Effectiveness and robustness of an independent flight control law monitor

Electronic flight control systems are safety–critical and complex. For aircraft certification, it has to be proven that a flight control system failure with catastrophic consequences is extremely improbable. Such systems need highest levels of integrity and availability. This requires hardware redundancy and a development process for embedded flight control laws that ensures rigorous validation and verification. However, complete absence of development errors—especially in the requirements—cannot be guaranteed. Usually, there is one requirement set from which flight control laws and their software are developed. Accordingly, undetected errors in the flight control law requirements represent a potential single point of failure. A possible countermeasure is to develop a monitor that is independent from flight control law requirements and that can detect safety–critical failures—without false detections. The paper evaluates monitor effectiveness and robustness by comparing performance indicators. The evaluation uses a simulation environment with a flight mechanical model of a commercial aircraft and its flight control laws for manual flight.