Understanding Air France 447

by Palmer, Bill

  Fly by Wire Introduction

  In a fly-by-wire control system, included on airplanes like the Airbus A320, A330, A340, A380, and Boeing 777 & 787, the pilot’s inputs are provided to sophisticated flight control computers that then position the flight controls according to programming, called flight control laws.

  Computers can be programmed to behave in any way desired, so engineers worked to program out characteristics that they deemed undesirable and programmed in behaviors that were favored instead. The latest jet fighters, bombers, and the space shuttle are all fly-by-wire, and it is said that many would be virtually uncontrollable were it not for the fly-by-wire system.

  SideSticks

  Airbus fly-by-wire aircraft use a sidestick controller and conventional rudder pedals for pilot control inputs. Stick-type controllers are no stranger to most pilots and are found in aircraft ranging from gliders, helicopters, and Piper Cubs to jet fighter aircraft and the Space Shuttle. On the Airbus, the stick controllers are positioned forward and outboard of each pilot’s seat and are therefore called sidesticks.

  Each sidestick is lightly spring loaded to its center detent. Each is equipped with a combination autopilot-disconnect/takeover push button (the red button in the photo above), and a push-to-talk trigger on the front side for communications. The two sidesticks are not mechanically linked, nor do they move unless the pilot moves them. Moving one, does not move the other. Except on the ground, the position of the sidesticks is not displayed.

  It is difficult to see the other sidestick, and in flight there is no indication of its position to either pilot. If both sidesticks are moved at the same time, their inputs are summed. Full forward on one and full back on the other results in no pitch command, but that is contrary to how it should be flown. However, when both sidesticks are out of the center detent at the same time, a green light in front of each pilot flashes, and a synthetic voice calls out “DUAL INPUT.” This “DUAL INPUT” call was heard on the AF447 cockpit voice recording during three separate time periods.

  All pilots are taught that only one pilot should be flying at at time, and that is no exception with the sidesticks. In an Airbus that discipline is critical. The voice recorder transcript includes exchanges of that transfer of control, e.g., “I have the controls.” The takeover push-button is not meant to resolve a fight over who is flying the airplane. Its primary function is to override erroneous inputs due to mechanical or electrical malfunction. When a pilot’s sidestick is being overridden due to the opposite takeover push-button, a red arrow illuminates on the glare-shield in front of the pilot losing control, pointing to the pilot who has taken control. The last pilot to push the button gains control overriding opposite sidestick’s inputs while it is held down. If held for more than 40 seconds, the opposite sidestick is locked out until its takeover push-button is pressed. The point is that simultaneous dual input is not only against procedure, but when it happens, both aural and visual indications alert the crew so that a dangerous or confusing situation can be avoided.

  The sidestick design is not without its detractors, including those that believe their design to be a contributing factor to the accident.

  While it is difficult to see the other pilot’s sidestick position, there is rarely a reason to. The combined input is shown on the Primary Flight Display (PFD) only on the ground, intended for use in pre-takeoff flight control check. But again, the opposite sidestick can be assumed to be in neutral unless the green light is on and “DUAL INPUT” is being repeatedly announced.

  When Captain Dubois returned to the cockpit, one minute and forty seconds after the autopilot disconnected, it is assumed he was standing aft of the center pedestal, between the two pilots, or likely sitting on the jumpseat in the same location. From that position, the sidesticks were blocked from view, unless he deliberately leaned forward to look.

  The evidence that the hidden sidestick position was an issue is that as they were descending through about 9,000 feet, Robert told Bonin to “climb, climb, climb, climb.” When Bonin responded that he had “been at maxi nose up for a while,” the captain responded with “no, no, no, don’t climb,” and Robert took the controls within a few seconds. One theory is that had there been a big control yoke in front of both pilots, and one was pulling back as the stall warning was going off, it would be readily apparent to everyone what was happening and it could have been corrected earlier. In fact, there are a few seconds before Bonin relinquished the controls that his sidestick was all the way back, Robert’s was all the way forward, and no pitch change occurred. This obviously could not happen with mechanically linked controls.

  Pilots transitioning from conventional flight control aircraft to the sidestick do so quite easily and naturally. Most will have flown some type of stick controlled aircraft in their career making it a natural transition. Even for those that have not, it is rarely an issue. However, the sidestick input is best flown with a gentle hand. Light fingertip pressure is often all that is needed to fly precisely. A firm grip and strong inputs are almost certain to result in over controlling the airplane. Constant displacement on the sidestick is almost never required, but that is exactly what the pilot flying aboard AF447 was doing as he was losing control of the airplane.

  Flight Control Laws

  In the past, flight controls were designed to meet two sets of criteria: they had to be “well harmonized” and had to meet the criteria for certification. With Fly-By-Wire, three possibilities have been added: improved safety by restricting maneuvers which could lead to a loss of control, reduced weight of the structure with the prohibition of some actions which may increase the loads, and finally improved comfort for the passengers.23

  On the Airbus family, the flight control laws are similar, but not exactly the same between models A319/320/321, A330/A340, A380, and soon, the A350. Each enjoy the results of progress in design with their respective age, as well as differences due to the nature of the aircraft itself. The point being that the A320 flight control system, flight control laws and the transition between them are not the same as the A330. As a result, there are a number of posts, articles, and opinions based on A320 flight control system that do not apply correctly to the A330.

  On the A330, the flight control laws are provided by five redundant computers: 3 Primary (also called PRIMs or FCPC [Flight Control Primary Computer]), and 2 Secondary (also called SECs or FCSC [Flight Control Secondary Computer]). The flight control computers control the two ailerons and seven spoilers on each wing, the two independent elevators, trimmable horizontal stabilizer, and the rudder, using hydraulic actuators powered by 3 independent hydraulic systems. (Flaps and slats are controlled by a separate computer.)

  Each computer controls specific hydraulic actuators for the flight control surfaces. All of the flight control surfaces can be actuated by at least two hydraulic actuators (except spoilers which each have one and the rudder which has three) and each actuator on the inboard ailerons and elevators can be driven by either of two computers. Suffice it to say there is a lot of redundancy built into the system that even with multiple hydraulic and flight control computer failures, control of the airplane can be maintained, although handling may be degraded.

  There are four basic levels of flight control laws:

  Normal Law

  Alternate Law (with two versions: Alternate 1 and Alternate 2)

  Direct Law

  Backup Control

  Airbus refers to the flight control laws other than Normal Law as reconfiguration laws.

  Normal Law is the flight control law normally in effect unless there are multiple failures. Normal Law allows the airplane to handle consistently throughout the flight envelope with automatic trim. For each movement of the sidestick, instead of commanding a specific amount of flight control surface deflection, Normal Law commands a performance. So the same sidestick input consistently results in the same aircraft handling response. The amount of flight control surface deflection required to provide that performance will va
ry with airspeed and other conditions. While the control deflection can be seen on the flight control display, it is not normally monitored except for a pre-takeoff control check. Normal Law also provides the highest degree of protections to prevent the airplane from leaving the normal operating envelope. Protections are provided for high and low speed (including stall protection), bank and pitch angles, and g load. Though not usually listed as a protection, roll rate is also limited by the design.

  In the roll axis, sidestick deflection signals a rate-of-roll demand. This means that for a given amount of sidestick deflection left or right, the pilot commands a given roll rate, with a maximum of 15° per second. The center position commands a zero roll rate, or in other words, maintain the current bank angle.

  In pitch, Normal Law provides a g-load/pitch-rate demand. This means that for a given amount of sidestick deflection forward or aft, the pilot commands a consistent pitch response. At higher speeds this is best expressed in the g-force as a result of the pitch maneuver, at other times the pitch rate is a better measure. The center position commands 1 g, or unaccelerated flight (which could be in a climb, level, or descent). The result is the flight path is maintained. If flaps are extended or retracted the airplane will automatically adjust the pitch in order to maintain the same flight path. In normal operation this reduces the workload of hand flying the airplane. The stab trim is set automatically because the flight control system holds the airplane as commanded whether it is in trim or not. In Normal and Alternate laws, the pilot does not receive feedback on the trim status, nor does he need any.

  Normal Law provides two key low-speed reference points: Alpha Protect (commonly, Alpha Prot) and Alpha Max. As the name Alpha implies, a term meaning angle of attack, even though they are represented on the airspeed indicator, they are actually referenced to angle of attack.

  When slowing, as the angle of attack reaches Alpha Prot the sidestick transforms from a g-load demand to an angle-of-attack-demand input.

  Alpha Max is an angle of attack just below stall, that is the maximum angle of attack allowed by the low-speed protections.

  The airspeed at which Alpha Prot occurs is lower than normal operating speeds but higher than the stall speed. When operating between Alpha Prot and Alpha Max, the center/neutral sidestick position commands Alpha Prot, and full back commands Alpha Max. Therefore, in Normal Law, the airplane will pitch down on its own if the angle of attack increases to Alpha-Prot, but the pilot retains the authority to command a higher angle of attack. Once the angle of attack reaches Alpha Max, the flight control laws will not allow the angle of attack to increase further and will control the pitch to keep the AOA at or below Alpha Max. Because of this, the pilot can command a maximum performance maneuver by holding the sidestick all the way back.

  For Air France 447, when the transition to Alternate Law was made, these angle of attack limits no longer functioned.

  A Different Relationship

  In an airplane with conventional flight controls the resultant roll or pitch rate would more directly correlate with the force applied to the control wheel, and not the amount of deflection required. At higher speeds less control deflection is required to achieve the desired performance, and the airflow over the control surfaces makes the controls correspondingly stiffer. At low speeds greater control deflection is required and the controls feel “sloppy.”

  On the fly-by-wire system, the sidesticks do not provide tactile feedback of flight control force. Sidestick deflection correlates to the desired performance. The system determines how much to move the actual controls surfaces to satisfy the demand. Therefore, airplane handling and response is consistent throughout the flight envelope.

  The Airbus pilot must occasionally remind himself of this different relationship. I have told many students “you are telling it what to do, not how to do it.” Airbus pilots will have trouble if they forget this principle. One common instance is during approach with turbulence. Most pilots of conventionally controlled airplanes are used to instantly responding with a wind gust that tips a wing with a corresponding lateral control input. With the sidestick in neutral, an Airbus will attempt to maintain a zero roll rate on its own, and will automatically input a roll command in response to the gust. Pilots who react to each bump and gust end up creating their own turbulence by wagging the sidestick back and forth faster than the airplane can respond. With each movement of the sidestick, the pilot is asking for a different performance (roll left, roll right), and it takes some time for this to all happen. It is not difficult to get into a situation where the inexperienced Airbus pilot is reacting to his previous sidestick input.

  Despite how it may sound, the transition to this different flight control/performance relationship is quite easy. Pilots do not normally think of how much control deflection they need to achieve a given pitch or roll rate, but will use as much as required with the the airplane’s response as a cue. Likewise with the sidestick, the pilot inputs as much control input as necessary to achieve the desired performance and do not give it a second thought.

  Another situation where this different relationship becomes significant is during crosswind landings. During the approach the airplane is crabbed into the wind, flying somewhat sideways to the runway. It is a normal procedure during the pre-touchdown stage of a crosswind landing to use the rudder to align the airplane with the runway so that the wheels touchdown in line with their axis of rotation. When the airplane is aligned with the runway, drift is controlled with the input of a slight bank angle.

  A properly input bank angle balances out the effect of a crosswind. To maintain this balance rudder and opposite aileron must both be deflected. In a conventional airplane, this is done be holding the rudder and the control wheel both deflected in opposite directions, referred to as a cross-control input. But on Airbus fly-by-wire aircraft, the sidestick commands rate of roll and not aileron deflection. Therefore, if the sidestick was held as in a conventionally controlled airplane, the airplane would continue to increase its bank angle as long as the sidestick was held deflected.

  The Airbus pilot must learn to use the sidestick only to establish the bank angle, and then return it to neutral in order to maintain the bank angle. This is not particularly difficult, but it does require an conscious understanding of what the sidestick is commanding.

  As an interesting contrast to the Airbus fly-by-wire design, the Boeing 777 (also a fly-by-wire airplane) directly commands aileron deflection for roll so that airplane mimics one that is conventionally controlled.

  The B-787 on the other hand, uses a rate-of-roll demand for lateral inputs, similar to Airbus aircraft. But the engineers also designed in a roll response to rudder pedal input so that in a cross control situation the pilot inputs can be conventional. The simultaneous control wheel and rudder pedal commanded roll rates cancel each other out. This provides the excellent handling characteristics of a roll-rate demand with the crosswind handling that pilots are used to.

  As mentioned earlier, Normal Law in addition to providing well behaved and consistent handling characteristics, also provides the highest level of protections. These protections are designed to prevent loss of control and exceeding the normal operating parameters. Protections are provided for g load, pitch and roll attitudes, speed, and angle of attack.

  Some naysayers describe the protections as the pilot wanting something and the computers deciding if they will allow it, inferring that the pilot always knows better and should always be obeyed. The pilot commands a performance not a control command. There is no reasonable scenario where a transport category airplane should be rolled, looped, stalled or significantly oversped. There is however, an accident history where these parameters were inadvertently exceeded ending in disaster. The protections are there for a good reason.

  In roll, the sidestick commands a rate up to 15° per second, which is quite fast. In airline operations bank angles rarely exceed 30°, and Normal Law reflects that. At bank angles up to 33° if the stick is returned to
neutral, the airplane will maintain that bank angle all day long. For bank angles beyond 33° lateral sidestick deflection must be held in, as these bank angles are allowed, but unusual. If the sidestick is released back to neutral the airplane will automatically reduce the bank to 33°. This is known as a “spiral stability.” At 67° of bank, full left or right sidestick deflection must be held to maintain this unusual bank angle. This bank angle also correlates to 2.5g’s in level flight, the positive g-load limit.

  In pitch, Normal Law limits pitch attitude to 30° nose up and 15° nose down. These would be extremes in any airline operation.

  High speed protection will pitch the airplane up when the maximum speed is exceeded to slow it down and prevent damage to the airframe. However, the pilot can command a transient of about 20 knots beyond the upper limit with forward stick input.

  Low speed protection references the angle of attack and will automatically pitch the airplane down as necessary to protect from stall. It establishes a neutral point at Alpha-Prot. To go beyond that (lower speed, higher angle of attack) requires the pilot to pull back on the sidestick.

  These protections allow the Airbus pilot to ask for the maximum performance by simply moving the control to the limit. For example, in a terrain avoidance maneuver (e.g., mountain ahead) a maximum performance climb is required, but the pilot must not risk stalling or over-stressing the airplane. In a conventionally controlled airplane, this is up to the pilot to manage. There is no g-meter available to show the relationship to the g limit, and the pilot must attempt to operate near the stall warning point in order to achieve the maximum lift from the wings. It is difficult to do this in a precise manner. Some Boeing airplanes display an angle-of-attack based pitch limit indicator (PLI) on the attitude indicator for assistance. The Airbus fly-by-wire system allows the pilot to pull back on the sidestick all the way to achieve maximum performance without risk of stall or exceeding the g limit. The full back sidestick does not command full up elevator, but up to 2.5 g’s (or the AOA limit) - a maximum performance pull up.