|
. 
|
- Fly-By–Wire / In The Beginning –
How do state of the art jet aircraft fly? How doe pilots fly an Airbus or Boeing commercial aircraft, take off and ascend to 35,000' or higher, provide a relaxing trip for passengers and then safely descend to a smooth landing? How do current generation jet fighters get off the ground, execute seemingly impossible maneuvers, complete the mission and return home? Flying modern commercial and military aircraft is done by extraordinary system known as Fly By Wire whose orgins predate jet aircraft.
Originally Fly-By-Wire was mechanical flight management with metal wires moving the wing ailerons. This system required the pilot to use brute force in the era before hydraulic controls. The pilot moved control sticks and rudder pedals that were linked to cables and pushrods. These, in turn, pivoted control surfaces on the aircraft’s wings and tails.
The installation and first test of a Digital Fly-By-Wire system was made on a modified Vought F-8 Crusader at the Flight Research Center, Edwards California USA in 1972. The development of Digital Fly-by-Wire had strong support at NASA from the famous Apollo astronaut, Neil Armstrong. After the Apollo 11 Mission, Armstrong took his knowledge of electronic control systems to the Office of Advanced Research and Technology where he made his prestige and expertise available to the development of Fly-By-Wire.
The first Digital Fly-By-Wire system was an off the shelf backup, Apollo digital flight control computer and the inertial sensing unit which transmitted pilot input to the actuators on the F-8 control surfaces. This F-8 made its first successful flight on May 25, 1972 and 210 flights were completed over the next 13 years.
Digital Fly By Wire is safer than mechanical FBW because of built in redundancies, and on military aircraft it is less vulnerable to battle damage than old fashioned hydraulics. Digital Fly-By-Wire is also more maneuverable because computers can generate adjustments more frequently than can be done manually by the pilot. Commercial flying becomes smoother and the travel experience more pleasurable. Aircraft designers could now set aside features that made aircraft more stable at the expense of maneuverability. Digital Fly-By-Wire is also fuel efficient as the hardware is compact and lightweight. Fuel per flight can be reduced or passengers and/or freight added to the aircraft.
Design Concepts for FBW / Aircraft and Pilot
Digital Fly By Wire implementations are flexible in their response to a changing flight environment that requires continual fine tuning of the aircraft’s Flight Envelope.
The computer interface with electrical control circuits profoundly changed the design and material requirements of aircraft. Mechanical and hydro-mechanical flight control systems are heavy and require a complicated system of pulleys, cranks, wires and hydraulic controls. Redundant backups should always be in place. Mechanical and hydro-mechanical flight control systems are designed for rapid response to changing environmental, aerodynamic variables. Nonetheless, the dangers of stalling, spinning and Pilot Induced Oscillation (PIO) are always present and must always be considered.
Fly-By-Wire – How it Works / Overview -
Side sticks, center sticks or conventional control yokes fly modern aircraft. The side stick is lighter, mechanically simpler but provides very little visual feedback. Boeing does not like that limitation and uses conventional yokes in the 777 and the forth coming Dreamliner. Airbus uses side sticks and the USA F-16 Falcon uses a small side stick.
On a typical Airbus aircraft there are several computers usually three primary and two secondary. They are often referred to collectively as the aircraft’s ‘system’. The computers use position and force data from the pilot’s controls, input from manual movements on the side stick or joystick and aircraft sensors to solve differential equations. The solutions to these equations determine the appropriate commands (which are executed as digital signals) necessary to move the aircraft flight controls so as to optimize flight as intended by the pilot.
The bottom line with Fly-By-Wire is the fine grained ‘tuning’ of control surface position. Sensors at control surfaces feed data back to the Flight Control Computer (FCC). At the same time, the pilot is flying the plane and makes continual adjustments to a frequently changing flying environment. There are ‘two’ brains at work simultaneously, the FCC and the human pilot. To avoid dangerous and possibly life threatening situations where the FCC would be forced to work with two data sets of equal priority, these two data streams flowing to the FCC do not have equal priority. By design and therefore embedded in the computer code and software interface, priority is given to the data stream coming from the sensors on control surfaces.
The FCC digests both data streams, a process that involves obtaining solutions to systems of differential equations. The central computer analyzes the difference between the immediate control surface position as determined from digital data input from the control surface sensors, and the control surface configuration desired by the pilot (which is revealed by his movements of the stick as he ‘flies the plane’. A command signal is generated by the FCC and then sent to the control surface. This instruction to the control surface is often designated ‘ corrective’ because it almost always makes a small adjustment to the current alignment of the control surface. The ‘corrective’ designation is also applied because the data input from the pilot is analyzed against that from the control surface and then ‘corrected’. The Fly-By-Wire premise is that the Flight Control Computer knows best, but only after ‘considering’ input from the pilot.
The protocols behind FBW imply that the data deemed most accurate by the FCC is that from the electronic sensors on the control surfaces but that data alone does not suffice. Pilot input is required and then the adjusted data stream is used to solve the differential equations that generate the output for the control surface sensors which usually change the alignment of the control surface, at least in some small fashion. Stating that the ‘computer flies the plane’ in FBW is simplistic and misleading. The pilot flies the plane subject to minute by minute ongoing command adjustments made by the FCC. Alternatively, the central computer through the autopilot flies the plane subject to adjustments derived from pilot input who generates a second digital data stream to the FCC as he/she flies the plane. Pilot and FCC have a symbiotic relationship, a relationship in which both parties benefit and which would be deficient if either entity’s data contribution were absent. During flight, the pilot and FCC can be said to constitute a 'cyborg' as defined in the realm of science fiction literature. A cyborg is an entity composed of both biological and computer intelligence.
Feedback compensation plays an important role when Fly-By-Wire is active. FCC compares output signals (pilot commands) to input signals (sensor data sent to ‘system’), and errors (ie differences) between the two are translated into commands to flight control surfaces. This process continues until output equals input, ie the pilot is flying the plane as would the systems computer. The FBW computer ‘brain’ has reconciled the two, has negated the differences between the pilot flying the aircraft alone, or the computer flying the aircraft by itself without any human input. The final result might best be called a hybrid command cascade, it is neither 100% computer generated, and certainly not 100% pilot generated. Context changes minute by minute. At its most intense, command structure is revised and sent to control surfaces as fast as computer processing design will allow.
The autopilot, which we can describe as the summation of the digital and electronic components that fly the aircraft may also be characterized as both a (S)tabilty (A)ugmentation (S)ystem and a (Control A)ugmentation (S)ystem because each is a feedback control system. At the end of the day, the aircraft response is adaptable to a broadly defined flight envelope, and is achieved through manipulating the numerical data of airspeed, Mach number, Center of Gravity position, angle of attack and configuration.
Full Authority FBW controls with ‘hard limits’ was first implemented by Airbus in the design of their A320 series of commercial jet liners which entered service in March, 1988. On these aircraft, the computer system and autopilot have absolute authority and absolute control unless the pilot chooses to activate Direct Law, a flying protocol wherein many flight envelope protections are removed. That is the price that EADS and Airbus decided would have to be paid if the pilot chose to assume direct control over flying the aircraft. Boeing’s approach to FBW was developed later and is not considered ‘Full Authority’. In Boeing FBW, it is not mandatory that Direct Law be activated in order for the pilot to have significant access to the minute by minute commands that fly the aircraft. More and immediate options for pilot control of the aircraft differentiate the two FBW systems as will be explained below.
Manual control of the aircraft is replaced with a computerized, electronic interface. The pilot’s movement of flight controls (joy stick, side stick, center stick) are ‘translated’ to electronic signals which become the ongoing data stream that is fed to computer system. In early versions of FBW, including that used in the Concorde and still in use in Embraer E-Jets, electronic controllers simulated the ‘feel’ of manual controls for the pilot. Analog computers then replaced these electronic controllers an they provide good customization of flight control and relaxed flexibility. Early versions of the USA F-16 fighter exploited this capability and had impressive maneuverability. Flight control computers digest their data input and then instruct the actuators at each control surface where and when to respond.
Because mechanical and hydraulic systems usually fail slowly as parts wear out, pilots and engineers are not often taken by surprise by a system wide failure. Digital computer systems can ‘crash’ instantly and require a backup system whose response time should be near instantaneous. The results for an aircraft in flight are potentially catastrophic. Much attention has been spent in designing, second and third tier redundancy for Digital-Fly-By-Wire, and also the best approach to integrating the pilot into a problem/crisis-response scenario. It was decided some time ago, that a mix of Digital-Fly-The-Wire and Mechanical Controls is not desirable. The approach to FBW failure is multiple levels of computer FBW redundancy. Nonetheless, much work remains to be done to refine the best approach to first level FBW system failure. Detailed analysis of aircraft crises where FBW malfunction or failure was central to the scenario often reveal that old fashioned quick thinking and access to manual flight controls by the pilot, saved lives and were able to prevent activation of worst possible situations.
When the aircraft computer is in Flight Envelope Protection, it will try to prevent pilot actions that might endanger the aircraft. The computer can prevent pilots from exceeding preset limits for stall, spin or limiting G forces. Software can filter control inputs to avoid pilot induced aircraft oscillation.
In the absence of a problematic environment, be that external or internal, the computers continuously fly the aircraft and pilot workload is reduced. Inherently unstable aircraft can be flown as test beds, prototypes to thoroughly evaluate for possible production. Military aircraft benefit with a more maneuverable flight performance and most stalling and spinning can usually be prevented. Military aircraft also benefit with improved combat survivability because they can avoid hydraulic failure.
Above all, the computers are programmed to enable and maximize flight envelope protection. Aircraft designers tailor a plane’s handling characteristics to stay within the limits of what is not only possible, but safe, considering the structural design and the strength/stress resistance of the materials used in components. This latter objective is once again receiving intense scrutiny as the use of composite materials in newest Airbus and Boeing designs will exceed 50% of the aircraft’s total weight.
Boeing and Airbus differ in their approach to FBW. In Airbus aircraft, flight envelope protection retains ultimate control. In an Airbus, pilots cannot fly outside the normal flight envelope without taking extraordinary measures. In a Boeing 777, the pilot can override the system and fly outside the approved flight envelope with much less ‘struggle’. With Full Authority Digital Engine Control, flight control systems and auto-throttles for engines are fully integrated. Current generation military aircraft integrate auto-stabilization, navigation, radar and weapons systems with flight control.
With the Airbus aircraft from the A320 family forward, flight envelope protection prevents stalling at low speeds. In economy cruise modes, flight control fine tunes throttles and fuel tank selections more precisely than most pilots could do, and thereby minimizes fuel costs per flight. Rudder drag, which is called upon to compensate for sideways flight from unbalanced engine thrust, is reduced. In the A330/A340 Airbus family, fuel is transferred between main tanks (wing, center fuselage) and a fuel tank in the horizontal stabilizer. The aircraft’s center of gravity is thereby accurately trimmed with fuel weight during cruise flight, and drag inducing aerodynamic trims in the elevators are not needed.
The Airbus A320 was the first aircraft to use a complete Fly-By_Wire system. Since implementation, there has been an ongoing debate about the advantages and potential problems with a complete Fly-By-Wire system. This debate inevitably contrasts Airbus and Boeing commercial aircraft because Boeing allows pilots to have more immediate and perhaps wider contextual. manual control over their aircraft in several flying scenarios. This difference inevitably calls forth a discussion, if not an argument, about procedures and aircraft responses during situations not often encountered, and during crisis situations where aircraft integrity and lives are threatened.
Fly-By-Wire / Advantages –
Implementation of Digital Fly-By-Wire confers a number of advantages to aircraft design, assembly and ccost efficient business models.
Schematic about bank angle * stall and speed during landing. – FBW introduced an advanced approach to Flight Envelope Protection that for the first time addressd low speed flight (stall), over-speed (flying too fast for the contextual realities), bank angle, aircraft G factor etc. Photo/diagram of Spoilers and/or extended flaps etc. cf B 737 site and photos.. - Airbus FBW greatly improves lift augmentation by allowing both ailerons to be symmetrically lowered. This configuration provides additional lift when flaps are extended.
The Critique -
With recent airbus crashes and the tragic loss of life, all aspects of Airbus design are now subjected to increased scrutiny and investigation. The implementation of FBW has a decades long history and we have reviewed compelling reasons for implementing this degree of computer control over aircraft performance. It is important to understand this history before criticism is unleashed. Recent history of technology documents an ever increasing melding of human and computer capacities to achieve hybrid ‘machines’. Modern civilian and military aircraft require a complex integration of human and computer driven capacities. Gone are the days when a pilot flew the aircraft by direct mechanical actions. Yet we have not reached that future where autopilot is turned on and the pilots can then settle down to play chess for several hours.
Material in this Critique Section is indebted to the discussions on several aviation blogs, particularly the Professional Pilot’s Rumor Network and airliners.net. First and foremost, Fly-By-Wire does not monitor the consequences of human action. This is an obvious, yet subtle concept with far reaching consequences. FBW is not the pilot’s mother, it is not present to offer direct advice, or say ‘no’ don’t do that. FBW is not Hal, the intelligent rogue computer that controlled the spaceship in Arthur C. Clark’s epic novel and science fiction film ‘2001’.
New photo/schematic - Pitot tubes and icing ..
Fly-By-Wire does not compute near future scenarios and then comment to the pilot via instrument or message display in the cockpit. If a changing flight environment carries with it a risk of icing and loss of airspeed in near future time, then likely a significant difference between stall and overspeed would minimize the danger. But FBW will not say a word about that to the pilot. No message directly addressing this possibility will appear anywhere in the cockpit. The pilot has to figure out changing responses to the external environment as rapidly as possible using the data displayed. FBW flies the aircraft minute by minute, without a glance into the future.
Industry aviation blogs often discuss worse case scenarios and thereby provide further insight into where fragility exists in FBW systems. Some opinion believes the worst failure of all for A320 aircraft would be loss of hydraulic function, although this is very unlikely due to built in redundancy. No recent aircraft can be flown without hydraulics because the physical force required to move the control surfaces far exceeds the physical strength of any pilot. The odds of a complete computer system failure are estimated at 1 in 109 as there are five computers on an A320 each of which monitors the others for problems. Although one can read that a complete computer system failure has never occurred on an aircraft in flight, that is not accurate. When Direct or Manual Law has been activated or the pilot has 'reverted to manual law' or the pilot was assumed direct control over the aircraft, then a serious failure of 'systems' had occurred.
Diagramn - rudder and elevators
If the pilot sees the amber message “USE MAN PITCH TRIM” on the Primary Flight Display (PFD), then the aircraft is now subject to Direct Law. If all electrical flight control goes down, a red message “MAN PITCH TRIM ONLY” appears on the PFD. Rudder(s) are available only through cable backup and there is no other rudder control. Elevator pitch can be somewhat controlled with pitch trim wheel and cable backup. A rough landing with some aircraft damage should be possible.
Diagram - tailplane and elevators
Mechanical backup on earlier Airbus families is the Trimmable (T), Horizontal (H) Stabilizer (S), not the elevator. The THS is the entire tailplane. The elevator is the control surface at the rear of the THS. The left elevator is moved by blue and green hydraulic systems. Right elevator is moved by yellow and blue hydraulic systems. There is no mechanical control. The THS has three electric motors, mechanical control and green hydraulic systems. There are three cable systems on the A319/A320/A321 family: stabilizer trim, rudder and emergency landing gear (free fall) extension. Everything else is electrically controlled and hydraulically actuated.
In crises where the autopilot has malfunctioned, flying law has degraded and the pilot has access to some control independently of the autopilot, it is important to have as clear a picture as possible as to exactly what control access is possible. There were several minutes at the onset of the crisis with Air France Flight 446 when it is possible that the pilots were rapidly attempting several control maneuvers independently of the malfunctioning autopilot.
There are three cable systems on the A319/A320/A321 family: Stabilizer trim, rudder and emergency landing gear (free fall) extension.
Photo - McDonell Douglas F/A-18
Airbus has implemented C* Flight Control Law (C-Star) on A320/330/340 and A380 family of aircraft. C* utilizes G command at higher speeds (> 200 knots) and pitch rate commands at lower speed. Immediate implementation can be more easily seen with military aircraft. The McDonell Douglas F/A-18 accesses both speed and flight FCS systems during different flight phases. When landing gear is retracted, the F/A-18 utilizes a flight control system much like Airbus. With landing gear extended, the F/A-18 uses a more conventional speed referenced FCS and has excellent and accurate speed control to effect a precision carrier landing. With landing gear retracted, the F/A-18 has accurate control of flight path and can best employ guns, missiles and bombs.
Boeing 777 FBW –
Currently, the only Boeing aircraft now flying with FBW technology is the 777 which entered commercial service in June, 1995 with United Airlines. The maiden flight of the Boeing 787 – Dreamliner – is at least one year away. The Boeing 777 is the world’s largest twin engine jet liner in the world and has the largest diameter turbo-fan engines of any aircraft. Unit cost for the most expensive variant is ~$USD 260 million. Configuration options reveal that maximum passenger capacity is 368, and longest range is 9380 miles. Airbus A330-300 and the A340 are the direct competitors for the Boeing 777.
A pilot who flies the Boeing 777 confronts what looks like a traditional mechanically controlled Primary Flight Control System as seen on earlier design commercial airliners. There is a conventional control column, wheel and rudder pedals whose controls are like those on other Boeing airliners. Flight deck controls are very similar to those on the Boeing 747-400. Look ‘under the hood’ and the story changes dramatically because cockpit design overlays a digital computer system. Boeing’s decision to design a cockpit and instrument panels that retained a ‘human’ and familiar look was smart. Familiarity makes the transition to a new operational environment easier and the performance within that environment will be maximized.
Boeing chose to use a Flight Control System for the 777 that was based on airspeed and resembled that of the F/A-18 with landing gear down. This design implements good speed control but poor to average flight path control. Airbus FBW autotrim adds a ‘bias’ to the FCS so that the tactile feel on the stick mimics that of conventional aircraft.
Boeing has published "Boeing B-777: Fly-By-Wire Flight Controls" by Gregg Bartley which provides a detailed look into the Boeing FBW system and the degree to which ‘Authority’ is implemented, how Flight Envelope Protection is defined and dealt with and the complex options and protocols that Boeing pilots must understand. I’ll paraphrase important sections of this document. We should be a bit awed at the complexity of the technical protocols that pilots must learn and then be able to creatively apply in difficult situations.
The Boeing 777 flight deck has standard flight deck controls, there is nothing unusual as the pilot looks around the cockpit. He will see a control column, wheel and rudder pedals that are mechanically linked between the Captain and First Officer controls. Unlike earlier ‘conventional’ flying systems, these pilot controls are attached to electrical transducers that convert mechanical displacement (ie control movement upon pilot action) to electrical signals. Gradient control actuators give the pilot a tactile feel on the control column, it ‘feels’ as if this were the earlier mechanical–hydraulic flying system. The force the pilot experiences on the control column increases with air speed.
Let’s begin with bank angle protection. If the pilot attempts to roll his aircraft beyond the predefined bank angle, he will ‘feel’ a significant increase in wheel force. That change is intended to make the pilot think again about rolling the plane past what Boeing FBW has defined as a ‘safe’ bank angle. If the pilot chooses to roll the plane past what FBW advises, he can do so by exerting extra force on the wheel that is more than that provided by the backdrive actuator. Backdrive actuators ‘backdrive’ the flight deck controls and there are instruments that provide visual feedback.
System Electronics –
There are both analog and digital computers in the 777 Primary Flight Control System (PFCS), four analog Actuator Control Electronics (ACE) and three digital Primary Flight Computers (PFC). The PFC calculates the control laws by converting the pilot control position into actuation commands that are transmitted to the ACE. More precisely, these Control Laws which are analogous to Airbus Aviation Laws, are programmed into this system when it is built. What is calculated is the information needed minute by minute by the autopilot to fly the specific aircraft within its unique, ever changing flight envelope. The PFC is also responsible for system monitoring, crew annunciation and PFCS on board maintenance.
The four identical ACEs correspond to the left, center and right hydraulic systems with the flight control functions distributed among the four ACEs. The ACEs convert the signals sent from transducers on the flight deck controls and primary surface actuation into digital form and send those values to the three Primary Flight Computers. The PFC calculates the required surface commands. At the same time, commands from automatic functions such as yaw damper rudder, are summed with the flight deck control commands. These digital commands are sent back to the ACEs which perform the final step – conversion of these commands into analog signals appropriate to each actuator.
Electrical Power -
The three Flight Control Direct Current power systems (FCDCs), each is dedicated to the PFCS. Two dedicated Permanent Magnet Generators (PMG) on each engine generate AC power for the FCDCs. Each Power Supply Assembly of each FCDC converts the alternating current from the PMG into 28 volt DC for the electronics in the PFCS.
Spoiler panels 4 and 11 are used as speedbrakes, both in flight and on the ground. The commands for speedbrake function are electrical and there are only two positions – stowed and fully extended.
Fly-by-Wire Actuation -
The control surfaces on the wing and tail of the 77 that are still hydraulically powered are activated by electrically signaled actuators. There are three actuators for the rudder; two for each surface on the elevators, ailerons and flaperons; and one for each spoiler panel. The two hydraulic motors that position the horizontal stabilizer do so by driving the stabilizer jack screw. Evaluate sensor data from flight control surfaces, check against flight protection model and then possibly adjust some of the control surfaces is the never ending procedure by which Fly By Wire flies an aircraft.
Mechanical Control -
Spoiler panels 4 and 11, and the alternate stabilizer pitch trim system, are controlled mechanically. Spoilers 4 and 11 are driven from control wheel deflections via a control cable. The Alternate horizontal stabilizer control is adjusted using the pitch trim levers on the flight deck aisle stand. Electrical switches actuated by alternate trim levers tell the Primary Flight Computers when alternate trim is commanded. This allows the PFCs to adjust commands that will affect pitch control.
Redundancy and Fault Tolerance –
Trusting computers to fly a plane is not intuitively comfortable, indeed likely creates immediate feelings of discomfort. What if the computer fails? If the pilot ‘fails’, in most crew configurations, the co-pilot or first officer can take over. When the bottom line is computers, redundancy is mission critical and obvious. Each of the three PFCs in the 777 PFCS has three identical computing ‘lanes’. Any of the three PFCs can fail and have all three computing lanes go down as well, but PFCS does not lose any functionality. All four ACEs will continue to receive their necessary surface position commands from the remaining PFCs. Furthermore, any single computing lane with a PFC can fail and that PFC will continue to operate with no degredation in functionality. The Minimum Equipment List for a 777 certifies the aircraft for takeoff on a revenue flight for 10 days with only 2 of 9 computing lanes functioning properly (but they must be within different PFC channels). A 777 can be certified for a one day flight with one complete PFC channel operative. As the tragedy of Air France Flight 447 has revealed, more danger is posed to the aircraft by faulty data input from control surface sensor electronics, than failures in the PFCS.
Fault tolerance is likewise robust. Flight control functions are distributed among the four ACEs in a design that ensures that total failure of a single ACE will leave the major functionality of the system intact. Although such a failure would render inoperative single actuators on several primary control surfaces and several spoiler symmetrical panel pairs would be lost, the pilot would notice little if any change in the aircraft handling characteristics. A total ACE failure would impact the PFCS as would a hydraulic system failure.
A second class of fault tolerance, which is a priority interest in the aviation industry at this time, causes erroneous operation of a specific component of the system. The usual design solution is to have multiple elements performing the same function, followed by a procedure to compare and contrast these outputs. In aircraft design, this approach is a ‘voting plane’. In the 777 PFCS, all important interfaces use multiple inputs which are compared by a voting plane. For interfaces that must remain operational after a first failure, there are at least three inputs.
For example, there are three individual Low Range Radio Altimeter (LRRA) data inputs to the PFCs. The three inputs are compared and a mid value is calculated which becomes LRAA input into all calculations that require radio altitude datum. An erroneous input from a LRRA can be detected and then discarded. The divergence between the three LRRAA data inputs cannot exceed set values in order to be accepted by the PFC for use in its calculations. If a LRRA data input does exceed the required numerical distance from the other two LRRA datums, it will be labeled an outlier value and not be used by the PFCs to compute radio altitude datums for use elsewhere. If a subsequent problem causes the remaining two LRRA datums to disagree by more than the model standard allows, the PFCs will throw out both values and take other actions to create radio altitude figures.
Furthermore, there is a self referencing voting plane system used by the PFCs that can be activated. There is a single master, computing lane within a PFC channel which is responsible for transmitting all data onto data busses for use by the ACES and other aircraft systems. All three computing lanes simultaneously compute the same control laws, and the output of all three computing lanes within a single PFC channel are compared against each other. This procedure makes for rapid detection of a ‘failed’ computer lane. Likewise, output from all three PFC channels is compared, each command output for an actuator is compared with that computed by the other two computer lanes. Each PFC channel does a mid-value select procedure on the three commands calculated for each actuator, and that is the value sent to the ACEs. Redundancy is excellent
Airbus and FBW with Full Authority -
There are important differences in Fly-By-Wire (FBW) as implemented by Boeing when contrasted with Airbus FBW. Boeing’s system has often been labeled ‘soft’ while that used by Airbus is considered ‘hard’. The debate over possible deficits and problems with the Airbus implementation is still ongoing, often vociferous as a quick visit to any aviation blog will confirm. Airbus implementation of FBW still has problems. It is still designed to only relinquish some controls during a crisis. The data stream from air speed indicators (Pitot tubes) is the essential raw data required by the aircraft ‘system’ to compute the instructions that fly the aircraft.
The primary mission of an aircraft determines the design and priorities built into the ‘system’, the five computers and autopilot. For example, transport (freighter) aircraft must fly long distances with level flight at ~1G and their design has low drag parameters and high weight. The multiplier factor is 1.5X. Designed safety margins are 2.5G during regular operations with survivability at 3.75G (ie 1.5X 2.5G) for 3 seconds for only one incident during the aircraft’s lifetime. Immediately after takeoff, freighter aircraft can accelerate rapidly with low nose attitude (ie nose down angle < 10º) but their design loses airspeed rapidly when nose attitude >30º. Not designed for even the mildest aerobatics, transport aircraft will rapidly approach stall condition and the speed at which structural integrity is challenged if maneuvered aggressively in pitch. The Airbus implementation of FBW with Full Authority allows for the 'least' complicated approach to achieve and maintain performance goals across the flight envelope. Boeing and other approaches that do not incorporate Full Authority allow the pilot to set any G loading parameter.
Roll rate also illustrates the limits set by FBW Full Authority. On an Airbus, the pilot cannot roll the aircraft because when the bank limit has been achieved, the roll is set to zero, the 2.5G multiplier for safety is operational. On a Boeing 777, the pilot could decide to the roll and exceed the 2.5G safety parameter.
On Airbus aircraft older than A300 and A310, the computer system prevents the pilot from climbing at an angle > than where stall and loss of lift are immediately present. There are protections (built in hard limits) that set the bank or roll at 67º, nose-down pitch to 15º and no pilot decisions can be made affecting side to side turning or ascent-descent where the G forces generated might exceed 2.5XG – the force of gravity experienced on the earth’s surface. The first aircraft with implementation of a complete FBW was the A320 which entered service in 1988.
In March 2000, several journalists visited the Airbus flight training simulator facility in Miami, Florida for a demonstration and further education about the Airbus FBW system, see Source # Descending through 3,000’ for a final landing approach, an Airbus 320 jetliner pilot noticed a smaller regional jet liner bearing down on his aircraft. A collision was imminent and the pilot immediately yanked back on the control stick. One of the flight control computers took immediate command of the A320. The Airbus climbed sharply and executed a turn away from the regional jet and there was no collision.
In more detail, the journalists learned that when the pilot yanked back on the control stick, one of the A320 computers applied full thrust to the plane’s engines. At the same time, the computer retracted the speed brakes on the wings that had been lowered for the landing. Wing flaps were not lowered, however, because they provide additional lift during the steep ascent. The computer also limited the climbing angle to 30º. A stall during these maneuvers could result in the pilot losing all control of the aircraft and it would plummet to earth in a terrible crash. Airbus FBW with Full Authority had performed as designed and saved the aircraft and many lives in this simulation. Nonetheless, the debate about Full vrs 'Soft’ Authority FBW systems continues, and it unavoidably pits Airbus against Boeing in the ultimate commercial aviation industry ‘smackdown’. The demonstration that Airbus provided for these journalists took place more than nine years ago, computer technology and changes to FBW software continue. A number of Airbus accidents where FBW had an important role to play continue to keep the debate alive, and development continues on systems that can best maximize safety and save lives. Many older pilots want immediate, almost complete control of their aircraft during an emergency, the hard wired limits set into FBW remove several options from direct pilot action.
Some FBW limits upon the flight envelope can likely be exceeded for short periods without seriously compromising aircraft and passenger safety. For example, as stall speed is approached and G forces rise, the control column gets harder and harder to pull back which is an important cue for the pilot. If a pilot could briefly exceed the G force multiplier which is a flight envelope protection set by the aircraft’s FBW computer system when aircraft speed is low, then having to recover aircraft control at high speed, which is more difficult, is avoided.
BUSS -
A recent example of FBW software/instrument evolution, is the announcement by Airbus of the Back Up Speed Scale (BUSS) in June, 2009. The intent is to reduce steps and time to effective actions that ensure maximum safety if the pilot and crew are confronted with unreliable speed (instrument display. The immediate demand in such a situation is to confirm the legitimacy of the data display, then adjust aircraft speed. BUSS replaces pitch and thrust tables. It is optional on A320/A330/A340 but always installed as part of the ADR monitoring equipment on the A380.
BUSS relies upon Angle of Attack sensor data and is therefore not affected by erroneous pressure measurements. This new protocol also allows for ADRs Off without loosing Stall Warning Protection. When the ADRs OFF is selected by the pilot or designated crew member, the Back Up Speed Scale replaces the Primary Flight Display on both PFDs; GPS Altitude replaces the Altitude Scale on both PFDs. Backup Speed Scale is then enabled to fly the aircraft at safe speed. ‘Safe Speed’ is above stall speed and below maximum structural speeds and is controlled with thrust and pitch adjustments.
When all ADRs are switched OFF, the BUSS will be displayed. This new protocol should be very valuable particularly in time crunched, crisis situations whose complexity carries the potential to overwhelm the pilot and crew with both accurate and faulty instrument data display. When the crew cannot identify suspected faulty ADRs, or when all ADRs appear to be affected by the problem situation, all ADRs can be switched OFF. The aircraft can then be flown using the green area of the BUSS. Because the BUSS is associated with some ADR monitoring functions, some unreliable speed situations can be automatically detected and some ECAM procedures will lead to a request to activate the BUSS.
In 1985, a Boeing 747 flying a China Air flight tumbled out of control when over the Pacific Ocean. Flight 006 was a late night, direct flight from Taipei to Los Angeles. When over the Pacific Ocean, the 747 lost power to one engine. The pilots, later determined to be very exhausted, had made several poor decisions and the aircraft plunged 30,000’ in 2.5 minutes. Gravitational forces briefly rose to 5G causing serious damage to the jumbo jet’s structure and injuries to some on board. Nonetheless, the crew was able to right the plane, diverted to San Francisco and landed safely. In retrospect, it seems that the brief period at 5G helped the crew to gain control of the aircraft and prevent a terrible crash in which everyone would likely have died. Using the terminology that accompanies FBW, the plane was briefly outside what would now be described as the appropriate, safe and therefore to be protected by FBW – flight envelope. This incident is often quoted in the argument against implementing Hard Controls for FBW. If the pilots of Flight 006 had to struggle for many minutes to gain a large measure of manual control over their aircraft, it is likely that a worse case scenario would have quickly unfolded. Exhausted or not, this crew goes on the Aviation Heroes List.
Airbus FBW with ‘hard controls’ provides automatic trim of the plane even when it is flown by the pilot. On Boeing and other aircraft, the trim system must be operated by the pilots.
Click here for an excellent Power Point presentation about the Boeing 777’s implementation of Fly-By-Wire, and the Airplane Information Management System (AIMS). Important aspects of the Primary Flight Computer (PFC), Air Data Inertial Reference System (ADIRS), Secondary Altitude & Air Data Reference Unit (SAARU) and Global DATAC Bus are explained for a general readership with clarity and precision. The Fault Tolerant Air Data Inertial Reference System (FT-ADIRS) consists of Air Data & Inertial Reference Unit (ADIRU), Secondary Attitude & Air Data Reference Unit (SAARU) and six Air Data Modules (ADMs). This critical system has essential built in redundancy.
The Air Data Inertial Reference System (ADIRS) eliminates the need for many subsystems to perform inertial & air data redundancy management. It also provides a single high-integrity, consolidated source of inertial and air data to all systems. And theoretically, the ADIRS relieves the pilots of the responsibility to detect and isolate erroneous data from their displays. The Secondary Altitude & Air Data Reference Unit (SAARU) is a backup unit, a physically discrete repository of critical data and has a design that is very different from the Fault Tolerant Air Data Inertial Reference System (FT-ADIRU). If the ADIRU can no longer function, the SAARU performs air data sensor ‘voting’ and monitoring. The Air Data Modules (ADM) are connected to the Pitot tubes and flush static probes. The ADMs use the ARINC 629 to to communicate with the ADIRU and SAARU. Two standby ADMs used a dedicated ARINC 629 to communicate with standby displays.
The Airbus and Boeing 777 cockpits reflect the different implementations of FBW: moving vrs fixed throttle, yoke vrs stick, connected vrs independent controls etc.
Boeing 787 Dreamliner / Back Up Power and Emergencies –
The next generation Boeing 787 will have three hydraulic systems but a very limited pneumatic system to pressurize the hydraulic reservoir; and another for engine cowl ice protection. Boeing’s cutting edge ‘no bleed’ technology makes all of the high pressure air available for engine thrust, thereby increasing engine and fuel efficiency. Devices formally run by high pressure air ‘bled’ from the engines, will now be powered by electricity. Bleed air will only be used for protecting the engine cowls from ice and pressurization of hydraulic reservoirs. Electricity will now be responsible for wing deicing, engine starting and the cabin environmental control system and will be generated by the engines and APU generators. Electricity drives compressors that provide cabin pressurization. Much of the physical structure of the pneumatic system is eliminated, and overall fuel savings will be at least 1%.
As in past designs, there are three independent systems, left, right and center that together manage the Primary Flight Actuators (PFA): landing gear actuation, nose gear steering, thrust reversal and leading/trailing edge flaps. Most of the power for the left and right systems are engine driven pumps mounted on the gearbox. For ground operations and when power demand is highest, there is also an electric motor driven hydraulic pump in action. Using ‘bled’ high pressure air, previous Boeing jet liners had two large, air-turbine driven hydraulic pumps to power the center system. They required 50 gpm at 3,000 psi to meet the demands for landing gear actuation, high lift actuation and Primary Flight Control during takeoff and landing. Once aloft, two small – ~6 gpm electric driven hydraulic pumps powered the center system.
The major difference in no bleed systems is the power source for the center system. The familiar two large air-turbine driven hydraulic pumps are replaced by two large (~30gpm at 5,000 psi) electric, motor driven hydraulic pumps. One of these pumps runs throughout the entire flight, the other only during takeoff and landing. Higher pressure translates into smaller components, less weight and less space required.
The hybrid voltage of the 787 draws upon four different voltage systems as the expanded power output is 2X that in previous Boeing aircraft. There are six generators, two for each engine and two per APU that operate at 235 VAC. Generators are directly connected to engine gearboxes and operate a variable frequency 36 to 800 hertz that is proportional to engine speed. By comparison, constant speed electric drives are complicated. The APU operates at variable speed for improved performance.
One down side of ‘no bleed’ technology is the consequences of engine failure while in flight. To the extent that many more systems are electrical, as opposed to pneumatic, the challenge to restore minimal electric power after an ‘engine flame out’ emergency is greater.
The 787 has heating blankets bonded to the interior of slat leading edges. These can be simultaneously, or sequentially, energized for anti-icing protection. Power usage for ice protection may be cut by 50%.
Is Fly-By-Wire Failure, Redundancy and Fault Tolerance
In Digital Fly-By-Wire, a computer running software is the only control path between pilot and controls surfaces, wings, rudder etc. A software crash without backup is not an option therefore Digital Fly By-Wire systems are triple or quadruple redundant both in the number of computers and number of wires to each control surface.
This is a bottom line question and it is nearly impossible to answer with any certainty. The primary impetus behind Fly-By-Wire may be seen as inevitable, acknowledging an historical imperative. The digital computer revolution had arrived and henceforth mechanistic systems would be based on ‘1’, ‘0’ and the tiny electronic devices that can convert the seemingly, endless permutations of binary numbers into higher order numeric, solutions to complex equations. Solutions to these differential equations place many more options on the table for real word situations and questions. For aeronautics, we hope the end result is greater safety. Next generation aircraft design - the primary manifestation - forever generates increased complexity. Quickly compare the Boeing 787, Airbus A350 and A380 with any jetliner of choice designed 20 years ago. This growth in complexity mandates an unavoidable increase in data stream generated by the sensory system of the aircraft. Complexity of computer solutions rises in tandem. More options are now available to human pilots during difficult situations and some of us wonder if the challenge to human perception, processing capability and decision making ability will soon reach a limit, the genetic designed limit of the human brain. I sometime wonder what someone who is not in the aviation industry nor any technical profession, might think when looking at photographs of the instrumentation in the cockpit of a Boeing 777 or Airbus 380. We all pray that this new more complex, ‘state of affairs’ is a ‘good thing’ and superior to the ancestors.
There are only a few basic design models for aircraft: dynamically stable, neutral stability, and relaxed stability. Center of Gravity (CG) parameters are dependent upon design model and flying regime. FBW is not required for dynamic stability and as a rule of thumb, mechanical systems require a system that is dynamically stable. Dynamic stability produces a nose down stall condition which means the aircraft can accelerate to produce lift and resume flying. In small, light aircraft, mechanical systems suffice. The wing in dynamically stable aircraft must negate a downward lift vector.
Dynamically unstable designs (condition of relaxed stability) produce a stall in which the aircraft nose oscillates about all three geometric axes and recovery is complicated and not intuitive. The USA F-16 and F-22 are dynamically unstable and therefore have to be flown by computer. These fighters are highly maneuverable and they must incorporate an integrated FBW design. A jet fighter must have unexpected and unwanted increases in angle of attack or slide slip immediately recognized, and rapidly adjusted to, while they are still small. Identified quickly, these problems can be corrected by small scale deflections of the control surfaces. Human pilots cannot anticipate the required control inputs rapidly enough to be effective. Air Force pilots flying the F-16 and F-22 represent a true fusion of human and machine. When in flight the aircraft with human pilot is a hybrid entity meeting the science fiction definition of a cyborg, complete with futuristic sculptural aesthetics. Neutral stability designs are also highly maneuverable and require FBW.
Dynamically unstable (relaxed stability) aircraft allow for a vertical lift vector where the horizontal lift contributes to the overall lift vector. This situation lessens the load on the wings and increases maneuverability. The Center of Gravity has to be positioned where it will not couple with the horizontal stabilizer to produce a ‘situation’ wherein the aircraft will flip over. If the Center of Gravity is as close as possible to the lift vector, couples are minimized as are control forces, and the efficiency of maneuverability is enhanced and likely maximized.
Engine asymmetry is the ‘drive’ behind vertical and horizontal tail sizing, the movement of Center of Gravity within an aircraft and how that affects horizontal tail sizing. Center of Gravity often ‘travels’ – changes location - within an aircraft during flight. Passengers and freight come and go during a flight with multiple destinations. Loss of weight due to fuel burn is significant and a major factor influencing changes in aircraft CG. Flying scenarios in which there is important shifting of CG require the pilot to have a great deal of pitch trim authority. If extreme CG is close to the center of pressure, a large tail surface is required for stability and preventing the aircraft from acquiring difficult pitch oscillation. A plane with a large tail is heavy and has a large surface area and large skin friction as well. Large trim authority translates to a large downward force on the stabilizer and a negative design spiral may begin to build. Large trim authority implies a larger wing than otherwise, and with that requirement comes more weight, more skin friction and more induced drag.
Breaking out of this design spiral is achieved using the computer systems of FBW. The fuel system can be localized and moved congruent with keeping the Center of Gravity within a tight range. When moving fuel, the plane can be trimmed without using downward force. In the A330/A340A family, fuel is transferred between the main tanks in the wing and fuselage, and a fuel tank in the horizontal stabilizer. This procedure optimizes the aircraft’s CG during flight and keeps the aircraft’s Center of Gravity trimmed with fuel weight.
The alternative would be to install drag inducing aerodynamic trims in the elevators. The aircraft would soon confront an unstable flying regime that would oscillate badly if control surfaces were pegged. FBW elevators can be used to make the aircraft stable, instead of always striving to achieve a large horizontal flying surface. High speed computer processing, adjusts and controls elevators on a very fine grained time scale to maintain altitude. No commercial aircraft has ever been designed with known instability. The F-16 is famous for many reasons, one of which is the inherent instability of the design and how FBW works with, and overcomes, that instability.
FBW allows aircraft design to break free from the horizontal, tail sizing spiral. It also allows for Center of Gravity to be moved and repositioned to an optimal location as the flight proceeds, as opposed to having the CG ‘travel’ in an ‘uncontrolled’ fashion as fuel is burned. Optimal CG position is when down force is lowest on the stabilizer, and therefore throughout the flight. Less down force also mandates less required lift. As a result, there is less induced drag and lower fuel burn.
With current advanced aircraft, considerable situational complexity is always present. It is possible to be in dynamically stable mode about the longitudinal (pitch) axis, in neutral mode in the lateral (roll) axis, and also be unstable about the directional axis (yaw). A human pilot could not fly an aircraft when all three instability modes are simultaneously present. The only possible operational flying modality is to have the computer decide upon control inputs after receiving pilot inputs. External environmental data is also essential, above all the air speed fed to the computer system by the Pitot tubes. Imagine trying to calculate (solve complex differential equations), then to immediately advise control surfaces about the flying regime best adapted to protect the aircraft flight envelope, without having accurate air speed data. Yet this is the situation that almost instantly afflicted Air France, Flight 447 about 2AM on June 1, 2009 when encountering a radar invisible, storm system of extreme turbulence and dangerous frozen water droplet/?rime > graupel ice precipitation.
Only a partial answer to the question “Is Fly-By-Wire safer than earlier generation Hydraulic Systems?” can ever be given. The answer must be context dependent and must be stated with reference to the flying regime in force. To illustrate the extremes of answers that are possible, consider a C152 transport that is dynamically stable about all three axes, and is not only the least complex situation to consider in theory, but in flying practice also. The simple control cable system in place more than suffices for the environments and flight challenges that the C152 will encounter and must perform well within. Contrast with the F-22 Raptor jet fighter where the pilot alone could never get the aircraft off the ground. FBW is required for take off and almost everything else to do with flying regime. The question now becomes, has been edited and more appropriately phrased to: “How safe is the hydraulic system the aircraft must use?” or “How safe is the approach to Fly-By-Wire implemented by the manufacturer in this aircraft?”
Given the very different missions, tasks and challenges to be encountered by aircraft that remain under primary hydraulic control vrs those with a FBW implementation, comparative assessment and ranking now seem irrelevant. If a C152, which does not fly into a battlefield environment and have to perform dangerous combat missions, repeatedly executes its transport missions safely and effectively, then the C152’s hydraulic control system gets high marks. If a combat ready and battle tested F-22 jet fighter has a long, successful record of completed missions, then the F-22 implementation of FBW is well designed and has performed with excellence within the flying regime and design of the F-22. Comparisons between hydraulic controls and FBW now seem out of joint, historically disengaged, and not appropriate because the question and answer forever reside in two distinct and separated contexts. In terms of probability theory, the C152 and F-22 reside in their individual, discrete and separated geometric spaces – circles in the Venn Diagram. There is nothing of significance that is identical in the hydraulic system of the transport and also in the FBW of the fighter. The circles in the Venn Diagram, one each for the transport and fighter respectively, remain forever separated.
Bring Forth the RAT -
If the engines are running, the aircraft has hydraulic pressure via the engine driven hydraulic pump. On the Boeing 777, there is a backup generator for essential FBW. New airplanes have an airborn Auxiliary Power Unit that provides electric power.
At the End of the Day, when both engines fail and everyone believes they are looking at Death, the R)am (A)ir (T)urbine deploys. Do not confuse the RAT with a Ramjet which is next generation, hypersonic aircraft engine. It automatically deploys into the airstream when air speed is above 80 knots and both engines fail. The RAT is a small Ram Air Turbine hydraulic pump and is usually located in the body fairing aft of the right main gear. It generates power from the airstream and provides minimal electric power when all else fails. When deployed, the RAT propeller powers an hydraulic pump that pressurizes the center hydraulic channel and the essential electrical bus. It cannot be retracted until the aircraft is on the ground. Most modern and next generation commercial aircraft have a RAT, as do the majority of military aircraft.
In flight at low speed, the RAT can supply power to the center (computer) system, remember that slipstream velocity is the key to RAT output. At speeds above 130 knots, the RAT usually provides enough power for ‘normal’ center system operation. There is a RAT Pressure Light in the cockpit to indicate that the RAT is also providing hydraulic power. There often a manual control for extending the RAT, provided by the guarded ? RAT Switch. A large RAT on a commercial airliner could produce 5 to 70 KW. Smaller low, airspeed models might only generate 400 watts. The center hydraulic system includes the center autopilot servos, spoilers, elevators, rudder, yaw dampers, stab trim and elevator feel. The RAT controls: Roll, Pitch and Yaw, Lateral Central Control Actuators (LCCA), L&R Elevators, Rudder, Elevators Feel, Stab trim, and Yaw damper. The RAT does not, however, manage the landing gear.
Airbus A300, A310, A320, A330, A340 and A380 have RATs. On an Airbus A320, the RAT powers the ‘blue’ hydraulic system which control a core, important set of control surfaces and a separate small hydraulic generator which can provide 5 KVA. The Airbus A380 has the largest RAT in the world with a propeller 1.63m in diameter, most RAT propeller’s are about 80 cm in diameter RATs can be activated by pilot command, or designed to be active when emergency parameters meet certain thresholds.
Rats are more common on military than civilian aircraft, although most large commercial airliners are now fitted with them. Not all large aircraft have a RAT, they are more likely on planes with fewer engines and longer range. On some Boeing planes – 757, 767 and 777 planes – have RATS as a source of backup hydraulic power. Commercial aircraft have two or four bladed propellers, but military RATs are often pod fitted systems with ducted multi-blade fans. Press releases confirm that the Boeing 787 Dreamliner will have a RAT built by Hamilton Sundstrand. The RAT’s propeller sits in the air stream and it generates enough power in the 787 to run the hydraulic pump that pressurizes the center hydraulic channel and a small generator. The latter, Ladies and Gentlemen, will power the essential electrical bus of the 787.
The bottom line in several worse case flight scenarios is the RAT. When all engines fail, the aircraft is forced to rely upon its aerodynamic gliding capability (excellent for modern jet liners), pilot courage and skill and the RAT. Thanks to the power generating capacities of the RAT, when engines fail all is not necessarily lost. What at first glance looked like a one way trip to disintegration, may be ‘only’ a very scary, long glide to a survivable rough landing. Love your jetliner’s RAT, love that dear rodent forever!
Situational Awareness -
This section on Situational Awareness owes a great deal to the Professional Pilots Rumor Network blog, particularly p.208 and p.209 of the extended online discussion about the Air France Flight 447 tragedy. With thanks to Harry Mann, PJ2, rgbrock1 Phantom Driver, and other contributors on these pages.
To start with the obvious, computer systems do not get tired, particularly if basic drive maintenance is attended to on a regular schedule. Computers do not get vertigo; eat, drink or go the john; develop anxiety attacks or fear, must call the kids, wife or girl friend etc. Flesh and Blood Human frailties are absent but there is a significant trade off. The computers behind Fly-By-Wire cannot think, they are not at that very advanced level where programmers and neurologists experiment digital chip evolution towards 'intelligence'. System cannot think and has No Situational Awareness where the entity not only knows where it is, but remembers where it was and can tell the difference. Storing the last 15 seconds of probe data so as to be able to discard ‘noise’ of intermittent fluctuations is not thinking or ‘awareness’. In other words, a sudden altitude drop when landing from 500’ to 80’ should be dealt with as unsustainable. Unfortunately, the engines will be instantly cut and we take it from there ‘on a wing and a prayer’ when the time interval to hand manual control to the pilot is ludicrously short.
Repeatedly on Pprune.org experienced pilots advise doing nothing when first stall warnings appear on the cockpit instruments. Yes, sit up wide awake and start thinking but do not take immediate aggressive action. Why ? Some of these warnings will be ‘false’, and in many other situations the situation is not grave enough to justify a fast procedure that reduces flight envelope protection and rapidly provides more direct pilot control. In yet other instances, there is simply not enough time for the most experienced and creative pilots to process all relevant data then reach a best situational decision. This statement is Not a criticism of pilot training and performance anywhere, it is only a reflection of many observations made by experienced pilots. A few more minutes down the ‘stop, look and think trail’, and what can be ignored, and what must be dealt with is much more apparent and perhaps within the realm of human potential and good action, including those most creative decisions we label ‘out of the box’.
Repeatedly on Pprune.org experienced pilots advise doing nothing when first stall warnings appear on the cockpit instruments. Yes, sit up wide awake and start thinking but do not take immediate aggressive action. Why ? Some of these warnings will be ‘false’, and in many other situations the situation is not grave enough to justify an immediate reduction of flight envelope protection that rapidly provides more direct pilot control. In many situations, there is simply not enough time for the most experienced and creative pilots to process all relevant data then reach a best situational decision. This statement is Not a criticism of pilot training and performance, it is only a reflection of many observations made by experienced pilots. A few more minutes down the ‘stop, look and think trail’, and what can be ignored, and what must be dealt with is much more apparent. Now the situation may be within the realm of human potential and good action, including those most creative decisions we label ‘out of the box’.
Severe critics of the basics of computer ‘system’ flying an airplane, be that Full or Partial Authority, often have a cynical view of the aircraft industry. The FBW era coincides with the development and use of plastic-resin components (‘composites). Aircraft weight is noticeably reduced and there are important fuel savings. Crew size, and therefore crew costs, can also be reduced. The Boeing 767 introduced the two pilot crew. Safety issues that come with increased use of composite aircraft components are under serious scrutiny for next generation aircraft: Airbus 350,
Boeing 787 Dreamliner and F-35.
Nonetheless, ‘managing the airplane’ works. Automation and FBW is very good most of the time and increased flight safety is impressive – most of the time. However, introduction of the Airbus 320 which had the first complete implementation of FBW with Full Authority, created an immediate pilot anxiety and intense discussion. Experienced pilots pointed out the loss of a third set of eyes, the absence of situational awareness and the presence of ‘mode confusion’. A pilot with excellent situational awareness who cannot quickly access that capability quickly during a potential crisis has been immobilized from immediately using his highest level expertise. Aircraft and passenger safety are thereby compromised. Granted the situations that would benefit are rare, but they are often near crisis when lives are at risk. The implication of a cynical cost savings tradeoff is lurking in this situation because the airline industry was financially stressed at the time that FBW was first developed for the A320, and there was a mild economic recession. Always suspected and impossible to prove, an intense priority for the most cost efficient approach to aircraft flight carries serious consequences. De-regulation of airlines in the USA added additional impetus to look at costs savings above other considerations when designing aircraft and FBW systems.
‘Managing the airplane’ works. Automation and FBW is very good most of the time and increased flight safety is impressive – most of the time. However, introduction of the Airbus 320 which had the first complete implementation of FBW with Full Authority, created an immediate pilot anxiety and intense discussion. Experienced pilots pointed out the loss of a third set of eyes, the absence of situational awareness and the presence of ‘mode confusion’. A pilot with excellent situational awareness who cannot access that capability quickly during a potential crisis has been immobilized from immediately using his highest level expertise. Aircraft and passenger safety are thereby compromised. Granted the situations that would benefit are rare, but they are often near crisis when lives are at risk. The implication of a cynical cost savings tradeoff is lurking in this situation because the airline industry was financially stressed at the time, and there was a mild economic recession. Always suspected and impossible to prove, a priority to the most cost efficient approach to aircraft flight carries very serious consequences. De-regulation of airlines in the USA gave yet another push to cost savings first.
Experienced pilots report that during the early years of Airbus A320, instructors were barely one day ahead of their students. When something with FBW was not understood, pilots disconnected FBW and flew manually while the situation was sorted out. That choice is not possible today and many of today’s younger pilots may not possess the skill to make that transition non problematic. Training today does not install confidence in flying without FBW, without autopilot, autothrust and autoflight. Management is afraid that pilots would consider flying without the autopilot in various situations. Training for that capability is de-emphasized, pilot confidence in manual flying has gone down and the probability that pilots would access Manual Law in real flight situations that have problems is decreased. All well and good, unless the computer system and autopilot go down or are performing with dysfunction. Granted such circumstances are rare but in them we have the worst of environments. ’System’ can no longer be depended on, yet switching over to manual flight is difficult, and the pilots are uneasy and without deep training or much experience with Manual Law and direct pilot flight. There are compelling images of Death in classic Christian art work in this article for a reason. The choice of those images is not to play with fears in an immature manner but to convey yet again – and this time without words – the terrible seriousness of aircraft situations at high altitude when a malfunctioning computer system is part of the problem.
Likely impossible to reposition manual flying in a centered priority position. Computer aircraft flying has been with us for many years and is not going away. “ … when I am riding down the back, I don't want to be subjected to some wild ride while the guy up front tries to polish up his manual flying skills (not) , while the PM is working like a one-armed paper hanger doing config changes & RT/MCP/MCDU work, as well as frequency changes, at the same time as trying to monitor the Ace's not-so-hot flying on a dark night on a typical European or elsewhere RNAV SID or STAR. Don't laugh;I have seen it on quite a few occasions while sitting on the jumpseat as augmenting Captain.” Phantom Driver,Pprune ..
Yet there are numerous, well documented scenarios where an experienced pilot – and in at least two incidents an inexperienced pilot – took over the flying regime of the aircraft in crisis and saved the day. But this is not official recognition of the interpretative paradigm that explains the immediate problem within a context that Manual Law must now be present. Such incidents represent creative ‘out of the box’ (or immediate us of the ‘old box’) approaches to crisis situations. Training does not address what these accident reports reveal. Pilots are congratulated and honored, but the corporate approach to flight training, emergencies etc does not change in any appreciable manner. Anecdotal evidence suggests that in the crisis contexts discussed here, many pilots immediately rely on the Thrust Asymmetry Compensator and that is that.
Computers cannot think. The crisis situation with Air France Flight 447 included the problems posed by clogged and or iced up Pitot tubes. Before losing all function, it seems these damaged Pitot tubes sent erroneous air speed data to systems. Computers cannot think. Computers eat what is on the plate and the computers on Air France 447 processed that air speed data, then sent back erroneous output to flight control surfaces. What followed was very complex, may never be reconstructed with accuracy and all possible solutions are bad. Flight adjustments to an environment that in fact did not exist in the real world flight envelope may have occurred. Systems and autopilot may have executed an aircraft stall that was extreme, following adjustments to that stall may also have been extreme and inappropriate, and there may have been a brief rapid climb to 47,000’ a recent suggestion that is controversial. When and if the pilots understood enough of the computer malfunction to decide to override the autopilot and activate Manual Law and fly Flight 447 is very difficult to determine. As there is good evidence that a high speed deviation to the West from the approved flight path occurred for several miles, we can propose that manual control of the aircraft was obtained quickly. That is a testimony to exceptional skills of the pilot(s) considering the fundamental breakdown in data input to systems and the aberrant autopilot behavior that followed that had to be confronted within a cabin environment of fear and terror, and a passenger cabin likely dominated by hysteria and panic. Subsequently, loss of cabin pressure may have rendered crew and pilots unconscious, Out of control and falling rapidly with the tail possibly broken off, Flight 447 rapidly descended toward the ocean where it impacted in a vertical position.
A fundamental aspect of the change over to ‘managing the cockpit’ is a basic change in ‘Need to Know” – NTK. NTK is now driven by economics and therefore a cultural parameter. Priority is now longer assigned to understanding what is ’under the hood’, but to performing well with one’s assigned role within the micro-society at the work place. Prior to the introduction of the A320, pilots were able from memory to draw aircraft systems, draw complex terminal areas and know in engineering detail what made an aircraft work. Experienced pilots could draw the flying route’s weather patterns, analyze frontal systems in 3-D and accurately pinpoint positions where icing was likely. These skills are now rare, dumbing down is the norm not the deviance from the norm. The technical knowledge previously valued and presented as a most worthy goal is no longer encouraged. Knowledge is outcome driven, not needs – comprehensive – driven. The inexorable steady drive towards mediocrity and complacency has been underway for years. This is also the relentless evolution of dependency upon computer and machine. A good analogy exists in the world of small computers. How many people have any understanding of what happens when you use mouse, click a key on the keyboard or the sequence of events when booting up a personal or business PC ? Airline pilots cannot be made by having someone ride in the right seat of an A320 or B747 after 250 hours of simulator training. What else but money could force the appearance of such a situation, a cost effective model generated by MBAs without an ounce of aviation brains or experience. It would be a breath of fresh air through an open cockpit window if the aviation could recognize that the FAA in the United States takes this situation seriously which means it is serious, is important and need immediate attention.
References –
1. Aircraft flight control systems at Wikipedia
2. FBW for Airbus Industrie aircraft is now mature.
3. Boeing 777 profile at Wikipedia
4. Boeing 777 Overview / PowerPoint Presentation
5. Fly-By-Wire overview / short, well done
6. Boeing B-777: Fly-By– Wire Flight Controls in detail
7. Fabulous panoramic view of A380 cockpit
8. Boeing lets aviator override fly-by-wire technology
9. Is Fly By Wire Safer Than Hydraulic Systems? - Blog discussion at airliners.net
10. Is FBW safe? / pilots discussion at Pprune.org
11. Fly By Wire at physics forums blog
12. Ram Air Turbine - Wikipedia
| ||||||||||||||
_opt600x354_FAA_Avionicshdbk.jpg)
_opt600x363__Airbus.jpg)
>
_opt600x390_FAA_AviationHdbk_chp7.jpg)
_information_opt600x383_FAA_Avionicshdbk.jpg)
_flight_opt600x398_usaf.jpg)
_opt550x843_airpoweraustralia.jpg)
_opt588x600_Wikimedia.jpg)
_opt600x403_Airbus.jpg)
_opt600x415_Airbus.jpg)
_opt600x409_Airbus.jpg)
_opt600x417_Airbus.jpg)
