Lessons
The paper focuses on lessons learned from this challenging program, in the context of our limited experience in combat aircraft development. The paper dwells on details of a few of the invaluable lessons learned so far.
(a) It is Not Necessary That the Most Complex System is the Most Troublesome: The Integrated Flight Control System (IFCS) comprising of quadruplex digital fly by wire system is the most complex system on board the Tejas. However, failure rates on this system have been extremely low compared to the more mundane systems such as Brake Management System (BMS), Nose Wheel Steering (NWS) System and Environmental Control System (ECS). As stated earlier, this is the first time in the country that these technologies have been incorporated in an aircraft and as in any developmental programme, failures were expected. Due to the safety critical nature of the IFCS, extreme caution has been exercised in design and flight testing of the system. Perhaps, it is due to this reason that there have been no significant failures expect for a channel dropout once in flight, which was reset immediately. On the other hand, there have been number of failures in NWS and Brake management systems, though, fortunately, not during the critical take off and landing phases. Tejas has a "brake by wire" system controlled by the Digital Hydraulic Electronic Unit (DHEU). During the initial days of Taxi Test phase prior to first flight, the system's performance was highly unsatisfactory due to uneven braking (Tugs). A number of changes in the control law were required to be implemented before the system performances reached a satisfactory state. Similarly, the NWS system and ECS also had a number of problems that needed design fixes at different stages.
(b) Software Driven Systems have High Cycle Time: Contrary to the general perception that software updates are done quickly, our experience from the programme is that the process takes a substantial amount of time. The difficult decision is the amount of regression tests that need to be done to cover the update and the changes thereof. This is particularly true in relation to the flight critical FCS software. Each software update needs to be thoroughly tested by the design teams and also verified / validated by an independent testing agency before the same can be ported on to the hardware. Extensive tests in test rigs / flight simulators must follow before actual flight tests. The whole process is so time consuming that, at times, flying needs to continue with temporary limitations or change in operating procedures till the new software is flight tested satisfactorily.
(c) The Extent and Content of Testing is a Difficult Decision: For a complex system like the IFCS, hundred percent test coverage is neither possible nor economical. The extent and content of testing becomes a difficult programme management decision that may have impact on safety. The roles of Independent Verification and Validation (IV&V) and certification agencies are crucial in this context.
(d) Expect the Unexpected: Tejas flight test experience has shown that Murphy does exist. A case in point was the twin hydraulic utility systems failure soon after takeoff, resulting in loss of all hydraulics services except flight controls. Emergency lowering of undercarriage was carried out just before the hydraulics depleted and aircraft landed using parking (emergency) brakes. This failure was caused by rupturing of a hydraulic hose of System 1 in the main undercarriage bay and the high-pressure jet caused rupture of the System 2 hose also. Though, a common point from where hydraulic fluid from both systems could leak out was avoided by design, rupture of both hoses in such a fashion was not expected.
(e) Concessions Have a Tendency to Become Standard: There are occasions when system related concessions have to be accepted in the form of limitation log to proceed with the flight test programme. However, a time bound action plan to remove these concessions needs to be in place, to prevent them from becoming part of the SOP for the next prototype(s). At ADA, the flight test team initiates Requests for Action (RFA) for the design teams to correct any observed deficiencies in various systems. Regular reviews of these RFAs are conducted with the concerned design groups and certification agencies, which ensure that the concessions remain under focus and a time bound plan exists to resolve all outstanding issues.
(f) Record More and Not Less Parameters to Avoid Unresolved Issues in Flight Test. There were a few minor failures in the flight control system of which the cause could not be conclusively established due to lack of sufficient data for analysis. In retrospect, the lesson is, it is better to record more and not less number of parameters through the flight test instrumentation in order to capture the system functioning and cause of failure as and when it occurs. Although at times it may be possible to alter the instrumentation scheme to include more parameters when required, this would result in increased aircraft down time and could affect the programme adversely. Using current generation digital data recorders, it should be possible to achieve this aim with adequate storage space available even for future data requirements.
(g) Simulation is an Invaluable Tool in Design, Development and Testing. Simulation has been used extensively in Tejas programme right from design through testing phases. Accordingly, flight test objective was one of model validation rather than data generation. It was possible to optimize the flight test effort largely through this approach.
(h) State of the Art Technology Needs To Be Backed By Quality Engineering: While trying to bridge the technology gap, equal emphasis needs to be given to all aspects that constitute advanced aircraft technology. This spans from design, manufacturing to flight test technologies.
(j) Fortune Favours the Brave? Developing quadruplex digital fly-by-wire system on a prototype was a bold programme decision, which, in retrospect, has paid off. As part of the cautious incremental approach, flight tests commenced in a relatively small flight envelope with fixed gain control laws in DFCC. Later, when full up scheduled gain Control Law (CLAW) was brought in, certain control coupling with landing gear dynamics was observed which had potential safety implications. At that stage in the programme, with the experience gained, such issues could be handled without compromising flight safety.
