Current requirements and processes employed during the development of military and commercial aircraft do not preclude adverse APC events or ensure that they will be recognized when they do occur. APC-related incidents and accidents have occurred in both developmental and operational (nondevelopmental) aircraft. A study of those events has identified some lessons and some analyses and tests that could significantly reduce the risk of APC events. This chapter outlines a structured approach to the development of FCSs that should minimize the potential for adverse APC events in flight.

The committee believes that flight experience with conventional and FBW FCSs substantiates the following lessons with regard to APC events:

• Truly optimizing aircraft handling qualities, by definition, reduces susceptibility to APC problems (because an aircraft with APC problems cannot be considered to have optimized handling qualities).
• Attempts to optimize aircraft handling qualities have sometimes inadvertently led to APC problems that were not recognized until after the fact.

• Structural dynamics may significantly influence closed-loop control systems and must be considered in the design process, particularly for large aircraft.
• The FCS must accommodate transitions between different modes in a way that is consistent with the pilot's expectations. When many modes are necessary to meet performance-related requirements, the resulting increase in system complexity can complicate system development and validation.
• Transitions between modes, especially in the case of failures, can cause unexpected transients that may trigger APC events. Therefore, automatic step changes in surface commands should be carefully analyzed in the FCS design.
• APC problems have occurred during development because of the improper or incomplete allocation of system parameters (e.g., system time delays) among subsystems.
• APC problems have occasionally occurred because APC criteria were not periodically revisited as the design proceeded.
• Simulation and flight testing should include thorough evaluations of high-gain, task-oriented flying qualities specifically to test for APC characteristics.
• Sequences of ''carefree flight"* during simulation and early flight testing when pilots actively search for APC possibilities are essential.
• A number of pilots should be exposed to simulation and flight tests of new aircraft as early as possible in order to investigate APC characteristics.
• The effects of various combinations of aircraft system modes, failure states, and pilot actions should be evaluated.
• During testing, all anomalous results should be investigated. Sometimes this is not done because of time pressure or inexperience.
• APC susceptibility should be assumed until proven otherwise.
• "A pilot would never do that" is not a valid argument for excluding a particular series of pilot commands from analysis or simulation.

Lessons learned from the committee's review of APC-related incidents and accidents include the following:

• Civil and military organizations, both national and international, approach APC concerns in a variety of ways. Some focus on formal APC criteria, while others rely primarily on empirical methods and rules of thumb based on experience with prior aircraft. On the one hand, the committee found that no approach consistently produced aircraft free of adverse APC characteristics. On the other hand, the committee found that no approach consistently produced aircraft with unacceptable APC characteristics.

• Manufacturers of civil and military aircraft often consider the approaches they use to address adverse APC part of the proprietary design and manufacturing process. The APC characteristics of current aircraft are often treated as proprietary or classified performance data, which tends to inhibit the exchange of APC-related information and interferes with cooperative efforts to eliminate adverse APC.
• In many cases, indications of sensitivity to APC were identified in simulations and analysis, but these indications were dismissed prematurely. At a minimum, potential APC sensitivity should be taken as an early warning that requires further investigation.
• All signals critical to the FCS must be fault tolerant and must be accommodated adequately by reversionary modes.
• Designs should minimize phase delays due to rate saturation (from surface actuators or other sources). In addition, integrator windup must be avoided. (See the section on technical fixes near the end of this chapter.)

There are opportunities for improving the processes used during the analysis, design, testing, and certification phases of a development program. The committee believes that wider use of the following policies and procedures would reduce the potential for adverse APC events.

Management should recognize that available APC evaluation criteria are tentative and incomplete but will continue to improve as the design of the aircraft and aircraft systems evolves. Management should also recognize that opportunities for adverse APC are often created when new systems are introduced. Therefore, periodic reviews, pilot evaluations, and criteria updates are warranted. Senior management should ensure the continuous implementation of the following general policies:

• APC susceptibility should be assumed; evaluations aimed at minimizing APC risk should be an essential part of vehicle design and development from the beginning of the program and should continue through vehicle certification and entry into service.
• A highly structured systems-engineering approach to APC risk reduction should be implemented. This approach should require all relevant disciplines to be aware of and focus attention on the APC risk

• reduction process from early in the program until the aircraft enters service.
• A multidisciplinary team should develop the FCS. This team should include representatives of the following disciplines: piloting, flight controls, stability and control, aerodynamics, structures, avionics, electrical power, human factors, and maintenance.
• Team leaders should be prepared to facilitate the resolution of problems, to convey to higher management the need to investigate thoroughly potential APC problems, and to withstand the pressure to avoid program delays by cutting corners on APC risk reduction.
• The relevant teams should agree early on design and evaluation criteria for flight qualities and APC risk reduction. All team members must be aware of the consequences of adverse APC events and must rigorously apply the selected criteria.
• Team charters should include procedures for resolving differences of opinion regarding steps to be taken to identify and eliminate adverse APC tendencies.

The overall design process is illustrated in Figure 4-1. The key steps in the process that focus on the elimination of adverse APC events are discussed below.

The basic flight control philosophy should incorporate safety, past experience, customer requirements, and company strategies. Different types of aircraft (fighters, transports, etc.) often have significantly different control philosophies. The control philosophy may include the following elements: the aircraft-pilot interface (inceptors, displays, etc.); pilot control authority; augmentation of handling qualities; and enhanced control functions, such as envelope protection. The philosophy should be understood clearly by each member of the team involved in developing focused requirements and objectives for the system.

The type of inceptor can significantly affect the design process and methods of evaluation. For example, there are major differences between a large-displacement center-stick inceptor and a minimal displacement side-stick inceptor. Piloting techniques may differ for different inceptor designs, and the selection of handling qualities and APC criteria may be influenced by the type of inceptor. The type of inceptor may also be important to the simulator and aircraft design teams because the geometry, hardware, type of simulation, etc.,

are all influenced by the inceptor selection. For all of these reasons, it is important that the design team reach agreement or develop a plan to reach an agreement very early in the design process on the type of inceptor.

Good flying qualities are fundamental to the elimination of adverse APC. These are defined in the form of requirements with relevant metrics to be satisfied. Table 4-1 provides an outline of some fundamental qualities that are directly reflected in the aircraft and FCS designs. The design team should select the appropriate metrics (and values) for a specific aircraft that will maximize the overall performance of the aircraft in terms of its ability to execute assigned tasks safely (which implies good flying qualities). Additional criteria and metrics that specifically address APC should be developed and

added to this list. Among the additional criteria that should be considered are the following:

• Aircraft-Bandwidth*/Phase Delay, ω_BW and τ_p
• Gain/Phase Template, including ω₁₈₀/Average Phase Rate
• Smith-Geddes Attitude-Dominant Type III
• Neal-Smith
• Dropback

Each of these criteria is described in detail in Chapter 6. These criteria relate primarily to maneuvering characteristics and should not be viewed as pass/fail tests but as ways of alerting the analysis and design teams to potential sources of APC risk. The criteria can be refined for different aircraft types and can increase confidence that APC risk in the design has been minimized.

Not all of the criteria are equally appropriate for all control system designs and aircraft types. For example, Boeing has found that the Smith-Geddes Attitude-Dominant Type III criterion is probably overly conservative when applied to the roll axis of large transport aircraft.⁵⁴ The manufacturers of the YF-22 and F-16 have had similar concerns with respect to the control system designs. Even with these limitations, however, design teams should use each available criterion as an indicator and recommend improvements or adjustments when there is sufficient evidence to do so.

The existing control system flying qualities and APC criteria for Category I PIOs appear to work best with FCSs with a "classical" response, and the design team should consider this fact early in the design process. For example, one reason the F-22 program decided to use a classical approach to control system design was to prevent ambiguities between pilot comments on FCS performance and the results of analyses using conventional criteria for the nonclassical YF-22 and F-16 design concepts and approach. If a nonclassical approach is selected, the team should be aware of the ambiguities that may result from the use of conventional criteria.

The APC criteria listed above need to be supplemented to address Category II and III APC phenomena. The committee emphasizes that, when changes are made to the FCS as the development evolves, the new configuration should be reassessed against the APC criteria. Until reliable criteria and analysis tools become available for Category II and III phenomena, reliance must be placed on comprehensive simulation tests and, perhaps, flight tests.

Once flying qualities requirements have been established, they should be integrated with other design requirements that address reliability, availability,

and maintainability. A well structured process for developing control laws should be implemented. This is an iterative process requiring extensive communication between the team members and pilots. The lessons learned for APC prevention, which are presented above, should be used to formulate design goals such as the following:

• Ensure that, wherever possible, the control strategy applies to all tasks under all flight conditions.
• Design the system to perform consistently throughout as much of the flight envelope as possible to minimize the chance that the pilot will incorrectly modify his behavior to compensate for system response characteristics.
• Verify that the detailed design is satisfactory in terms of potential problem areas such as integrator windup, the impact of power interrupts, and switching feedback capacitors.
• Minimize the number of modes and failure states, consistent with aircraft performance requirements.
• Ensure smooth transition between modes and failure states.
• Avoid designs that depend on the high end of normally available aircraft performance (e.g., a flight path profile that is only achievable with all engines at full thrust).
• To achieve predictable input-output characteristics, avoid nonlinear design features; design for linear proportional responses whenever possible.
• Include appropriate structural dynamics models.
• Check that the probability of saturating actuator rate and/or position is extremely unlikely under all circumstances, including maximum maneuvering rates and severe turbulence.
• Allow sufficient authority and priority for the augmentation functions during extreme maneuvers.
• Minimize phase delays caused by rate-limiting effects.
• Ensure that time delays are accounted for in development models for simulation and analysis.
• Ensure that key system parameters, such as effective time delays, have been allocated and included in subsystem specifications.
• Analyze the system behavior in great detail to understand the effects of all nonlinearities in the design; analyze what happens when command inputs saturate the control system, especially when the SAS (stability augmentation system) may also be working (or trying to work), which can lead to unrealizable demands on control-surface actuators.

Specifications for all major FCS elements and interfaces, including the flying qualities metrics defined earlier, should be prepared and translated into

appropriate parameters. These specifications also should address APC lessons learned.

The availability of critical data significantly influences the design process. The final design of a FCS is dependent on the aerodynamic database that describes the aircraft, the weight and inertia of the aircraft, the rate and hinge-moment capability of the actuation systems, the effectiveness of the control devices, the structural rigidity of the aircraft and control surfaces, the dynamic behavior of the aircraft, etc. Unfortunately, these data are almost never available at the start of the control-system design process; they are progressively released and updated throughout the development process. Often, a new aircraft is flying before all this information is known. The control-system design team must decide how the evolving design data will be incorporated into the design process.

Simulators (both ground and in-flight) are key elements in the design process. Availability, schedule, cost, etc., all require early agreement on how simulators will be used.

The requirements of the FCS may significantly affect the design of other systems. The design team should consider how these requirements can be identified early in the process and should communicate them to other system design teams. An important requirement (particularly from an APC perspective) is the rate capability of the actuation system. The hydraulic or mechanical limitation on the actuator rate is a key factor in the susceptibility to Category II APC. If the aircraft design is finalized with severe rate limitations, problems in designing the control system can be greatly magnified. The integrity, availability, and redundancy of sensors and other subsystems could be a source of triggering events if these parameters are not adequately integrated into the overall design.

In this phase of the design process, the effects on flying qualities of many factors are assessed in detail. A structured analysis of system performance can provide guidance on where to apply certain requirements and can focus subsequent testing. A matrix of variations should be considered for analyzing the following factors:

• flight conditions
• aircraft configuration
• aircraft loading
• atmospheric conditions
• air/ground states
• FCS modes

• failure states for the FCS and all interfaces
• structural influences

From an APC standpoint, these factors should be assessed in the context of upsets or abuses that may occur in conjunction with large or otherwise inappropriate pilot inputs under high workload conditions.

Simulators and simulator pilots play a significant role in developing the FCS and reducing the risk of adverse APC. In the selection of the simulation approach, a number of factors should be considered.

• Installing the correct pilot inceptors is critical. It is very difficult to extrapolate handling qualities and APC characteristics between different types of inceptors.
• The end-to-end time delays in the simulation must be understood, and any differences between the simulated and real systems should be minimized. The simulation is always a degradation of the real world, and the effects of this degradation must be considered.
• To minimize the time delay for simulations of handling qualities, the simulator visual scene may have to be restricted.
• Ground-based simulations may not adequately reveal the existence of adverse APC because (1) they lack acceleration cues, (2) the visual systems are less than satisfactory, and (3) it is difficult to instill a sense of urgency in the pilot. Moving-base simulators may be better than fixed-base simulators for testing the PVS in some parts of the flight envelope. However, the committee believes an excellent visual display system is more important than a moving base in most cases because instrument-rated pilots are trained to rely upon visual rather than acceleration cues. (Simulation is addressed more extensively in Chapter 5.)
• In-flight simulations solve many of the problems inherent in ground simulations, but because they are very expensive, in-flight simulations must be well planned and used judiciously.

The committee discovered a strong industry consensus on the importance of selecting simulation tasks for detecting APC tendencies. Adverse tendencies that are evident with low-gain inputs are easily observed and can be eliminated

in the design process. However, discovering, minimizing, or eliminating most adverse APC requires high-gain pilot inputs. Thus, the tasks selected for simulator pilots should generate high pilot gain.

The committee believes that a desirable way to generate high gains is to simulate real aircraft tasks that emphasize precision PVS performance because realistic high-gain tasks make problems more credible. However, it is useful to include some tasks that naturally maximize pilot gain but that may not be typical of normal flight operations. These tasks should stress the PVS to its limits, thereby ensuring that it is not susceptible to APC phenomena under even the most extreme conditions. High gain tasks should be repeated several times. A variety of tasks should also be included that focus on possible differences in pilot responses to visual and acceleration cues.

In the absence of applicable APC criteria and analysis tools, the ground simulator is the only convenient place to evaluate the wide range of conditions that could produce hazardous Category III APC events. By definition, Category III APC events are unpredictable and are often caused by unexpected mode changes and system failures. Ground simulation is the only place where it is safe to introduce a pilot to many conditions that may produce these events. Because of this restriction, eventually a high fidelity mock-up with actual hardware should be coupled with the pilot-in-the-loop aircraft ground simulation. This mock-up should include significant pilot cues (e.g., vision system, inceptors, and displays). Structured testing, as already described, can then be used to minimize the risk of adverse APC characteristics lurking in the system design.

Guided by the structured analysis matrix for system performance discussed earlier, maneuvers to evaluate handling qualities throughout all portions of the flight envelope should include the following:

• takeoffs
• landings and go-arounds in various atmospheric conditions (including carrier, short runway, or slope landings, when appropriate)
• aborted takeoffs and landings
• trims and speed offsets
• stalls and pushovers
• wind up turns (i.e., turns conducted with a constant "g" while allowing airspeed to fall off until the aircraft stalls or encounters some other limiting condition)
• configuration changes (flaps, speedbrakes, gear, and thrust) during normal and, in selected cases, off-normal flight conditions
• open-loop inputs (controller pulses and steps, frequency sweeps)
• turn entries
• sideslips
• engine-out conditions
• maneuvering into and out of buffet at high altitude

• mission-oriented precision tasks (e.g., air-to-air tracking, air-to-air refueling, etc.)
• evasive maneuvering

The design and development process is iterative in nature. Design goals may be refined in the course of control law development and analysis and by design changes in response to data updates (e.g., aerodynamics, propulsion, and structures) or other design changes.

Flying qualities evaluations involving piloted simulations are used to validate the FCS design and optimize predicted flying qualities prior to flight testing. Flight test evaluations provide, of course, the final measure of performance. In reality, both simulator and flight-test pilot evaluations can and do lead to design changes. Consideration should be given to the use of both ground-based and in-flight simulator evaluations. In-flight simulator evaluations can be valuable when new functions or fundamental changes in control strategies are planned.

As a first principle, all evaluation and assessment processes, whether conducted in analysis, simulation, or flight stages, should be designed to actively seek latent APC conditions. Pilot evaluations for APC tendencies should increase the pilot gain or workload and so increase the possibility of finding hidden APC tendencies. Table 4-2 is a composite list of tasks designed to create a sense of extreme urgency and result in high pilot-vehicle gain and aggressive control techniques. For some of these tasks, performance objectives are indicated when a reasonable rationale is available. For military aircraft, the proposed revisions to MIL-STD-1797^70,71 serve this purpose.

In most cases, task-induced stress can be magnified by adding turbulence and wind shears. In addition, the pilot should be instructed to perform the tasks aggressively and accept little error; assessments should emphasize performance, as well as possible APC tendencies. This type of evaluation is sometimes referred to as ''handling qualities during tracking" (HQDT).

Most of the tasks in Table 4-2 apply to detecting Category I or II APC events. Category III and non-oscillatory APC events are very difficult to uncover because they are frequently associated with changes in aircraft characteristics due to failures, external inputs, or unexpected mode transitions. A promising test and evaluation technique currently in development by Saab is comprised of a formal procedure of stick movements that successfully revealed APC susceptibilities associated with a buildup of "disconnects" between the pilot's commands and the response of the control surface. This technique has been referred to as the "klonk method" and is described as follows:¹⁹

1. Move the control stick to maximum positive pitch deflection and hold for a selected time period. This is klonk #1.
2. Move the stick to maximum negative pitch deflection and hold until the aircraft reaches maximum positive pitch angle (as a result of the command from the previous step). This is klonk #2.
3. Move the stick to maximum positive pitch deflection and hold until the aircraft reaches maximum negative pitch angle (as a result of the command from the previous step). This is klonk #3.
4. Repeat steps 2 and 3 for the desired number of klonks. For example a 10-klonk test would cycle the pitch stick into the stops a total of 10 times.
5. Simultaneously with steps 1 through 4, move the stick to the maximum left roll position each time the stick is moved to maximum pitch position, and move the stick to the maximum right roll position each time the stick is moved to the minimum pitch position. Also, while the stick is being held in the pitch stops in steps 1 through 4, slowly reduce the roll command at a constant, selected rate.
6. Determine if the aircraft has remained stable and controllable for the specified number of klonks.
7. Repeat steps 1 through 6 using different values for the initial hold period in step 1 and the roll command rate in step 5.

The klonk method has been effective for assessing the effects of the kinds of delay buildup described in Chapter 2 in connection with the second JAS 39 accident.

Many of the tasks for simulator use should be repeated during flight tests. If unexpected APC events are encountered in flight tests, they should be reevaluated in the simulator. It is essential that a significant number of pilots be exposed to the system, during both simulation and flight test evaluations, to ensure that the aircraft will accommodate a wide range of piloting skills. Particular attention should be paid to each pilot's comments during the first exposure to the aircraft. Test pilots, in particular, adapt very quickly and unconsciously to compensate for possible FCS deficiencies.

The selection of pilots for flight (and simulator) testing can be a key factor in developing an APC-free aircraft. Boeing's experience with the 777 indicates that exposure of the aircraft to a large number of pilots can be fruitful in ferreting out problems. In several instances, the first encounter with a particular variety of PIO was discovered with customer, rather than company, test pilots. Once an APC susceptibility was discovered, company test pilots were usually able to duplicate the events, thereby helping to isolate causes and

evaluate corrective measures. Airbus, which has by far the largest number of FBW-equipped commercial aircraft in service (more than 600 aircraft, with more than six million flight hours as of early 1996), also emphasizes the need for a diverse pilot population for APC evaluations. For APC clearance, Airbus attempts to include evaluations by three kinds of pilots: (1) pilots who are unfamiliar with the aircraft; (2) test pilots who are "not APC prone" (and, as a result, have little or no experience with APC events, even when flying aircraft with poor APC characteristics); and (3) pilots who are experienced with APCs and can translate their experimental assessments into terms that line pilots can appreciate.

APC-free aircraft require specific examinations and searches for APC tendencies very early in programs, especially in simulations and even in some flight testing operations. These "discovery" processes are aided enormously if at least one pilot has a "high gain" piloting style and an "explorer'' attitude and is permitted to engage in carefree flight operations that emphasize the types of tasks and inputs suggested in Table 4-2. As exemplified by the Navy tests for the F-14 backup flight control module described in Chapter 2, the pathway to a flying qualities cliff may not be found using incremental advances from one stabilized flight condition to another. Needless to say, such operations and freedom are seldom popular with program managers. But when they are conducted prudently they can be highly productive.

A general caveat may be appropriate at this point. Hands-on exposure to adverse APC events in training is highly desirable for flight test pilots and engineers. Committee members who were so exposed using an in-flight simulator (see Chapter 5) underscore the need for APC awareness training and for effective learning tools. (It may also be possible to use ground-based simulators for APC awareness training, especially for Category I APC events, but they are not likely to make the same sort of dramatic impression on pilots as in-flight experiences.) APC awareness training does not currently exist within the FAA, and greater emphasis is needed within the Department of Defense.

Careful implementation of recommended processes does not guarantee that APC problems will never be encountered during subsequent analysis and evaluation tests. When problems are encountered, individual analysis will be needed to determine causes and corrective actions. Technical fixes for some of the more common problems include the following:

• Reduce coupling between flexible modes and pilot inputs. Command filtering (e.g., notch filters) may be used to reduce the sensitivity of the PVS to flexible mode coupling. Command filtering has been used

• to reduce or eliminate oscillations in the 3-Hz regime for the CH-53E helicopter and the Boeing 777 (see, e.g., Nelson and Landes⁵⁴). An unfortunate side effect of such filtering is an additional time delay between the pilot's input and the aircraft's response. If necessary, techniques such as phase stabilization can be used to reduce time delays.
• Mitigate the effect of actuator rate limits. The maximum rate available from the actuator in a control system is often lower than the designer would prefer. Signals to the actuator that demand a higher rate than is available result in an additional delay between the pilot and the actuator response. This has been a primary factor in several Category II and III PIOs and non-oscillatory APC events. The preferred solution is to ensure, by design, that commands cannot exceed the available rate capability. Other solutions are also available, for example a nonlinear scheme for the JAS-39.⁶⁰
• Eliminate integrator windup. "Integrator windup" describes a condition where an integrator in the command path continues to compute even though the element receiving the integrator signal has reached a position or rate limit. When the command to the integrator is reversed, the integrator must unwind before the downstream element will respond. This is another potential source of significant delays between the pilot and the desired aircraft response. A solution to this is to limit the integrator so that the output is less than the actuator displacement minus the sum of any required augmentation signals.

Developing and implementing more effective processes will be complicated because the nature of the problem will continue to evolve as advanced military technologies migrate into civilian aircraft. In addition to FBW and fly-by-light technology, technologies that could make this migration include multiuse control surface effectors (see Chapter 2); all-electric actuation systems; and increasingly complex, unconventional flight control laws, such as "task-tailored" control laws that are optimized for specific flight conditions and tasks.

In addition, commercial aircraft manufacturers have been developing and introducing new technologies and features that have not been used in military aircraft. The commercial use of these technologies has the potential to introduce unique phenomena for which proven APC criteria and analysis methods may not be available. As the number of commercial aircraft that employ these technologies increases, their potential impact also increases. Critical items of interest include the following:

• Automated modes and pilot proficiency. As discussed in Chapter 2, current and future airline operations have relied and will continue to rely heavily on automated modes of the FCS. This can lead to very little hand-flying by the pilot, thereby reducing pilot proficiency in manual flying. Adopting unconventional manual flight handling characteristics, which have been proposed for some future aircraft, would further exacerbate APC problems because it would increase the challenge faced by pilots who must quickly assume manual control of the aircraft.
• Novel inceptor characteristics. Small-displacement, low-force inceptors are already used on some military and commercial aircraft. They may become more prevalent on future commercial airliners as cockpit designers strive to reduce the weight, size, and volume of control inceptors. Differences have also appeared in the degree to which automatic system operations, such as autothrottles, are reflected in inceptor motions. However, as noted earlier in this chapter, these inceptor characteristics can significantly affect the design process, methods of evaluation, and situation awareness. Without adequate criteria or data, flying qualities designers will not have adequate information to ensure that the characteristics of new inceptors will not contribute to adverse APC.
• Structural modes. Reducing the weight of structures reduces the overall weight of the aircraft and improves fuel economy, which are important design goals. However, as optimized structures become more flexible, the structural mode frequencies are reduced, and the potential for an APC event is significantly increased. This trend has already become important in large helicopters and at least one large transport. The APC problems experienced in these aircraft have been countered thus far by notch or low-pass filtering in the command pathway. Limitations in this approach will be reached when the additional time lag associated with this filtering is reflected in poorer flying qualities.
• Inexperienced designers. Current trends in the aviation industry will result in fewer and fewer new aircraft developments, which will make it difficult to maintain a cadre of designers with extensive experience in a variety of aircraft and aircraft types. This situation emphasizes the need for specialized training to acquaint designers with APC phenomena (because they will have fewer opportunities to pick up such knowledge in the normal course of events).
• Software and hardware updates. Mild APC events can often occur when a pilot is learning the characteristics of a new aircraft. More severe events can occur if there are sudden changes in effective aircraft dynamics. The possibilities of both of these occurrences can

• increase significantly if software and hardware updates are not managed properly.
• • Software updates. Modifications to digital FCSs that include radical control law changes can be implemented by software updates, and the potential for introducing adverse APC characteristics will continue to grow as more and more commercial aircraft are equipped with digital FCSs. Manufacturers and regulatory authorities should redouble current efforts to ensure that (1) software updates are adequately tested, (2) new control laws are compatible with pilots' experience and expectations, and (3) pilots receive necessary training before they are assigned to aircraft with updated software. New, more efficient, more affordable processes could help achieve these goals.
  • Hardware updates. Aircraft operating lifetimes are now generally far longer than the technological lifetime of digital FCS equipment. Major investments are made in software validation and verification, some of which are hardware specific. Significant incompatibilities and significant additional costs can be anticipated in the future as FCSs are replaced and associated software is reworked.