the analysis of mode validity discussed in the main report. For the control system described

there, the 7 Command mode corresponds to control of flightpath angle by means of elevator control

with fixed throttle setting, and the V Command mode corresponds to control of airspeed by means

of elevator control with fixed throttle setting. It has just been demonstrated that, with fixed throttle

setting, both flightpath angle and airspeed responses to elevator control can be approximated satisfactorily by the two-degree-of-freedom model, which replaces specification of the form of the

elevator control time history with specification of the resulting medium-term and long-term pitch

response. The two-degree-of-freedom approximation is therefore valid for both they Command and

the V Command modes.

B-67
Two degrees of freedom

2.0000

Angie of

attack

^i - - - - _. - - - - stable

-- - - - - - - - - - -----------------------------

1.5000

Pitch angle

- Flightpath rate

— — Ftightpath angle

-- - - - Angle of attack

Q 0.5000

o- __... - -

_...._..... ----..

Flightpath

angle

stable

-0.5000

0 20.000 40.000 60.000 80.000 100.000 120.000

Time, sec

a)

4.00 

Two degrees of freedom

0.0200

Airspeed stable at 225 sec. V=286.8 kt l

-a

----------------------------------- 

3.00 .............................. __.__.................................................... ....---................_......-..............___._.................__.... < p

Y

N

Q] ^

C _

2.00 -0.0200

N

Q

1.00 Airspeed change -0,0400

----- Long acceleration

Normal acceleration

0 -0.0600

0 20.000 40.000 60.000 80.000 1000.000 120.000

Time, sec

b)

Figure B-20. Pitch step response, 115 sec.. two degrees of freedom.

1.0000

rn

Ci

rn

B-68
In a similar way, the two-degree-of-freedom model can be extended to include control of both

flightpath angle and airspeed by simultaneous elevator and throttle control, which corresponds to the

y-V Command mode. This extension is accomplished by replacing specification of the form of the

throttle control time history with specification of the resulting medium-term and long-term thrust

response generated by the engine model. Because the dynamic thrust lag within the engine model

has a narrower bandwidth and a longer time scale than that of the pitch response to elevator deflection, it follows that neglect of thrust dynamics presents a less critical challenge to validity of the

two-degree-of-freedom model than does the neglect of pitch dynamics already demonstrated.

One-Degree-of-Freedom Model

If flightpath angle is controlled by means of pitch (that is, elevator deflection) and thrust is controlled by means of throttle so that the forms of both the flightpath angle and thrust time histories are

specified, then the airspeed response can be approximated by making use of the one-degree-offreedom model illustrated by figure B-10(d). This drastically simplified model, which neglects the

dynamics of pitch, flightpath, and thrust, nevertheless retains the important quadratic nonlinearity

resulting from the variation of drag with speed.

Path step response— To specify the flightpath angle time history for the single-degree-of-freedom

model, the flightpath angle step is shaped by a 2-sec cosine bell that approximates the flightpath lag

relative to elevator deflection (fig. B-13(a)). The resulting responses of longitudinal acceleration

and airspeed are illustrated by figures B-21(a) and B-2 I (b). Comparison of figure B-2I(a) with

figure B-13(b) shows that the single-degree-of-freedom approximation provides a nearly exact

match of the two time histories during the first 5 sec, and comparison of figure B-21(b) with

figure B-16(b) shows that this excellent agreement extends over the long term. Since the engine

thrust lag (figs. B-5 and B-6) is of the same order as that of the flightpath response (fig. B-10(b)),

the thrust input for figure B-10(d) could be specified in a similar manner by shaping a thrust step of

the desired magnitude with a 2-sec cosine bell to approximate the engine thrust lag. It is clear that,

if one is interested chiefly in the airspeed response to flightpath angle and thrust control, the singledegree-of fteedom model wi// serve very well. This somewhat surprising result reduces the entire

aircraft model to a very simple dynamical system governed by the nonlinear differential equation

(B-2a) for longitudinal forces, which can be solved numerically by a single integration for each

time step.

B-69
50.00

40.00

6

30.00

rnC

L

U

d

Q^

N 20.00

d

10.00

0.0050

0.0040

0.0010

0.0030

_N

C

0

0.0020

One degree of freedom

0.50

0.40

0.30

aiuC

L

U

d

v

a 0.20

Q

0.10

1.000 2.000 3.000

Time, sec

a)

One degree of freedom

0

0

-0.0400

4.000

-0.0600

5.000

0.0400

0.0200

0

N

C

-0.0200

0 r i a I i ---r--s -. j i 0

0 500.000 1000.000 1500.000 2000.000 2500.000

Time, sec

b)

Figure B-21. Path step response, 5 sec and long term, single degree of freedom.

B-70
REFERENCES

Bridgman, P. W.: Dimensional Analysis. Encyclopedia Britannica, vol. 7, pp. 439-449, 1970.

Davies, D. P.: Handling the Big Jets. Air Registration Board, Brabazon House (England), 1969.

Erzberger, Heinz; and Lee, Homer Q.: Characteristics of Constrained Optimum Trajectories with

Specified Range. NASA TM 78519, Sept. 1978.

Erzberger, Heinz: Automation of On-Board Flightpath Management. Tenth von Karman Memorial

Lecture presented at 24th Israel Annual Conference on Aviation and Astronautics, Tel Aviv and

Haifa, Israel, Feb. 17-18, 1982.

Erzberger, Heinz; and Nedell, William: Design of Automated System for Management of Arrival

Traffic. NASA TM 102201, June 1989.

Erzberger, Heinz; Davis, Thomas J.; and Green, Steven: Design of CenterTRACON Automation

System. AGARD CP-538, AGARD Guidance and Control Panel 56th Symposium, Berlin,

Germany, May 1993.

Green, Steven M., Den Braven, Wim; and Williams, David. H.: Development and Evaluation of a

Profile Negotiation Process for Integrating Aircraft and Air Traffic Control Automation. NASA

TM 4360, April 1993.

Hill, Philip G.; and Peterson, Carl R.: Mechanics and Thermodynamics of Propulsion, 2nd ed.

Addison-Wesley (Mass.), 1992.

Innis, Robert C.; Holzhauser, Curt A.; and Quigley, Hervey C.: Airworthiness Considerations for

STOL Aircraft. NASA TN D-5594, Jan. 1970.

Lee, Homer Q.; and Erzberger, Heinz: Algorithm for Fixed-Range Optimum Trajectories. NASA

TP-1565, July 1980.

McRuer. D. T.; Ashkenas, I. L.; and Graham, D.: Aircraft Dynamics and Automatic Control.

Princeton University Press (New Jersey), 1973.

Press, W. H.; Flannery, B. P.; Teukolsky, S. A.; and Vetterling, W. T.: Numerical Recipes: The Art

of Scientific Computing. Cambridge University Press (New York), 1986.

Shevell. Richard S.: Fundamentals of Flight, 2nd ed. Prentice Hall (New Jersey), 1989.

Taylor, E. S.: Dimensional Analysis for Engineers. Clarendon Press (England), 1974. (Quoted by

Hill and Peterson, 1992.)

B-71
B-72
APPENDIX C

SYMMETRIC (COORDINATED) TURNING FLIGHT

This appendix generalizes the longitudinal equations of motion for symmetric (coordinated) turning

flight, in order to provide results needed for the main report. The main report uses the two-degreeof-freedom model presented in appendix B, which eliminates the pitching moment equation from

the dynamic model by the assumption of effectively intf inite pitch bandwidth and control power.

Therefore, only the two longitudinal force equations require generalization for turning flight.

In order to achieve a concise but rigorous treatment, the development that follows makes extensive

use of vector/matrix methods, and limited use of spherical tri gonometry. It will be shown that, for

straight wings-level flight, the generalized equations reduce to those already obtained (app. B) by

elementary methods. The aircraft structural, aerodynamic, and propulsive models, together with

those for the Earth and the atmospheric environment, remain the same as those discussed in

appendix B. For the generalized treatment that follows, flight is assumed to take place in still air.

GENERAL VECTOR FORCE EQUATION

The equation of motion for a rigid aircraft subject to aerodynamic, propulsive, and gravitational

forces is obtained directly in vector form from Newton's second law:

m aputh — Fl aero + F prop + F gray — (C- I )

where m denotes the aircraft mass, a its kinematic acceleration, and F the external force acting on

the aircraft. The superscripts indicate the nature of each force, and the subscript indicates the

reference frame in which each quantity is described. In equation (C-1), the path-frame components

of the aerodynamic and propulsive forces are the lift L, the dra g D, the side force Y, and the thrust T,

as discussed previously (app. B). The path-frame components of the aircraft weight W must be

found by trigonometric resolution. To accomplish this task, the spatial orientation of the path frame

can be specified relative to the Earth by defining three Eulerian angles.

Eulerian Angles for Path Frame

These three Eulerian angles are defined as follows (fig. C-1). The process starts with the orthogonal

right-handed local Earth frame N E D (that is, the directions North, East, and Down) with its origin

fixed at the aircraft center of gravity. The frame X" Y" Z" is generated by positive rotation about the

D axis through the aircraft track angle WT (fig. C-I (a)). It can be seen that the Z" axis coincides with

the D axis. Next, the frame X' Y' Z' is generated by positive rotation about the Y axis through the

aircraft flightpath angle y (fig. C- l (b)). It can be seen that the Y' axis coincides with the Y" axis.

Finally, the path frame T L N (that is, the tangent direction along the aircraft velocity vector, the

normal to the velocity vector in the negative lift direction, and the lateral axis in the direction of the

side force) is generated by positive rotation about the X' axis through the roll angle 0' (fig. C-1(c)).

C-1
-z"

_p

X' T Y's

-n _z.

Y"- T.' 

N Y' Y" /^ X , d `^-

E ^ X" #1X..

L

a) Definition of track angle WT. b) Definition of flightpath angle y. c) Definition of roll angle

Figure C-1. Spatial orientation of path frame.

It can be seen that the T axis coincides with the X' axis. The N axis is taken as the negative lint

direction in order to preserve the right-handedness of the path frame.

Weight Components

With the Eulerian ancy les YT, y, and 0' specified, the path-frame components of the aircraft weight W

are given by the matrix equation

[WI- W1

 WN ] T =[$ ]lYl[iVT] [0 0 W] T (C-2)

In equation (C-2), the direction cosine matrices [WT], [y], and [0'] are specified by symmetric nineelement arrays as follows:

COS W T Sin 111 1. 0

—sin 111 T cos W T 0 (C-2a)

0 0 1

cos y 0 —sin y

[y] = 0 1 0 (C-2b)

sin y 0 cos y

1 0 0

0 cos 0' sin (C-2c)

0 — sin o' cos o'

C-2
In equation (C-2), the first matrix multiplication yields

'YT ][0 0 W] F = [

0 0 W]T(C-2d)

Equation (C-2d) shows that, because the Wj rotation is taken about the D axis, which coincides with

the direction of the gravity vector, the path-frame components of the weight vector are independent

of the aircraft track direction YT. Therefore, the track angle can be taken as North (that is, WT = 0)

without loss of generality. With equation (C-2d), equation (C-2) becomes

[ WT W W ] T = [$1 ] [7] [0 0 W] T (C-2e)

The indicated matrix multiplication on the right side of equation (C-2e) results in the product

cos 7 0 — sin 7

10'][7]= sin o' sin 7 cos 0' sin O' cos 7 (C-2f)

cos 0' sin 7 —sin 0' cos 0' cos 7

With equation (C-2f), the path-frame components of the weight W are found from equation (C-2e)

to be

[W 

T W WN ] T W [ — sin 'y sin O' cos 'y COs O' cos 71 T (C-2g)

After Substitutin g equation (C-2g) and putting m = W/ g , equation (C-1) becomes, in matrix form,

( W/g )[a T a L a N ] T = [ — D Y —L] Taero

+ [T 0 0] T prop

+ W [— sin 7 sin o' cosy COS o ' sin 'y] T grav

or, combining terms and dividing by W,

(1/-)[aT a L aN] 7

(C-3)

= [(T — D)/W — s1n 7) (Y/W + sin 0' cos 7) (—L/W + Cos 0,1 7] T

Kinematic Acceleration Components

The next task is to calculate the path-frame components of the kinematic acceleration a on the left

side of equation (C-3). In general, the path frame rotates with respect to the Earth with an angular

velocity that is denoted by (o. Since by assumption the Earth frame is inertial, the path frame rotates

with angular velocity (o relative to inertial space. In such a rotating frame, the kinematic acceleration

a is given by the well-known formula for vector differentiation of velocity (Wills, 1958; Etkin,

1959; McRuer, Ashkenas, and Graham, 1973):

C-3
a=dV/dt=SV/St+(nxV

(C-4)

where dV/dt denotes the time derivative of the velocity vector V measured in the inertial (Earth)

frame, and BV/8t denotes the time derivative of the scalar magnitude V measured in the path frame.

Equation (C-4) has the physical interpretation that, at constant speed, the 8V/8t term vanishes, but

the centripetal acceleration owing to curvature of the flightpath is accounted for by the vector crossproduct term (u x V.

In equation (C-4), the total an g ular velocity w is found by vectorial summation of the Eulerian

angular rates dyT/dt, dy/dt, and d0'/dt. This summation is complicated by the fact that the axes about

which the Eulerian rotations YT, and 0' are taken are not, in general, orthogonal (fig. (C-1)). It

follows from the definitions of these angles that the path-frame components of the angular velocity

vector (o are given by the matrix equation

[mT (0L

 0)N ] T = [ d0'/dt 0 0] T + [01 ] { [0 dy/dt O] T + [Yl 1() 0 dW T /dt] T }

or (C-5)

[0)T W (0N] T

= [d0'/dt 0 0] T + [0'] [0 dy/dt 0] T + [0'] [Y] [0 0 dWT/dt] T

After carrying out the indicated matrix multiplications on the ri g ht side of equation (C-5), the pathframe components of the angular velocity vector 0) are found to be

[WT (0L wN ] T = [(d0'/dt — dW T /dt sin y) (dY/dt cos 0'+ dW T /dt sin 0' cos y)

(—dy/dt sin 0'+ dWT/dt cos 0' COSY)] T (C-5a)

In equation (C-4), the path-frame components of the 8V/8t term on the right are given by

8V/8t = [8V/8t 0 0 1 1 (C-5b)

With equations (C-5a) and (C-5b), equation (C-4) becomes

a (dV/dt)

a L = (— V dy/dt sin 0' + V dy T /dt cos 0' cos y) (C-5c)

a 

(—V dY/dt cos 0'— V dY T /dt sin 0' cos y)

All the elements of the path4rame longitudinal force equations have now been found. After

substituting equation (C-50 intothe left side of equation (C-3), the general vector equation of

motion becomes

C-4
(dV/dt) (T— D)/W— sin y)

(—V dy/dt sin 0'+ V dYT/dt cos o' cos y) _ (Y / W + sin o' cos y) (C-6)

b 

(—V dy/dt cos 0' — V dWT /dt sin O' cos y) (—L / W + cos 0' cos y)

When expressed in scalar form, the vector equation (C-6) is equivalent to three scalar equations for

longitudinal (streamwise) force, side force, and normal force (lift):

(1 /g) [(dV/dt) = (T — D)/W — sin y (C-6a)

— (V/g) d^/dt sin 0'+ (V/g) dW T /dt cos o' cos 7 = Y/W + sin o' cosy (C-6b)

— (V/g) dy/dt cos 0' — (V/g) dWT/dt sin o' cos 7 = — L/W +cos o' cosy (C-6c)

COORDINATED TURNING FLIGHT

In coordinated (symmetric) turning flight, the side force Y vanishes. After imposing this condition,

equation (C-6b) can be solved for the quantity (V/g) dWT/dt to obtain

(V/g) dWT/dt cos O' cos y = sin O' cos y + (V/g) dy/dt sin 0'

or

(V/g) dy.,,/dt = tan 0'+(V/g) d^/dt tan 0'/cos y (C-7a)

In level flight, or in a steady climb or descent, the flightpath rate dy/dt vanishes, and the turn rate

equation (C-7a) reduces to a well-known formula for a steady coordinated turn:

(V/g) dW /dt = tan 0' (C-7b)

Returnin g to the general coordinated turn, the quantity (V/(,) dWT/dt can be eliminated from the lift

equation (C-6c) by substituting equation (C-7a). After simplifying with the help of the identity

1/cos,

I + tan (', the lift equation for the coordinated turn is finally obtained:

(V/g) d7/dt + cos 7 = (L / W) cos 0' (C-7c)

The longitudinal (streamwise) force equation (C-6a) can be written

(1/g) (dV/dt) + sin y = (T — D)/ W (C-7d)

It should be noted that the streamwise force equation (C-7d) holds in general, but the lift equation

(C-7c) is restricted to coordinated flight.

C-5
-z' -z..

Y'.

a N

X'

X"

X"

b) Definition of pitch angle A. c) Definition of bank angle 0.

= igure C-2. Spatial orientation of body frame.

le yr

-Z"

-n

-Z -Z,

X, x

By comparing equation (C-7c) with equation (B-2b) (app. B), and comparing equation (C-7d) with

equation (B-2a) (app. B), it can be seen that, for wings-level Might (that is, ^' = 0), the generalized

equations reduce to those obtained previously by elementary methods. (As noted in appendix B, for

flight in still air the inertial velocity and inertial flightpath angle coincide with their airmass

counterparts.)

KINEMATIC EQUATIONS FOR COORDINATED TURNING FLIGHT

Although equation (C-7c) is exact, it involves the roll angle 0' taken about the velocity vector

(fig. C-l(c)). This definition of the roll angle differs from the conventional one, which takes the roll

rotation about the longitudinal fuselage axis (that is, the X axis of the body frame). It will be shown

that, in coordinated (symmetric) flight, the direction of the fuselage axis differs from that of the

velocity vector by the angle of attack a. Therefore, for small angles of attack, it is immediately

obvious that the lift equation (C-7c) holds approximately if the roll angle 0' taken about the velocity

vector is replaced by the conventionally defined bank angle 0 taken about the fuselage axis. The

region of validity of this approximation can be determined by finding the exact relation between the

two roll angles 0' and 0. This problem is considered next.

Eulerian Angles for Body Frame

The first task is to specify the spatial orientation of the body frame, which can be achieved by

defining the Eulerian aircraft heading angle W, the pitch angle 0, and the bank angle 0 (fig. C-2). It

can be seen that the aircraft heading angle W specifies the azimuth direction relative to north of the

projection of the fuselage axis X onto the horizontal plane (fig. C-2), while the track angle YT

defined previously specifies the direction of the horizontal projection of the aircraft velocity vector

(fig. C-1).

Starting from the Earth 1'rame N E D as before, the frame X" Y" Z" is generated by positive rotation

about the D axis through the heading angle yf (fig. C-2(a)). It can be seen that the Z" axis coincides

with the D axis. Next, the frame X' Y' Z' is generated by positive rotation about the Y" axis through
the pitch angle 6 (fig. C-2(b)). It can be seen that the Y' axis coincides with the Y" axis. Finally,

the body frame X Y Z is generated by positive rotation about the X' axis through the roll angle

(the conventionally defined bank angle). It can be seen that the fuselage axis X coincides with the

X' axis. To summarize, the body frame is related to the Earth frame by the Eulerian angles y, 0, and

(fig. C-2), and the path frame is related to the Earth frame by the angles W T, y, and ^' (fig. C-I).

The path frame is related to the body frame by the angle of attack a and the angle of sideslip 0

(fig. C-3(a)). It can be seen from figure C-3(a) that the body-axis velocity components u, v, w are

related to the total velocity V by the equations

u = V cos ^3 cos a

v=V sin P (C-8)

w = V cos R sin a

In coordinated flight, the sideslip angle P vanishes together with the side force Y because of the

assumed aerodynamic and propulsive bilateral symmetry (app. B), so that the velocity vector lies in

the body-frame plane of symmetry X Z (fig. C-3(a)). It can be seen that, in the plane of symmetry,

the projection of the velocity vector intersects the fuselage axis in the angle of attack a, as stated

previously.

Kinematic Relationships

The relationship of the body frame to the path frame in coordinated flight is illustrated by

figure C-3(b), which depicts the surface of the sphere of unit radius whose origin lies at the aircraft

center of gravity. The North direction N intersects the spherical surface at point D, the gravitational

vertical —D intersects it at point A, the aircraft velocity vector T intersects it at point B, and the

fuselage axis X intersects it at point C. The horizontal plane cuts the sphere in arc DE. The vertical

plane containing the velocity vector T cuts the sphere in arc ABD, and that containing the fuselage

axis cuts it in arc ACE. The two vertical planes are orthogonal to the horizontal plane, so that the

angles ADE and AED are ri ght an g les. The aircraft plane of symmetry contains both its fuselage

Plane of symmetry X -D

U

X A

W ^; ycoS" , b

i <^

V

Z C 

<q a-a

t ^ CB T

f)

Y ,^

V E D

N

a) Definition of angle of attack (Y. and angle of b) Relation of body frame to path frame in

sideslip ^. symmetric (coordinated) flight.

Figure C-3. Orientation of body frame to path frame.

C-7
axis X and its velocity vector T, and cuts the sphere in the arc BC, which by definition (fig. C-3(a))

measures the angle of attack a. Since all these planes contain the origin, their intersecting arcs are

therefore great-circle arcs. In figure C-3(b), the direction of the aircraft track is north, so that xVT = 0.

Its heading angle Ni coincides with the angle CAD, and is measured by the arc DE. Its pitch angle 0 is

measured by the arc CE, and its fl1Lhtpath angle y by the arc BD. The roll angle 0' about the velocity

vector T and the bank angle 0 about the fuselage axis X are illustrated by figure C-3(b). The pilot, of

course, observes these relationships from inside the sphere.

Instead of multiplying out the direction-cosine matrices as done previously in deriving equation

(C-6), the desired relation between the roll angle 0' and the bank angle 0 will be obtained in a

simpler way by making use of spherical tri gonometry. In the spherical triangle ABC, the angles A, B,

and C and the opposite sides a, b, and c can be identified as follows (fig. C-3(b)):

A=y B =0' C=n -0

(C-9)

a = a h=n/2-0 c=n/2—y

The law of sines gives immediately the relations

sin A/sin a= sin B/sin b= sin C/sin c (C-9a)

After substituting the identities (C-9), the second equality (C-9a) becomes

sin Osin (n/2 —0)=sin (n—Osin (n/2-7)

which reduces to

sin O'/cos 0 = sin O/cos y

or, finally,

sin 0' = ( cos 0/ cos y) sin 0 (C-9b)

Equation (C-9b) is exact, and holds for coordinated fli ght without restriction to first-quadrant angles.

It gives the desired relationship between the two roll angles 0' and 0 for coordinated flight.

Another exact relationship between 0, ,y, a, and 0 can be obtained from the law of cosines for side c

of the spherical triangle ABC:

cos c = cos a cos b + sin a sin b cos C (C-9c)

Upon substituting the identities (C-9) into equation (C-9c), it is found that

sin y= sin 0 cos a — cos 0 sin a cos 0 (C-9d)

C-8
The kinematic equation (C-9d) is exact, and holds for coordinated flight without restriction to firstquadrant angles.

For wings-level flight (0 = 0), equation (C-9d) reduces to

sin y = sin 0 cos a — cos 0 sin a = sin (0 — (x)

or

y = 0 — a (C-9e)

in agreement with the elementary definitions of these angles (app. B).

Kinematic Approximations

If the angles a, y, and 0 are small, then equation (C-9d) can be simplified to obtain the approximate

relation

0—y=a Cos 0 (C-9f)

Equation (C-9f) is useful for the inverse control system described in the main report, where it

enables the pitch command to be computed conveniently in closed form. It will be shown in the

next two sections that the approximation (C-9f) remains valid even under the most extreme flight

conditions encountered during controlled flight of transport aircraft.

If the difference 0 — y is smal I, then it is cleat- from equation (C-9b) that, for roll angles in the first

quadrant, 0' can be approximated by 0:

0=0' (C-9g)

Substitution of the approximation (C-9g) into the lift equation (C-7c) eliminates dependence of the

equations of motion for coordinated turnin cy Flight on the roll angle 0' taken about the velocity

vector, which is not measured by conventional onboard instrumentation.

Alternatively, if the pitch angle 0, the fli`_htpath angle y, and the bank angle 0 are known from

in-flight measurements or simulation computations, then the roll angle 0' can be found from the

exact equation (C-9b). Use of the exact roll an g le in the lift equation (C-7c) could improve the

accuracy of the lift command calculation for the inverse control system described in volume one of

this report. It will be shown in the next two sections that use of the approximation (C-9g) is justified

for coordinated t1i(*ht over the range of bank an g les extendin g from 0 to about 40 deg, which

includes the range normally encountered in airline service. At larger bank angles, its use in the lift

equation could result in significant lift error.

C-9
Limiting Flight Conditions for Transport Aircraft

In order to test the validity of the approximations (C-9e) and (C-9g) with the largest practical values

of a, y, 0, and 0, a minimum-radius climbing turn that is representative of a collision-avoidance

maneuver is calculated as an example using the generic transport aircraft model developed in

appendix B. It will be shown that this maneuver results in flight conditions that reach both structural

and aerodynamic limits for transport aircraft.

The aircraft load factor (denoted by n) is defined by the expression n = L/W. For a steady climbing

turn, the flightpath rate dy/dt vanishes, and the load factor is found from equation (C-7c) to be

n=L/W= cos y /cos 0' (C-10)

It is assumed that the design limit load factor n MAX is 2.5 g, as is usual for transport aircraft (Shevell,

1989).

For a level turn (y= 0), equation (C-10) shows that the maximum roll angle 0' is then given by

cos I /nMAX = 1/2.5, or 66.4 deg. Since the turn radius R is equal to the quotient V /dWT/dt, it

is given by (eq. (C-7b))

R=VZ/g tan 0'

Since n'- = 1 /cos'` 0' = 1 + tan 20% so that tan g ^' = nz — 1, eliminating the roll angle 0' results in the

expression

R=V2/g (n'-1)

It is clew that the turn radius R is minimized by choosing the maximum load factor and the minimum airspeed, which corresponds to the maximum lift coefficient (app. B), and results in flight near

the stalling angle of attack. It is assumed that the corresponding fuselage angle of attack is 15 deg.

For a steady climbing turn, since the velocity component in the horizontal plane is V cos y

(fig. C-3(b)), the aircraft follows a helical path whose radius is given by

R HELIX =

(Vcosy)/g (n^—I)

The radius of the helix is minimized by climhing as steeply as possible (maximum 7), which requires

maximum thrust. It is assumed that the aircraft is at light weight, and the thrust loading near sea

level is taken as a maximum value of T/W = 0.5.

C-10
For a steady climbing turn, the fli g htpath acceleration dV/dt vanishes, and the streamwise force

equation (C-7d) becomes

sin y = T/W - D/W = T/W (D/L) (L/W) = T/W - n/(L/D) (C-10a)

At the maximum lift coefficient of 1.3 (app. B), the lift/drag ratio for the generic transport model

using parameter values from table B-1 (app. B) is found to be 12.36. With T/W = 0.5 and

n MAx = 15, the climb flightpath angle is found from equation (C-10a) to be yMAx = 17.33 deg, and

the maximum roll an g le is found from equation (C-10) to be 67.55 deg.

If the pitch angle 0 were known, the corresponding bank angle 0 could be found from equation

(C-9b). Conversely, if the bank angle were known, the pitch angle could be found numerically

from equation (C-9d). By using an iterative procedure involving both these equations, the solution

0 = 22.46 deg, = 72.69 deg is found numerically for 'y = 17.33 deg and a = 15 deg, which can be

verified by direct substitution in equations (C-9b) and (C-9d). These exact values can now be

compared with those obtained from the approximate equations (C-9f) and (C-9g).

Approximation Validity

For 0' = 67.55 deg, the approximate value of 0 obtained from equation (C-9g) is also 67.55 deg.

The exact value of 0 is 72.69 deg, so that the roll error is 67.55 - 72.69 = -5.14 deg. For the values

y= 17.33 deg, a = 15 deg, and 0 = 67.55 deg, the approximate value of 0 obtained from equation

(C-90 is 23.05 deg. The exact value of 0 is 22.46 deg, so that the 0 error is +0.59 deg. If the

approximate value for 0 of 67.55 deg is replaced by the exact value of 72.69 deg, the value of 0

obtained from equation (C-9f) is then 21.79 deg, so that the 0 error becomes -0.67 deg.

These 0 errors seem rather insignificant, especially after considering the extreme severity of the

assumed flight conditions, and they would be even smaller for operating conditions normally

encountered in airline service. Therefore, the kinematic approximation (C-90 can be considered

valid over the whole range of conditions encountered by transport aircraft during coordinated flight.

On the other hand, the error in the lift equation (C-7c) resulting from use of the kinematic approximation (C-9g) for roll angle is more significant.

For the minimum-radius climbing turn, if the exact value for the roll angle 0' of 67.55 deg is

replaced by the exact value for the bank angle 0 of 72.69 deg, the load factor obtained from equation

(C-10) is 3.21 g. Since the exact value of the load factor is 2.50 g, the normal acceleration error is

0.71 g, an overestimate which amounts to 28% of the lift.

However, if the load factor is limited to 1.1 g (perhaps by proximity to stall), which corresponds to a

less extreme bank angle of 39.3 deg in the climbing turn, the normal acceleration error is reduced to

0.078 g, an overestimate of 7.1% of the lift. Furthermore, the lift error decreases rapidly with further

decrease of bank angle. Therefore, the approximation (C-9g) can be considered valid for bank angles

smaller than about 40 deg; that is, for the range of bank angles normally encountered in airline

service.

C-1 I
REFERENCES

Etkin, B.: Dynamics of Flight: Stability and Control. John Wiley (New York), 1959.

McRuer, D.; Ashkenas, I.; and Graham, D.: Aircraft Dynamics and Automatic Control. Princeton

University Press (New Jersey), 1973.

Shevell, Richard S.: Fundamentals of Flight, 2nd ed. Prentice Hall (New Jersey), 1989.

Wills, A. P.: Vector Analysis with an Introduction to Tensor Analysis. Dover Publications, Inc.

(New York), 1958.

C-12
APPENDIX D

ELEMENTS OF PROPOSITIONAL LOGIC

This appendix presents a concise review of elementary propositional logic that is needed to support

developments in Volume I of this report. Formal logic is a classical discipline; Greek propositional

logic was recast by Boole (Boole, 1854) into algebraic form. The two forms are logically equivalent.

Both forms are treated in this appendix, because they illuminate the subject material from different

perspectives. However, the logical form is used in the main report.

After a brief review of logical operations and truth tables, several elementary theorems are proved

by the method of perfect induction, and a list of theorems is provided for reference. Logical simplification of composite propositions is illustrated by deriving several results needed for the main report,

and the appendix concludes with a discussion of condition-action decision tables, which must be

characterized by lo g ical consistency and completeness.

ELEMENTARY LOGICAL PROPOSITIONS

Elementary logical propositions are simple declarative statements like "The grass is green" or "It is

raining." Logically, it is taken as axiomatic that such elementary statements must be either true or

false. In the logical form termed symbolic logic, elementary propositions are represented by letter

symbols like p and q; in the algebraic form, they are represented by algebraic variables (termed

Boolean variables) like X and Y, which are restricted to take on only the binary values zero or one.

In Boolean algebra, the symbol 0 represents FALSE, and the symbol I represents TRUE.

Truth Tables

Elementary propositions can be combined to form compound statements like "It is raining, and the

grass is green." Such a compound proposition is itself a single logical entity that must be either true

or false, which is termed its truth value. The truth value of a compound statement depends on the

truth or falsity (abbreviated as T and F) of the elementary propositions from which it is formed; it

can be determined by construction of a truth table as follows:

TRUTH TABLE FOR CONJUNCTION

P q p AND q

----------------------

F F F

F T F

T F F

T T T

D-1
The first row of- this truth table shows that if both p and q are false, then the compound statement p

AND q (which is termed their conjunction) is false. The second and third rows show that if p is false

and q true, or if p is true and q is false, then in both cases p AND q is false. The fourth row shows

that if both p and q are true, then p AND q is true.

In algebraic form, the same truth table has quite a different appearance. Denoting the operation of

logical conjunction by the symbol x, the truth table becomes

TRUTH TABLE FOR CONJUNCTION

P q Pxq

---------------------

0 0 0

0 1 0

1 0 0

1 1 1

It is obvious from inspection of this table that, from an algebraic viewpoint, the operation of logical

conjunction can be regarded as logical multiplication acting on the Boolean variables 0 and 1, with

its multiplication table defined as follows:

TRUTH TABLE FOR CONJUNCTION

0x0=0

0x 1 0

1x0 =0

1x1=1

Proceeding in the same way, the truth value of the compound statement p OR g, which is termed the

logical disjunction of p and q, can be regarded as logical addition (denoted by the symbol +), with

truth tables defined as follows:

TRUTH TABLES FOR DISJUNCTION

P q pOR(I

F

---------------------

F F 0 +11 =0

F T T 0 +1 =1

T F T 1 +11=0

T T T 1+1=1

It can be seen from the fourth row of the addition table on the right that logical addition does not

follow the same rule as ordinary algebraic addition. Nevertheless, Boolean algebra forms a mathematically consistent system.

D-2
Logical Operations

At this point of the discussion, the notions just presented can be generalized to include the other

commonly used ways of combining elementary propositions to form compound propositions, which

are negation, implication, and equivalence; in Boolean algebra, negation is termed complementation,

equivalence becomes equality, and implication is not defined. The complete set of operations is

therefore conjunction, disjunction, negation, implication, and equivalence; with the exception of

negation, these are termed logical connectives, since they connect elementary propositions to form

compound propositions.

Each of these operations is defined by a truth table similar to those already presented for conjunction

and disjunction. The truth tables for negation (denoted by the symbol --1), implication (denoted by

the symbol =*), and equivalence (denoted by the symbol =) are as follows:

TRUTH TABLES FOR NEGATION

P --1P

--------------

F T —10 =1

T F ,1 =0

TRUTH TABLE FOR IMPLICATION

P q 1) =>

F

----------------------

F T

F T T

T F F

T T T

It should be noted that the first and second rows of the truth table for implication express the rule

that "anythin g follows from a false antecedent," the third and fourth rows agree with the notion of

implication in the everyday use of natural language, and also with the mathematical statement

"if p, then q."

TRUTH TABLE FOR EQUIVALENCE

P q P=q

---------------------

F F T

F T F

T F F

T T T

Equivalence can be regarded as reversible implication: if p implies q and q implies p, then p and q

are equivalent.

D-3
Elementary Logical Theorems

Consider the compound logical proposition p OR TRUE. Since it has the same form as the proposition

p OR q where q is equivalent to TRUE, its truth value can be found by forming the truth table for p OR

TRUE, and evaluating the result by referring to the truth table for disjunction:

TRUTH TABLES FOR p OR TRUE

p T pORT

F

---------------------

T T 0+1=1

F T T (1+1=1

T T T 1+1=1

T T T 1+1=1

The coincidence of the second and third columns shows that p OR 'TRUE is equivalent to TRUE. (The

second and fourth rows are redundant, and can be dropped.) In symbols,

pORT - T p+1=1 (A)

Statement (A) is a theorem in symbolic logic, which we have proved by the method of perfect

induction (that is, by comparison of truth table columns—two propositions are logically equivalent if

and only if their truth table columns coincide).

By proceeding in a similar manner, we can prove that p AND TRUE is equivalent to p. The truth table

is as follows:

TRUTH TABLES FOR p AND TRUE

P T p AND T

---------------------

F T F 0x1=0

T T T 1x1=1

The third column is obtained by referrin g to the truth table for conjunction. The coincidence of the

first and third columns proves the second theorem:

pANDT - p pxl=p (B)

Statement (B) is also a theorem in symbolic logic.

As a third example, the truth table for the proposition p OR -,p is as follows:

D-4
TRUTH TABLES FOR p OR —,p

P --lP p OR -,p

----------------------

F T T 0+1=1

T F T 1+0=1

The second column is obtained from the first by referring to the truth table for negation, and the

third column is obtained from the first two by referring to the truth table for disjunction. The third

column shows that the proposition p OR —,p always holds, without regard to the truth value of p. In

symbols,

pOR --,p=T p+gyp= I (C)

Statement (C) is another theorem in symbolic logic. (Theorem (C) is the well-known law of the

excluded middle; all these theorems were known to the Greeks.)

The proposition p OR --ip is one example of a tautology, which is defined as a compound proposition

that holds because of its form, independent of the truth values of its component elementary propositions. The proposition p OR TRUE is another example, as shown by Theorem (A).

Other theorems involving more complicated combinations of elementary propositions can also be

proved by the method of perfect induction, which is demonstrated next.

COMPOSITE LOGICAL PROPOSITIONS

Since each compound expression is itself a logical proposition, as already noted, it follows that

compound propositions can be combined by means of logical connectives to form more complicated

propositions; indeed, an elementary proposition is sometimes defined as one that does not contain

any connectives. To avoid ambi g uity, composite propositions formed by combining three or more

elementary propositions must include parentheses to indicate the sequence in which evaluation is to

be carried out, just as in ordinary algebra. The commutative, associative, and distributive laws hold

axiomatically, just as in ordinary algebra.

For example, consider the composite proposition p OR (p AND q). The parentheses show that the

conjunction p AND q is to be evaluated first, by means of the truth table for conjunction. Let the

result be denoted by r, so that the equivalence r = ( p AND q) holds. The disjunction p OR r is then to

be evaluated by means of the truth table for disjunction.

The truth table for the composite proposition p OR (p AND q) is constructed as follows. The first

three columns of the combined table are the same as those for the truth table for conjunction, with r

replacing p AND q:

D-5
TRUTH TABLE FOR p OR (p AND q)

P q r p pORr

F F

------------------------------------

F F F

F T F F F

T F F T T

T T T T T

To form the disjunction p OR r, the fourth column is added to the table by repeating the first column,

and the last column is obtained by evaluating each row of the third and fourth columns according to

the truth table for disjunction. It will be seen that the last column coincides with the first; therefore,

the truth table proves that the composite proposition p OR (p AND q) is equivalent to p. In symbols,

pOR(p AND q)=p p+(pxq)=p (D)

Statement (D) is another theorem in symbolic logic.

Theorem (D) can be verified algebraically as follows. Apply the distributive law to factor out p on

the left-hand side:

px(1+q)=p

Now simplify the parenthesis by applying Theorem (A) to obtain

px(1)=p,

and simplify the left-hand side by applying Theorem (B) to obtain

P=P,

which verifies Theorem (D).

ELEMENTARY THEOREMS IN SYMBOLIC LOGIC

As this example (Theorem (D)) shows, proof of a new theorem is often facilitated by using other

theorems already established, instead of proceeding from first principles by the method of perfect

induction. Nevertheless, truth tables are regarded as the "gold standard" for logical proof. By combinin g the two proof methods, other elementary theorems can be established (Dromey, 1989; Bartee,

1980. A reference list of 23 such theorems, which follows the format of Dromey, can be found in

the List of Theorems.

D-6
LOGICAL SIMPLIFICATION OF COMPOSITE PROPOSITIONS

The process of simplifying composite logical propositions by application of elementary theorems is

illustrated by deriving several results needed for the main report.

Simplification of Definition for PE (V)

The partial effectiveness of the V Command mode is defined as follows (Volume I (Effectiveness

Requirements)):

PE (V) —= NOT JP AND (YPOT TGT # 7POT MAX) AND NOT IQ AND ( ) /POT TGT # 7POT MINA

Expressing negation symbolically, this of the form

PE (V) _ -IP AND M I AND -IQ AND N]

where M and N are given by the equivalences

M = (7POT TGT # 7POT MAX) N = (YPOT TGT YPOT MIN)

Simplification of PE (V) is needed for the following three cases:

(a) (YPOT TGT = 7POT MAX) holds:

(b) (YPOT TGT = YPOT MIN) holds, and

(e) (7POT MIN < YPOT TGT < YPOT MAX) holds.

In case (a), M is false and N is true, so that PE (V) becomes

PE (V) _ -,[P AND F] AND -,[Q AND T]

By applying Theorem 13, the first bracketed proposition reduces to F, and the second reduces to Q.

Removing the brackets by taking negations results in PE (V) = T AND ^Q, which simplifies to —,Q

by a second application of Theorem 13. Expressing case (a) in the form of an implication gives

(a) (YPOT TGT = 7POT MAX) => (PE (V) = --,Q)

In case (b), M is true and N is false, so that PE (V) becomes

PE (V) = =[ P AND T] AND ^[Q AND F]

By applying Theorem 13, the first bracketed proposition reduces to P, and the second reduces to F.

Removing the brackets by taking negations results in PE (V) _= -,P AND T, which simplifies to —,P by

a second application of Theorem 13. Expressing case (b) in the form of an implication gives

(b) (7P0T TGT = 7POT MIN) => (PE (V) = _P)

D-7
In case (c), both M and N are true, so that PE (V) becomes

PE (V) = -,(P AND T] AND --i(Q AND T]

By applying Theorem 13, the first bracketed proposition reduces to P, and the second reduces to Q.

Removing the brackets by taking negations results in PE (V) - -,P AND --,Q. Expressing case (c) in

the form of an implication gives

V e) (YPOT MIN < YPOT TGT < YPOT MAX) =:> [PE (V) ° (-,P AND --,Q)]

Collecting results, the required simplification of PE (V) is

(a) (YPOTTGT = YPOT MAX) => WE (V) = _Q)

(b) (YPOT TGT = YPOT MIN) => (PE (V) = --,P)

(e) (YPOT MIN < YPOT TGT < YPOT MAX) =:> [PE (V) = (-,P AND —,Q)]

This completes the first example.

Simplification of Definition for PE (Y)

The partial effectiveness of the yCommand mode is defined as follows (Volume I (Effectiveness

Requirements)):

PE (Y) _ ( YTGT < YPOT MAX) OR [(YTGT ^! YPOT MAX) AND (V > VMIN DRAG)]

This is of the form

PE (y) = M OR 1^M AND N]

where M and N are given by the equivalences

M = (YrGT < YPOTMAX) N = (V > V MIN DRAG)

By applying the distributive law g iven by the first statement of Theorem 9, PE (y) becomes

PE Cy) a (M OR -,M) AND (M OR N)

Because the first bracketed expression is tautologically true (Theorem 4), PE (y) becomes

PE (y) = T AND (M OR N)

Applying Theorem 13 reduces this to PE (y) = (M OR N), and replacing M and N with their equivalent expressions g ives the final result:

PE (Y) _ (YTGT < YPOT MAX) OR (V > VMIN DRAG)-

This result could also have been obtained directly by application of Theorem (D).

D-8
CONDITION-ACTION DECISION TABLES

Another logical tool needed for the main report is used to specify actions to be taken by an automated system if and only if certain logical conditions hold. Such actions can be specified in compact

form by tables that are termed condition-action decision tables. This section describes the arrangement and interpretation of such tables, including conventions for the solid or broken lines that separate the elements of the table and form an essential part of the specification (Sherry, Youssefi, and

Hynes, 1995). There are two kinds of decision tables, a simple table that specifies condition-action

pairs, and a more complex table that also specifies mode selection. The simple table is treated first.

Simple Condition-Action Tables

A simple condition-action decision table has the following form:

TABLE D-1

----------------------- ------

Conditionp q r

--------------- ------- ------

Action 1 3

It can be seen that the upper row of table D-1 specifies logical conditions p, q, and r, and the lower

row specifies actions 1, 2, and 3. Each column of the table specifies a condition-action pair; the first

column specifies the pair (p, 1), the second column specifies the pair (q, 2), and the third column

specifies the pair (r, 3). Other columns could be added as desired.

Table D-I is interpreted as follows. If condition p holds, then the first column shows that action I is

to be taken; the other columns are interpreted in the same way. Condition p could represent any logical proposition, either simple or compound. and action I could represent any action or set of actions

that are to be specified.

To avoid ambiguity, it is essential that the conditions be mutually exclusive, so that whatever the

truth values of the conditions p, q, and r may be, in any particular situation one and only one action

is specified. This property is termed logical consistency. If logical consistency does not hold, the

table is said to be logically inconsistent. For example, if p and q could both hold, logical consistency

would be violated; in that case, more than one action would be specified, so that the specification

would fail to be unique.

A second essential property of table D-1 is that disjunction of the conditions (that is, the compound

proposition (p OR q OR r)) must be tautologically true, whatever the truth values of p, q, and r. This

property is termed logical completeness. If logical completeness does not hold, the table is said to be

logically incomplete; in that case, other logical conditions or combinations of conditions could exist

for which no action is specified.

D-9
Mode Selection Tables

For the automated system described in Volume I of this report, a mode is defined as a characteristic

set of actions that the system can take; that is, a physical behavior (Volume I (Flight Control System)). Therefore, decision tables involving mode selection must specify the three-way relationship

between the logical conditions that govern mode selection, the modes available for selection, and the

set of actions associated with each mode. Such tables have the form illustrated by the following

example:

TABLE D-2

Mode Mode A Mode B Mode C

Scenario Normal Abnormal

Condition

m T

----------------------------------------

—Im T T

n

----------------------------------------

T

—,n T

p T

----------------------------------------

T

q T

----------------------------------------

T

►• T

Action Action 1 Action 2 Action 3

It can be seen that the upper row of table D-2 specifies three modes A, B, and C. The second row

specifies an entity termed a scenario, which is explained later and should be ignored for the present.

The legend Condition ill left column identifies seven logical conditions m, gym, n, ten, p, q, and

r, which are arranged in the next seven rows below the Condition legend. The significance of the

broken horizontal lines in table D-2 will be explained shortly; for the present, all the horizontal lines

should be regarded as solid. The lowest row of table D-2 specifies three actions 1, 2, and 3. Other

columns could be added to the table as desired.

In each column, the entries in the body of table D-2 show the logical conditions that must hold for

selection of the mode corresponding to that column, and also the action that is to be taken when that

mode is selected. For example, in the first column the conditions required to hold for selection of

mode A are indicated by the various entries of the symbol T, which denotes TRUE; it can be seen that

conditions m, -in, p, and q are required to hold for selection of mode A. If mode A is selected, the

lowest row of the left column shows that action I is to be taken. The entries in the other columns are

interpreted in the same way. Blank spaces in each column of the table indicate conditions whose

truth values are not relevant for mode selection in that column.

The two columns on the right both correspond to mode C, which is to be selected if the conditions in

the third column (the normal scenario) hold, or alternatively, if the conditions in the fourth column

(the abnormal scenario) hold. In both cases, action 3 is to be taken; each action is uniquely associated with its corresponding mode, without regard to the scenario (column) by which mode selection

is determined.

D-10
Line codes— It can be seen that the rows of table D-2 are separated by horizontal lines of two kinds,

either solid or broken. The interpretation of this line code is as follows. Broken horizontal lines indicate disjunction of the conditions in the rows they separate, while solid lines indicate conjunction.

For example, in the column for mode A, it may be seen that the T entries in the rows for conditions p

and q are separated by a broken horizontal line. This shows that the disjunction (p OR q) is required

for selection of mode A. The solid lines separating the T entries in the m row, the -,n row, and the

p row show that the conjunction of m and -,n with the compound condition (p OR q) is required for

selection of mode A. That is, the compound condition that must hold for selection of mode A as

specified by table D-2 can be stated in implication form as follows:

[m AND —,n AND (p OR q)] =* (Selection of mode A)

The compound conditions in the columns for mode B and mode C are specified by the line code in

the same way.

Logical consistency and completeness— For logical completeness, the logical disjunction of the

conditions in rows separated by broken lines must hold tautologically. For example, because the

rows for conditions p, q, and r are separated by broken lines (table D-2), their logical disjunction

(p OR q OR r) must hold tautologically; otherwise, table D-2 would be logically incomplete.

Logical completeness requires careful attention to the definition of logical conditions that depend on

physical variables. For example, suppose that p represents the condition (X <_ U), q represents the

condition (U < X < V), and r represents the condition (X > V), where X is a continuous physical

variable and U and V are constants. The requirement for logical completeness is satisfied by these

definitions, because physical continuity ensures that no value for X exists for which none of the

three conditions p, q. or r holds. On the other hand, if p were defined as the condition (X < U)

instead of (X <— U), then logical completeness would be violated, because if X took the value

(X = U), none of the three conditions would hold. In this example, a parsimonious use of symbols

could be achieved by using the lo gical simplification q = —,p -,r to eliminate q. The conditions

appearing in table D-2 would then be p, —,p ter. and r; their disjunction can be seen by inspection to

hold tautologically. It is clear that the line code in table D-2 facilitates checking the table for logical

completeness.

Logical consistency is a more delicate matter. For logical consistency, the selection logic for each

column must be mutually exclusive; that is, the pattern of T entries must be different in each column. If any two columns had the same pattern, then either or both of the corresponding modes could

be selected, depending on the exact details of the implementation code. Therefore mode selection

would fail to be mutually exclusive (unique) as required. For large decision tables with many columns, checkin g logical consistency by inspection can become quite tedious, but the task can be

automated by means of utility programs developed for that purpose.

Hierarchical decision tables— For a large automated system like that described in the main report, it

is often convenient to combine several decision tables into a hierarchical relationship. This can be

achieved without changing the structure already described for table D-2 by specifying additional

actions, such as "Enter Table E." Table E could then contain an action "Enter Table F" and so on.

The hierarchical structure can be built up recursively in this way to whatever extent is desired.

D-1 I
REFERENCES

Bartee, Thomas C.: Digital Computer Fundamentals, 6th edition, McGraw-Hill (New York), 1985.

Boole, George: An Investigation of* the Laws of Thought, on Which are Founded the Mathematical

Theories of Logic and Probabilities. Macmillan (London), 1854; reprint, Dover Publications

(New York), 1958.

Dromey. R. G.: Program Derivation, Addison-Wesley (Menlo Park, Calif.), 1989.

Sherry, Lance; Youssefi, David; and Hynes, Charles S.: A Formalism for the Specification of

Operationally Embedded Reactive Avionic Systems. Honeywell Publication C69-5370-001,

Honeywell Air Transport System Division (System Engineering Technology), Phoenix, Ariz.,

1995.

D-12
LIST OF THEOREMS (after Dromey)

Symbols

Conjunction x Disjunction + Negation

Equivalence = Implication =>

Theorems

(1) p = p Law of identity

(2) p + p = p Idempotent laws

pxp=p

(3) —(—p) = p Law of double negation

(4) p + -,p - T Law of the excluded middle

(5) —(p x —p) = T Law of contradiction

(also used as p x ^p = F)

(6) (p => -,p) = -,p Reductio ad absurdum

(7) p + q = q + p Commutative laws

pxq=qxp

(p=q)=(q=p)

(8) (p + q) + r - p + (q + r) Associative laws

(pxq)xr=px(gxr)

(9) p + (q x r) = (p + q) x (p + r) Distributive laws

px(q+r)=(pxq)+(pxr)

(10) (p =:> q) x (q =:> r) =::> (p => r) Transitive laws

(p = q ) x (q = r) => (p =r)

(1 1) -,(p + q) - -,p x q De Morgan's laws

--,(p x q) = -,p + q

—,(pxq)=pxq

—(p=q)°(p=—q)

D-13
(12) p+T=T

p+p=p

P+(pxq)=P

(13) pxT=p

Pxp=P

px(p+q)=p

(14) (p=>q)x(q=:>r)=(p=>gxr)

(p=>r)x(q=>r)=(p+q=>r)

(P=>q)+(P=>r)=(p=>q+r)

(per)+(q=>r)=(pxq::-->r)

(15) (P=>q)=(—q=>—p)

(p ° q) = (—p = —q)

(16) p =:^> p + q

(p =:> q) =:> (p => q + r)

(p => q) => (p x r => q)

(p=>g)=:>(p=>(pxq))

(17) pxg=:>P

(1 g) (Pxq=>r)=>(p (q=>

(p+q=>r)^(p r)

( 19) (P=>(q=>r))=:>(pxq=>r)

(P=>(gxr))=>(P=>q)

(20) (p =:> (q x —q )) => ^P

(21) Px(P=>q)=>q

(22) -,q x (p => q) => -,p

( 23 ) —P x (P + q) =:> q

OR simplification

(note: p + F - p

T+T=T

T+F=T)

AND simplification

(note: p x F = F

TxF=F

TxT -T)

Implication simiplification

Contraposition

Law of addition

Law of absorption

Law of simplification

Law of exportation

Law of importation

Law of absurdity

Law of detachment

D-14
APPENDIX E

STATECHART SEMANTICS

Statecharts provide a graphical representation of discrete logical systems, which are termed state

machines. In this report, statecharts represent the discrete elements of hybrid systems such as flight

control systems. The continuous elements of these hybrid systems are represented by block diagrams

containing input/output transfer functions, such as those illustrated by figure 11 in Volume I. This

appendix summarizes statechart interpretation conventions (termed semantics), which enable statechart diagrams to serve as rigorous specifications for the operation of discrete state machines.

Such state machines could be implemented directly in hardware by means of relays, or in concurrent

(parallel) digital computers. However, for reasons that will become clear in the discussion to follow,

within the aircraft industry it is considered desirable to implement both the discrete and continuous

elements of hybrid systems within a sin gle clock-based sequential processor. Several changes to

conventional statechart semantics are needed to facilitate implementation within a single sequential

machine. These issues are discussed in detail, and suitable semantic modifications proposed. It is

shown by a simplified example that these modifications enable implementation code for a sequential

machine to be prepared directly from statechart diagrams.

In particular, it is required by conventional statechart semantics that changes in the logical conditions governing mode transitions be propagated instantaneously throughout the system. This convention, termed broadcast synchronization, can be violated in a sequential machine. Such violations are

analyzed in detail, and their implications for formal validation are assessed; it is shown that, under

certain conditions, unacceptable delay in the identification of safety-critical failures could result

from an improperly chosen sequence of computation.

CONVENTIONAL STATECHART SEMANTICS

State Transition Diagrams

A state transition diagram for a simple state machine is illustrated by figure E-1. In figure E-1, the

three circles represent states designated A, B, and C, and the arrows represent transitions between

states. For example, these states could be identified with the modes of a flight control system. Each

transition is governed by a condition indicated on the diagram by legends labeling each transition

arrow. For example, condition I must hold for the transition from state A to state B to occur, condition 2 must hold for the transition from state B to state C to occur, condition 3 must hold for the transition from state C to state A to occur, and condition 4 must hold for the transition from state A to

state C to occur. The unlabeled arrow pointing to state A indicates that the system is to be initialized

in state A before operation commences. The rectangles in the diagram represent actions that must be

taken at the time a transition occurs; for example, action (a) must be executed whenever the system

transitions from state A to state B.

E-I
14

t

A

Action (a)

Action (b)

8 2

Figure E-1. State transition diagram.

For the deterministic state machines considered in this report, logical consistency requires that

operation be specified uniquely, so that state transitions must be mutually exclusive. For example,

in state A, condition 1 and condition 4 must not both hold at the same time; otherwise, machine

operation is nondeterministic. Logical completeness requires that operation be specified for all possible combinations of the conditions governing transitions; otherwise, a combination of conditions

could be presented for which operation of' the machine would be undefined.

Null transitions can be represented explicitly if desired. For example, if the system is in state A and

conditions 1 and 4 are both false, the system remains in state A, as indicated by the broken arrow.

For logical completeness, the broken arrow must be labeled by the concatenation of the negations of

each condition that would cause transition out of state A, as shown on the diagram. Explicit representation of null transitions enables verification of logical completeness. However, such arrows

clutter the diagram, and the concatenation of all transitions out of state A can become logically complex in large systems. Alternatively, null transitions can be suppressed to simplify the diagram after

logical completeness has been verified by some other means.

It is clear that state transitions depend only on the current state and the current conditions, and not on

the past history of the state evolution, so that the process is Markovian. It is assumed that changes in

the logical conditions are propagated instantaneously throughout the system, a convention termed

broadcast synchronization.

Hierarchical Statecharts

An elaboration of conventional state transition diagrams that provides a more natural representation

of aircraft systems and possesses several other advantages (Harel, 1987) is illustrated by figure E-2.

In figure E-2, two state machines have been combined to form a higher-level entity termed a supermode in the diagram, with system hierarchy indicated by enclosing the two lower-level machines

within an outer boundary. Thus figure E-2 is to be regarded as the projection of a three-dimensional

structure onto the two-dimensional plane. In fig ure E-2, the states are represented by rectangles with

rounded comers instead of circles as in figure E-1. Concurrent (parallel) operation of the two lowerlevel machines is indicated by the broken vertical line in the diagram, which shows

E-2
I Action (a ) I

I MODE 8

MODE Q

SUPERMODE

Figure E-2. Hierarchical statechart.

that the supermode consists of the Cartesian product of the two lower-level systems. It should be

noted that, in the diagram, condition 2 governs transitions in both lower-level machines.

To express the operation of the system of figure E-2 as a conventional state transition diagram like

Figure E-1, six states are required to form the Cartesian product, since the machine on the left of

figure E-2 has three states, and the machine on the right has two. Thus representation of the combined system in the hierarchical form of figure E-2 has saved one state. This economy should not be

regarded as trivial. If each of the lower-level machines contained 100 states, 10,000 states would be

required to represent the system as a conventional `flat" state transition diagram, while representation in the three-dimensional hierarchical form would require only 200 states. Corresponding

economies are also realized in the effort required to analyze the operation of such complex systems,

which increases rapidly with the number of states involved.

Furthermore, if each of the lower-level machines represents an aircraft subsystem (such as a hydraulic system and an electrical system), the hierarchical representation enables designers to deal with

them in a natural way, avoiding the need to form their Cartesian product. Finally, in preparing

system documentation for use by groups representin g different design disciplines, the hierarchical

representation enables low-level detail to be suppressed to whatever extent is considered desirable,

since the internal details of figure E-2 could be omitted without destroying the usefulness of the

diagram at still higher levels.

It should be noted that hierarchical decision tables can serve as an alternative method for specifying

state machine operation that is logically equivalent to statecharts (Sherry, Youssefi, and Hynes,

1995). The statecharts discussed in this report could be translated into such decision tables, for

which automatic generation of implementation code is available (King et al., 1994).

E-3
Aircraft Implementation

Several fundamental issues discussed later can be clarified by considering some simple physical

models. In principle, the continuous elements of the hybrid control system could be implemented in

analog hardware, and their discrete elements implemented by relays controlled directly by analog

signals, as they were in aircraft autopilots designed before the mid-1970s. Alternatively, the state

machine illustrated by figure E-1 could be implemented within a parallel computer, with three processors synchronized by the exchange of interrupts.

In current aircraft, the continuous elements are implemented by digital computation using short

clock-based time steps. A real-time operating system representative of current aircraft is illustrated

in statechart form by figure E-3. It can be seen that when power is applied, the system first initializes

computer memory and then enters the operating mode. In the operating mode, the processor continuously executes various background tasks not requiring precise timing, until it is interrupted by the

clock. The clock interrupt transfers execution to foreground tasks, such as flight control, that require

precise timing.

In figure E-4, a state machine for flight control mode selection is shown embedded in this flight

computer system as one of many foreground tasks, together with other tasks that implement the

continuous system elements that are controlled by mode selection. Since there is only a single

processor, the various foreground tasks must be executed sequentially instead of concurrently. In

figure E-4, the broken vertical lines now represent sequential operation, with time increasing to the

right, in contrast to the concurrent operation represented by the broken vertical line in figure E-2.

All foreground tasks must be completed before the next clock interrupt starts foreground execution

again. Whatever time remains after foreground execution is complete is applied to the background

task, which resumes at the point at which it was previously interrupted.

FLIGHT COMPUTER OPERATING SYSTEM

Power

OFF ON InitiaEize OPERATE

No interrupt

Execute

background

_ tasks

Power

OFF

clock Execute

interrupt foreground

tasks (frame)

Figure E-3. Real-time operating system.

E-4
FOREGROUND

I I Flight control Power ON 1 I

I I mode selection I I

I 1 MODE A I I

I I ^ ! !

I I I 1

I I i 1

I ! 1 2 3 1 I

I 1 I '

Other I Action a Action b I Emulation of

foreground I I continuous

tasks I

I systems

4

I MODE B MODE C I

1 I I r

t 1 I I

! I I I

I I I

I I ! !

I I

2

Action b I I

I I I I

Time

Figure E-4. Flight control mode selection example.

Because sequential computation can only approximate concurrent processing instead of implementing it exactly, it is clear that implementation in a sequential, clock-based machine instead of a

concurrent, interrupt-driven machine may require some modifications to conventional statechart

semantics. These modifications are discussed in detail in the next section. The discussion begins by

considering emulation of the continuous system elements.

MODIFICATIONS FOR SEQUENTIAL PROCESSING

Emulation of Continuous System Elements

Continuous functions of time are approximated in di g ital computation by discrete staircase functions

that coincide with the continuous function only at the instant of update (fig. E-5). The duration of

these time steps must be short relative to the time scale of the continuous process being approximated, in order to achieve sufficient computational accuracy and avoid numerical instability. In current

aircraft, the duration of each time step, which is termed the computation frame, ranges from 10 milliseconds in high-performance aircraft to 50 milliseconds in older transports.

In the emulation of a continuous dynamical process, the computations should be carried out in a

well-defined sequence that is determined by functional dependency. For example, state estimates

such as altitude should be updated before they are used as inputs to the control laws. Otherwise,

excess delay is introduced by out-of-sequence computations that de grades both dynamic accuracy

and closed-loop stability. Because the requirement that the calculations be carried out in correct

sequence severely restricts the possibilities for parallel computation, the discrete emulation of a

continuous dynamical process can be regarded as inherently clock-based and sequential.

E-5
Function

value

Time

Figure E-5. Discrete emulation of continuous function.

Emulation of Discrete System Elements

The question can now be raised: how should the emulation of the concurrent, interrupt-driven system represented by conventional statecharts be related to the sequential, clock-based emulation of

the underlying continuous process that is being controlled by mode selection? Since mode transitions are initiated by changes in the conditions, which are evaluated continuously in conventional

statechart semantics, it is logical to ask first how these conditions should be discretized.

Within each computation frame, the natural time reference is the instant at the beginning of the

frame, which is the time at which the emulation of the continuous system is most accurate. It follows

that the conditions should be updated to the beginning of each frame before they are used in the

emulation of the state machine to determine mode transitions. This policy emulates the broadcast

synchronization convention at the instant of update.

Definition of Time Step

In the concurrent system illustrated by figure E-6(a), suppose that the system is in state A, and that

condition I is FALSE and condition 2 is TRUE. The system remains in state A. If now some external

stimulus makes condition I TRUE, the system transitions first to state B and then to state C

(fig. E-6(a)). Generalizing, it is clear that, in a complex system, a single external stimulus can

produce a flurry of transitions before a new steady state is reached. Observation of such equilibrium

states has been proposed as the basis for definition of a time step in concurrent systems (Harel, 1987;

Leveson et al., 1992).

It is difficult to emulate this process within a sequential processor in real time. To illustrate the

difficulty, consider a naive attempt to emulate the state machine of figure E-6(a) by embedding the

following pseudocode within the foreground tasks of figure E-4.

E-6
a) b)

Figure E-6. Modification of state machine for sequential implementation.

IF (State A) THEN

IF (Condition I) THEN

Transition to State B

ELSE

Remain in State A

END IF

ELSE IF (State B) THEN

IF (Condition 2) THEN

Transition to State C

ELSE

Remain in State B

END IF

ELSE IF (State C) THEN

IF (Condition 3) THEN

Transition to State A

ELSE

Remain in State C

END IF

END IF

According to the IF ... ELSE IF syntax, whenever a TRUE condition is found the processor executes a

single mode transition and then skips to the following END IF. Furthermore, the entire routine is

executed only once during each frame (figs. E-3 and E-4). Therefore, it is clear that this pseudocode

allows only one mode transition per time step. If the system is initially in state A and condition I and

condition 2 both hold, the machine specified by this pseudocode transitions to state B and remains

there during the first time step (frame). At the next time step, the system transitions to state C. Thus

E-7
the semantics of the pseudocode differ from those of the conventional statechart (fig. E-6(a)), for

which the transition from state A to state C would be instantaneous.

This difference is not trivial. For example, suppose that the falsity of condition 2 is required for

validity of the mode corresponding to state B, and that the truth of condition 2 represents a sensor

failure that requires the system to transition to state C. If the underlying continuous system emulated

in state B involves state estimation by recursive filtering, a single frame of computation in the mode

corresponding to state B with an invalid input could fatally corrupt the recursive estimates.

Possibly the pseudocode implementation could be modified so as to match the statechart semantics

by executin g the pseudocode repeatedly until a steady state is observed. However, such iteration is

undesirable in real-time code because it contributes an unknown variation in execution time. Furthermore, if external stimuli continue to be presented, causing changes in the conditions governing

transition, the system may never reach a well-defined, observable equilibrium state.

Alternatively, the statechart semantics can be modified to incorporate a convention that allows only

a single mode transition per frame. This definition of time step for the state machine seems to be

the natural one for a clock-based sequential system. The function of the original statechart can be

restored by adding a transition path directly from state A to state C that is traversed if both condition 1 and condition 2 hold (fig. E-6(b)). The pseudocode for the modified system is then as follows.

IF (State A) THEN

IF (Condition I) THEN

Transition to State B

ELSE IF (Condition I and Condition 2) THEN ! Modification

Transition to State C

ELSE

Remain in State A

END IF

ELSE IF (State B) THEN

IF (Condition 2) THEN

Transition to State C

ELSE

Remain in State B

END IF

ELSE IF (State C) THEN

IF (Condition 3) THEN

Transition to State A

ELSE

Remain in State C

END IF

END IF

E-8
This modification method can be generalized. Provided that the desired function of the state machine

can be specified by adding appropriate transition paths to the conventional statechart while retaining

the modified semantic convention that allows only a single mode transition per frame, then implementation of the modified state machine within a sequential processor is straightforward. if null

transitions are represented explicitly on the diagram, the modified statechart has the appealing interpretation that, at the beginning of each frame ("tick of the clock"), the system is required to execute

one and only one of the state transitions indicated explicitly on the statechart by the transition

arrows.

Violation of Broadcast Synchronization Convention

In emulation of statecharts within a sequential processor, another problem can be encountered that

involves violation of the broadcast synchronization convention. As mentioned previously, this

convention requires that all changes to the conditions governing transition be propagated instantaneously throughout the system. For emulation, the logical conditions that govern transition should

be updated to the beginning of the frame, as discussed previously. This updating process is straightforward for transition conditions that depend only on quantities external to the flight control system,

such as sensor measurements and their associated Boolean valids (that is, auxiliary quantities that

report the results of external sensor validity tests).

However, some transition conditions may depend on internally computed quantities like commanded

fli ghtpath angle and airspeed. These computed quantities are, in general, mode-dependent, and therefore cannot be updated until after the flight control modes have been selected for the current frame.

Before update, these quantities are referred to the beg inning of the previous frame, and so also are

the transition conditions dependent upon them. It follows that propagation of these transition conditions is effectively delayed by one frame at the time of mode selection, violating the broadcast

synchronization convention.

Implications for Formal Validation

In assessin- the consequences of such violations, it seems useful to distinguish between cases for

which not a single frame of delay in mode transition can be permitted, which is termed hard violation, and those in which one or more frames of delay can be tolerated, which is termed soft violation.

For example, consider a sensor failure that requires an immediate mode reversion without a single

frame of delay. If detection of this failure depended on testing computed, mode-dependent quantities, the mode reversion would occur one frame too late to avoid the execution of servo commands

to the aircraft control surfaces that were dependent on the failed sensor, constituting a hard violation.

Such a design should be considered unacceptable for flight safety.

Formal validation of systems subject to such failures lies outside the scope of this report. However,

the dynamical process of mode evolution tends to proceed at a slower pace than the evolution of the

underlying continuous states—typically, each mode transition is separated from the preceding one

by several hundred frames. Therefore, most violations of the broadcast synchronization convention

encountered in flight control systems are found to be soft. It is clear that formal validation of the

flight control system by the methods developed in this report requires verification of the softness of

each such violation.

E-9
A DETAILED IMPLEMENTATION EXAMPLE

With the modifications to conventional statechart semanticsjust developed, the statechart diagram

forms a complete specification from which implementation code can be prepared. To illustrate this

process, a simplified example is presented in this section, and the resulting pseudocode is compared

with pseudocode generated by the well-established Jackson program design method (Jackson, 1975).

It is shown that the two specification methods are equivalent for the example to be discussed.

Statechart Example

To illustrate the implementation procedure, it is assumed that the discrete mode control system

illustrated by figures E-4 and E-6(b) is to be embedded in the clock-based sequential machine

illustrated by figure E-3. The mode control task is to be accomplished by a subroutine (procedure)

called from foreground, which selects the mode for the current frame and makes it available for use

by the emulation of continuous system elements that follows mode selection (fig. E-4).

It can be seen that the system is to be initialized in MODE A when power is first applied (fig. E-4).

Thereafter, transitions between the three states MODE A. MODE B, and MODE C are governed by

conditions 1, 2, and 3. According to the modified semantic convention developed in the previous

section, only one mode transition is allowed at each time step, and the statechart of figure E-4 has

been modified accordin g ly, as previously discussed. It is assumed that conditions 1, 2, and 3 have

been updated to the beginnin g of the frame by one of the other foreground tasks (fig. E-4) executed

before mode control processing begins.

Since the system is to be initialized in MODE A on the first frame of operation, but not subsequently

(fig. E-4), it is logical to set a flag (to be called the Init_DONE flag) to indicate that initialization

should be skipped durin g all subsequent frames. It is assumed that the lnit_DONE flag is initialized

FALSE by the operating system when power to the flight computer is first applied (fig. E-3).

After initialization, the mode selection depends on conditions 1, 2, and 3 as well as upon the mode

selected during the previous frame. A nested IF structure could test conditions first, or previous

mode first, or alternatively a case structure could avoid nesting entirely by combining condition and

previous mode into a single compound condition. The choice among these alternatives must be

based on psychological criteria relating to ease of use by humans, since considerations of computational efficiency are trivial in this simple example.

For this example it has been decided to test first for previous mode, based on our opinion that this

choice leads to pseudocode that is easier to understand than that resulting from either of the other

choices. Makin, use of standard structural forms for sequence and for choice among mutually

exclusive alternatives, the pseudocode is then as follows (table E-1). (The numbers in parentheses

following each action to be performed relate to the Jackson program desiyon example to be discussed

next, and should be ignored for the present.)

E-10
TABLE E-1

Operating System Initialization

Set lnit_DONE flag FALSE (l )

Subroutine Flight Control Mode Selection

IF (not Init_DONE) THEN

Select MODE A (3)

Set Init_DONE flag TRUE (2)

ELSE

IF (MODE A) THEN

! Called from Foreground

! First frame

! All subsequent frames

! Process MODE A

IF (not Condition 1) THEN

Select MODE A (3)

ELSE IF (Condition I and not Condition 2) THEN

Perform Action (a) (6)

Select MODE B (4)

ELSE IF (Condition I and Condition 2) THEN

Perform Action (b) (7)

Select MODE C (5)

END IF

ELSE IF (MODE B) THEN ! Process MODE B

IF (not Condition 2) THEN

Select MODE B (4)

ELSE IF (Condition 2) THEN

Perform Action (b) (7)

Select MODE C (5)

END IF

ELSE IF (MODE C) THEN ! Process MODE C

IF (not Condition 3) THEN

Select MODE C (5)

ELSE IF (Condition 3) THEN

Select MODE A (3)

END IF

END IF

END IF

RETURN (8)

E-11
NEW

MODE

MODE A MODE B MODE C

* 4

i

Jackson Program Design Example

The Jackson program design method (Jackson, 1975) begins with the preparation of a diagram

representing the structure of the input and output data streams hierarchically (fig. E-7). In figure E-7,

the vertical dimension indicates hierarchy, and the horizontal dimension indicates time sequence,

with time increasing from left to right. An asterisk placed at the upper right within a block indicates

iteration, while a small circle indicates one amon( T several mutually exclusive alternatives.

Correspondences are then established between input and output data elements that occur in the same

sequence (broken lines in figure E-7), and the corresponding data elements are combined to create a

processing structure (fig. E-8). Specific operations (see Notes, figure E-8) necessary to achieve the

required output are enumerated, and then added to the processing structure in the appropriate locations determined by the required sequence of operations (fig. E-8). Finally, pseudocode is prepared

directly from the program structure chart (fig. E-8). The Jackson method results in a unique program

structure that guarantees correct sequential operation. Readers unfamiliar with the Jackson method

who desire a more detailed discussion can consult Michael Jackson's 1975 textbook (Jackson, 1975).

OPERATING

SYSTEM

INITIALIZATION I I OPERATION

FRAME

Operating system

Application program

FRAME

Correspondences

FIRST OTHER

FRAME FRAMES

/

i

/

MODE A MODE B MODE C

i

` 1 12 12 2 2 3 3 y_^!

i

Figure E-7. Jackson Data Structure Chart for mode control example.

E-12
OPERATING

SYSTEM

Notes:

INITIALIZATION ' l I OPERATION

EXECUTE

FRAME

Operating system

Application program

1 Set Init. DONE flag FALSE

2 Set Init... DONE flag TRUE

$ Select MODE A

4 Select MODE B

5 Select MODE C

6 Perform ACTION a

7 Perform ACTION b

8 Return

PROCESSFRAME

PRODUCING MODE

PROCESS FIRST FRAME ' ^ PROCESS OTHER

PRODUCING MODE A FRAMES

PROCESS PROCESS PROCESS

MODE A MODE B MODE C

PROCESS 1 PROCESS 1 2 PROCESS 1 2 ` PROCESS-2 PROCESS 2 PROCESS -3 PROCESS 3

PRODUCING PRODUCING PRODUCING PRODUCING PRODUCING PRODUCING PRODUCING

MODE A MODE B MODE C MODE B MODE C 11 MODE C MODE A

Figure E-8. Jackson Program Structure Chart for mode control example.

To prepare pseudocode from the program structure chart of figure E-8, the chart is read as follows.

Starting at the top and working downward, each row is read from left to right. The first operation

encountered is settin a the Init_DONE flag FALSE, which must be taken care of by the operating

system (compare Operating System Initialization, table E- I ). Working downward and to the left into

the application program (compare Subroutine Flight Control Mode Selection, table E-1), the second

row consists of two nuftually exclusive alternatives (note the small circles at the upper right in each

block), of which the first is "Process the first frame producing MODE A." The two alternatives are

distinguished by testing the Init_DONE flag. On the first frame, two operations must be carried out

(see the two lame circles below the first-frame block referring to Note 3 and Note 2). Reading from

left to ri<aht, first the system must be initialized by selecting MODE A, and then the Init_DONE flag

must be set TRUE, causing the initialization to be skipped on all subsequent frames. The pseudocode

specified by the diagram of figure E-8 is as follows, from the top down to and including the second

row of the application program. The numbers in parentheses following each action to be performed

refer to the Notes on the Jackson chart (fig. E-8).

E-13
Operating System Initialization

Set Init_DONE flag FALSE (1)

Subroutine Flight Control Mode Selection ! Called from Foreground

IF (not lnit_DONE) THEN ! First frame

Select MODE A (3)

Set Init_DONE flag TRUE (2)

ELSE ! All subsequent frames

Process other frames

END IF

RETURN

The processing required during subsequent frames is specified by the lower two rows of the application program structure chart. Continuin g to work downward and to the left, the third row consists of

three mutually exclusive alternatives, which are distinguished by testing the mode selected during

the previous frame, beginning with MODE A. If MODE A was selected, the bottom row requires testing the conditions to distinguish among the three mutually exclusive alternatives shown. The block

at the extreme left of the bottom row specifies that, if condition I is FALSE, then MODE A must be

selected again for the current frame (Note 3). The next block to the right specifies that, if condition I

is TRUE and condition 2 is FALSE, first action (a) must be performed (Note 6), and then MODE B

selected (Note 4). The third block specifies that, if both condition 1 and condition 2 are TRUE, first

action (b) must be performed (Note 7), and then MODE C selected (Note 5).

Since there are no other blocks to the ri „ ht in the last row under the block "Process MODE A” in the

third row, this completes the MODE A processing. Now moving up to the third row, it can be seen

that the next block to the ri ght specifies the processing for MODE B, and the last block specifies the

processing for MODE C. At this point, the pseudocode is as shown in table E-2.

It will be seen that the mutually exclusive alternatives in the program structure chart are translated

directly into the standard IF ... ELSE IF structures in the pseudocode. This direct structural correspondence between chart and pseudocode, which is made possible by the use of standard structural

forms, is fundamental to the Jackson method.

In table E-2, the stubs for processing MODE B and MODE C are completed in the same manner as that

just explained for MODE A. The processing for MODE B and MODE C completes the processin g for the

third row (fig. E-8). Moving up to the second row, it can be seen that processing is now complete for

the block "Process other frames" at the right of the second row, and also for the block "Process

frame producing mode" in the first row. Moving to the right in the first row, the last operation is

specified by Note 8, RETURN.

E-14
TABLE E-2

Operating System Initialization

Set Init_DONE flag FALSE (I )

Subroutine Flight Control Mode Selection

IF (not Init_DONE) THEN

Select MODE A (3)

Set Init_DONE flag TRUE (2)

! Called from Foreground

! First frame

ELSE ! All subsequent frames

IF (MODE A) THEN ! Process MODE A

IF (not Condition 1) THEN

Select MODE A (3)

ELSE IF (Condition I and not Condition 2) THEN

Perform Action (a) (6)

Select MODE B (4)

ELSE IF (Condition 1 and Condition 2) THEN

Perform Action (b) (7)

Select MODE C (5)

END IF

ELSE IF (MODE B) THEN ! Process MODE B

Process MODE B

ELSE IF (MODE Q THEN ! Process MODE C

Process MODE C

END IF

END IF

RETURN (8)

The program is now complete. The complete pseudocode (table E-2) is found to correspond exactly

to that prepared directly from the modified statechart (table E-1), showing that, for this example, the

method based on the proposed statechart modification is equivalent to the well-established Jackson

program design method.

E-15
REFERENCES

Harel, David: Statecharts: A Visual Formalism for Complex Systems. Science of Computer

Programming, vol. 8, no. 3, June 1987, pp. 231-274. See also Harel, D.; Pneuli, A.;

Schmidt, J. P.; and Sherman, R.: On the Formal Semantics of Statecharts. In Proceedings of

the 2nd IEEE Symposium on Logic in Computer Science, Ithaca, N.Y, June 22-24, 1987.

IEEE Press (New York), pp. 54-64.

Jackson, M. A.: Principles of Program Design. Academic Press (London), 1975.

King, Tim; Krueger, Jon; Ward, Jon; Hughes, Banni; Michaels, Matt; and Sherry, Lance: Generating

Software from a Hierarchy of Operational Procedure Tables. Honeywell Technical Report SSTR94-009, Honeywell Technology Center, Minneapolis, Minn., 1994.

Leveson, Nancy G.; Heimdahl. Mats P. E.; Hildreth, Holly; and Reese, Jon D.: Requirements

Specification for Process-Control Systems. Technical Report 92-106, Information and Computer

Science Dept., University of California, Irvine, Calif., 1992.

Sherry, Lance; Youssefi, David; and Hynes, Charles S.: A Formalism for the Specification of

Operationally Embedded Reactive Avionic Systems. Honeywell Publication C69-5370-001,

Honeywell Air Transport System Division (System Engineering Technology), Phoenix, Ariz.,

1995.

E-16
APPENDIX F

THEOREMS ON SYSTEM BEHAVIORAL PROPERTIES

Volume I presents a new method for synthesizing hybrid systems from design requirements, and

applies it to the design of a system for longitudinal control of transport aircraft. The resulting system

satisfies general requirements for safety and effectiveness specified a priori. This appendix presents

theorems that summarize the behavioral properties of the hybrid system (Volume I, (Synthesis of

Altitude Command Supermode)), and provides methodology for generating formal proofs. These

theorems enable theoretical assessment of system dynamical behavior and verification of system

safety and effectiveness independent of the synthesis method. By this means, formal validation of

the complete system can be achieved.

The discussion begins with some considerations of proof methodology, followed by the theorems

themselves and their proofs. For clarity, an informal proof outline is presented immediately before

each formal proof. A short discussion shows by example how a rather subtle design error committed

durin o the synthesis process was revealed by attempted formal proof and subsequently corrected.

Finally, it is shown that currently available codes for automated hypothesis testing can provide the

basis for a theorem-proving tool. By this means, any hypothesis could in principle be tested to

determine whether it is a theorem of the formal system. In future system development making use

of the synthesis methods described in this report, such hypothesis testing could play a role similar to

that of simulation in today's development process, but unlike simulation it would lead to results that

would be rigorous and logically complete.

PROOF METHODOLOGY

Objectives

Several of the theorems to be discussed describe system dynamical behavior, such as capture of

altitude and airspeed targets, that is inherently time-dependent. The time required for capture of a

new target depends on the initial conditions prevailing at mode engagement, and ranges from a few

seconds for a small chan ce of airspeed to more than 30 minutes required for the aircraft to climb and

capture the cruising altitude following system engagement just after takeoff (appendix B). Therefore,

any attempt to characterize such time variations precisely would lead to an extremely complicated

analysis, with correspondingly complex theorems and formal proofs.

Fortunately, that effort is unnecessary. In our opinion, variations in the time required for target

capture are unimportant for formal assessment of system behavior, for two reasons: first, the human

flight crew will know roughly what variations to expect based on simulator training and flight experience; and second, this rough knowled ge is adequate for supervision of the automated system, just as

it is for supervision of a human crewmember during manual flight. What is essential for supervision

F-1
is assurance that the system cannot fail to capture a selected target without generating an appropriate

warning. Therefore, the theorems to be discussed can be regarded as guarantees of system behavior

offered to the flight crew by the system designers.

Approach

This viewpoint suggests a simplified approach to the formal description of system behavior. By

ignoring time-dependent detail, the essential behavior can be stated formally by logical propositions

of the form (A B C => D), where A denotes selection of a primitive mode, B denotes selection of a

valid target, C denotes satisfaction of a guarding condition, and D denotes capture of the selected

target in the long term after some unspecified time has elapsed. For example, let A denote selection

of the primitive y-V Command mode described in Volume I, B denote selection of valid flightpath

and airspeed targets, C denote absence of thrust saturation (table 3, Volume I), and D denote

(eventual) capture of the selected flightpath and airspeed targets. The proposition (A B C =:> D)

then has the semantic interpretation that continuous engagement of the y-V Command mode AND

continuous selection of the (fixed) flightpath and airspeed targets AND continuous absence of thrust

saturation IMPLY eventual capture (and hold) of the selected flightpath and airspeed targets.

It should be noted that the truth value of the proposition (A B C => D) depends only on the stability

properties of the fli ghtpath and airspeed regulators, which are continuous elements of the hybrid

system. Their stability properties characterize the closed-loop dynamical behavior of the aircraft

with the y-V Command mode engaged, as discussed in detail in Volume I. Regulator stability, which

is governed by continuous differential equations, can be verified by well-known control-theoretic

methods independent of the discrete mode selection logic. In this example, the mode selection logic

determines the truth values of the conditions A, B, and C, but not the truth value of the implication

(A B C => D), which depends only on regulator stability.

It follows that, after independent verification, the proposition (A B C => D) can be taken as an axiom

of the formal system that describes the essential dynamical behavior of the y-V Command mode.

Other axioms similar in form can describe the essential dynamical behavior of the other primitive

modes (that is, the y Command mode and the V Command mode). Ordinary propositional logic

(appendix D), which is inherently static in nature because it deals with propositions whose truth

values are independent of time, can then be applied to these axioms (together with other system

properties to be defined in the next section) in order to establish formally the dynamical behavior of

the complete system.

Framework of Analysis

The mode structure of the complete system is organized hierarchically on three levels, as explained

in detail in Volume I. On the first level, the three primitive modes (whose dynamical behavior is

summarized by the axioms just discussed) are combined to form the lowest-level supermode, which

is termed Path/Speed Command. The mode selection logic for the Path/Speed Command supermode

determines which one of the three primitive modes is engaged at any time, and must provide an

appropriate strategy for switching between them as flight conditions change. On the second level of

the mode hierarchy, higher-level supermodes accept altitude and airspeed targets entered manually

into the aircraft mode control panel by the flight crew, generate appropriate flightpath and airspeed

F-2
targets, and select the first-level Path/Speed Command supermode, which becomes an internal

element of the higher-level supermode that invokes it. (The third level of the hierarchy, which is not

treated in detail by this report, enables aircraft trajectories to be optimized to conserve time and fuel

by appropriate automated selection of altitude and airspeed targets.) The dynamical evolution of all

the modes in this hierarchy constitutes the system behavior that must be summarized by the theorems to be presented.

For analysis, this dynamical mode evolution is considered to be composed of piecewise-continuous

segments, each of which is characterized by a set of modes and supermodes on different levels of the

hierarchy that remain selected throughout the (unspecified) time duration of that segment. The segments are separated by well-defined mode transitions, which occur instantaneously in accordance

with the convention of broadcast synchronization (appendix E).

At each mode transition, mode selection for the next segment depends only on (1) the set of modes,

supermodes, and targets selected for the current segment, and on (2) currently prevailing flight

conditions (specifically, flightpath angle, airspeed, and thrust). Mode selection is independent of the

past history of mode selection previous to current selections, and of flight conditions previous to

prevailing conditions (the Markovian property). The continuous variables representing prevailing

flight conditions are discretized for mode selection by separating the flightpath-airspeed plane into

7 regions (termed geometric stability regions) with mathematically sharp boundaries. These boundaries correspond to minimum airspeed, maximum airspeed, minimum thrust, maximum thrust, and

speed for minimum drag, which are estimated on board the aircraft based on real-time sensor

measurements and on stored aircraft performance data. Detailed discussion of this mode selection

logic can be found in Volume I.

The followin g discussion shows that the system behavior theorems to be presented can be established formally by applying propositional logic to this structural framework.

DEFINITIONS

Logical Symbols

Logical symbols are defined as follows (List of Symbols, Volume 1):

Equivalence - Negation Implication =>

Logical OR U Logical AND will be omitted

Elementary Theorems

A reference list of theorems in symbolic logic can be found in appendix D (Dromey, 1989; Bartee,

1985). For example, Theorem 17 is referenced as follows:

(17) pq=:>p

F-3
Symbolic Logical Propositions

For reference, the following definitions are taken from Volume I:

V I = (V< VMIN DRAG ) VT3 - (V TGT < VMIN DRAG)

V3 -(V = VTGT)

G1 =(7=O)

- (7TGT - 7SPEED MAX

DCl = (7POT MIN < 0)

TCl = (7POT MAX < O)

TSI = (7 C 7SPEED MIN )

TTI - (7 POT TGT = 7POT MIN )

V4 - (V > VTGT )

GT6 = (7TGT > 7 POT MAX)

(7TGT - 7SPEED MIN

PF1 - (7POT MAX = 7POT MIN )

TC2 = (7POT MAX 0)

TS? = (7 > 7SPEED MAX )

TT2 = (7 POT TGT - POT MAX)

APE (7) - (GT6 V 1 TS2) —,PE(V)-(P TTI)U(Q TT2)

APP = (PRIORITY = SPEED) PP - (PRIORITY = PATH)

Mode Selection Strategy

Denote mode selection by the following symbols:

AC - Altitude Command supermode

CH = Altitude Capture / Hold supermode CD = Climb / Descend supermode

CM = Climb supermode DM = Descend supermode

PS = Path / Speed Command supermode

VC = V Command mode GC = 7 Command mode

F-4
Path/Speed Command Supermode Selection

The primitive mode selection logic for the Path/Speed Command supermode can be summarized as

follows (table 7, Volume I):

PS APP =:> VC PS PP => GC

Altitude Command Supermode Selection

The supermode selection logic for the Altitude Command supermode can be summarized as follows

for the abnormal cases (table 12, Volume I):

AC —,PE (7) ^ CD AC PE (7) ^PE(V) => CH

The supermode selection logic for the Altitude Capture/Hold supermode and the Climb/Descend

supermode within the Altitude Command supermode can be summarized as follows (table 10,

Volume 1). (Note that (AH < 0) = (H > HTCT) and (AH >_ 0) - (H<_ HTCT).)

CD (H > HTGT) => DM APP PS CD (H <_ HTGT) => CM -'PP PS

CH => PP PS

Combining the selection logic for the supermodes within the Altitude Command supermode with

that for the Altitude Command supermode itself results in the following combined selection logic:

AC APE (7) => CD —,PP PS AC PE (7) —,PE(V) => CH PP PS

Drag Condition

The following property holds for all transport aircraft (Volume I (Flight Control System)):

DC1 - (T POTMIN < 0)

Thrust Condition

During total propulsion failure, the following properties hold (Volume I (Flight Control System)):

TMAX TMIN 7POT MAX - 7 POT MIN 7SPEED MAX ' 7SPEED MIN

Therefore, from the definitions of PFI, TCI, and DC1, the followin g property holds:

PF1 => (TC1 = DCl)

In the absence of total propulsion failure, the following properties hold (Volume I (Flight Control

System)):

TMAX > TMIN 7POT MAX > 7 POT MIN ySPEED MAX > 7SPEED MIN

F-5
Therefore, from the definitions of PH, TS1, TS2, TT1, and TT2 the following properties hold:

---,PF I (7 POT MAX > 7 POT MIN ) (7SPEED MAX > 7SPEED MIN)

^PFI => (TS2 = -,TS1)(TT2 = -,TT1)

Strategy for Setting Target Thrust

When thrust is saturated, the strategy for setting target thrust can be summarized as follows (table 5,

Volume 1):

PH => TT1-,TT2 ^PF1 TS] => TT1 -,TT2 -,PFI TS2 => TT2 -,TT1

From the definitions already stated, these implications are equivalent to the following propositions:

(7 < SPEED MIN ) =:> (7POT TGT - 7 POT MIN)

(7 > SPEED MAX ) => %OT TGT - 7POT MAX)

Speed Regulator

The parameter 7SPEED is defined as follows (Volume I (Flight Control System)):

TT2 = (7 POT TGT - 7 POT MAX (7SPEED = 7 SPEED MAX)

[TTl (7 POT TGT - POT MIN (7SPEED = 7 SPEED MIN )

Because the acceleration command (dV/dt)cMD is assumed proportional to airspeed error (Volume I

(Flight Control System)), (dV/dt)cMD vanishes when V = VTGT.

The speed regulator has the following properties (Volume I (Flight Control System) and figure

I I (c)):

( 7 SPEED MAX = 7 POT MAX ) ^ [V' = (V = V TGT )^

V3 = (V = VTGT )' =:> (7SPEED MAX = 7

POT MAX)

(7SPEED MAX > 7 POT MAX ) =:> 

[V4 = (V > VTGT)1

V4 - (V > VTGT )1 => (7SPEED MAX > 7 POT MAX)

F-6
Longitudinal Acceleration Limiter

The longitudinal acceleration Iimiter has the following property (Volume I (Flight Control System)):

(7SPEED MIN < 0)

Height Regulator

The height regulator has the following property (Volume I (Synthesis of Altitude Command Supermode) and figure 11(b)):

(7TGT <0) => (H > HTGT)

Definition of HMAx

By definition of the maximum altitude HMAx, the following property holds (Volume I, (Synthesis of

Altitude Command Supermode)):

(H<_ H MAx ) => (7'rGT > 0.3 deg)

Subscripts

Subscripts denote conditions prevailing at different times, as follows:

o Initial conditions

C Conditions at capture of VTGT

Logical propositions without subscripts hold at all times. Specialization of such unrestricted

propositions to particular conditions is indicated by the properties

(•) => (•)o (•) => (•)c

which follow from the subscript definitions because any proposition which holds in general must

hold at any particular time.

Fixed Speed and Altitude Targets

The properties

VT = (VTGT VTGT0) HT - (HTGT HTGT O)

hold if and only if the speed target VTGT and the altitude target HTGT remain fixed at their initial

values.

F-7
V Command Capture Axiom

The eventual capture of flightpath and airspeed targets after some unspecified time has elapsed

following engagement of the primitive V Command mode can be expressed by the axiom

VC HT VT =:> (7c = 

7SPEED d Vac

which follows from the stability of the flightpath and airspeed regulators (Volume I, figs. I I(e) and

11(c)). (Regulator stability can be verified independently by well-known control-theoretic methods.)

V Command Hold Axiom

Following capture, continuous engagement of the V Command mode ensures that the conditions

(7 = YSPEED) and (V = VTCT) continue to hold indefinitely. This property can be expressed by the

axiom

VC HT VT 

(7C = 7 SPEED C ) Va c => (7 = 7 SPEED ) V3

which follows from the stability of the flightpath and airspeed regulators (Volume I, figs. 1 1 (e) and

1 I (c)). (Regulator stability can be verified independently by well-known control-theoretic

methods.)

PERFORMANCE DEGRADATION

The first theorem to be presented (Theorem 1) shows that the abnormal condition —,PE (7) -'PE (V)

can occur only if performance has become so degraded that maximum thrust is insufficient for

steady level flight. (This condition could be encountered following engine failure at cruising altitude.) Lemma A treats the case of total propulsion failure, and Lemma B treats its absence.

Lemma A

PF1 => TCI

Informal Proof Outline

By definition of total propulsion failure, the property

PFI = (7 POT MAX = 7 POT MIN)

holds following total propulsion failure. By hypothesis, PFI holds. Since yPOTMAX then coincides

with yPOT MIN, it follows from their definitions that the equivalence

F-8
2. PF 1

3. TC 1 = DC 1

4. DC 1

5. TC 1

1. PF I => (TC 1 = DC 1) Thrust condition property

during total propulsion failure.

Hypothesis.

Lines 1 and 21

Drag condition.

Lines 3 and 4. QED

TO = (7POT MAX < 0) ( POT MIN < 0) = DCI

holds. But the property DC l = (yPOT MIN < 0) holds for all transport aircraft (Volume I (Flight

Control System)). Therefore, the property TC I = (yPOT MAX < 0) holds following total propulsion

failure, and the lemma is established.

Formal Proof

Lemma B

^PFI -,PE(7) -,PE(V) => TO

Informal Proof Outline

By definition, -,PE (y) _ (GT6 V I TS2). Since APE (y) holds by hypothesis, in particular- the

property TS2 = (y> ySPEED MAX) must hold. By definition of total propulsion failure, the condition

(TS2 = --,TS1)(TT2 = -TTI) holds in its absence, as required by the hypothesis. Therefore, since TS2

holds, -,TS 1 must hold. According to the strategy for setting target thrust, the property TT2 holds

after thrust is set, and TT l cannot hold.

From the definition of APE (V) -,PE (V) _ (P TT I) u (Q TT2), which holds by hypothesis,

and from the conditions -,TTI and TT2 just established, it follows that the condition

Q = (7TGT < ySPEED MIN) must hold. Combining this condition with the property of the longitudinal

acceleration limiter (ySPEED MIN < 0) shows that the condition (yTGT < ySPEED MIN < 0) must hold.

Since the condition -,PE (y) = (GT6 V 1 TS2) holds by hypothesis, in particular the property

GT6 = (yrGT ? YPOT MAX) must hold. Now, combining this condition with the condition

(yTGT < ySPEED MIN < 0) just established shows that the condition

yPOT MAX — yTGT — ySPEED MIN < )

must hold. But then in particular the property TCI = (yPOTMAX < 0) must hold, and the lemma is

establ [shed.

F-9
Formal proof

1. APE (y) = (GT6 V 1 TS2) Definition of APE (y).

2. -,PF 1 -,PE (y) Hypothesis.

3. ^PFI TS2 Lines 1 and 2.

4. -,PF I TS2 :::> TT2 -,TT I Thrust setting strategy.

5. TT2 -ITT 1 Lines 3 and 4.

6. APE (V) = (P TT I) u (Q TT2) Definition ol'-APE (V).

7. APE (V) Hypothesis.

8. (P TT I) u (Q TT2) Lines 6 and 7.

9 .Q Lines 5 and 8.

1 0• Q - (7TGT < ySPEED MIN) Definition of Q.

I I • (yTGT < ySPEED MIN) Lines 9 and 10.

12. (ySPEED MIN < 0) Property of longitudinal

acceleration limiter.

13. (yTGT < 7S PEED MIN < d) Lines I I and 1 2.

14. GT6 Lines I and 2.

15. GT6 = (YFGT ? 7P OT MAX) Definition of GT6.

16. (YTGT 'Y POT MAX) Lines 14 and 15.

17. (YPOT MAX < yTGT < •YSPEED MIN < 0) Lines 13 and 16.

18. (7POT MAX < 0) (17) p q => p and Line 17.

19. TC I = (yPOT MAX < 0) Definition of TC 1.

20. TC I Lines 18 and 19. QED

F-10
Theorem 1 (Performance Degradation Theorem)

Statement

APE (y) APE (V) => TC 1

Informal Proof Outline

There are two cases: (a) total propulsion failure present, or (b) total propulsion failure absent.

Case (a)- Assume that total propulsion failure is present. In that case, according to Lemma A, the

condition TC 1 = ( yPoT MAX < 0) holds, and the theorem is established for case (a).

Case (b)- Assume that total propulsion failure is absent. In that case, according to Lemma B, if both

PE (y) and PE (V) are violated, then the condition TC 1 = (yroT MAX < 0) holds. Since by hypothesis

both PE (y) and PE (V) are violated, the condition TC 1 = (yroT MAX < 0) must hold, and the theorem

is established for case (b).

Therefore, the condition TC I = (yroT MAX < 0) holds whether or not total propulsion failure occurs,

and the theorem is established in general.

Formal Proof

I . PF 1 => TC l Lemma A.

2. -,PFI APE (y) APE (V) => TC1 Lemma B.

3. -,PE (y) -,PE (V) Hypothesis.

4. -,PF I => TC 1 (13) p T = p and Lines 2 and 3.

5. (PF 1 u --,PF 1) =:> TC 1 Lines 1 and 4.

6. (PF1 u --,PF1) (4) (P u -P) = T.

7. TC1 Lines 5 and 6. QED

RECOVERY FROM ABNORMAL CONDITIONS

The next three theorems (Theorem 2, Theorem 3, and Theorem 4) to be presented are concerned

with recovery from the three abnormal conditions for the Altitude Command supermode. As discussed in Volume I (table 11), these abnormal conditions are -APE (y) -,PE (V) -,PE (y) PE (V), and

PE (y) -,PE (V); the normal condition is PE (y) PE (V). The point of the three recovery theorems is

to show that, starting from any of the three abnormal conditions, the system recovers to the normal

condition without crew intervention. If recovery to the normal condition should be precluded by

performance limitations, then it is demonstrated that the aircraft stabilizes in a desirable flight condition and that no potentially unsafe behavior results.

F-11
Because all three recovery theorems involve dynamical behavior, their proofs are more complex and

difficult than the proof of the static theorem (Theorem 1) already presented. The discussion begins

with a (static) lemma that specifies initial conditions for the -'PE (y) -'PE (V) Recovery Theorem

(Theorem 2) that hold in the absence of total propulsion failure.

Lemma C

-,PF1 -,PE(7) --,PE(V) => (a) (7POT MAX < 7TGT < 7SPEED MIN < 0)

(b) (7SPEED MIN < 7SPEED MAX < 7)

(c) (V TGT < V S VMIN DRAG)

(d) (H > HTGT)

Informal Proof Outline

Part (a)- The hypothesis coincides with that of Lemma B. The first claim is established by Line 17.

Lemma B.

Part (b)- By hypothesis, the condition -APE (y) - (GT6 VI TS2) holds. In particular, the condition

TS2 - Cy > YSPEED MAX) holds. Since -,PF I => (7SPEED MAX > 7SPEED MIN) holds by the thrust condition

property, and since -,PF 1 holds by hypothesis, (YSPEED MAX > 7SPEED MIN) must hold. Combinin g this

with TS2 shows that (YSPEED MIN < 7SPEED MAX < 7) must hold, establishin,- the second claim.

Part (c)- The condition (yPOT MAX < 7TGT < YSPEED MIN < 0) holds by Part (a) and the condition

(YSPEED MIN < 7SPEED MAX < y) holds by Part (b). Combining these conditions shows that the condition

(7SPEED MAX > 7POT MAX) must hold. By the property of the speed regulator, the impl ication

(7SPEED MAX > 7POT MAX) => ( V > VTGT) holds. Therefore, the condition (V > VTGT) holds. By

hypothesis, -,PE (y) - (GT6 V 1 TS2) holds. In particular, V I - (V <- VMIN DRAG) holds. Combining

the conditions (V > VTGT) and (V !^ VMIN DRAG) shows that the condition ( VTGT < V-< V MIN DRAG)

holds, establishin- the third claim.

Part (d)- The implication (7TGT < 0) => (H > HTGT ) holds by the height regulator property, and the

condition (yTGT < 0) holds by part (a). Therefore, the condition (H > HTGT) must hold, establishing

the fourth claim.

Therefore, the lemma is established.

Formal Proof

Part (a)

1. --,PF I -,PE(y) -,PE(V) => (YPOT MAX < 7TGT < 7SPEED MIN < 0) Line 17, Lemma B.

2. —,PF1 -,PE(7) --,PE(V) Hypothesis.

3, (7 POT MAX < 7TGT < 7SPEED MIN < 0) Lines 1 and 2.

F-12
Part (b)

4. —,PE(7) = (GT6 V I TS2) Definition of --,PE(7)

5. TS2 lines 2 and 4.

6. TS2 = (7 > 7SPEED MAX) Definition of TS2.

7. (7 > 7SPEED MAX) Lines 5 and 6.

8 * --,PF I =^ (7SPEED MAX > 7SPEED MIN) Thrust condition property.

9. (7SPEED MAX > 7SPEED MIN) Lines 2 and 8.

10 ' (7SPEED MIN < 7SPEED MAX < 7)

Lines 7 and 9.

Part (c)

I I* (7SPEED MAX > 7 POT MAX ) => (V > V GT) Speed regulator property.

12. (7POT MAX < 7SPEED MIN) Line 3

13. (7POT MAX < 7SPEED MAX) Lines 9 and 10.

14. (V > VTGT ) Lines 11 and 13.

15. V I Lines 2 and 4.

16. V1 = (V <_ VMIN DRAG) Definition of V L

17. (V <_ VMW DRAG) Lines 15 and 16.

18. (VTGT < V < VMIN DRAG) Lines 14 and 17.

Part (d)

19' (7TGT < 0) =:> (H > HTGT) Height regulator property.

20. (H > H TGT) Lines 3 and 19. QED

The next lemma establishes initial mode selection for the initial conditions of Lemma C.

F-13
Lemma D

(a) AC -,PE(7) => CD APP PS VC

(b) AC -,PFI -,PE(y) -,PE(V) =:> CD DM APP PS VC

Informal Proof Outline

Part (a)- The implication AC APE (y) => CD -,PP PS holds by the property of the Altitude Command supermode selection logic. Since AC APE (y) holds by hypothesis, the condition CD - 'PP PS

must hold. The implication -,PP PS =:> VC holds by the property of the Path/Speed Command supermode selection logic. Since APP PS holds, VC must hold. Combining these results shows that

CD -,PP PS VC must hold, establishing the first claim.

Part (b)- The implication -,PFI APE (y) APE (V) => (H > HTGT) holds by Lemma C, and the

condition AC -,PF 1 APE (y) APE (V) holds by the hypothesis of part (b). Therefore, the condition

(H > HTGT) must hold. But the implication CD (H > HTGT) => DM holds by the property of the

supermode selection logic within the Altitude Command supermode, and AC CD (H > HTGT) holds.

Therefore DM holds (the Descend supermode is selected). Combining this result with that of part (a)

shows that the condition CD DM APP PS VC holds, establishing the second claim.

Therefore, the lemma is established.

Formal Proof

Part (a)

1. AC -,PE(7) => CD APP PS

2. AC -,PE(7)

3. CD -APP PS

4. -PPPS=::>VC

5. CD APP PS VC

Altitude Command supermode

selection property.

Hypothesis.

Lines I and 2.

Path/Speed Command

supermode selection property.

Lines 3 and 4.

Part (b)

6. AC --,PF1 -,PE(y) ::--> CD -,PP PS VC

7. AC -,PFI --,PE(y) -,PE(V)

8. CD -,PP PS VC

9. --,PFI -,PE(7) --,PE(V) => (H > H TGT )

Part (a).

Hypothesis of Part (b).

Lines 6 and 7.

Lemma C, part (d).

F-14

I
0

WC5

7SPEED MAX

'(SPEED MIN

1POT AMX

fPOT MIN

10. (H > HTGT) Lines 7 and 9.

11. CD(H>H TGT ) --:::> DM Altitude Command supermode

selection property.

12. CD DM -,PP PS VC Lines 8, 10, and 11. QED

Initial Conditions for APE (y) APE (V) Recovery

To summarize the initial conditions implied when APE (y) APE (V) holds, the conditions on yTGT, V,

and VTGT specified by Lemma C severely constrain the location of the initial (V, yTGT) point within

the (V, yTGT) plane. The situation is illustrated qualitatively by figure F-1, which can be constructed

from the specification of Lemma C together with the definitions of -'PE (y) and -,PE (V). The initial

point must be located within the shaded area (fig. F-1). Furthermore, upon engagement of the Altitude Command supermode the primitive V Command mode is selected, as required by Lemma D.

During the first segment of the subsequent mode evolution, the (V, yTGT) point follows a trajectory

in the (V, yTGT) plane (fig. F-1) that is determined by the initial (V, y) operating point and by the

V Command regulator law, as discussed in Volume I. The resulting dynamical behavior of the

system can be analyzed informally as follows.

MIN DRAG

V N11N VTGT AMAX

The shaded area indicates the initial operating point.

Figure F-1. Conditions for APE (f) -,PE (V) recovery.

F-15
Dynamical Analysis

The system attempts to capture ySPEED MAX and then to capture VTGT by decelerating along the

ySPEED MAX contour. Consider first the ySPEED MAX capture maneuver. According to Lemma C, the

condition (y _> ySPEED MAX) holds initially, but since ySPEED MAX is not specified it could take either

positive or negative values. Therefore, the aircraft could either climb or descend initially. According

to Lemma C, the condition (H > HTGT) holds initially. If the aircraft climbs away from the target

altitude, it follows from the height regulator law (Volume 1, fig. 1 I (b)) that yTGT must decrease.

If the aircraft descends, then yTGT must increase. Since the condition (y > 7POT MAX) holds initially

(Lemma C, parts (a) and (b)), it follows from the longitudinal equation of motion (equation (1c),

Volume I (Aircraft Model)) that the longitudinal acceleration is initially negative, so that the speed

must decrease. Since V must decrease initially, but yTGT could either increase or decrease, it can

be seen from figure F-I that transitions are possible from the shaded region where the condition

APE (y) APE (V) holds to regions where either the condition —,PE (y) PE (V), the condition

PE (y) APE (V), or the normal condition PE (y) PE (V) holds. There are therefore three possible

recovery cases.

Furthermore, both figure F-1 and Lemma C, part (c), also show that the initial condition

--IPFI APE (y) APE (V) cannot continue to hold at V = VTGT. Therefore, one of the three possible

recoveries must occur before VTGT is captured. If either the PE (y) -,PE (V) or the PE (y) PE (V)

recovery occurs, then the Altitude Command supermode selection logic (table 12, Volume I) shows

that the Altitude Capture/Hold supermode is selected. In that case, either they Command mode or

the y-V Command mode is selected, ending the first segment of the mode evolution. On the other

hand, if the APE (y) PE (V) recovery occurs, the primitive V Command mode remains selected, and

the first segment continues. We shall continue the analysis of dynamical behavior for this latter case

of APE (y) PE (V) recovery.

Since the condition APE (y) = (GT6 V 1 TS2) continues to hold by assumption, the condition

TS2 = ( y >_ ySPEED MAX) must hold, in particular along the ySPEED MAX contour where the condition

(y = ySPEED MAX) holds. Therefore, TT2 ° ( yPOT TGT = ySPEED MAX) remains selected. The definition

—,PE (V) = (P TT I) v (Q TT2) shows that, since PE (V) holds by assumption and TT2 continues to

hold, Q = (yTGT < ySPEED MIN) cannot hold. Therefore, the condition --IQ = (yTGT > ySPEED MIN) mUSt

hold. Since this condition can hold at V = V TGT (fig. F-1), the V Command mode can remain

selected, and the V Command capture property then ensures capture of VTGT. At V = VTGT, the

condition (ySPEED MAX = yPOT MAX) holds by the property of the speed regulator. The condition

TC1 = (ypoT MAX < 0) holds initially by Theorem l (Thrust Degradation Theorem).

If TCI continues to hold at V = VTGT the aircraft descends steadily in the V Command mode, passing through the target altitude without attempting to capture it, although the Climb mode is then

selected at all lower altitudes. During descent, yTGT increases monotonically by the height regulator

property. At V = VTGT, yTGT is unbounded above (fig. F-1). Therefore, the descent of the aircraft can

continue indefinitely in the V Command mode. But maximum thrust increases as altitude decreases

(appendix B). If a lower altitude is reached where (yPOT MAX = 0) holds, then the condition

(y = ySPEED MAX = yPOT MAX = 0) holds in the long term, so that the aircraft stabilizes in level flight at

V = VTGT without crew intervention. The Climb mode remains selected. (The crew would then be

expected to select a lower target altitude within the performance capability of the aircraft, which

would enable the system to recover to the normal condition PE (y) PE (V).)

F-16
Notice that the diagram of figure F-1 plays a role in the foregoing dynamical analysis somewhat

similar to that of diagrams in Euclidean geometry—such diagrams can aid in discovering a rigorous

proof, but cannot themselves be used to prove anything directly. Therefore, the kind of informal

dynamical analysis just presented is suggestive, but not decisive. Nevertheless, the outline of a

theorem for -APE (y) -APE (V) recovery can be seen emerging from the discussion, which can be

stated informally as follows.

Theorem 2 (APE (y) -,PE (V) Recovery Theorem)

Informal Statement

If both PE (y) and PE (V) are violated initially, and if the Altitude Command supermode is selected

and the target altitude HTGT and the target airspeed VTGT remain fixed, then in the absence of total

propulsion failure

(a) the condition (VTGT < V <_ VMIN DRAG) must hold initially;

(b) recovery from the condition -,PE (y) -,PE (V) occurs before VTGT is captured;

(c) if the conditions APE (y) PE (V) and TC I = CyPOT MAX < 0) hold at capture of V TGT and

continue to hold thereafter, then the aircraft stabilizes in descent at V = V TGT, and the

V Command mode remains selected; and

(d) if a lower altitude is reached where the condition (yPOT MAX = 0) holds in the long term, the

aircraft stabilizes in level flight at V = VTGT.

Approach to Formal Proof

To establish this theorem formally, we shall first construct an informal proof outline based on the

initial conditions and on the dynamical analysis just presented. The cases corresponding to total

propulsion failure, to recovery to the condition PE (y) APE (V) or PE (y) PE (V), and to the condition ('/POT MAX ^! 0) at V = VTGT, which are ruled out by the hypothesis of the present theorem, can be

treated by the same method. In constructing the informal proof outline, logical gaps resulting from

missing definitions of system properties can be i gnored temporarily, because they can be filled in

later by formalizing material from Volume I as necessary.

Informal Proof Outline

Part (a)- In the absence of total propulsion failure, the condition --,PFI holds. The implication

-,PF I -,PE(7) —iPE(V)( POT MAX ^TGT 7SPEED MIN < 0)

(SPEED MIN < 7SPEED MAX 7) AND

(V TGT V C VMIN DRAG ) (H > HTGT)

F-17
holds by Lemma C, and the condition -,PF I APE (y) APE (V) holds by hypothesis. Therefore, the

condition

(^ POT MAX < y TGT < y SPEED MIN < 0)

(SPEED MIN < -Y SPEED MAX < Y) AND

V <V<_V ( TGT MIN DRAG) (H H TGT )

must hold. In particular, the condition (VTGT < V :5 DRAG) must hold, establishing the first

claim.

Part (b)- The second claim can be established by means of contradiction. The implication

AC -,PE (y) => CD -,PP PS VC holds by Lemma D. part (a). Assume that the condition

AC --,PF1 APE (y) -,PE (V) continues to hold. Therefore, VC holds, so that the primitive

V Command mode is selected and continues to hold. Since the implication VC => V3c holds by

the V Command capture axiom and VC holds, V3 C must eventually hold when VTGT is captured.

Because the condition --,PFI APE (y) APE (V) holds by assumption, the condition

(YPOT MAX G YTGT G YSPEED MIN < 0) must hold by Lemma C, part (a), and the condition

(YSPEED MIN < YSPEED MAX <'Y) must hold by Lemma C, part (b). Combining these conditions,

the condition (YSPEED MAX > YPOT MAX) holds in general. In particular, the condition

(YSPEED MAX C > YPOT MAX C ) must hold when VTGT is captured. But since the implication

V3 => (YSPEED MAX = YPOT MAX) holds by the property of the speed regulator, and since V3C

eventually holds, the condition (YSPEED MAX C = YPOT MAX C) must hold, contradicting the condition

(YSPEED MAX C > YPOT MAX c) just established. It follows that the assumption that the condition

AC -,PFI APE (y) APE (V) continues to hold until VTGT is captured is false, establishing the

second claim.

Part (c)- Since the condition AC -,PFI APE (y) PE (V) HT VT TC I holds at VTGT capture by the

hypothesis of part (c), and the implication AC APE (y) => CD =PP PS VC holds by Lemma D, part

(a), the condition VC must hold, so that the V Command mode remains selected at VTGT capture.

By hypothesis, the condition APE (y) _ (GT6 V I TS2) holds. In particular, the condition

TS2 = (Y >- YSPEED MAX) holds. In the absence of total propulsion failure, -,PF I holds, as required

by the hypothesis. Therefore, the condition --,PF1 TS2 holds. According to the strategy for setting

target thrust, the condition TT2 = (yPOT TGT = YPOT MAX) then holds after thrust is set. Therefore,

the condition (YSPEED = YSPEED MAX) holds by definition of -YsPEED. Since the implication

VC =:> (-YC = YSPEED C) V3 C holds by the V Command capture axiom, and since VC holds, YSPEED

and VTGT are captured. Since (YSPEED = YSPEED MAX) holds, the conditions (Y = YSPEED MAX) and

V3 = (V = VTGT) hold at VTGT capture. Since V3c holds, and since the implication

V3 ::^ (YSPEED MAX = YPOT MAX) holds as a property of the speed regulator, the condition

(YSPEED MAX C = YPOT MAX C) holds. Combining these conditions shows that the condition

V3C (YC = YSPEED MAX C = YPOT MAX C) holds at VTGT capture. Furthermore, the condition

TC l = (YPOT MAX < 0) holds by the hypothesis of part (c). Therefore, the condition V3c ('Yc < 0) holds

at V = VTGT. This shows that the aircraft descends initially at V = VTGT after VTGT capture.

F-18
Since the implication VC (Yc = YSPEEDC) V3c => (Y = YSPEED) V3 holds by the V Command hold

axiom, and since the condition VC (Yc = YSPEEDC) V3c holds, it follows that the condition

(Y = YSPEED) V3 must hold In general after VTGT capture. Since ('YSPEED = YSPEED MAX) also holds,

the condition VC (Y= YSPEED MAX) V3 must hold. Furthermore, since the implication

V3 => (YSPEED MAX = YPOT MAX) holds as a property of the speed regulator and V3 holds, the

condition (YSPEED MAX = YPOT MAX) holds. Combining these conditions shows that the condition

VC (Y = YPOT MAX ) V3 holds. Finally, since the condition TC I = (YPOT MAX < 0) holds by the hypothesis of part (c), the condition (Y < 0) VC V3 holds in general after VTGT capture, establishing the third

claim.

Part (d)- By the hypothesis of part (d), the condition (YPOT MAX = 0) holds in the long term. Since the

condition (Y = YSPEED MAX = YPOT MAX) was established by part (c), it follows that the condition

(Y = YPOT MAX = 0 ) holds in the long term. Furthermore, V3 = (V = VTGT) continues to hold by the

V Command hold axiom. Therefore, the condition (Y= 0) (V = VTGT) holds in the long term. This

shows that the aircraft eventually stabilizes in level flight at V = V TGT, establishing the fourth claim.

Therefore, the theorem is established.

Formal Statement of =PE (y) =PE (V) Recovery Theorem

AC --,PFI --,PE(7)0 -1PE(V)0 HT VT =>

(a) (VTGT0 < V0 < VMIN DRAG ) AND

(b) -,[AC -,PF] --,PE(Y) -,PE(V) HT VT] V3 

(c) AC -,PF1 --,PE(Y) PE(V) HT VT TO => (Y < 0) VC V3

(d) AC -,PFI -,PE(Y) PE(V) HT VT TC2 =::> (Y = 0) VC V3

Formal Proof

Part (a)

I . --,PF1 --,PE(Y) ---,PE(V) => Lemma C.

(a) (Y POT MAX < YTGT 

G Y

SPEED MIN < 0)

(b) (Y SPEED MIN < Y SPEED MAX < Y)

(C) (VTGT < V < VMIN DRAG)

(d) (H > H TGT )

2. -,PFI --,PE(y)0 __1PE(V)0 Hypothesis

F-19
3. (7POT MAX 0 

G 7

TGT 0 < 7SPEED MIN 0 < 0) Lines I and 2 and Subscript.

AND (7SPEED MIN 0 < 7SPEED MAX 0 < 70) specialization property

AND (VTGT 0 0 MIN DRAG 0 TGT 0 < V V ) (H > H

) (•) => (•)o

Remark— In particular, the condition (VTGT0 < VO < V MIN DRAG) holds, establishing the first

claim.

Part (b)

4. AC -,PE(7) => CD APP PS VC

5. AC -,PF1 --,PE(7) --^PE(V) o HT VT

6. VC

7. VC HT VT => V3c

8. V3C

9. C 7POT MAX G 7rGT G 7SPEED MIN< 0)

AND (7SPEED MIN < 7SPEED MAX < 7)

1 0• (7SPEED MAX C > 7POT MAX C)

I I . V3 => (7SPEED MAX = 7POT MAX)

1 -2 - (7SPEED MAX C = 7POT MAX C)

13.--,[AC -,PF1 --,PE(7) -,PE(V) HT VT]

14.,1AC -,PF1 --,PE(7) --,PE(V) HT VT] V3c

Lemma D, part (a).

Assumption.

Lines 4 and 5.

V Command capture axiom.

Lines 6 and 7.

Lines 1 and 5.

Line 9 and subscript

specialization property(-) => (•)c.

Speed regulator property.

Lines 8 and 11.

Lines 5, 10, and 12.

Lines 8 and 13.

Remark— The contradiction of Lines 10 and 12 shows that the assumption of Line 5 is false. The

second claim is established by Line 14.

Part (c)

15. AC -,PF I --,PE(7) PE(V) HT VT TC 1 Hypothesis of part (c).

16. VC HT VT Line 15 and Lemma D, part (a).

17.-,PE(7) = (GT6 V 1 TS2) Definition of -,PE(7).

18.TS2 Lines 15 and 17.

19.^PF1 TS2 Lines 15 and 18.

20. -,PF1 TS2 =:> TT2 ^TTI Thrust setting strategy.

F-20
21. TT2 Lines 19 and 20.

22. TT2 =:> (YSPEED = YSPEED MAX) Definition of YSPEED23• (YSPEED = YSPEED MAX) Lines 21 and 22.

24. VC HT VT =:> (Yc = YSPEED c) V3c V Command capture axiom.

25. (YC = YSPEED MAX C) V3c Lines 16, 23 and 24.

26. (Yc = YPOT MAX c) V3c Lines 11 and 25.

27. TC I - (7POT MAX < 0) Definition of TC I.

28• (YPOT MAX < 0) Lines 15 and 27.

29. (Yc < 0) V3c Lines 26 and 28.

Remark- This result shows that the aircraft initially descends at V = VTGT (that is, at VTGT

capture and immediately afterward).

30. VC HT VT => (YC = YSPEED c) V3c => (7- YSPEED) V3 V Command hold axiom.

31. (7 = YSPEED MAX) VC V3 Lines 16, 23, and 30.

32• (YSPEED MAX = YPOT MAX) Lines 11 and 31.

33 • (Y = YPOT MAX) VC V3 Lines 31 and 32.

34. (Y < 0) VC V3 Lines 16, 28, and 33.

Remark- This result shows that the aircraft continues to descend at V = VTGT, establishing the

third claim.

Part (d)

35. AC -,PF1 ^PE(Y) PEN) HT VT TC2

36. VC HT VT

37. -,PE(y) = (GT6 V I TS2)

38. TS2

39. ^PF I TS2

40. -,PF I TS2 =:> TT2 -,TT 1

41. TT2

42. TT2 => (YSPEED = YSPEED MAX)

43 • (YSPEED = YSPEED MAX)

Hypothesis of part (a).

Line 35 and Lemma D, part (a).

Definition of -,PE(Y).

Lines 35 and 37.

Lines 35 and 38.

Thrust setting strategy.

Lines 39 and 40.

Definition of 'YSPEEDLines 41 and 42.

F-21
44. VC HT VT :::--> Cyc = YSPEED c) Vac

45. (yC = 7SPEED MAX C) V3C

46. (yC = yPOT MAX c) V3C

47. VC HT VT (yc = 7SPEED c) V3c => (y = ySPEED) V3

48. (y = 7SPEED MAX) V3

49• (7SPEED MAX = yPOT MAX)

50. (7 = yPOT MAX) V3

V Command capture axiom.

Lines 36, 43 and 44.

Lines 1 1 and 45.

V Command hold axiom.

Lines 36, 45, and 47.

Lines 11 and 48.

Lines 48 and 49.

51. (yPOT MAX = 0) Line 35 and definition of TC2.

52. (y = 0) VC V3 Lines 36, 50, and 57. QED

Remark- This result shows that, if the condition (yPOT MAX = 0) holds in the long term, the

aircraft eventually stabilizes in level flight atV = VTCT, establishing the fourth claim.

Therefore, the theorem is established.

Proof Automation

Formal proof of the APE (y) APE (V) Recovery Theorem (Theorem 2) is long and complex even

though the theorem has been stated in a weak form: the total propulsion failure case has been

excluded, and likewise the cases of recovery to the conditions PE (y) -,PE (V) and PE (y) PE (V), as

shown by the dynamical analysis presented previously. Despite these simplifications, formal proof

of the -,PE (y) APE (V) Recovery Theorem, to gether with its auxiliaries Lemma C and Lemma D,

require a total of 84 steps. Formal proof of the Performance Degradation Theorem (Theorem 1)

together with Lemma A and Lemma B previously required 36 steps, makin g a total of 120 steps for

the formal proofs of the theorems presented thus far. Furthermore, three theorems involving

complicated dynamical behavior remain to be proved.

In our opinion, the development of formal proofs such as that just presented for the APE (y) -APE (V)

Recovery Theorem (Theorem 2) by means of manual pencil-and-paper methods would be too complex and laborious for routine use by the aircraft industry. On the other hand, informal proofs of the

kind outlined may not be sufficiently rigorous to provide an independent check of the integrity of the

synthesis process, as indicated by failure to reveal omission through oversight of a total propulsion

failure case to be discussed later. A potential resolution of this dilemma might be achieved by using

currently available theorem-proving software (Rushby, 1999; Schumann, 2001) to generate formal

proofs. To enable such machine-generated formal proofs to be checked manually if desired, a

sequential listin g of the detailed steps (together with their justifications) should be provided for each

proof by the theorem-proving software.

Thedevelopment of practical working methods for formalizing informal proof outlines is currrt^+1%

being investigated. The first step is to formalize the definitions of system properties suggested

L - -

F-22
the informal proof outline, as already illustrated for the APE (y) APE (V) Recovery Theorem

(Theorem 2). Some iteration of this first step may be required during attempts at formal proof

(Lakatos, 1976). Development of methods for automating formal proofs remains incomplete, and

only informal proof outlines will be offered for the three theorems to be presented next. In the

meantime, these informal proof outlines, while not rigorous, can be regarded as making the

existence of rigorous formal proofs plausible.

Theorem 3 (PE (y) APE (V) Recovery Theorem)

Informal Statement

If PE (V) is violated initially, but PE (y) holds, and if the Altitude Command supermode is selected

and the target altitude HTGT remains fixed with HTGT <_ HMAX, then in the absence of total propulsion

failure PE (y) PE (V) must eventually hold.

Informal Proof Outline

By hypothesis, the condition PE (y) --,P (V) holds, where

—PE (y) = (YTGT > YPOT MAX) AND (V S V MIN DRAG) AND (Y : 7SPEED MAX)

APE (V) _ I P AND (YPOT TGT = 7POT MIN)] OR [Q AND CyPOTTGT = YPOT MAX)]

and

P = (yrGT ^! YSPEED MAX) Q ° (7TGT < 7SPEED MIN)•

By definition of -,PE (V), there are two possible cases for evaluation: (i) the conditions P and

(YPOT TGT = 7POT MIN) hold; or else (ii) the conditions Q and (YPOT TGT = 7POT MAX) hold. Since the

Altitude Command supermode is selected and PE (7) APE (V) holds by hypothesis, according to the

Altitude Command supermode selection strategy the Altitude Capture/Hold supermode is selected in

both cases.

Case (i)- Assume that the conditions P and (yPOTTGT = 7POT MIN) hold. According to the strategy for

setting the target thrust, there are three subcases that correspond to the resulting condition

(7POT TGT = 7POT MIN)- Either (a) the thrust saturation condition (Y <_ 7SPEED MIN) holds; or else (b) thrust

is unsaturated and Q holds; or else (c) thrust is unsaturated and -,P ^Q holds, in which case 7POTTGT

is not updated, but could previously have been set to 7POT MIN.

(a) Assume that the condition (y5 7SPEED MIN) holds. Since the Altitude Capture/Hold supermode is

selected, the fightpath angle y is driven toward the flightpath target 7TGT by the stability property

of the path regulator. Since P = (7r G-r ? 7SPEED MAX) holds by assumption, if the Altitude Capture/

Hold supermode were to remain selected until path capture were complete, the condition

(y? 7SPEED MAX) would hold. In that case, the initial condition (75 ysPEED MIN) would change to

the final condition (7 >_ 7SPEED MAX) during path capture. As a consequence of the physical condition (7POT MIN < YPOT MAX), the condition (7SPEED MIN < 7SPEED MAX) holds by definition. Therefore,

provided that the Altitude Capture/Hold supermode remains selected, the intermediate condition

(7SPEED MIN < 7 < 7SPEED MAX) must hold at some time during path capture because of the physical

continuity of the tlightpath angle 7. In that case, thrust is unsaturated. Since P also holds by

F-23
assumption, yPOTTGT is reset to '/POT MAX according to the strategy for setting target thrust. Then

PE (V) holds by definition. Therefore, PE (y) PE (V) holds, demonstrating the theorem for

subcase (a).

(b) Assume that thrust is unsaturated and Q holds. Since P also holds by the assumption of case (i),

PQ must hold. But since the condition (ysPEED MIN <'/SPEED MAX) holds by definition, the condition

PQ is impossible. Therefore, subcase (b) is impossible.

(c) Assume that thrust is unsaturated and -,P -,Q holds. Since the assumption that --,P holds contradicts the assumption of case (i) that P holds, subcase (c) is impossible.

Since the theorem holds for subcase (a), and since both subcase (b) and subcase (c) were shown to

be impossible, the theorem holds for case (i).

Case (ii)— Assume that the conditions Q and (yPOT TGT = '/POT MAX) hold. According to the strategy

for setting the target thrust, there are three subcases that correspond to the resulting condition

('/POT TcT = '/POT MAX) . Either (a) the thrust saturation condition (y >—'/SPEED MAX) holds; or else (b)

thrust is unsaturated and P holds; or else (c) thrust is unsaturated and —,P =Q holds, in which case

'/POTTGT is not updated, but could previously have been set to '/POT MAX.

(a) Assume that the condition (y ? ysPEED MAX) holds. Since the Altitude Capture/Hold supermode is

selected, the flightpath angle yis driven toward the fli g htpath target'/rGT by the stability property

of the path regulator. Since Q = ('/TGT < ysPEED MIN) holds by assumption, if the Altitude Capture/

Hold supermode were to remain selected until path capture were complete, the condition

(7 < ysPEED MIN) would hold. In that case, the initial condition (y >— ysPEED MAX) would change to

the final condition (y <— ysPEED MIN) during path capture. As a consequence of the physical condition ('/POT MIN < '/POT MAX), the condition (ysPEED MIN < ysPEED MAX) holds by definition. Therefore,

provided that the Altitude Capture/Hold supermode remains selected, the intermediate condition

('/SPEED MIN <'/ < '/SPEED MAX) must hold at some time during path capture because of the physical

continuity of the flightpath angle y. In that case, thrust is unsaturated. Since Q also holds by

assumption, "yPOTTGT is reset to '/POT MIN according to the strategy for setting tar get thrust. Then

PE (V) holds by definition. Therefore, PE (y) PE (V) holds, demonstrating the theorem for

subcase (a).

(b) Assume that thrust is unsaturated and P holds. Since Q also holds by the assumption of case (ii),

PQ must hold. But since the condition (ysPEED MIN < ysPEED MAX) holds by definition, the condition

PQ is impossible. Therefore, subcase (b) is impossible.

(c) Assume that thrust is unsaturated and -,P -,Q holds. Since the assumption that -,Q holds contradicts the assumption of case (ii) that Q holds, subcase (c) is impossible.

Since the theorem holds for subcase (a), and since both subcase (b) and subcase (c) were shown to

be impossible, the theorem holds for case (ii).

Since the theorem holds for both case (i) and case (ii), it is established in general.

F-24
Theorem 4 (APE (y) PE (V) Recovery Theorem)

Informal Statement

11' PE (y) is violated initially, but PE (V) holds, and if the Altitude Command supermode is selected

and the target altitude HTGT remains fixed with HTGT <— HMAx and if Climb effectiveness holds while

in the Climb mode, then in the absence of total propulsion failure the condition PE (y) PE (V) must

eventually hold.

Informal Proof Outline

By hypothesis, the Altitude Command supermode is selected and the condition -'PE (y) PE (V)

holds, where

APE (y) _ (yTGT > yPOT MAX) AND (V S V MIN DRAG) AND (y ^! ySPEED MAX)

-,PE (V) = [P AND (yPOT TGT = yPOT MIN) 1

 OR [Q AND (yPOT TGT = yPOT MAX)

and

P = (yTGT ^! ySPEED MAX) Q = (yTGT < ySPEED MIN)•

According to the Altitude Command supermode selection strategy, the Climb/Descend supermode is

selected. There are two cases depending on the altitude error AH: (i) the descent case AH < 0; and

(ii) the climb case AH >_ 0.

Case (i)— Assume that the condition (AH < 0) holds. Therefore, by the height regulator law, the

condition (yTGT < 0) holds for the flightpath target yTGT. Since as a consequence of the definition

of HMAX the condition (yPOTMAX ? 0.3 deg) must hold, and the condition (yTGT < 0) also holds, it

follows that the condition (yTGT < 0 < YPOT MAX) must hold. Therefore, PE (y) holds by definition,

contradicting the hypothesis that —,PE (y) holds. Therefore, case (i) (the descent case) is impossible.

Case (ii)— Assume that the condition (AH >— 0) holds. Since by hypothesis APE (y) PE (V) holds,

according to the Altitude Command mode selection strategy the Climb mode is selected. By hypothesis, the climb effectiveness condition CE holds. Therefore, by the definition of climb effectiveness,

the aircraft vertical velocity must remain strictly positive. It follows that, during operation in the

Climb mode, the altitude error AH decreases monotonically toward zero. By the height regulator

law, the target flightpath angle yTGT is proportional to the altitude error AH for IAHI sufficiently

small. Therefore, the flightpath target yTGT also decreases monotonically toward zero for IAH

sufficiently small (that is, when the aircraft approaches the target altitude sufficiently closely from

below). Since the condition (yPOTMAX ? 0.3 deg) holds by definition of HMAx, the condition

(yTGT < yPOT MAX) must hold for I yTGT I sufficiently small. In that case, PE (y) holds by definition.

Therefore, since PE (V) holds by hypothesis, the condition PE (y) PE (V) must hold, and the

theorem is demonstrated for case (ii).

Since the theorem holds for case (ii) and since case (i) was shown to be impossible, the theorem is

established in general.

F-25
EFFECTIVENESS OF ALTITUDE COMMAND SUPERMODE

This section presents a theorem (Theorem 5) concerned with the effectiveness of the Altitude

Command Supermode, which requires capture of altitude and airspeed targets (Volume I (Synthesis

of Altitude Command Supermode)). In the absence of design error, effectiveness of the Altitude

Command Supermode should be guaranteed by the desi gn synthesis process (Volume I). Therefore,

the theorem to be presented next (Theorem 5) provides an independent check of the integrity of the

system desi gn process described in Volume I.

Theorem 5 (Altitude Command Supermode Effectiveness Theorem)

Informal Statement

if the target altitude HTGT lies at or below HMAx and HTGT remains fixed, and if climb effectiveness

holds while in the Climb mode, and if descent effectiveness holds while in the Descend mode, then

selection of the Altitude Command supermode ensures that

(a) the target altitude HTGT will be captured; and

(b) if normal effectiveness of the y Command mode holds while in the Altitude Capture/Hold mode,

then the target airspeed VTCT will also be captured.

Informal Proof Outline

By definition of HMAx, the condition (yPOT MAX ? 0.3 deg) holds at HMAx and at all lower altitudes.

Since by hypothesis the condition (HTCT < HMAX) holds, the condition (yNOT MAX ? 0.3 deg) must

hold in the neighborhood of HTGT.

In general, four cases are possible initially for the Altitude Command supermode:

(i) -,PE (y) APE (V)

(ii) PE (y) APE (V)

(iii) APE (y) PE (V)

(iv) PE (y) PE (V)

Case (i)- Assume that the condition APE (y) --,PE (V) holds initially. By Theorem 2

(APE (y) -,PE (V) Recovery Theorem), the condition -,PE (y) APE (V) cannot hold except in the

short term. Accordin g to the recovery theorem, recovery to the condition PE (y) -,PE (V) (case (ii)),

the condition APE (y) PE (V) (case (iii)), or the condition -,PE (y) APE (V) (case (iv)) must occur

before the target airspeed VTGT is captured. Therefore, case (i) need not be considered further.

Case (ii)- Assume that the condition PE (y) APE (V) holds. By Theorem 3 (PE (y) APE (V)

Recovery Theorem), APE (y) -,PE (V) cannot hold except in the short term, and terminates in the

condition PE (y) PE (V) (that is, in case (iv)). Therefore, case (ii) need not be considered further.

Case (iii)- Assume that the condition -,PE (y) PE (V) holds. Since by hypothesis the Altitude

Command supermode is selected and the target altitude HTGT remains fixed with HTCT < HMAx, by

Theorem 4 (-,PE (y) PE (V) Recovery Theorem), the condition PE (y) PE (V) must eventually hold.

F-26
Therefore, case (iii) terminates in the condition PE (y) PE (V) (that is, in case (iv)). Therefore, case

(iii) need not be considered further.

Case (iv)- Because it has been demonstrated that the abnormal conditions for case (i), case (ii), and

case (iii) terminate in the normal condition PE (y) PE (V) (that is, case (iv)), the normal condition

PE (y) PE (V) must eventually hold. Therefore, according to the supermode selection strategy for the

Altitude Command supermode, there are two cases for supermode selection: either the condition

P u Q holds, resulting in the selection of the Climb/Descend supermode, or else the condition

^P --,Q holds, resulting in the selection of the Altitude Capture/Hold supermode. Furthermore, if

P u Q holds and the condition (AH >- 0) holds for the altitude error AH, then the Climb mode is

selected, and if P u Q holds and the condition (AH < 0) holds, then the Descend mode is selected.

Therefore, the following three subcases must be considered: (a) P u Q and the climb condition

(AH >- 0) hold; (b) P u Q and the descent condition (AH < 0) hold; and (c) the condition -,P ^Q

holds.

(a) Assume that P u Q and the climb condition (AH > 0) hold. III case, by definition of the

altitude error AH (VOlUrne I), the target altitude HTGT lies above the initial altitude. By the height

regulator law, the flightpath target YTGT has the same sign as the altitude error AH. Therefore, the

condition (yTGT > 0) holds. Since the condition (ysPEED MIN < 0) holds by the property of the

longitudinal acceleration limiter, and since the condition (yrGT >- 0) also holds, the condition

Q = (yTGT < ysPEED MIN) cannot hold. Therefore, since P u Q holds by assumption, P must hold

initially.

Since by assumption PE (y) PE (V) holds, and since by assumption P u Q and the condition

(AH >_ 0) also hold, according to the Altitude Command mode selection strategy the Climb mode

is selected. By hypothesis, the climb effectiveness condition CE holds. Therefore, according to

the definition of climb effectiveness (Volume I), the aircraft vertical velocity must remain

strictly positive. It follows that, during operation in the Climb mode, the absolute altitude error

1 AH I decreases monotonically toward zero, provided that HTCT remains fixed as required by the

hypothesis. According to the height regulator law, the target flightpath angle YrGT is proportional

to the absolute altitude error I AH I for I AH I sufficiently small. Therefore, the absolute flightpath

target I yrGT I also decreases monotonically toward zero for I AH I sufficiently small (that is, when

the aircraft approaches the target altitude sufficiently closely from below).

Since the condition (yPOT Max > 0.3 deg) holds by definition of HMAX, the condition

(ysPEED Max > 0.3 deg) must hold by the property of the speed regulator. Therefore, the condition

—P ° (YFGT < ysPEED Max) must hold for IyTGTI sufficiently small, contradicting the assumption of

subcase (a) that P u Q holds.

Because it was demonstrated that Q cannot hold, the condition -,P -,Q must hold (subcase (c))

for I yTGTI sufficiently small, which results in selection of the Altitude Capture/Hold supermode

according to the Altitude Command supermode selection strategy. Therefore, operation in the

Climb mode (that is, subcase (a)) terminates in selection of the Altitude Capture/Hold supermode

when the aircraft approaches the target altitude sufficiently closely.

F-27
(b) Assume that P u Q and the condition (AH < 0) hold. In that case, by definition of the altitude

error AH (Volume I), the target altitude HTGT lies below the initial altitude. By the height

regulator law, the flightpath target YTCT has the same sign as the altitude error AH. Therefore, the

condition (yTGT < 0) holds. Since the condition (y,OT MAX ? 0.3 deg) holds by definition of HMAx,

the condition (ysPEED MAX > 0.3 deg) must hold by the property of the speed regulator. Therefore,

since the condition (yTCT < 0) also holds, the condition P = (yrcT ? ysPEED MAX) cannot hold.

Therefore, since P u Q holds by assumption. Q must hold initially.

Since by assumption PE (y) PE (V) holds, and since by assumption P u Q and the condition

(AH < 0) also hold, according to the Altitude Command mode selection strategy the Descend

mode is selected. By hypothesis, the descent effectiveness condition DE holds. Therefore,

according to the definition of descent effectiveness (Volume I), the aircraft vertical velocity must

remain strictly negative. It follows that, during operation in the Descend mode, the absolute

altitude error I AH I decreases monotonically toward zero, provided that HTGT remains fixed as

required by the hypothesis. According to the height regulator law, the target flightpath angle yrcT

is proportional to the altitude error AH for I AH I sufficiently small. Therefore, the flightpath

target I yrcT I also decreases monotonically toward zero for I AH I sufficiently small (that is, when

the aircraft approaches the target altitude sufficiently closely from above).

Since the condition (ysPEED MIN < 0) holds by the property of the lon g itudinal acceleration limiter,

the condition -,Q = (yrcT > ysPEEO Mm) must hold for I yTGT I sufficiently small, contradicting the

assumption of subcase (b) that P u Q holds.

Because it was demonstrated that P cannot hold, the condition ^P -,Q must hold (subcase (c))

for IYFGT I sufficiently small, which results in selection of the Altitude Capture/Hold supermode

according to the Altitude Command supermode selection strategy. Therefore, operation in the

Descend mode (that is, subcase (b)) terminates in selection of the Altitude Capture/Hold

supermode when the aircraft approaches the target altitude sufficiently closely.

(c)Because it was demonstrated that both suhcase (a) and subcase (b) terminate in the condition

-,P —,Q (that is, in subcase (c)) when the aircraft approaches the target altitude sufficiently

closely, -,P ^Q must eventually hold. Because it was demonstrated that PE (y) PE (V) must also

hold eventually, the condition PE (y) PE (V) ^P --,Q must hold eventually. Therefore, according

to the Altitude Command mode selection strategy, the Altitude Capture/Hold supermode is then

selected. Since PE (y) holds, by definition of PE (y) capture of the flightpath target yTGT is

assured. Therefore, capture of the target altitude HTGT is assured by the stability property of the

height regulator, establishing the first claim.

Since PE (y) holds, by definition of PE (y) an acceptable point of airspeed equilibrium is captured, although in general this equilibrium airspeed differs from the target airspeed. By definition, normal effectiveness of the y Command mode (Volume I) requires that the longitudinal

acceleration have the correct sign leading to capture of the tar get airspeed VTCT. By hypothesis,

normal effectiveness of the yCommand mode holds while the Altitude Capture/Hold supermode

is selected. It follows that the airspeed target VTGT must be captured, establishing the second

claim.

Therefore, the theorem is established.

F-28
CORRECTION OF A DESIGN OVERSIGHT

During the synthesis process, a design oversight was committed by assuming tacitly that maximum

thrust would always be computationally distinct from minimum thrust, ignoring the possibility of

total propulsion failure. For multiengine transport aircraft, the probability of such a failure is small,

but not negligible. Since all engines depend on the aircraft fuel system, fuel contamination could

cause simultaneous failure. Furthermore, incidents have occurred in which fuel mismanagement by

the human flight crew resulted in an attempt to feed all engines from empty fuel tanks while other

tanks contained fuel, leading to total propulsion failure that was soon corrected.

In our opinion, such emergency situations should not be complicated by anomalous actions of the

flight control system that result from failure to account for the possibility of total propulsion failure

at the design level. Therefore, total propulsion failure should be considered in control system design.

Error Identification

The logic error resultinu from this oversight was revealed during attempted formal proof of the

Performance Degradation Theorem (Theorem 1). It can be seen that step 5 of Lemma B establishes

the condition TT2 —TT 1, but since by definition

TT I = (7POTTGT = 7POT MIN) and TT2 = ( 7POTTGT = YPOT MAX),

the required condition TT2 ITT I does not hold dorm(; total propulsion failure, because in that case

the condition PF1 = CYPOTMAX = yPOTMIN) holds.

Strategy for Setting Target Thrust

Further consideration of the strategy for setting target thrust (table 5, Volume I) then showed that

the ori a inal table was logically incomplete because the case in which both the conditions

TS I = (y <_ ysPEED MIN) and TS2 = (y >_ ysPEED MAX) hold simultaneously had erroneously been considered logically impossible. Therefore, the original thrust setting strategy (table F-1) was logically

indeterminate in the event of total propulsion failure.

TABLE F-1. ORIGINAL STRATEGY FOR SETTING TARGET THRUST

TSI TS2 --,TS1 —,TS2

QP , --1P -,Q

Set Set Set Set YPOT TGT

TT1 TT2 TT1 TT2 not

TRUE TRUE TRUE TRUE updated

F-29
In that case, several possible actions could result, depending on the exact details of the implementation code. Target thrust mi ght be set to minimum thrust (TTI), or to maximum thrust (TT2), or not

be set at all (in that case, the previous setting would prevail), or a thrust setting error might be

annunciated, or the autothrottle might be disconnected (with unpredictable consequences for the

subsequent motion of the aircraft if normal engine operation should be restored). In our opinion,

such behavioral uncertainties should be considered unacceptable in a safety-critical system.

Correction of Error

After the design error was identified, case analysis was applied to the logically complete set of cases

TS TS2 TS TS2 TSI TS2 TSI TS2

to determine the best thrust setting strategy. This analysis resulted in the revised strategy as follows

(table F-2).

TABLE F-2. REVISED STRATEGY FOR SETTING TARGET THRUST

PF1 ^PF1

TS1 TS2 ^TS1 —,TS2

I

I

I

I

I Q

I

I I P I

I I

-nP ^Q

Set

I

I Set

I

' Set

I

' Set

I I

I Set ' yPOT TGT

TTI TTI TT2 TTI TT2 not

TRUE TRUE

I

TRUE

I

TRUE

I

TRUE

I I

updated

It can be seen that in case of total propulsion failure, the target thrust is set to minimum thrust (TTI)

in order to minimize the thrust transient if normal engine operation is restored.

Discussion

This case history shows by example how formal proofs of system properties can provide an independent check of system design integrity. It should be noted that omission of the total propulsion

failure case was not revealed by informal proof. It seems likely that, in most cases in which attempted formal proof of a theorem reveals that some case has been omitted through oversight, the situation could be dealt with by a trivial strengthening of the hypothesis of the theorem so as to rule out

the omitted case. In the exceptional case just described, it was decided that design iteration was

necessary to remedy the logic error, instead of ruling out the total propulsion failure case because of

its low probability.

F-30
CONCLUDING REMARKS

Several theorems have been presented that summarize the behavioral properties of the hybrid system

for transport aircraft longitudinal control, which is the subject of Volume I. These theorems enable

theoretical assessment of system dynamical behavior and verification of system safety and effectiveness independent of the design method. They can therefore provide an independent check of system

design integrity, enabling formal validation of the complete system to be achieved.

Methods have been demonstrated for generatin g formal proofs of these behavioral theorems based

on informal dynamical analysis. However, formal proof of such behavioral theorems by manual

pencil-and-paper methods may be too complex and laborious for routine use by the aircraft industry.

On the other hand, informal proof is not sufficiently rigorous to provide a check of system design

integrity, as shown by a case study involving omission through oversight of a total propulsion failure

case.

Resolution of this dilemma can be achieved by using currently available theorem-proving software

to generate formal proofs. To enable such machine-generated formal proofs to be checked manually

if desired, a sequential listing of the detailed steps should be provided for each proof. Practical

working methods for achieving partial automation of formal proofs by means of theorem-proving

software are under current investigation.

By means of automated hypothesis testing, any hypothesis could in principle be tested to determine

whether it is a theorem of the formal system. In future system development making use of the synthesis methods described in this report, such hypothesis testing could play a role similar to that of

simulation in today's development process, but unlike simulation it would lead to results that would

be rigorous and logically complete.

REFERENCES

Lakatos, Imre: Proofs and Refutations: The Logic of Mathematical Discovery. Cambridge

University Press (New York), 1976. (Reprinted 1987.)

Rushby, John: Mechanized Formal Methods: Where Next? Invited paper presented at The World

Congress on Formal Methods: PM 99, Toulouse, France, September 1999. Springer-Verlag

Lecture Notes in Computer Science, vol. 1708, 1999.

Schumann, Johann: Automated Theorem Proving in Software Engineering. Springer-Verlag

(Heidelberg, New York), 2001.

F-31
F-32
APPENDIX G

SELECTED TRANSPORT AIRCRAFT ACCIDENTS AND INCIDENTS

The following statements briefly summarize the aspects of four selected transport aircraft accidents

and incidents that are considered relevant to issues of system design. Available references should be

consulted for more complete accounts of these occurrences.

L-1011, EVERGLADES, 1972

After encountering an indication of unsafe nose landing gear extension during a night approach to

the Miami airport, the aircraft requested and received radar vectors from Miami Approach Control to

a nearby area where troubleshooting of the landing gear problem could be conducted with minimal

conflict with other traffic. The assigned altitude was 2000 ft above ground level, and the assigned

airspace was over the Everglades swamp in an area without lights on the ground. The autopilot was

operating in its barometric altitude hold mode. At one point in the troubleshooting procedure, the

first officer was required to enter the nose tunnel in order to make a visual inspection of the position

of the nose gear strut. It is believed that in leaving his seat, the first officer may have bumped the

control column, which would have caused the autopilot to change modes. Alternatively, the mode

reversion may have resulted from some other cause.

Whatever the cause, the autopilot reverted from the barometric hold mode, in which it was engaged,

to the pitch attitude hold mode, which held the pitch attitude at which the aircraft had last been

trimmed. The annunciation of this mode reversion was cautionary in nature, in contrast to the warnin cy provided for complete disconnect of the autopilot, and failed to claim the attention of the crew.

The target pitch attitude held by the autopilot then allowed the aircraft to descend slowly below the

assigned altitude. The crew failed to monitor the system performance adequately because they were

distracted from their normal duties by the elaborate procedure required for troubleshooting the

landing gear problem. The absence of lights on the ground also contributed to their lack of altitude

awareness. The aircraft struck the surface of the swamp and was totally destroyed, with heavy loss

of life. (NTSB, 1972).

B-767, SAN FRANCISCO, LATE 1980s

Several altitude violations on departure from San Francisco led to an investigation. Within the

autotlight system of the aircraft, it was found that the conditional branching that governed the

transition from the climb mode to the altitude capture mode contained a test for validity of the

vertical velocity, a common programming strategy intended to defend the altitude capture routine

a gainst invalid input data. If the vertical velocity were invalid, execution would be transferred to the

exit from the climb routine, skippin g the test for transition to the altitude capture mode. Validity of

the vertical velocity was determined by a reasonableness test that examined whether the vertical

velocity lay within the expected range specified a priori.

G-1
But at light aircraft weight and lower-than-standard atmospheric temperature, and for northeast

departures not requiring noise abatement procedures using partial thrust, the vertical velocity during

climb could reach values that lay outside the tolerance limit imposed by the reasonableness test.

Under these seldom-encountered conditions, the reasonableness test generated false indications of

invalid vertical velocity that caused the test for transition to the altitude capture mode to be skipped,

so that the system remained by default in the climb mode. The result was that the aircraft failed to

level off at the assigned altitude. No annunciation was provided to the crew. These altitude overshoots violated the traffic separation required by Air Traffic Control (ATC), and could have resulted

in a catastrophic midair collision. (Lauber, J. K., Member, National Transportation Safety Board,

personal communication, 1994.)

B-737, DENVER, EARLY 1990s

In airline training simulations, failure of the glideslope receiver during instrument landing system

(ILS) approach is often simulated. The autoflight system reverts from 1LS approach mode to the

vertical velocity hold mode. This mode reversion is annunciated by the vanishing of a small symbol

on the primary flight display, a cautionary annunciation that is frequently overlooked by the crew.

The system then holds the vertical velocity that prevailed at the instant of failure, a situation that

could cause the aircraft to fly into the ground short of the runway. Identical system behavior in the

aircraft has been verified. (Irving, Capt. James, United Airlines, personal communication, 1996.)

A-330, TOULOUSE, JUNE 1994

This accident occurred during a test flight commanded by the manufacturer's chief pilot. Immediately following takeoff at light weight and with center of gravity far aft, the flight test card required

the pilot to engage the autoflight system and then simulate engine failure by cutting one engine. (The

A-330 is a twin-engine aircraft.) The purpose of the test, which had been carried out successfully

with engines of a different type, was to verify that safe airspeed margins were preserved following

the simulated engine failure.

Other demonstrations had been conducted earlier in the flight, and a target altitude of 2000 ft above

ground level remained in the system from a previous entry. With this target altitude and the unusually high rate of climb achieved shortly after takeoff under the test conditions, the system transitioned from the climb mode to the altitude capture mode immediately after engagement. In the

altitude capture mode, the flightpath was commanded to follow the specified altitude capture trajectory. Path error was fed back to pitch control, and with thrust fixed at maximum thrust there was no

closed-loop control of airspeed. Furthermore, an automatic de-clutter mode would remove mode

annunciations from the primary flight display at nose-high pitch attitudes exceeding 25 deg.

The crew may not have appreciated the significance of the reversion to the altitude capture mode, or

alternatively they may not have been aware of it. They cut the engine as required by the flight test

card at an airspeed of about 150 kt. The thrust available with one engine out was inadequate for

steady climb at the commanded path angle, so the airspeed decayed rapidly and the aircraft settled

G-2
below the commanded altitude capture trajectory. The system responded by increasing pitch attitude

to excessive nose-high angles that reached 32 deg, which increased the rate of decay of airspeed.

The airspeed decayed below the minimum-control speed of 118 kt, and the aircraft began an uncontrollable roll into the dead engine. According to the Director General of Armaments' report (1994),

the crew was slow in deciding to take over manually, although their decision may have been delayed

by the automatic de-cluttering of the primary display, which removed mode annunciations. The pilot

attempted to recover roll control by cutting the remaining engine, which also disabled the envelope

protection based on angle of attack (the "alpha floor"). But sufficient altitude for recovery was not

available, and the aircraft stalled and crashed, reaching airspeeds as low as 77 kt before the impact.

The aircraft was totally destroyed, with fatal injuries to all those on board.

REFERENCES

Director General of Armaments (France): Investi gation Committee report on A330 Accident in

Toulouse on 30 June 1994. Unpublished report. See also Sparaco, Pierre: Autopilot a factor in

A330 accident. Aviation Week and Space Technology, vol. 141, no. 2, July 11, 1994;. and A330

crash to spur changes at Airbus. Aviation Week and Space Technology, vol. 141, no. 6, August

8, 1994, pg. 20.

NTSB: Eastern Air Lines L-101 I, Miami, FL, December 29, 1972. NTSB Report no. AAR-73-14,

Washington, D.C., National Transportation Safety Board, 1972.

G-3
REPORT DOCUMENTATION PAGE Form Approved

OMB No. 0704-0188

The public reporting burden for this collection of Information Is estimated to average 1 hour per response, including the time for reviewing instructions, searching existing

data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or

any other aspect of this collection of information, Including suggestions for reducing this burden, to Department of Defense, Washington Headquarters Services,

Directorate for information Operations and Reports (0704-0188), 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA 22202-4302. Respondents should be aware

that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of Information if it does not display a

currently valid OMB control number.

q F DO NOT RETURN YQ_U- -Q_­ TO THE ABOV ADDRESS.

1. REPORT DATE (DD-MM-YYYY) 2. REPORT TYPE 3. DATES COVERED (From - To)

21-12-2007 Technical Publication

4. TITLE AND SUBTITLE 5a. CONTRACT NUMBER

Synthesis from Design Requirements of a Hybrid System for

Transport Aircraft Lon(l itudinal Control 5b. GRANT NUMBER

Volumes I and II

5c. PROGRAM ELEMENT NUMBER

6. AUTHOR(S) 5d. PROJECT NUMBER

Charles S. Hynes', Gordon H. Hardy', and Lance Sherry

5e. TASK NUMBER

5f. WORK UNIT NUMBER

41 1931

7. PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES) 8. PERFORMING ORGANIZATION

'Ames Research Center, Moffett Field, CA 94035 REPORT NUMBER

'Honeywell International Inc., Flight Control Systems Design,

Phoenix, AZ A-070008

9. SPONSORING/MONITORING AGENCY NAME(S) AND ADDRESS(ES) 10. SPONSORING/MONITOR'S ACRONYM(S)

National Aeronautics and Space Administration NASA

Washington, D.C. 20546-0001 11. SPONSORING/MONITORING

REPORT NUMBER

N ASA/TP-2007-213475

12. DISTRIBUTION/AVAILABILITY STATEMENT

Unclassified — Unlimited Distribution: Standard

Subject Category: 03, 06, 08, 54, 66

Availability: NASA CAST (301) 621-0390

13. SUPPLEMENTARY NOTES

Point of Contact: Jeffery A. Schroeder, Ames Research Center, MS 210-4, Moffett Field, CA 94035-0001

(650)604-4037

14. ABSTRACT

Volume I of this report presents a new method for synthesizing hybrid systems directly from desi gn requirements, and

applies the method to design of a hybrid system for longitudinal control of transport aircraft. The resulting system satisfies

general requirement for safety and effectiveness specified a priori, enabling formal validation to be achieved. Volume II contains

seven appendices intended to make the report accessible to readers with backgrounds in human factors, flight dynamics and

control, and formal logic.

Major design goals are (1) system design integrity based on proof of correctness at the design level, (2) significant simplification and cost reduction in system development and certification, and (3) improved operational efficiency, with significant

alleviation of human-factors problems encountered by pilots in current transport aircraft.

This report provides for the first time a firm technical basis for criteria governing design and certification of avionic systems

for transport aircraft. It should be of primary interest to designers of next-generation avionic system.

15. SUBJECT TERMS

Air transportation and safety, Avionics, Aircraft stability and control, Flight controls and autopilots, Man/machine

systems, Systems analysis

16. SECURITY CLASSIFICATION OF: 17. LIMITATION OF 18. NUMBER 19a. NAME OF RESPONSIBLE PERSON ABSTRACT OF

a. REPORT b. ABSTRACT PAGES Jeffery A. Schroeder c. THIS PAGE

19b. TELEPHONE (Include area code) Unclassified Unclassified Unclassified

I

Unclassified 168

(650) 604-4037

Standard Form 298 (Rev. 8-98)

Prescribed by ANSI Sid. Z39-18