ISSN 1229-1889(Print) ISSN 2887-9005(Online) J Korean Soc Qual Manag Vol. 41, No. 3: 433-442, September 2013 http://dx.doi.org/10.7469/jksqm.2013.41.3.433 군용항공기비행제어소프트웨어품질인증절차에관한연구 허진구 * * 국방기술품질원사천센터 A Study on Qualification Procedures of Flight Control Software on Military Aircraft Jin-Goo, Heo * * Sacheon Center, Defense Agency for Technology and Quality Abstract Purpose: This study investigates software qualification procedures based on the FA-50 flight control software to satisfy high reliability and flight safety. Methods: We studied software qualification categories, standard/specification and developed country case. We proposed procedure to satisfy not only flight safety but also international standard. Results: The proposed software qualification procedure satisfied flight safety and airworthiness based on the testing result of the FA-50 flight control software. Conclusion: This paper showed an appropriate qualification procedures of the flight control software in domestic circumstance through the FA-50 flight control software qualification. Key Words: Flight Control Software, Software Qualification, Airworthiness, Fly-By-Wire Received 26 July 2013, revised 25 August 2013, accepted 27 August 2013 Corresponding Author(jingooguy@hanmail.net) c 2013, The Korean Society for Quality Management This is an Open Access article distributed under the terms of the Creative Commons Attribution Non-Commercial License (http://creativecommons.org/licenses/by-nc/3.0) which permits unrestricted non-commercial use, distribution, and reproduction in any medium, provided the original work is properly cited.
434 J Korean Soc Qual Manag Vol. 41, No. 3: 433-442, September 2013 1. 서론 군용항공기에적용되는전자식비행제어 (Fly-By-Wire, 이하 FBW) 시스템은종래의기계식조종장치를대체한전기신호를이용하는전자식조종장치방식을적용한다. FBW의핵심장비는비행제어컴퓨터 (Flight Control Computer) 이며조종사에의해입력된전기적조종입력신호를바탕으로내부연산을거친후조종면에전기신호를전달하는기능을한다. 이러한전자식비행제어시스템은주로소프트웨어적인방법으로제어를수행하기때문에비행제어소프트웨어의설계및구현을수행하는사람의능력및질에따라그소프트웨어의안전성이좌우되는경향이크다. 따라서, 비행제어소프트웨어의안전성을확인하기위해서, 비행제어소프트웨어품질인증은비행안전의측면에서매우중요한절차라고할수있으며, 대부분의소프트웨어에있어서개발전과정에서품질인증이차지하는비중이상당히높다. T-50 계열항공기중최근개발된 FA-50 군용항공기는감항인증을포함한품질인증을수행하였으며품질인증과정중에록히드마틴社의비행제어소프트웨어시험평가에대한기준및절차에대한내용이부족할뿐만아니라일부시험에대하여개선이필요한것으로확인되었다. 이에본논문은국제적인기준서를바탕으로감항인증요구시험항목도출하였으며, 도출된시험항목및선진국사례를바탕으로비행제어소프트웨어시험절차를개선 / 수립하였다. 2. 소프트웨어품질인증제도 2.1 소프트웨어품질인증의종류 비행안전성및신뢰성이보장하여야하는항공용소프트웨어의인증을위하여, 다양한소프트웨어규격이만들어져적용되어왔다. 이러한규격들은군용및민간용, 미국, 유럽규격이있으며, 시대에따라적용되거나취소되기도하였다. 이들분류는크게 3가지유형으로가능하며, 소프트웨어인증규격의종류및특징은다음과같다.[Table 1] Table 1. Software qualification categories and characteristic Categories Feature Related Specification Assessment Standards Development Standards Assurance Standards evaluate ability of the S/W developer, quality of the maturity Provide guide line for S/W developing procedure Provide method for S/W developing project to achieve specific goals CMMI ISO-9000-3 MIL-STD-2167A/2168/498 IEEE/EIA 12207 DEF-STD-055/056 DO-178B DO-278 IEC 61508
Heo : A Study on Qualification Procedures of Flight Control Software on Military Aircraft 435 2.2 감항인증 감항인증 ( 국내의경우 2009.4.1. 법률제정 ) 은군용항공기가운영범위내에서비행안전에적합하며, 그성능과기능을발휘할수있음에대한감항당국 (Certification Authority) 의인증을말하며이러한감항인증은항공기품질인증의한부분으로볼수있다. 감항인증을위해서는항공기설계가기종별감항인증기준을충족하여야하며일반적인감항인증기준은미공군의 를준용하여기종별특성에맞게설정된다. Figure 1는비행제어소프트웨어 ( 컴퓨터자원 ) 에대한감항인증기준사례를나타내며, 해당기준은 DO-178B( 항공기탑재시스템및장비인증에있어서의소프트웨어고려사항 ), DO-254( 전자하드웨어에대한설계보증지침서 ), JSSG-2008( 항공기제어관리시스템합동군사규격지침서 ) 및 AC 20-115B( 미연방항공국 (FAA) 의소프트웨어고려사항 ) 를기반으로기준이설정되었다. Figure 1. Flight control software airworthiness certification criteria 3. 비행제어소프트웨어품질인증요구시험항목도출 비행제어소프트웨어품질인증을위하여수행하여야할시험항목이있으며해당요구사항은 DO-178B( 항공기탑재시스템및장비인증에있어서의소프트웨어고려사항 ), JSSG-2008( 항공기제어관리시스템합동군사규격지침서 ), ( 감항인증기준 ) 등을고찰하여비행제어소프트웨어품질인증요구시험항목도출하여 Table 2에정리하였다. 도출된요구시험항목은 Hardware Certification, Unit, Hardware/Software Integration Test, System Test, Ground Test( 항공전자연동, 전자기적합성, 전원, 구조연동시험 ), Software Certification 을수행하여하여야하며각종규격자료를통해시험항목을도출하였으며대표적인요구조건및관련근거는다음과같다.
436 J Korean Soc Qual Manag Vol. 41, No. 3: 433-442, September 2013 Table 2. Required test of flight control software qualification Requirement Verify that the VCF components meet safety requirements. Certain events and conditions can adversely affect the functional and operational integrity of the VCMS. The system requirement enumerates those hazards and sets the stage for the limitation of their effects Related standard or specification 6.2.2.15 JSSG 2008 3.1.14 (Hardware) Validation and Verification processes DO-254 5 Verify that all parameters passed among SOF processing elements are defined and that unnecessary coupling is avoided. The analysis should confirm the degree of structural coverage appropriate to the software level. The VCF hardware/software integration shall perform an integrity process which accounts for VCF development of its software and integration elements. Hardware/software integration testing: To verify correct operation of the software in the target computer environment Verify that redundancy (hardware and software) is incorporated to satisfy fault tolerant SOF requirements, including probability of loss of control(ploc) and reliability numbers. The VCF redundancy requirements shall meet the handling qualities and flight safety requirements for all operational states Verify that interfaces/integration with other functions and sub-functions are safe. Pre-flight tests are required to provide assurance of subsequent VCMS safety and operability. VCMS should have design for System test, Results Display, Fault Reporting and Monitor for preflight check. Verify that sensors are safely located to minimize/avoid structural mode coupling including vibration from configuration loading and gun fire, and to have safe sensitivity margins. Verify that electrical power normal/backup/ emergency capability following loss of engine(s) and generator(s) for VCF is safe. Interrupting, impeding or otherwise interfering with signal generation, propagation or transmission in the VCMS shall not create hazards during air vehicle operation during flight. 15.2.1 DO-178B 6.4.4.2 JSSG 2008 3.5.7 DO-178B 6.4 15.1.5 JSSG-2008 3.1.12 6.2.2.7 JSSG-2008 3.1.13.1 6.2.2.33 6.2.3.6 JSSG-2008 3.1.11.11 Required test FLCC(Flight Control Computer) H/W Certification Unit Test HW SW Integration Test System Test Ground test (Avionics Compatibility Test, On-Ground Functional checkout) Ground Test (Structural Coupling Test) Ground Test (Power Interaction Test) Ground Test (EMC Test) The results of the SQA process activities are recorded in SQA Records. These may include SQA review or audit reports, meeting minutes, records of authorized process deviations, or software conformity review records. DO-178B 11.19 Software Cert. VCF: Vehicle Control Functions, SOF: Safety Of Flight, VCMS: Vehicle Control Management System, SQA: Software Quality Assurance
Heo : A Study on Qualification Procedures of Flight Control Software on Military Aircraft 437 4. 비행제어소프트웨어품질인증절차선진국사례 선진국 ( 록히드마틴社에 ) 에서제공된문서 ( 비행제어소프트웨어개발계획 ) 를통하여항공기비행시험을위해서는주요계통별비행안전이검증되어야만비행시험이가능하다는것을확인하였다. 특히비행제어소프트웨어의경우선진국절차에따라품질인증을위한비행안전인증서를통해비행시험가능여부를보증하게된다. 비행제어소프트웨어비행안전검증을위해서는아래의시험절차를거쳐야한다.[Figure. 2] 1) 비행제어소프트웨어개발 2) 비행제어컴퓨터에비행제어소프트웨어장입 (Loading) 3) Informal 시험수행 (Verification & Validation) - Stand Alone V&V, Integrated V&V, FMET(Failure Mode Effect Test) 4) Formal 시험수행 - Stand Alone V&V, Integrated V&V, FMET(Failure Mode Effect Test) - PI(Processor Interface) Hotbench Testing( 수락시험전시험장비의건전성확인 ) - Stand Alone V&V Acceptance Test Procedure - Integrated V&V Acceptance Test Procedure) 5) 비행안전인증서 (Safety Of Flight Certificate) 발행 만일비행제어소프트웨어에결함이발생한다면 Software Product Anomaly Report(SPAR) 를통하여소프트웨어에서발견된문제를기록하며문제해결을위해필요한변경내용을형상관리시스템에기록, 검토회의등을통해결함수정활동을수행한다. Source: Lockheed Martin - Software Development Plan for the FA-50 Flight Control Computer Operation Flight Program, 2012 Figure 2. Qualification procedure of the Flight control software
438 J Korean Soc Qual Manag Vol. 41, No. 3: 433-442, September 2013 5. 비행제어소프트웨어품질인증절차수립 비행제어소프트웨어품질인증요구시험항목및선진국 ( 록히드마틴社 ) 에서제공한계획문서에명시된절차를기반으로비행제어소프트웨어품질인증절차를수립하였다. 수립된품질인증절차의개선사항은다음과같다. 1) 중복및필요없는시험항목삭제 - PI(Processor Interface) Hotbench Testing 공식시험시작전에시험장비 (Processor Interface) 에대한정상적인기능수행여부를확인하는시험으로해당시험은 Informal Test 과정에서검증가능하므로삭제 - Stand Alone V&V Acceptance Test Procedures 록히드에서제시한절차와는다르게실제로 Stand Alone V&V Acceptance Test를수행하지않고 Stand Alone V&V 시험에포함하여수행함. - Integrated V&V Acceptacne Test Procedure 록히드에서제시한절차와는다르게실제로 Integrated V&V Acceptance Test를수행하지않고 Integrated V&V 시험에포함하여수행함. 2) 비행제어소프트웨어품질인증에서요구되는시험항목추가 - FLCC Hardware Certification - Software Unit Test - HW/SW Integration Test - 지상시험 (Avionics Compatibility Test, Functional Checkout, System Install & Functional Test, Structural Coupling Test, EMC Test, Power Interaction Test) - SOF(Safety Of Flight) Audit - Airworthiness -( 양산시 )ROKG/ROKAF CCB, OFP Functional Checkout Flight, Service Letter & Retrofit for Customer 기존록히드社의비행안전인증절차를기준으로개선된비행제어소프트웨어비행안전인증절차는중복또는필요없는시험항목은삭제하였으며품질인증을위하여민 / 군규격 ( 표준 ) 에서도출된요구사항을바탕으로비행제어품질인증에서요구되는시험항목을추가하였다. 개선된비행제어소프트웨어비행안전인증절차는아래와같다.[Figure 3] 1) FLCC H/W에대한인증 ( 수락시험통과 ) 2) OFP Unit Test 후 Build up 그리고 OFP 장입 3) Hardware Software 통합시험 4) 비공식 System V&V 시험 5) 조종사및시험담당자에의한공식 System V&V 시험 ( 지상시험과병행 ) 6) 항공전자 & 비행제어호환성시험 7) 항공기장착후장착 / 기능, 구조연동, EMI 시험등과같은지상시험수행
Heo : A Study on Qualification Procedures of Flight Control Software on Military Aircraft 439 8) 시스템시험및지상시험결과를토대로 SOF 감사및 SOF Certification 발행 9) ( 양산시 ) 정부형상통제심의회를통해승인 10) ( 양산시필요에따라 )Service Letter 발행및운용항공기에변경된소프트웨어 (OFP) 장입 Figure 3. Improvement of the flight control software qualification procedures 6. 비행제어소프트웨어품질인증사례 선진국의사례를기반으로국내환경에적합하게수립된 FA-50 비행제어소프트웨어품질인증절차에따라시험을수행한결과감항인증기준을충족함을확인하였다. 대표적감항인증기준및적합성확인사례는아래와같다. 1) Processing Throughput( 프로세싱처리량 ) 의충분한마진설계 Processor가 64Hz 동작, 처리량마진에대한설계반영사항을문서검사를통해확인, 그리고최악시나리오환경에서수행한 LAB시험 ( 결함모드영향성시험 ) 결과를통해처리량이충분함을확인. 2) 단일결함허용을위한물리적 / 기능적분리, 자체진단 소프트웨어에결함및자체진단기능을고려한설계가반영하였는지여부를문서검사를통해확인, 모든결함상황에대한안전성확보여부를 LAB시험 ( 결함모드영향성시험 ) 을통해확인, 그리고지상시험을통하여항공기상에서기능점검및자체진단기능을수행하여기준충족함을확인 [Figure 6]. 3) 추적성 소프트웨어개발계획 ( 형상관리, 요구도설정, 시험방안등 ) 을문서검사를통해확인.
440 J Korean Soc Qual Manag Vol. 41, No. 3: 433-442, September 2013 Figure 4. Example of airworthiness means of compliance 7. 결론 비행제어소프트웨어품질인증은소프트웨어신뢰성과비행안전성확인을위하여반드시필요하다. 본논문에서는국외에의존하여수행되었던품질인증절차및국제적인기존서의내용을고찰하여국내실정에적합한비행제어소프트웨어품질인증절차를수립하였다. 제시된절차를적용하여 FA-50 개발에따라비행제어소프트웨어에대한품질인증을위하여최소단위시험 (Software Unit Test), 기능적요구도충족여부를검증할수있는독립검증시험 (Stand-Alone V&V Test), 조종사에의해수행되어시스템상위요구도를검증하기위한통합시스템검증시험 (Integrated System V&V Test), 비행제어소프트웨어가결함내성을가진동작을수행하는지를평가하는고장모드영향성시험 (Failure Mode Effect Test) 및지상시험을수행하였으며시험및감항인증기준충족을통하여제시된품질인증절차가타당함을확인하였다. 본연구를통하여후속국내개발항공기의비행제어소프트웨어품질인증방안제시및수행능력을확보할수있을뿐만아니라감항인증적용에적용및활용가능할것으로기대한다. 그리고제시된품질인증절차에대하여다양한품질인증을사례제시및개선사항도출에대한추가연구가필요할것으로생각된다.
Heo : A Study on Qualification Procedures of Flight Control Software on Military Aircraft 441 REFERENCES Department Of Defense. 2005. Airworthiness Certification Criteria. Heo, Jin Goo. 2012. A Study on the Methodology for the Airworthiness Certification of Flight Control Integration Technology. Spring Conference of the Korean Society for Aeronautical & Space Sciences 430-435. Kim, Jung Ja, and Cho, Sung Keun. 1991. Study on Development of software Reliability Model and Application. Journal of the Korean Society for Quality Management 19(1):65-71. Lockheed Martin. 2012. Software Development Plan for the FA-50 Flight Control Computer Operation Flight Program. National Aeronautics and Space Administration. 1969. The use of pilot rating in the evaluation of aircraft handling qualities. Park, Peom. 1992. Experiment design and human reliability in software quality control system. Journal of the Korean Society for Quality Management 20(2):94-108. Radio Technical Commission for Aeronautics. 1992. Software Consideration in Airborne System and Equipment Certification. Seo, Sung Jo, Ko, Ki Ok, Choi, Du Yeol, and Hwang, Byeong Mon. 2007. Study of T-50 Flight Control System Ground Test. Journal of the Korean Society for Aeronautical & Space Sciences 07(1302):319-322.