Amplifier and Computer

The BAC 1-11 AFCS, like that in the VC10, was based on the well proven Bendix PB-20 Autopilot and was designated the Series 2000 AFCS. New features over the PB-20 system include separate pitch and azimuth control computers, a modular Air Data Sensor and a range of units specifically designed for autoflare and autolanding.

Each unit in the BAC 1-11 AFCS is built to a common configuration with circuit modules arranged in stacks either side of the chassis. The stacks are connected by plugs to a mother board and are physically separated into ‘command’ and ‘monitor’ functions to preclude common failures. The computers are entirely solid state and there is a high degree of built-in-test. Self-monitoring techniques and multiple channel redundancy are used to give automatic failure survival in approach and cruise flight.

The basic requirement for an automatic landing is that the equipment must survive a single failure and continue to operate. Fundamentally, this can be achieved by triplication of all equipment. But in providing and justifying redundant equipment in civil passenger aircraft, consideration must be given not only to overall safety, reliability and performance, but also to weight, installation difficulties, overall cost, maintenance problems and many other factors. Unnecessary redundancy must therefore be avoided.

It is essential that effective autopilot disconnection should occur in the event of a failure and that the pilot should be warned of the failure and the control runs automatically freed. The disconnection and warning unit can only be electrical and must be made truly fail-safe. In practice, failure of the system to disconnect following an autopilot failure will occur only if both the autopilot and the disconnection device fail. The likelihood of this is remote as it involves a product of small probabilities in the landing phase. The acceptance of an electrically actuated disconnect device permits further simplifications of the duplicate channel, with an increase in system reliability and a saving in weight.

The operation can be checked in a different way by comparing the demand of the second autopilot with the effective demand of the first which is obtained by suitably processing the actual control output with the approximate inverse transfer function of the servo motor control loop. This concept is called a "monitored-duplicate" system and is the design used by Elliotts on the VC10. The comparison concept is used throughout the Autopilot and the Flight Director system with the various flight parameters derived in a stand-alone units. Because the duplicate sensors are used for comparison and not for actual control, they can be considerably simplified and therefore made more reliable and lighter than those used in the autopilot; and the inherent differences make them less liable to fail from a common environmental cause.

Longitudinal and Lateral Computers have equivalent Comparison computers, the Vertical Gyro has a simple comparison unit and the Air Data Computer core elements are separated for this purpose. Not all the functional boxes are compared in this way; in some cases such as the Polar Path Compass the units are duplicated and are compared electro-mechanically but there is not a Comparison unit.