VC10 Computer Flight Steering

The flight director computes and displays the proper pitch and bank angles required for the aircraft to follow a selected flight path. The flight director instrument system on the VC10 is considered as an alternative to the autopilot for all modes except automatic flare-out and for this reason is integrated with the automatics to only a limited extent. It derives its attitude and compass signals respectively from the main vertical gyros and Polar Path compasses and takes radio information from either group of radio receivers.

These signals are electrically separated from the autopilot as far as is practicable. The system is of necessity duplicated in that each pilot has his own course deviation indicator and horizon director indicator but only a single flight steering computer is provided. The attitude displays have independent absolute monitors consisting of circuits which check the vertically of the gyro and the continuity and operation of the transmission system. Failure warning is by a flag in the horizon indicator. Additionally there are comparator units between the horizon displays and between the compass systems which illuminate warning lights in the event of a difference between the two sides. Comparison is effected mechanically through torque synchros so that electrical isolation between the systems is maintained.

The system, supplied by Elliott Brothers (London) Ltd, is based largely on components of the well-proved Bendix PB-20 autopilot, made under licence by Elliott, and interchangeable with American built components as installed in Boeing 707s.

The basic requirement for an automatic landing is that the equipment must survive a single failure and continue to operate. Fundamentally, this can be achieved by triplication of all equipment. But in providing and justifying redundant equipment in civil passenger aircraft, consideration must be given not only to overall safety, reliability and performance, but also to weight, installation difficulties, overall cost, maintenance problems and many other factors. Unnecessary redundancy must therefore be avoided.

It is essential that effective autopilot disconnection should occur in the event of a failure and that the pilot should be warned of the failure and the control runs automatically freed. The disconnection and warning unit can only be electrical and must be made truly fail-safe. In practice, failure of the system to disconnect following an autopilot failure will occur only if both the autopilot and the disconnection device fail. The likelihood of this is remote as it involves a product of small probabilities in the landing phase. The acceptance of an electrically actuated disconnect device permits further simplifications of the duplicate channel, with an increase in system reliability and a saving in weight.

The operation can be checked in a different way by comparing the demand of the second autopilot with the effective demand of the first which is obtained by suitably processing the actual control output with the approximate inverse transfer function of the servo motor control loop. This concept is called a "monitored-duplicate" system and is the design used by Elliotts on the VC10. The comparison concept is used throughout the Autopilot and the Flight Director system with the various flight parameters derived in a stand-alone units. Because the duplicate sensors are used for comparison and not for actual control, they can be considerably simplified and therefore made more reliable and lighter than those used in the autopilot; and the inherent differences make them less liable to fail from a common environmental cause.

Longitudinal and Lateral Computers have equivalent Comparison computers, the Vertical Gyro has a simple comparison unit and the Air Data Computer core elements are separated for this purpose. Not all the functional boxes are compared in this way; in some cases such as the Polar Path Compass the units are duplicated and are compared electro-mechanically but there is not a Comparison unit.