25 March 2016, ©. Leeham Co: Last week we covered the natural stability of commercial aircraft and the most important movements the aircraft would go into if we had no pilot intervention.
Now we will cover how Fly-By-Wire (FBW) systems make enhanced flight control laws practical to implement. We will cover the principal build up of a FBW system with enhanced control laws and two of the most common approaches used in the market for such control laws: the Airbus and the Boeing implementations.
The discussion will focus on the essential and forgo many deeper discussions over redundancy and safety. Otherwise the subject expands into a book rather than an easy to read article and that is not what we want.
Airbus control laws
When we described the first commercial aircraft FBW, which was for the Concord, the electrical signalling controlled the movables directly with some minor modifications of the signals by a stability augmentation system. During the development of the A320, Airbus decided to use the knowledge gained from the Concorde but go one step further.
Digital computers were introduced that were allowed to change the movable controls signals in a rather major way. Instead of the pilot’s stick deflection in pitch commanding a certain movement of the pitch movables, the pilot’s intention was interpreted by the control computers and they commanded the aircraft to react with a certain pitch rate (low speed) or pitch load factor (high speed). For bank, the computers gave the pilot a roll rate. For yaw, the computers provided yaw damping and turn coordination (kicked a bit or rudder to fly cleanly without the pilot needing to do it). The yaw channel will also compensate for thrust asymmetry including if an engine goes inoperative during take-off or flight.
The gradual change from pitch rate to load factor as speed increases is the characteristic of a control law called C* (C star). This flight law is phased in after Take-Off, on the ground and during take-off the aircraft is controlled in a normal way, i.e., stick movements control movable deflection.
The feeling of flying an Airbus FBW aircraft after lift-off is as if the aircraft was in autopilot stick control mode all the time. The aircraft keeps the attitude and roll that one sets, regardless of speed or external disturbances. For landing, the computers put on a gradual pitch down during flare to simulate an aircraft that gets nose heavier as speed reduces.
All the changes in control laws are very gradual and as a pilot, one has the feeling of a normal aircraft except that one does not have to chase the aircraft in pitch and roll; it remains where one left it. It was easy to notice those that had flown a classical aircraft recently when we did the A350 media pilot test in April 2015. These pilots corrected every gust that hit the aircraft.
Having read the Airbus training manuals for the A330/A350 and trained in A320 and A330 simulators, I let the aircraft correct the disturbances. It worked perfectly and lowered my workload. I could focus on just controlling the aircraft when I wanted an attitude change.
Protections
One consequence of a C* controlled aircraft is that the attitude remains constant regardless of speed. Even when the aircraft approaches stall speed, the flight law keeps the nose steady, i.e., with low thrust from the engines, it flies the aircraft into stall. Airbus therefore let the computers stop that; they had all the data they needed (airspeed, altitude, aircraft configuration, load factor, alfa angle….) to stop the aircraft from entering dangerous flight situations.
There is a lot written about these protections modes and how they work. I’m not going to repeat that here. I was allowed to test them all (stall, overspeed, to high bank….) during the A350 flight test and they all worked smoothly and naturally (more throttle followed by pitch down for stall, pitch up for overspeed, roll back for to high bank).
It did not feel un-natural or constrained to have these protections come in and sort out any mess that one had created. If one reach these limits, there is something really wrong and one is grateful for any help.
We will now go on to describe the Boeing philosophy, which is a bit different. I fully understand the ideas behind it and would love to fly it (I would probably like it) but for those that are prone to armchair slamming of the Airbus way of implementing flight laws, let me tell you it’s the closest to the flight laws used on all modern fighters (these are unstable FBW aircraft and you need to be hard protected the Pilots from flying them into stall).
Boeing control laws
Boeing implemented computer augmented FBW about 10 years after Airbus for the 777. Boeing decided to use a modified C* flight law for pitch that included a feel for if the aircraft was trimmed in speed or not. The law is called C*U and it does lower/raise the nose if the aircraft moves away from trimmed speed. Roll is controlled with displacement for 777 and roll rate like Airbus for 787. Kicking rudder gives movable displacement for 777 and a certain yaw angle for 787. The yaw channel also does automatic turn coordination and thrust asymmetry compensation like the Airbus system.
The result is that the aircraft feels like a normally stable aircraft to fly; lose speed and the aircraft lowers the nose to regain speed. With a more conventional reaction of the aircraft in pitch to changes from steady flight Boeing decided that they would offer protection in a softer way than Airbus. Lower the speed and the aircraft will dip the nose to gain speed and you would need to pull back on the yoke to keep pitch attitude. As you pull the yoke back to keep pitch attitude, back-drive servos will increase the pitch force and make it harder and harder to keep the nose up and fly the aircraft into stall.
The philosophy is similar for the other axis. If you are bent on rolling the aircraft to 90°, you can, but you need to be strong; the yoke will fight you. This means the aircraft can be stalled and overloaded in pitch and it can get to any desired roll angle. The Boeing protection tells you that you are way outside the normal by making it very physical to get there.
I have not flown the Boeing philosophy but I can imagine that it feels natural. Whether I would prefer one of the other I have to reserve until I have tried them both in real flight. One area that I know that I will like better on the 787 is the way the throttles work. On Boeing aircraft, a set auto-throttle will command thrust changes through the cockpit throttle levers, i.e., one can see and feel how the auto-throttle is working.
On Airbus aircraft, the throttles are set at Climb position after take-off and remain there in an autopilot/FMS controlled flight until one throttles back for landing. It takes some getting used to.
Benefits of computer controlled FBW
There are several benefits of a computer controlled FBW that are independent of the flight law philosophy chosen. With the FBW computers having access to all data from the aircraft’s avionics systems (air data computer, inertial platform, distributed accelerometers, GPS…), a number of functions can be realised to lower the loads on the airframe and thereby gain weight and passenger comfort.
The computers can limit the maximum deflection speed and angle of the movables to avoid airframe overload. They can also modify the wing’s lift distribution, making it more central for flight close to the aircraft’s MTOW and then to spread it out to the drag optimal elliptical distribution as weight decreases during flight due to fuel burn off. Once again, this limits the loads on the wing which decreases weight.
The FBW can also be implemented to give the passengers gust alleviation. Accelerometers in the aircraft’s nose signal the gust to the FBW which control spoilers, ailerons and stabilator to alleviate the gust.
Flight safety
All FBW implementations use a multitude of channels and computers to offer a high level of redundancy. Commercial airliners also offer a mechanical back-up mode that enables the crew to restart FBW computers should a severe electrical problem put these out of order.
Such backup systems are normally made of a separate horizontal tail trim system and direct control (mechanical or electrical) of the aircraft’s rudder. Through the secondary roll effect, one can thereby control bank as well as pitch until the FBW computers are back on-line.
This is really good stuff. As a non pilot I have always been a bit confused by descriptions of FBW before.
If I understand correctly, you can crash a Boeing by pulling superhumanly hard at the controls,but an Airbus won’t let you. Isn’t this exactly what would happen if you became disorientated and panic, just when you needed help the most?Has this been the cause of accidents? Do either of the systems offer any protection against unwanted ground impact?
Sorry I have gone into your writing a book mode, haven’t I?
In the famous Hudson river 320 ditching Capt. Sullenberger wrote they actually worked against him.
..
” In fact, flight control computers actually hindered the landing, said Sullenberger, who’s now a CBS News aviation and safety consultant. Flight software prevented him from keeping the plane’s nose a little higher during the last four seconds before he ditched US Airways Flight 1549 in the icy Hudson River.
“So we hit harder than we would have, had we been able to keep the nose up,” he said. “That was a little-known part of the software that no airline operators or pilots knew about.””
“When automation became possible in aviation, people thought, “We can eliminate human error by automating everything.” We’ve learned that automation does not eliminate errors. Rather, it changes the nature of the errors that are made, and it makes possible new kinds of errors. The paradox of cockpit automation is that it can lower the pilot’s workload in phases of flight when the workload is already low, and it can increase the workload when the workload is already high.”
A very complex subject with no easy answers.
I think Sully is referring to that he could not plant the aircraft in the water by stalling it into the river, the hard limitation did not allow the stall. If I don’t miss-remember he was a vivid private and sailplane flyer, with these you put them down at lowest speed by pulling back until you stall for the last feet or so. To answer this and other questions whether the hard limits have saved lives? I would certainly think so, the instances when pilots gets lost and are saved by the protections is nothing that is crowed about. We have two instances when the FBW was degraded so that protections could not mop up the pilot’s mistakes, those are widely publicized. I have read both reports and the co-pilots must have been gravely disoriented in both cases. Had the protections worked both aircraft would have flown today.
Hi Bjorn,
“We have two instances when the FBW was degraded so that protections could not mop up the pilot’s mistakes”
Would you be referring to the Air France disaster over the Atlantic?
Yes and the AirAsia one over Indonesia.
The one where the “captain was standing on his seat” and pulling all the breakers to effect a reset for a longstanding hardware problem on this frame?
Is that an FBW philosophy problem?
Sounds like a short pilot problem!
Mr. Sullenberger ist a very capable and bright guy.
But he also is a rather political guy.
Afaics his position in that respect changed over time.
Not sure if it went from one side to the other or from neutral to one side.
No idea how much the Langenwiesche book on the landing is valid or not.
What evidence do you have his position has changed?
Since we’re talking about the Hudson incident, something I have always wondered, but never read a clear answer about.In thoery and with the benefit of hindsight,would they have made it to the emergency runway had not ditched?
When you train for engines out emergency landings you train to find a realistic spot which is well within your gliding capability and then stick to that. Uncountable are the disasters when pilots did not reach a spot they set out to reach but it was too ambitious. When you then run out of energy your coming down looks like the Taipei ATR accident.
I’m not suggesting for one moment that they were wrong with the information that they had at the time.But if they had made what was almost definitely the wrong decision (in my non pilot opinion) would they have got away with it with the remaining power available?
I will weight in a bit more on what Bjorn said.
If you fly that Sculy profile and know your engines are going to quit, then yes you can make the airport.
What Sullengburg was faced with was a plane full of passengers and no hindsight.
He did exactly what we as pilots are supposed to do, get the best you are sure you can make, not what you think you might be able to makes.
As Bjorn stated, there are a lot of dead pilots and passengers from pilots who tried to turn back rather than take what was the best ahead.
Hard to do, its what separates good pilots form the run of the mill.
I believe they did the same thing with the DC10 crash out of (Chicago?) If they knew it was coming they could save it.
You never know what’s coming, you have to assess what is going on, deal with it and make a decision.
“Would they have made it to the emergency runway had they not ditched?”
In a documentary I saw on this event, they had a number of pilots in a simulaor try to reach the Teterboro airport. None could do it.
Something of interest on this subject:
http://tailspinstales.blogspot.ca/2009/01/second-guessing-scully.html
I could be wrong but I thought that they did still have some thrust, although at the time had no idea what they would end up with.
Yes they had some thrust but so degraded that it was all but useless.
Scully had his co pilot start the APU which was not according to the book, but kept full control. I believe Airbus added that to the EO procedures. It was never expect to loose both engines. Of course we know it will happen sooner or latter.
At the risk of starting a B vs Ab war,how does it work in reverse, have there been instances where the ability to go past the stops would have saved an Airbus or has saved a Boeing ? I appreciate that this must be quite hard to analyse.
Capt. Sullenberger’s comments describe extremely well why Boeing avoids hard limits.
No, its simply Boeings take.
Very few aircraft wind up in the Hudson.
While this is not a criticisms of Sullenburg , he did a brilliant job, he could have turned off the control system and hand flew it.
I understand why he did not, but the Airbus did what it was supposed to, the stall limit would not have been a surprise.
He was probably surprised because he never hit it or used it as he did not put himself there.
Prior it may have been a help keeping the aircraft stable while he did the other work.
Keep in mind Boeing has a bad auto throttle setup (NTSB) that should be corrected.
And I believe there is a ditch mode for the Airbus that was not used on the Hudson. Not sure what it does.
Not something they practice on in Simulators, one they should as you learn a lot about aircraft ops that way.
And simulators are the ONLY place you should be doing that sort of thing.
For the average airline pilot I think Airbus ahs the right idea, its what it does when you need it that bothers me.
Downside is the aircraft progamin does not auto shift the modes (or all the time) and you have to boht deal with what is in front of you and know what mode you need to be in, put it there and know what that mode does.
Not something an airline pilot od days of yore had to do, decent, pull back the throttles and you are going to start your decent, put down the gear because you know you are landing. Full throttle and gear up as you do the go around.
Hull losses are pretty close to equal, so there is no right or wrong currently, I do think there is better to be done.
“Keep in mind Boeing has a bad auto throttle setup (NTSB) that should be corrected.”
If you (they) are referring to the crash at SF it was (much like the Air France disaster) a pilot training problem more than the throttle setup.
Sure, Radio Eriwan:
Is it true that Boeing pilots have training problems?
Yes, but Airbus pilots have design problems. 🙂
Another pair is Boeing excels or has a pinch of bad luck
versus Airbus has a moment of good luck or fails on obvious reasons.
In general design quality and pilot quality cover quite some range.
Problems arise when design issues meet training issues.
On the other hand one common falacy is that building on an established interface is intuitive and “A GOOD THING ™”.
They are often not intuitive but they are known.
Keeping old interfaces requires massive layering to fit over new and changed ways of doing things.
And due to the limited old interface newer features are not or only very uncomfortably accessible.
Paradigm wrapping is on first blush nice and easy and the way to go but it will surely lead you into dark cul de sac over time.
Does the fact that Sully’s gear was up for a water landing affect the A320 FWB control law with regard to how it handles a potential stall versus handling a near stall in the course of a normal landing with gear down?
Geo:
What you do not get is that systems should work intuitively.
The type of situation that got Assiana is a known aspect and is referred to as FLCH Trap.
http://aviationweek.com/awin/were-asiana-pilots-caught-flch-trap
There should never be any confusion and auto throttle should only be off it you specifically turn it off.
That does not excuse some grossly bad piloting, but if I have it right, Airbus would not do that to you.
NTSB in its final report went on to say that Boeing should change it, Boeig refuste it.
When you have to tria pilot tthat a mode is going to possibly kill you and avoid that mode then you have a serious issue.,
If only the pilot gets killed that’s one thing, Unfortunately the way the system has function we have bad pilots and you hope the automation is setup to keep that from being lethal, not actively assist it in being so..
Note how many different modes were involved. Try to keep that all straight and what happens to what and which and when.
In this case the last safety was not playing.
“If only the pilot gets killed that’s one thing, Unfortunately the way the system has function we have bad pilots and you hope the automation is setup to keep that from being lethal, not actively assist it in being so..”
Sorry but considering in all the flight hours and years the 777 had flown without incident until those idiots flew into the runway I think that saying it actively assisted in the crash is a gross misstatement.
Different design philosophies should not be made a scapegoat or viewed as dangerous and changing the throttle setup now in mid-stream would arguably make things more dangerous to all the other 777 pilots in the world who would have to unlearn what they know.
As two pilots wrote…
“”FLCH Trap” is a known factor, which is trained for. All pilots flying Boeing planes know FLCH is not to be used for final approach”
“”It’s certainly not a trap, either you know what you’re doing (well trained).
Or you don’t know what you’re doing (poorly trained).”
You can’t idiot proof aircraft.
As said: if you think you have made something idiot proof, someone will design a better idiot.
Both Boeing and Airbus systems are fantastically safe. Accident rates are significantly down since even 20 years ago. But sooner or later a master idiot will come along who will outdo the protections. And then the only consolidation is that both Airbus and Boeing will make the system a bit bitter to be able to handle this fool (until an even bigger fool comes alone and then the cycle starts all over again).
If one thinks these systems don’t work, then please go and look at the accident statistics of the 70s and 80s when fool proof pilots had ultimate control.
Geo:
I don’t think so. I don’t always agree witih the NTSB, but when the auto throttle goes off as a secondary aspect of the mode you are in, then its an issue, when they come up with a name for it, its an issue.
Why would you have to train pilots to avoid it when it?
It does not have to go off, Boeing is refusing to believe they are wrong.
It just took one. An again, while the PF was assisted in all of it, he also came from Airbus where that did not happen.
If automation is going to help it should not be actively hostile.
NDB:
Possibly true, but I have worked with well deigned and intuitive computer systems and I have worked with garbage and I make a lot fewer mistakes with well designed.
Both A and B should clean it up and or their should be regulations on how it works the same as there is for aircraft structures, pilot duty cycles etc.
The innovation have outstepped the regulatory process and now its however you want to do it as long as you can get an approval from the FAA for it (the same organization that allowed themselves to be flummoxed and approved an awful battery setup on a 787 as well as a few faux pauxs in the past like DC10 crash issues.
Sorry Grubbie I didn’t mean for this to turn into A “Scully on the Hudson” thread! 🙂 Nor say that Boeing is better than Airbus.
I just find the whole thing fascinating with different philosophies and way of implementing them.
“If I understand correctly, you can crash a Boeing by pulling superhumanly hard at the controls,but an Airbus won’t let you.” The Airbus may not let you put the plane into a deep dive, but the Germanwings incident suggests it will let you set the autopilot to fly the plane into the ground.
Airbus’ hard limits did not prevent the Air France A330 crash either.
You miss the issue, it was no longer in hard limits (normal law), it went to alternate law because of the loss of pitot (speed)
Poorly trained pilot reaction wrong, his co- hort did not catch and the head pilot did not assess until too late.
Question to me is why not program the right response into the system when you are altitude and loose pitot?
Ie, something like 5 deg up angle, 85% throttle is the correct manual flying response.
What is truly sad is that it was a straight forward wings level stall, any private pilot should be able to assess that and correct it easily. That 3 pilots with something around 15,000 hours flying did not do (let alone put it there) is almost unfathomable (if you did not have an aircraft loss to prove it). No one would believe it if you wrote it as fiction.
I don’t miss the issue at all. Airbus’ hard limits were supposed to prevent accidents but they have not. Their normal, alternate, etc, laws and no-feedback-controls only add to cockpit complexity/confusion and increase the cost of transistion training/type ratings.
Another thing that did not help is the setup of the control sticks where one pilot doesn’t know what the other was doing.
..
“where one pilot doesn’t know what the other was doing.”
Completely irrelevant in context of that crash.
They individually didn’t know what they were doing ( actually should have been doing).
Not irrelevant at all. Six times the the two pilots had conflicting inputs when in it’s descent.
From the transcript…
“02:12:15 (Captain) Alors, là, je ne sais pas!
Well, I don’t know!
As the stall warning continues to blare, the three pilots discuss the situation with no hint of understanding the nature of their problem. No one mentions the word “stall.” As the plane is buffeted by turbulence, the captain urges Bonin to level the wings—advice that does nothing to address their main problem. The men briefly discuss, incredibly, whether they are in fact climbing or descending, before agreeing that they are indeed descending. As the plane approaches 10,000 feet, Robert tries to take back the controls, and pushes forward on the stick, but the plane is in “dual input” mode, and so the system averages his inputs with those of Bonin, who continues to pull back. The nose remains high.
02:13:40 (Robert) Remonte… remonte… remonte… remonte…
Climb… climb… climb… climb…
02:13:40 (Bonin) Mais je suis à fond à cabrer depuis tout à l’heure!
But I’ve had the stick back the whole time!
At last, Bonin tells the others the crucial fact whose import he has so grievously failed to understand himself.
02:13:42 (Captain) Non, non, non… Ne remonte pas… non, non.
No, no, no… Don’t climb… no, no.”
http://www.popularmechanics.com/flight/a3115/what-really-happened-aboard-air-france-447-6611877/
Why go to all that effort when there are simpler ways of bending the thing? TK at Amsterdam, JT at Bandung, OZ at San Francisco, …
You might look up the accident to an Airbus doing a low flypast, though that may have been an overall management problem in crew performance – IIRC they got too slow and could not gain altitude quickly. (I don’t recall whether or not engine spoolup time was a factor, historically turbofans have been slow but I gather that with FADEC they are faster.)
“Habsheim Airshow crash”.
Actually a perfect example for effecting a benign crash via FBW envelope protection.
A non FBW craft probably would have gained some height from “superhumanly pulling” 🙂 and then gone into a full stall ending in a much more energetic crash.
The low death count would have been turned over into low a survivor count.
Didn’t know that the 777 only had partial/limited FBW.
But fits in the presented picture.
One thing to note is that all FBW systems rely heavily on
external airflow speed and incidence sensors that interface with the environment.
The “common environment” appears as a strongly limiting factor in sensor redundancy. ( forex sensor icing )
Uwe,
I was wrong re the 777 FBW. I got the info from a well respected book about the 787 but it was wrong. Having read Andy’s link to the 777 FBW and got info from an expert the 777 has indeed FBW in all three channels. It is just that the roll channel uses deflection and not roll rate. That is changed for the 787 to roll rate.
For yaw all described aircraft work with deflection, yaw damping, turn coordination and thrust asymmetry compensation to remove the need for kicking rudder when one engine goes inoperative.
I have changed the text in the article accordingly.
Hei, Mr. Bjorn! I don’t speak Engles. Your articles is very good. Would it be possible to adopt all as protection laws using analog fly by wire ? Thank you.
Hi Carlos, your English is fine. Yes it would be possible but only the less sophisticated protections like stall protection by lowering the nose. Anything more sophisticated gets complicated, that is when you are better off with digital computers that does the calculations what to do.
The Concorde is interesting, sounds advanced for its day (controlling engine inlet ramps was one challenge). Mind, UK people had earlier produced triplex airliner systems IIRC, on the Trident.
And the Blackbird for its day (controlling engine inlet cones was a challenge).
All Boeing commercial jet airplanes from the 707 and on have backdriven controls, so that the pilots always are made aware how the autopilot is controlling pitch and roll. Likewise, backdriven throttles make pilots aware of autothrottle activity. Unlike Airbus FBW airplanes, this important safety feature is also incorporated into Boeing’s FBW airplanes like the 777 and 787.
” .. this important safety feature .. ”
Can you show a statistically significant difference in safety performance ?
A recent example is the Air France A330 crash. The pilots were not aware that the autothrottle had reduced thrust since the throttles stayed at the cruise thrust position. It took them quite a while to sort that out while the cockpit confusion escalated as a result of all warning messages from failing systems.
I believe the pilot put the aircraft to full throttle and pulled the nose up.
With pitots gone the aircraft had reverted to alternate control law (one step short of no control law I believe)
The A330 would not have crashed if the pilots had gone to full thrust and flown the airplane out of the situation, but they did not.
Andy:
Once again you do not get it.
The pilot flying did go to full thrust. They remained there for the full time.
He also put the nose up 20 some degrees.
It called a power on stall, we practiced those regularly times in flight training. An aircraft will stall with full power.
You unstall by lowering the nose. Power only goes on if you were throttled back and only to minimize the altitude loss.
Rockets don’t care, airplanes do, it angle of attack. Nose high and they stall, full power or not.
The correct action for a jet loosing the pitots (speed) at altitude (which I never flew simulator or not) is to go to a fixed throttle setting (85% I believe) and 5 deg nose up.
what that does is keeps you out of a stall, also does not over speed (narrow window at 35k)
Computer could be programed to do just that, it does not.
Mhh, did you read the same BEA report I did?
Transworld:
I get it very well. I have enough piloting experience including advanced aerobatics, so I know very well what a power on stall is. In addition I’ve been on flight tests of power on stalls in commercial jets. The stall occurs at rather steep nose up pitch, and once beyond the stick shaker the nose drops rather sharply and the airplane picks up speed by itself.
In the A330 accident, due to throttles not being backdriven by the autothrottle, it took a while for the pilots to realize that the engines were at low power. Further, lack of interconnect between the joysticks added to cockpit confusion. The pilots did what they could but the airplane crashed. Airbus hard limits did not prevent this crash, and probably contributed to it. An airplane without “stall protection” would have pitched nose down at stall and recovered.
Mhh, did you read the same BEA report I did?
sorry to give the broken record here.
aerobatics and all do not seem to give reading comprehension. ( I’ll take that back when you prove me wrong. 🙂
IMU the pilot pulled the plane into a rapid climb taking the speed down below stall speed _while_ the pitots were out of order. ( also below valid speed indication? can’t remember )
later detected airspeed straddled the border between invalid from too low speed to valid but stalled.
The seemingly “inverted” indication, i.e. gaining speed and activating stall indication may have contributed to further crew confusion.
The thing that could have helped might be an indication of “speed too low to be deemed interpretable”.
Andy:
At this point I am straining to remember if a small aircraft would pitch down in a power stall. All my reflexes were trained to drop the nose. Obviously AF447 did not so an jet aircraft does not, at least under thrust.
If it had they would have had multiple drop off and then return to stall. They did not, once into it, the rate of decent was 10,000 fpm and stayed that way for the 4.5 minutes to get to sea level.
You are argue that the system is wrong, but it did not fail. It acted as it was designed to do, the pilots did not. I think its a system with serious and fatal issues. Maybe the worst is it allows poor pilots to fly aircraft.
Regardless of what was going on, an instrument scan of which we are trained never to stop would have shown the nose was way up, rate of decent was 10,000 fpm. That’s a stall.
There is no maneuver in normal flying that calls for pulling full back on the stick. Lack of hands on flying has been deemed the underlying issue, lack of training in other than rote simulations that all pass as well. They were working on that.
Read the following.
At 02:11:10 UTC, the aircraft had climbed to its maximum altitude of around 38,000 feet. There, its angle of attack was 16 degrees, and the engine thrust levers were in the fully forward Takeoff/Go-around detent (TOGA), and at 02:11:15 UTC the pitch attitude was slightly over 16 degrees and falling, but the angle of attack rapidly increased toward 30 degrees. A second consequence of the reconfiguration into alternate law was that “stall protection” no longer operated. Whereas in normal law, the airplane’s flight management computers would have acted to prevent such a high angle of attack; in alternate law this did not happen. (Indeed, the switch into alternate law occurred precisely because the computers, denied reliable speed data, were no longer able to provide such protection – nor many of the other functions expected of normal law).[26] The wings lost lift and the aircraft stalled.[6]
At 02:11:40 UTC, the captain re-entered the cockpit. The angle of attack had then reached 40 degrees, and the aircraft had descended to 35,000 feet with the engines running at almost 100% N1 (the rotational speed of the front intake fan, which delivers most of a turbofan engine’s thrust). The stall warnings stopped, as all airspeed indications were now considered invalid by the aircraft’s computer due to the high angle of attack
One of the problems was they were not shown the angle of attack on the displays.
I think it really goes back to a system problem.
It involves not just automation, but pilots, regulatory authorities and airlines.
Its obvious that 3 pilots with a lot of flying time, one of which put them into the stall, then could not figure out what was going on.
That’s bad pilot training, I don’t have their background but its like they never flew a small aircraft where you learn that stuff.
Regulatory wise the simulators (were) just flying the same rote training over and over again. They all knew what was coming and had it down pat, not as an understating of the aircraft system but by knowing what the test was gong to be.
As someone noted, why would you do a normal takeoff and landing wasting simulator time? You do that every day, many times several times a day. You have someone assessing it. If you can’t do it then you should not be flying.
Throw the kitchen sink at them and find out if they can handled and UNSPECYTED emergency, not the rote ones.
No hands on flying and that is (was) discourage by the airlines.
Too many alarms and horns, if you have worked around a construction site you know that you ignore the backup horns, . First it was bells, then horns, now squeals, all get ignored.
What no one has done is apply human factors to what works and does not work. If all the alarms horns bells and whistles do not work, then get rid of them.
A hospital was going nuts responding to their alarms. They finally sat down, went thorugh the options, deleted the alarms that were of no consequesnce and only kept those that were life imporatn.
They dropped their work load 95% which meant they could deal with people who really were in crisis, not acorss the ward dealing with a non important alarm.
The equipment mfgs decided, well we need to alarm everything Sheese.
Its not science its opinion and now its institutionalized and needs to start form ground zero and any alarm needs to earn it way into the system. .
And do we train for the best pilots or the worst? Either train for the worst or get rid of them (and how many would you wind up with in the end?)
Upset training is staring to be implemented, but hands on flying is still not done.
The automation end itself is erratic, reading true response of the failed pitot system form all A330 incident, it is also inconsistent .
Stall going in and out does no good as while not right for the rest of what the aircraft is telling you, it r4einfioored that you are doing it right (when in fact you slowed it down enough for stall to go off).
The only issue was the stall and that’s all that should have been alarmed, and the stall warning (alarm) should not be the only one, it should be there regardless of forward speed.
Its a system that has been implemented by hodge lodge of views and opinions that are not backed up by a scientific look at what works, what does not and implement what works not what someone thinks works, or as bad, tradition of horns, bells whittles and alarms 99.999% of which are secondary or further out to the problem (not matter what it is)
If you read the BAE report, most of those instances of lost pitot on the A330s were handled wrong. A330 not being the only one, but as it often crosses through those zones they had 13 incident to look at.
Its not just an Airbus issue, Boeing has had its share as well.
Interesting stuff as always. Bjorn what I would like to know is the impact of FBW on the design of control surfaces, has it allowed for a more aerodynamic profile (both in basic design and in terms of movable surfaces) and smaller empennage. Has it led to more efficient trimming/ flying of the aircraft and consequently more efficient operation?
Thanks
Hi Bob, it is yes on both counts. The empennage surfaces and thereby also the movables can be made smaller, thereby reducing wetted area drag. A more perfectly trimmed aircraft and don’t forget one with adapted wing camber for 787 and A350 lowers the fuel consumption.
Hi Bjorn
Thanks for your answer, my supplementary question is what sort of order of efficiency savings are we talking about eg a320 vs b737
Thanks
On the A320 vs 737 we are talking very marginal savings, the empennage of the A320 can be made a little smaller for less wetted area drag, trim drag differences are virtually nil. It is all in the total fuel consumption difference between the aircraft which is minimal.
Hi Bjorn,
Which certification requirement benefits the A320 horizontal tail size? Is it approach trim at full flap and FWD CG limit, speed stability at AFT CG limit, mistrim dive recovery at FWD CG limit, Vmu at FWD CG limit, or something else?
Hi Andy,
you will find it in the 777 FBW text you referenced. Quote:
The aerodynamic surfaces of the 777 have been sized to afford the required airplane response during critical flight conditions. The reaction time of the control laws is much faster than that of an alert pilot. Therefore, the size of the flight control surfaces could be made smaller than those required for a conventionally controlled airplane.
This results in smaller movables with lower weight and less drag. Embraer reduced the size of their empennage as they go from electrical wires (open loop) FBW on the E1 to feeback based FBW on the E2. The change in the size of the surfaces are significant.
Hi again Bjorn,
The horizontal tail area includes the elevator. The total area is determined by static trim/stability requirements. FBW may reduce the elevator size but it will not reduce the horizontal tail size. So there are no changes in total drag. Depending on design, the benefit from a smaller elevator can be in lower hinge moments and slightly smaller hydraulic PCUs.
So you say that Embraer got it wrong, you better tell them before they do the first test flight for the 190E2.
Bjorn,
Embraer mentions reduced empennage size which could be the vertical tail only. If they used same design philosphy as the 777, vertical tail can be a little smaller to meet certification engine out requirements in that reaction time is reduced and assuming no change to the Vmc speeds.
The E-2 has so many other changes that could have affected horisontal tail size, and the only way FBW can help would be relaxed stability margins. Is that what they did?
You would have to ask Embraer why they could reduce the horizontal stabilizer size with 26%, they did. VTP stays the same except for no dorsal fin on the E2. I have been thoroughly briefed by Embraer on the changes from the E1 to the E2 as I have been doing competitive studies with their aircraft and they specifically pointed out that I had to remeasure the HTP areas as they had been significantly reduced going from E1 to E2. I asked how they could do that, they answered the change from open loop to closed loop FBW allowed them to do that. We did not go into exactly what changed but there is more than stability margins that size a HTP. Flying qualities is an important part of certification criteria today so it might have been a combination. I will certainly go deeper into the root causes next time I talk to one of their FBW experts.
Hi again, Bjorn.
26% reduction in stabilizer area can never be due to autopilot changes only. The E-2 has many other changes, a new wing, probably a different flap system, probably revised CG limits, etc. Then there is always a possibility that the horizontal tail was too big too begin with. Maybe a compromise with other family members from a manufacturing point of view. The fact is that the stabilizer/elevator combination still has to provide enough aerodynamic pitching moment to meet the various certification requirements, autopilot or no autopilot.
Adapted wing camber reduces fuel consumption, that’s for sure; a sophisticated autopilot, like on the 777 can reduce vertical tail size with automatic engine-out control. Horizontal tail size can only be reduced if allowing relaxed longitudinal stability and installing a 4-channel, never fail, stability augmentation system, everything else being equal.
McDD reduced the horizontal stabilizer area on the MD-11 for lower drag and added a stability augmentation system (SAS) to make up for loss in pitch stability, while maintaining the conventional pitch control system (no FBW). While the pitch SAS worked fine, it turned out that elevator control power with the smaller stabilizer was reduced too much which resulted in several accidents. As I said in an earlier comment, the stabilizer/elevator must produce adequate aerodynamic pitching moment for maneuvering in all flight conditions, no matter what kind of pitch control system or autopilot the airplane has.
And let’s be clear on one thing — FBW means fly-by-wire. All it is, is electronic transfer of signals between the pilot and hydraulic PCUs which move the control surfaces. On airplanes with mechanical links between pilot and PCUs, autopilot signals were always FBW. Improvements in autoflight have been due to improvements to autopilot control laws.
FBW is not new by any means, and it was not invented by Airbus. Already the Boeing 737-200ADV had an autopilot mode called CWS. It was the first application of FBW: http://www.flaps2approach.com/journal/2015/11/6/control-wheel-steering-cws-explained.html
First fly by wire seems to have happened on Tupolev’s ANT-20 in the 30ties 🙂
it all depends on what FBW means to you.
A:
Just replacing hydraulic servo lines with electrical signals,
B:
electrical mixing of command inpura and/or actuators
C:
behaviour augmentation and protections? ( Hard, Soft )
..
Uwe:
To my knowledge, so far has FBW only replaced control cables or control rods between pilots’ controls and control surface PCUs, which are still powered by multiple hydraulic systems. Control laws, etc, are part of the autopilot/autothrottle.
I understand electrically, rather than hydraulically powered PCUs may have been considered, but I’m not aware that anyone has done it on commercial transports.
You appear to not be up to date as to what is “State of the Art” for FBW things. 🙂
Adaptive translation of pilot input and feedback ( to forex show stable behaviour on an unstable frame, limit airframe loads and lastly present an “abstract plane” ) are neither part of the autopilot nor autothrottle.
Same for algorithmic mixing of inputs for distribution to all flight surfaces.
Your language still presents the “layered on” design evolution that we see(saw?) on Boeing models.
But even Boeing seems to go for a more integrated solution.
( forex presenting similar dynamic behaviour over type borders.)
Uwe:
It depends on how one defines “autopilot”. There are airplanes that have three-axis stability and and other functions all part of the “autopilot” which sends electrical signals to hydraulically powered PCUs, while inputs from the pilot are via conventional feel units and mechanical connection to same PCU. Depending on function the FBW signals from the autopilot can be in series or in parallel to pilot inputs.
There are all kinds of variants. The important thing is that FCS designers have enough understanding of aviation and piloting so that system integration is as straightforward as possible and that cockpit design is such that it provides maximum situational awareness to the flight crew. As we have seen that does not always happen. What works OK in single seat fighters is not what works OK in commercial airplanes.
Andy:
MD11 accident are a problem with the way they balanced the aircraft.
CG is further aft than other jets.
which came first, the chicken or the egg. Tail plane is fine but the CG requires both alert and special training.
Interesting that the two direct losses are freight companies.
Transworld:
The MD-11s that crashed were loaded within CG limits. That they were freighters have nothing to do with it.
Like I said now twice, the horizontal tail/elevator must be capable of providing adequate pitching moment (Cms and Cmde) at certified CG limits, certified weights, pitching moments of inertia (Iyy), flap settings, power settings and all flight conditions within the certified flight envelope. Feel free to study FAR Part 25. No autopilot or FBW generates aerodynamic pitching moments.
Transworld:
“CG is further aft than other jets.”
Listen, every airplane type has certified CG limits. “Other jets” have nothing to do with it. The CG envelope depends on weight, flight envelope, airplane design characteristics, such as engine location, landing gear position, structure, elevator/stabilizer control power, stability augmentation, etc. I have worked with quite a few commercial jets and can not recall a single case where two airplane TYPES had identical CG limits.
Besides, the MD-11 crashes were due to inadequate elevator control power for flare, as a result of the stabilizer size being reduced from the DC-10. As you may know, more elevator control power is required at the FWD CG than at the AFT CG, so “CG further aft” did not have anything to do with it.
I understand it was a different design with how it balanced out, how much the wing carries and how much the tail carried.
No one has ever mention lack of elevator control.
I could be wrong but I don’t think so.
For what its worth, argue it whichever way you want I guess.
https://en.wikipedia.org/wiki/Relaxed_stability
http://www.airlinepilotforums.com/cargo/57831-md-11-stability.html
http://www.airlinesafety.com/faq/faq9.htm
The CG loading range is quite wide in terms of % MAC and the resulting CG location at take-off depends on the fuel load, cargo load, passenger load, etc. At landing the CG will be in a different position as a result of fuel burnoff. If loaded correctly it can be anywhere between the FWD and AFT limits. There is no fixed CG position, like you seem to imply.
Transworld:
The A330 has alfa-vanes for stall protection. Indicated airspeed is not used. The airplane was not beyond stall. Had it been it would have pitched down by itself.
End of discussion of a bad design.
IMU a minimum detected airspeed via the pitots is used to determine validity of the alpha vane signals.
“End of discussion of a bad design.”
Harumpf !
Andy:
No its not. You are arguing with people (not me) who know what a stall is?
Stall warning does quit when you get slow enough and that is what was happening (they got enough forward speed to show stall, then slowed up and went out of stall). That is bad.
There is nothing wrong with the A330 and the Airbus automation is no worse (or better) than Boeing.
Both have their issues, both should be regulated and not allowed to implemented bad automation.
The crash was a system failure (entire aviation system) in that it let 3 experienced pilots not recognize a stall when they are in one.
You do need to read the BAE report.
It has some issues in that it is vague on some of the time line actions early on. Still picking through that to sort it out. There looks to be some translation problems as well.
Me, I am still going through it form time to time sifting through the details.
Bjorn:
Please do the BOOK!!!!!!!!
I would like the first public copy (friends family and associates come first of course)
Seconded, but don’t make it to hard for people like me.
No, we need hard hard hard!
Bjorn: Gubbie and I will fight this out. I am deep into technical even if I get a lot of it wrong (all my flying was hard controls)
I did like the MD11 auto throttle, you could feel exactly what was doing.
Make it readable for the amateur, lots of pictures and drawings, a few examples and stories, sell like hot cakes.
Alright 2 books then
My version will sell 500 to 1,loads of hard books already (also loads that are far too simple)
Ok, we cut the guy out wrigint the book and make all the decision, I like that. Not sure we can get Bjorn to go along with it but worth a try!
Maybe one book with basics at start of each chapter and shift into deeper in the rest.
I have read some hard books like that, so far out of what I can do that I skip the in depth. Works pretty good if the book is written that way.
I only got to fly one landing in an MD11 simulator but the auto throttle was wonderful.
Without that the landing would have been iffy, with it the instructor was impressed. I thought it was decent, what I missed was getting some time to get the feel of the aircraft before I did it.
Calm winds programed so I did not have to maneuver latterly.
What was a shock was to have the aircraft shift into a spot at 3500 feet on a landing approach and sit there.
All the senses are screaming, push down push down, this is not a helicopter!
Perhaps the contributers might like to swap list’s of readable Books. Off the top of my head Bill Gunston and Winkle Brown.l would be interested to hear about any other good reads.
I understood that Boeing moved to a hard limit for stall protection on the 787-9 (though from the reports I saw, I’m not sure it represented a change in philosophy for them or if it was just a reaction to the particular characteristics of that model).
I was also interested to see Bombardier’s choices for the C-Series — they went with sidesticks, but implemented a speed-stable control law similar to Boeing’s.
An excellent description of the 777 FBW can be found here:
http://www.davi.ws/avionics/TheAvionicsHandbook_Cap_11.pdf
As a frequent passenger on both Airbus and Boeing aircraft, I have to say that Airbus flights seem jerky in comparison – especially where yaw is concerned on both take offs and landings. Is that just me or inherent to the computer(s) doing more of the work on the Airbus?
Ted, interesting. Flying on both for decades, I never noticed.
We can look at all accidents where the Airbus controls didn’t prevent a crash. Or where they did prevent it. Or where a Boeing control laws aircraft wouldn’t have crashed if it had been used Airbus control laws/ enveloppe protection. The last I’ve never encountered. Maybe the AMS TK 737?
I would suggest AA 965. Controlled flight into terrain. Quoating the FAA:
“The speed brakes (spoilers) that had been extended during the descent were not retracted. The stick shaker (stall warning) activated several times during the maneuver, indicating that the crew obtained the maximum climb angle available. However, the failure to stow the speed brakes may have made the difference in their ability to clear the terrain.”
http://lessonslearned.faa.gov/ll_main.cfm?TabID=3&LLID=43&LLTypeID=2
Alpha Floor would have commanded speed brakes retraction and TOGA. With only another 100 feet more needed to clear the hill it would it reasonable to assume this would have made the difference.
Good report from Flight Safety Foundation:
http://flightsafety.org/fsd/fsd_may-june98.pdf
Keesje:
I kind of like that idea. I know of a number of 737 accidents where they lost their situational awareness and crashed.
It would indeed be interesting to see if Airbus limits would have kept them from doing that.
Not that they can’t do other crashes with an Airbus but it would be an interesting study.
Also the reverse.
What should also be noted is the Boeing setup allows a pilot to go beyond the limits, for someone with an outstanding feel that might, and I do mean might, save you.
Most of the time you are better off as the computers can do a max allowed turn rate without stalling as the aircraft can do.
If the C17 had limits on it, they would not have had the Anchorage crash.
Pilot kept taking it to the limit and beyond, one sad day he found why those limits were there and lost it. Hot dogging it for an air show demonstrations. So much for flying by feel. 3 dead people and 200 million down the drain. At least it was practice and not into a crowd with hundreds dead.
Not that l really know what I’m talking about, but I’m a bit sceptical about all this flying by feel stuff. If someone controlling a power station messed up you wouldn’t get them to shovel coal so that they could get the feel for it again or install blow torch to their chair so that they could feel the heat through the seat of their pants.
The pilots of the A330 were very experienced and the Indonesian captain was an f16 pilot.
I read about some French research using cartoons, so if a pull up warning was ignored all non relevant information would dissappear and the screen would show a cartoon of a man pulling back the stick. If the A330 had simplified and the screen shown a big picture of a plane with its nose up and arrows showing the angle of attack I think that they would have soon worked out what was happening.
The other thing I can’t understand is why an aeroplane will allow you to fly into the ground (other than landing, ofcouse)
Grubbie:
Not at all a wrong thought process.
when I started we had pneumatic controls (mixed with relays). Pretty straight forward.
Then they started controlling things with computers.
In my case programmers took over the industry, changed the language and introduced various amounts of chaos.
Not sure who controls the airlines situation but it smacks a lot o programmers. Its not regulated other than if you can convince them having the pilot seat eject if it gets close to the ground, you are good to go (read that as deep sarcasm) – read the awful story of the battery Boeing put in the 787 and what they found when it failed, just stunning, amongst other things it was tested by driving a nail into it, not because driving nails into batteries proves anything, but because someone thought it was a good way to test a battery (no joke)
One of my favorite piece of non computer stupidity was the slat retraction system on the 747-400 (I believe)
This actually happened: A BA 747 is taking off from JBerg South Africa, I think that runway is 7500 feet altitude, high and hot.
As they just get off the ground, the slats retract, they are limping across the city rooftops trying ng to get some speed and not stall trying to figure out what happened. Amazingly they did not crash.
What occurred was that it had been decided the biggest issue with slats was that they be retracted when going into thrust reverse (keep from blowing stuff into the engine)
So what they did was link the slats to a single switch on each thrust reverser, not in series but in parallel.
Any single thrust reverser cowl that rattled out of position (or a incorrectly set switch) retracted the slats.
So what is the last thing you want on a high hot takeoff? Yep, your slats retracting. .
Now what genius thought a single input should kill a plane load of people is beyond me. If someone had shown me that design I would have fired them (and they should be shot).
Boeing put out an AD immediately and suggest maybe they would want to disable that bug (err feature)
Now jump into computers and once you have computers its incredible how many great ideas they have for them. No more hard wire and costly logic, just whiz bang zip 9 software changes.
My world is relatively simple and picking through the options of how to control a fan these days is insane. They ask what iffs that are unlikely and not an issue, but all maybe could be an issue so maybe we should implant it.
Pretty soon the fan shuts down and you spend two weeks trying to find out why.
My take is it should be regulated, you have to go through a regulatory process to change it, open discussion, critique it, look for flaws etc. Now its all done under the hood and then put out.
“We can look at all accidents where the Airbus controls didn’t prevent a crash. ”
and:
“Or where they did prevent it.”
Accidents that did not happen due to some safeguard or other are “unremarkable”.
They do not leave an imprint in the majority of cases.
Statistics on such things are thus overloaded on the “splashy” end.
The process to make flying saver has worked its magic on all the statistically evaluable issues.
Remaining are the outliers, solitary events that had a “7 holes lined up in a row” kind of causation. Often the “holes” aren’t even obvious if even known. ( IMHO the AF447 crew must have had a “personal dissonance thing” in their recent history to loose their CRM learning’s so thoroughly. )
Ewe: I think AF and its pilots had an institutional issue but it was supported by a system issue in that the training has not kept up with Automation. Read the AF pilots union response. ugh.
Regulatory wise asleep at the wheel, all those incidents of pitot issue and bad response. No one keeping track of it. 13 and all wrong response? Its a system issue that a poor pilot problem made worse (as bad worse as it can get)
This is worth reading as a fine example of unintended consequences of automation.
https://www.flightglobal.com/news/articles/fatigued-superjet-test-pilot-used-wrong-throttle-bef-423659/
And another interesting one. We are still having to remind pilots that sudden loss of airspeed makes not sense if nothing has changed.
https://www.flightglobal.com/news/articles/boeing-faa-warn-787-pilots-of-bad-airspeed-data-423735/
Short of running into a wall (not likely at altitude) then you do not want to de-stabilize your situation.
I still chew on the fact that you could program the computer to put the aircraft into a safe configuration of throttle settings (85% or so) and 5 deg up (may vary a tad by aircraft)
Telling people not to be panic rarely works