Carefree FCS
Thread Starter
Join Date: Dec 2004
Location: 51N
Posts: 61
Likes: 0
Received 0 Likes
on
0 Posts
Carefree FCS
Just seen the video from Tarnished on the military aircrew forum of the Rafale having a close encounter with the wet stuff - follows on from Typhoon having a close encounter with the concrete at Fairford. Assuming that both aircraft are probably g limited at the bottom of a loop is it a good idea to have a carefree aircraft that automatically limits g when in this scenario an overstress would have been more preferable and given the pilot the option of recovering with a greater safety margin? Are the new breed of pilots just pulling to the back-stop and hoping that the aircraft will give them enough performance and not making gate heights/speeds etc? Agreed that limiting the max alpha is a good idea as the aircraft cannot technically stall and will therefore operate at CLmax but should we not allow the pilot to decide an appropriate max g for all given circumstances - CFIT/mid-air/def manoeuvres?
Discuss please gents - after all Boeing still believe that avoiding CFIT shouldn't be limited by FCS whereas Airbus firmly believe that the aircraft should never be allowed to pull more than 2.5G regardless of the severity of the situation. Surely military aircraft should follow the Boeing lead?
SG
Discuss please gents - after all Boeing still believe that avoiding CFIT shouldn't be limited by FCS whereas Airbus firmly believe that the aircraft should never be allowed to pull more than 2.5G regardless of the severity of the situation. Surely military aircraft should follow the Boeing lead?
SG
Soiled Glove,
I posted several times on the Typhoon at RIAT thread worth a read if you have a chance.
I know Typhoon was not g limited during subject event and I seriously doubt this Rafale was g limited either, they would both have been on an alpha limit. To be on the (configuration and mass dependant) g limit a speed of about 400kts would be required.
Typhoon does have an over-ride stop to give a proportion of extra g, but it will not over-ride an alpha limited condition. It is important to be aware that this g over-ride was incorporated in the design a long time before GPWS was included into the baseline design. We tested GPWS in many extreme attitudes (albeit with a false base height set for safety) and it works, it works really well.
The utility of a g over-ride is I believe questionable in light of having GPWS. If you look at the sums the difference in recovery height (or displacement in the avoiding mid air collision case) between what max g will get you and what max g plus x% will get you is minimal. Bear in mind that this excursion comes with a significant penalty to the structural life of the airframe, inspection time etc.
The thought that came to me after watching Rafale video was that maybe these modern "carefree" aircraft are building a feeling of invincibility amongst their pilots? Typhoon is an absolute dream to fly and once you have learnt that you can smash the stick around the box without a care for historical limits you quickly get used to it. We did seriously rediculous series of inputs during the trials - we dubbed it a careless clearance rather than a carefree one.
Another problem these jets have is the ability to add energy very quickly, unload for a few secs and you've added 100kts, which makes a big difference to you turn circle and gate height. I think the Rafale pilot unloaded during his alignment correction just after the apex of his "loop", I believe this was his mistake.
Carefree FCS make life great, but they cannae change the laws of physics Jim (RIP Scotty).
Bubbles, base heights and gate heights are all there for good reason.
Tarnished
I posted several times on the Typhoon at RIAT thread worth a read if you have a chance.
I know Typhoon was not g limited during subject event and I seriously doubt this Rafale was g limited either, they would both have been on an alpha limit. To be on the (configuration and mass dependant) g limit a speed of about 400kts would be required.
Typhoon does have an over-ride stop to give a proportion of extra g, but it will not over-ride an alpha limited condition. It is important to be aware that this g over-ride was incorporated in the design a long time before GPWS was included into the baseline design. We tested GPWS in many extreme attitudes (albeit with a false base height set for safety) and it works, it works really well.
The utility of a g over-ride is I believe questionable in light of having GPWS. If you look at the sums the difference in recovery height (or displacement in the avoiding mid air collision case) between what max g will get you and what max g plus x% will get you is minimal. Bear in mind that this excursion comes with a significant penalty to the structural life of the airframe, inspection time etc.
The thought that came to me after watching Rafale video was that maybe these modern "carefree" aircraft are building a feeling of invincibility amongst their pilots? Typhoon is an absolute dream to fly and once you have learnt that you can smash the stick around the box without a care for historical limits you quickly get used to it. We did seriously rediculous series of inputs during the trials - we dubbed it a careless clearance rather than a carefree one.
Another problem these jets have is the ability to add energy very quickly, unload for a few secs and you've added 100kts, which makes a big difference to you turn circle and gate height. I think the Rafale pilot unloaded during his alignment correction just after the apex of his "loop", I believe this was his mistake.
Carefree FCS make life great, but they cannae change the laws of physics Jim (RIP Scotty).
Bubbles, base heights and gate heights are all there for good reason.
Tarnished
Join Date: Oct 2000
Location: South West UK
Posts: 367
Likes: 0
Received 0 Likes
on
0 Posts
Interesting topic.
In my Airbus (A320) I'm quite happy that the system limits me to max alph, g or pitch attitude as circumstances dictate. I can't forsee the need to exceede these limits given the ability of the EGPWS to warn me of the need to avoid the hard stuff; I won't be doing any aerobatic displays!
In the F18 I found the carefree handling considerably enhanced my ability to get on with the job of shooting missiles or dropping bombs. It did however have an over-ride switch on the stick which, if memory serves allowed up to 10G but I never had to use it. The 10G seems to me a good comprimise to give absolute max performance but without putting the pilot to sleep.
I'm sure that tarnished is right on the nail; these sort of aeroplanes can add energy in a heartbeat and unloading at the wrong time can be a killer. A USMC Col in an F18 discovered this at El Toro (if memory serves) in the early 90s.
Happy landings
3 Point
In my Airbus (A320) I'm quite happy that the system limits me to max alph, g or pitch attitude as circumstances dictate. I can't forsee the need to exceede these limits given the ability of the EGPWS to warn me of the need to avoid the hard stuff; I won't be doing any aerobatic displays!
In the F18 I found the carefree handling considerably enhanced my ability to get on with the job of shooting missiles or dropping bombs. It did however have an over-ride switch on the stick which, if memory serves allowed up to 10G but I never had to use it. The 10G seems to me a good comprimise to give absolute max performance but without putting the pilot to sleep.
I'm sure that tarnished is right on the nail; these sort of aeroplanes can add energy in a heartbeat and unloading at the wrong time can be a killer. A USMC Col in an F18 discovered this at El Toro (if memory serves) in the early 90s.
Happy landings
3 Point
I agree with what Tarnished has said regarding "invincibility" and energy gain.
In a combat aircraft display it is always a desire to demonstrate the maximum turn performance of an aircraft, both in the vertical and horizontal planes. With a g and AoA limiting FCS this is easily achieved with full back stick. However, employing full back stick in a vertical manoeuvre towards the ground means that you have no capability for reducing the radius of the manoeuvre. Is this a factor in these incidents? I believe that looping manoeuvres towards the ground should not be flown with full back stick.
One other aspect to consider is that in a straight-winged aircraft, looping radius on a pull through can generally be decreased by reducing power. In a high induced drag aircraft such as Typhoon, at low speeds looping radius may perhaps be reduced by increasing power i.e selecting reheat (your thoughts please, Tarnished).
Aircraft such as Rafale and Typhoon are markedly different to display than earlier generations of fighter. Company pilots have many years experience displaying such types successfully. Service pilots are new to them. Have all of the lessons learnt been passed on by industry or requested by the Services?
In a combat aircraft display it is always a desire to demonstrate the maximum turn performance of an aircraft, both in the vertical and horizontal planes. With a g and AoA limiting FCS this is easily achieved with full back stick. However, employing full back stick in a vertical manoeuvre towards the ground means that you have no capability for reducing the radius of the manoeuvre. Is this a factor in these incidents? I believe that looping manoeuvres towards the ground should not be flown with full back stick.
One other aspect to consider is that in a straight-winged aircraft, looping radius on a pull through can generally be decreased by reducing power. In a high induced drag aircraft such as Typhoon, at low speeds looping radius may perhaps be reduced by increasing power i.e selecting reheat (your thoughts please, Tarnished).
Aircraft such as Rafale and Typhoon are markedly different to display than earlier generations of fighter. Company pilots have many years experience displaying such types successfully. Service pilots are new to them. Have all of the lessons learnt been passed on by industry or requested by the Services?
Join Date: Jan 2001
Location: Adelaide Australia
Posts: 19
Likes: 0
Received 0 Likes
on
0 Posts
Few idle thoughts on the string. You're right, Lomcevak, in the effect of power on turning radius in these jets: setting idle power at the top of a loop will lower base height by 500 - 1000 ft, depending on start conditions, height, speed and so on.
It also depends a lot on just where the AOA limiter is set, and that tends to fall out of the clearance processes that define what you're allowed to test. For all these aircraft, all the initial clearance work comes from lots of modeling in seriously good simulations. For example, before Typhoon's first ever flight clearance, a minimum of 500 hours qualification testing was flown in the simulator, looking not just at the basic aerodynamics and handling, but also all the worst case tolerances on things like air data accuracy and CG management - and that's on top of the many more hours spent before that in just developing the design and aerodynamics.
However (and here, put on your Health and Safety at Work mindset) it's still a simulation based on lots of estimated data, e.g. wind tunnel data and lots of computational aerodynamics, as opposed to "real" aircraft data, so there needs to be a degree of caution in how you apply the simulation results. This might mean, for example, that you won't clear the aircraft to fly to the maximum AOA you fly in the sim, because you haven't the necessary level of confidence that the data (in these non-linear, difficult to predict areas) adequately predicts the real performance.
That's a good philosophy to start with, but then you go fly the real aircraft, match flight data with aero model data and explain, understand and remove the differences, and your flight clearances get better. Or do they? You can actually end up in the Catch 22 situation where you can't get improve the data because you can't get the clearances to get the data to improve the clearances. As the exceptionally capable, and often very frustrated flight control system design team test pilot said, the only truth is from God's wind tunnel, so we have to go and fly to get the truth. But in a heavily politicised, process-driven and risk-averse development environment (and that's the customer as well, don't just blame the contractor) it can be impossible to find anyone prepared to sign their name to the clearance. (And no, pilots are never invited to sign clearances until well after others have deemed it appropriate.)
It's an interesting philosophical test dilemma. I flew the first carefree trials in Typhoon with an AOA limiter set higher than the current service limit, but subsequent modelling (not related to the flight test results) made the clearance empire reduce the limits for general testing, and that inevitably ended up in initial service. Notwithstanding that, the jet was absolutely solid at the peak AOAs, no matter what I did to it and I remain certain that there's still more usable lift (at much higher drag) at and beyond the AOAs I saw. No, I don't have the numbers to prove it (Catch 22 again) but I do have judgement and feel - which is why you use human pilots for this, instead of an autopilot.
Basck to the subject matter of displays. I also flew some displays in the jet, both with the earlier (higher) AOA limit and the subsequent service limit. The fundamental difference was that with the higher AOA I had some extra drag to play with, which made a big difference in speed control - I had something to help balance out the stunning thrust. In contrast, at the service AOA levels I could fly much of the display at full back stick but still had to sometimes play with the throttles to keep speed under control. (As Tarnished says, you don't have a problem getting speed back in these jets , but you can have a problem getting rid of it!)
It also depends a lot on just where the AOA limiter is set, and that tends to fall out of the clearance processes that define what you're allowed to test. For all these aircraft, all the initial clearance work comes from lots of modeling in seriously good simulations. For example, before Typhoon's first ever flight clearance, a minimum of 500 hours qualification testing was flown in the simulator, looking not just at the basic aerodynamics and handling, but also all the worst case tolerances on things like air data accuracy and CG management - and that's on top of the many more hours spent before that in just developing the design and aerodynamics.
However (and here, put on your Health and Safety at Work mindset) it's still a simulation based on lots of estimated data, e.g. wind tunnel data and lots of computational aerodynamics, as opposed to "real" aircraft data, so there needs to be a degree of caution in how you apply the simulation results. This might mean, for example, that you won't clear the aircraft to fly to the maximum AOA you fly in the sim, because you haven't the necessary level of confidence that the data (in these non-linear, difficult to predict areas) adequately predicts the real performance.
That's a good philosophy to start with, but then you go fly the real aircraft, match flight data with aero model data and explain, understand and remove the differences, and your flight clearances get better. Or do they? You can actually end up in the Catch 22 situation where you can't get improve the data because you can't get the clearances to get the data to improve the clearances. As the exceptionally capable, and often very frustrated flight control system design team test pilot said, the only truth is from God's wind tunnel, so we have to go and fly to get the truth. But in a heavily politicised, process-driven and risk-averse development environment (and that's the customer as well, don't just blame the contractor) it can be impossible to find anyone prepared to sign their name to the clearance. (And no, pilots are never invited to sign clearances until well after others have deemed it appropriate.)
It's an interesting philosophical test dilemma. I flew the first carefree trials in Typhoon with an AOA limiter set higher than the current service limit, but subsequent modelling (not related to the flight test results) made the clearance empire reduce the limits for general testing, and that inevitably ended up in initial service. Notwithstanding that, the jet was absolutely solid at the peak AOAs, no matter what I did to it and I remain certain that there's still more usable lift (at much higher drag) at and beyond the AOAs I saw. No, I don't have the numbers to prove it (Catch 22 again) but I do have judgement and feel - which is why you use human pilots for this, instead of an autopilot.
Basck to the subject matter of displays. I also flew some displays in the jet, both with the earlier (higher) AOA limit and the subsequent service limit. The fundamental difference was that with the higher AOA I had some extra drag to play with, which made a big difference in speed control - I had something to help balance out the stunning thrust. In contrast, at the service AOA levels I could fly much of the display at full back stick but still had to sometimes play with the throttles to keep speed under control. (As Tarnished says, you don't have a problem getting speed back in these jets , but you can have a problem getting rid of it!)
Guest
Posts: n/a
Tea driver,
You didn't bring a Typhoon through Linton for a grad about 5 years ago with the increased alpha limit, did you? Never seen anything like it! Look almost like it was VIFing, certainly more AoA than the current software.
We do make a rod for own backs sometimes when it comes to MAR. I'll stop myself before I turn this thread into a 'good old days' rant....
CBA
You didn't bring a Typhoon through Linton for a grad about 5 years ago with the increased alpha limit, did you? Never seen anything like it! Look almost like it was VIFing, certainly more AoA than the current software.
We do make a rod for own backs sometimes when it comes to MAR. I'll stop myself before I turn this thread into a 'good old days' rant....
CBA
Join Date: Jan 2001
Location: Adelaide Australia
Posts: 19
Likes: 0
Received 0 Likes
on
0 Posts
Indeed I did, although I don't recall doing anything that challenged the envelope. It's one of those deceptive things: I used to just fly the jet slow, but not at or near the AOA limit, because a) with lots of wing even a non-limited but reasonable AOA you're still a fair bit slower than guys at the time were used to, b) because it means you're around longer so people have more time to look, and they tend then to see more than there is, c) it means the turn radius is small = close = looks impressive and d) with all that wonderful thrust on tap, getting speed or going up through the vertical is no challenge at all. In addition, the prototypes (that was DA2) had lower g limits than production aircraft, so going faster would potentially make you g limited and in the worst case make you look like a USAF F16 display pilot who's ordered to keep his speed above 400 kts at all times. I also tried to tell guys that although it was a prototype, it weighed much the same as a production aircraft, courtesy of a ton and a half of test instrumentation. And only 92% production thrust too.... Sigh!
Glad you admitted to that one Teadriver, T10 and myself were keeping our collective gobs shut I'm sure.
Plea bargain would be for 8 other similar offences to be taken into consideration and time off for good behaviour!
Tarnished
Plea bargain would be for 8 other similar offences to be taken into consideration and time off for good behaviour!
Tarnished
Thread Starter
Join Date: Dec 2004
Location: 51N
Posts: 61
Likes: 0
Received 0 Likes
on
0 Posts
We do make a rod for own backs sometimes when it comes to MAR
Now if only I could get my foot in the door at Boscombe...
Don Quixote Impersonator
Join Date: Jul 1999
Location: Australia
Age: 77
Posts: 3,403
Likes: 0
Received 0 Likes
on
0 Posts
Fascinating stuff and thanks for the erudite comments while I turn slightly green with envy. 
Did they have to use tyre levers to get the Rafale pilot off his seat on return.
I have not had the opportunity to use brute strength to overcome gravity and drag, but I have long been an interested student of the issues.
If I may ask a question about the Rafaele in the vid for example; as he pulls through the top and starts down there would have been an exit point beyond which his inability "against the stops" to further manage the energy and influence events would make contact with the sea/ground inevitable. ?? I have been very very close to there in the horizontal but not the vertical.
As it is a moveable feast and unloading the aircraft has predictable but rapid and unintentional results, is there sufficient computing power on board to predict the flight path for any current inputs, that would alert the pilot of an inevitable demise or unplanned ejection.
, should he unintentionally unload a bit or otherwise change the planned vector.
It seems to me that "gut" feeling has its limitations and the speed of events beyond rational thought.
Also as it is possible to build "feel or feedback" into the stick is it possible to reprogramme the travel so that the "carefree" travel is within 'normal' stick forces but provides extra "oooh ****" travel that requires a substantially higher force to invoke a "looser" set of parameters that might be enough to get you out of trouble.? There would have to be a penalty for its use, but it might just save the crew and aircraft.
Did they have to use tyre levers to get the Rafale pilot off his seat on return.
I have not had the opportunity to use brute strength to overcome gravity and drag, but I have long been an interested student of the issues.
If I may ask a question about the Rafaele in the vid for example; as he pulls through the top and starts down there would have been an exit point beyond which his inability "against the stops" to further manage the energy and influence events would make contact with the sea/ground inevitable. ?? I have been very very close to there in the horizontal but not the vertical.
As it is a moveable feast and unloading the aircraft has predictable but rapid and unintentional results, is there sufficient computing power on board to predict the flight path for any current inputs, that would alert the pilot of an inevitable demise or unplanned ejection.
, should he unintentionally unload a bit or otherwise change the planned vector.It seems to me that "gut" feeling has its limitations and the speed of events beyond rational thought.
Also as it is possible to build "feel or feedback" into the stick is it possible to reprogramme the travel so that the "carefree" travel is within 'normal' stick forces but provides extra "oooh ****" travel that requires a substantially higher force to invoke a "looser" set of parameters that might be enough to get you out of trouble.? There would have to be a penalty for its use, but it might just save the crew and aircraft.
Join Date: Jan 2001
Location: Adelaide Australia
Posts: 19
Likes: 0
Received 0 Likes
on
0 Posts
Gaunty,
Yep, there cerrtainly is Stuff Out There that can help with such decisions. Modern ground proximity warning systems (GPWS) take data from the aircraft nav/flight control system (i.e. defining flight path), predict future flight path based on that data, and compare the prediction with a digital model of the world ahead. You make some assumptions in predicting future flight path - e.g. that the pilot will continue the current manoeuvre for the predicted period - and also calculate a "recovery" manoeuvre based on known aircraft capability (for example, a wings level pullup manoeuvre at full back stick, i.e. on the AOA limiter at low speed or the g limiter at higher speed. If the wings aren't level, include time to roll wings level. Add on a time for generating a suitable warning and for the pilot to react to it). In an ideal, non-risk averse, non-safety/hazard analysis world, the pilot can rip around the sky with great abandon until he gets the warning, then roll wings level and pull, and shortly afterwards zip off to complete his aeros sequence. Of course, the sensible thing is to add another "advance" to the generation of the warning, so the pilot knows, for example, that if he continues his current manoeuvre for, say, another 3 seconds he'll generate the recovery warning and have to take full recovery action.
However, the picture gets murkier when 1) you consider possible error sources and 2) the dreaded hazard analysis gets involved. 1) is defined by navigation and flight control system data accuracies (actually, pretty good nowadays, and well inside the nosie levels needed for sensible predictions), by the accuracy of the digital terrain model (scope there for errors from spot spacing and integrity) and in the assumptions made for pilot reaction time, generation and presentation of warnings, and the like. Mix this lot with a design engineer who fears being sued by the widow if his allowances or data are wrong, and you end up with pessimistic assumptions, which translates into kit that gives you warnings when the flight path is obviously and credibly safe: "Cry Wolf" syndrome. That's disasterous, because when the warning IS genuine and vital, the pilot may not respond to it in time or at all. You therefore have to juggle the settings to minimise nuisance warning while still providing a worthwhile level of warning - and that's quite possible.
As for 2) that's even more disasterous. The probability of non-flight safety critical (Class 2) software failing ( to the hazard men) is 1, which means if any of your system - data inputs, GPWS box itself, warning generator, cockpit displays, audio - goes through Class 2 software, it must be considered unsafe (e.g. it might not give a warning when it should) and cannot therefore be used to maintain safe operation. It ignores the pragmatic reality that it does NOT fail every time - even Bill Gates' stuff doesn't - and that it will therefore provide a major improvement in operating safety for the majority of operating time. I've lost friends and collagues in Jaguars, Tornados, Phantoms and Lightnings all of whom would have been saved by this kit had it been there, and my heat level rises when someone suggests it's not safe to use because of a software engineering philosophy!
OK, end of rant, time for a cup of hot chocolate and a lie down in a quiet room.
Yep, there cerrtainly is Stuff Out There that can help with such decisions. Modern ground proximity warning systems (GPWS) take data from the aircraft nav/flight control system (i.e. defining flight path), predict future flight path based on that data, and compare the prediction with a digital model of the world ahead. You make some assumptions in predicting future flight path - e.g. that the pilot will continue the current manoeuvre for the predicted period - and also calculate a "recovery" manoeuvre based on known aircraft capability (for example, a wings level pullup manoeuvre at full back stick, i.e. on the AOA limiter at low speed or the g limiter at higher speed. If the wings aren't level, include time to roll wings level. Add on a time for generating a suitable warning and for the pilot to react to it). In an ideal, non-risk averse, non-safety/hazard analysis world, the pilot can rip around the sky with great abandon until he gets the warning, then roll wings level and pull, and shortly afterwards zip off to complete his aeros sequence. Of course, the sensible thing is to add another "advance" to the generation of the warning, so the pilot knows, for example, that if he continues his current manoeuvre for, say, another 3 seconds he'll generate the recovery warning and have to take full recovery action.
However, the picture gets murkier when 1) you consider possible error sources and 2) the dreaded hazard analysis gets involved. 1) is defined by navigation and flight control system data accuracies (actually, pretty good nowadays, and well inside the nosie levels needed for sensible predictions), by the accuracy of the digital terrain model (scope there for errors from spot spacing and integrity) and in the assumptions made for pilot reaction time, generation and presentation of warnings, and the like. Mix this lot with a design engineer who fears being sued by the widow if his allowances or data are wrong, and you end up with pessimistic assumptions, which translates into kit that gives you warnings when the flight path is obviously and credibly safe: "Cry Wolf" syndrome. That's disasterous, because when the warning IS genuine and vital, the pilot may not respond to it in time or at all. You therefore have to juggle the settings to minimise nuisance warning while still providing a worthwhile level of warning - and that's quite possible.
As for 2) that's even more disasterous. The probability of non-flight safety critical (Class 2) software failing ( to the hazard men) is 1, which means if any of your system - data inputs, GPWS box itself, warning generator, cockpit displays, audio - goes through Class 2 software, it must be considered unsafe (e.g. it might not give a warning when it should) and cannot therefore be used to maintain safe operation. It ignores the pragmatic reality that it does NOT fail every time - even Bill Gates' stuff doesn't - and that it will therefore provide a major improvement in operating safety for the majority of operating time. I've lost friends and collagues in Jaguars, Tornados, Phantoms and Lightnings all of whom would have been saved by this kit had it been there, and my heat level rises when someone suggests it's not safe to use because of a software engineering philosophy!
OK, end of rant, time for a cup of hot chocolate and a lie down in a quiet room.
Join Date: Jan 2005
Location: Racedo blows goats
Posts: 677
Likes: 0
Received 0 Likes
on
0 Posts
Teadriver
You're spot on with the safety philosophy. It gets even worse because even the systems that directly interface with your safety critical system are then by default also safety critical. It is common then to see a a hazard generating software changes throughout the aircraft. Your development costs then ratchet up by orders of magnitude depending on the complexity and a programme rapidly becomes unaffordable.
I had a discussion on this recently about whether secondary hazards should be made a part of the hazard analysis (i.e the effects of not fitting quite as robust a system). As a sledgehammer analogy, removing a weapon because there is a statisical chance that firing the weapon may take down the launch aircraft, against the odds of survival of going to war without said weapon. I think that your only work around because of the fear of litigation is to make your GPWS an advisory system only.
regards
Retard
You're spot on with the safety philosophy. It gets even worse because even the systems that directly interface with your safety critical system are then by default also safety critical. It is common then to see a a hazard generating software changes throughout the aircraft. Your development costs then ratchet up by orders of magnitude depending on the complexity and a programme rapidly becomes unaffordable.
I had a discussion on this recently about whether secondary hazards should be made a part of the hazard analysis (i.e the effects of not fitting quite as robust a system). As a sledgehammer analogy, removing a weapon because there is a statisical chance that firing the weapon may take down the launch aircraft, against the odds of survival of going to war without said weapon. I think that your only work around because of the fear of litigation is to make your GPWS an advisory system only.
regards
Retard
Join Date: Jan 2001
Location: Adelaide Australia
Posts: 19
Likes: 0
Received 0 Likes
on
0 Posts
I don't have much of a problem with the principle of carrying out a safety analysis as part of a rigorous design process, to identify potential hazards that an unstructured mind might miss. I have a big problem with how it's carried out. The methodology searches for things that may go wrong and seeks to quantify them: it never (certainly, never in my experience) simultaneously evaluates the advantages of providing that functionality and quantifies that benefit. The whole process is therefore acutely unbalanced and inevitably results in diminished performance or unnecessary limitations that the squadron pilot is supposed to apply to compensate for inadequate engineering.
Getting a rough quantitative estimate for the benefit ought to be straightforward in this case. As you implied, there is plenty of (distressing) historical evidence to analyse. Presumably this sort of thing has been done for other safety equipment. I know that when it comes to such things as "g-override", the potential benefits are indeed considered.
Where software is involved though, it's a sod to put numbers on hazards if the software doesn't have a proper pedigree. Basically unless someone uses a very rigorous approach to prove the software works properly, I'd assume it could do whatever it damn well likes, whenever it damn well likes. Including behaving as good as gold for years and then falling over simultaneously in dozens of aircraft when they all do something not exactly like anything the software's ever seen before. OK, so it's only a warning system and ought to only be a benefit or at worst neutral. But in principle, pilots could have modified their own behaviour to increase the chances of needing it to work on the occasion that it doesn't. I can think of one in-service system where that's happened even though it comes without a solid guarantee it will always work in the regime it's been used (although it's designed to and there's lots and lots of experience of it working just fine).
I'm not involved in GPWS, so I'd think that in order for pilots to trust it enough to increase the risk significantly, it would already have established a history of use including rescuing a few close shaves (and so getting a positive balance sheet). A system I am familiar with is in a similar situation, and part of the answer is to be totally rigorous with pilot-applied limitations and procedures. We can do that in a flight-test enviroment, but can we rely on really accurate feedback of how pilots are interacting with a system in squadron service to adjust those limits and procedures as required? It's not that people don't try, but it's not easy.
Sorry for the somewhat disjointed ramblings, but some of use are trying to help and I thought it worth saying so.
Where software is involved though, it's a sod to put numbers on hazards if the software doesn't have a proper pedigree. Basically unless someone uses a very rigorous approach to prove the software works properly, I'd assume it could do whatever it damn well likes, whenever it damn well likes. Including behaving as good as gold for years and then falling over simultaneously in dozens of aircraft when they all do something not exactly like anything the software's ever seen before. OK, so it's only a warning system and ought to only be a benefit or at worst neutral. But in principle, pilots could have modified their own behaviour to increase the chances of needing it to work on the occasion that it doesn't. I can think of one in-service system where that's happened even though it comes without a solid guarantee it will always work in the regime it's been used (although it's designed to and there's lots and lots of experience of it working just fine).
I'm not involved in GPWS, so I'd think that in order for pilots to trust it enough to increase the risk significantly, it would already have established a history of use including rescuing a few close shaves (and so getting a positive balance sheet). A system I am familiar with is in a similar situation, and part of the answer is to be totally rigorous with pilot-applied limitations and procedures. We can do that in a flight-test enviroment, but can we rely on really accurate feedback of how pilots are interacting with a system in squadron service to adjust those limits and procedures as required? It's not that people don't try, but it's not easy.
Sorry for the somewhat disjointed ramblings, but some of use are trying to help and I thought it worth saying so.
Re: “…after all Boeing still believe that avoiding CFIT shouldn't be limited by FCS whereas Airbus firmly believe that the aircraft should never be allowed to pull more than 2.5G regardless of the severity of the situation. Surely military aircraft should follow the Boeing lead?”
The history of the Boeing - Airbus difference is probably hidden in the marketing strategies of each manufacturer, but the design philosophies are much more evenly balanced. Airbus would argue that even with a late EGPWS warning you would not require more than the limiting FCS input to recover the aircraft; I doubt that Boeing would contradict that view, but in other circumstances there could be an advantage.
See the ALPA discussion ‘pilot authority and aircraft protections’
Perhaps there should be more focus on the human. Does the design philosophy affect the way in which the aircraft is flown?
Would Boeing pilots take more risks because they think that they have more control capability?
Are Airbus pilots more watchful as they believe that they may not have sufficient control capability?
I suggest that both points of view are true and also false; the issue is with human perception. Few line pilots really understand the design philosophies and the associated aerodynamic variables; instead they focus on specific situations that are central to the perceived hazard.
Boeing pilots could be mistaken about the ‘excess’ control capability available, as in many circumstances there is none. Conversely Airbus pilots falsely believe that they can fly the aircraft to its limit without thought of the consequences – Habshiem accident.
The hazard with either design is in human judgement; pilots believing that they can achieve a manoeuvre whereas they cannot. Is this the phenomenon that we have seen in recent military incidents? Or are they like many civil accidents, just errors of judgement, human fallibility? If the latter, then a carefree FCS will do little more to help, but technologies that monitor the overall aircraft capability and detect crew error might improve safety, EGPWS is a good example.
For me Airbus has the edge, not for their FCS philosophy, but for their better understanding of the capabilities and limitations of today’s pilots in the current aviation system; we all require much more protection from ourselves than ever before.
The history of the Boeing - Airbus difference is probably hidden in the marketing strategies of each manufacturer, but the design philosophies are much more evenly balanced. Airbus would argue that even with a late EGPWS warning you would not require more than the limiting FCS input to recover the aircraft; I doubt that Boeing would contradict that view, but in other circumstances there could be an advantage.
See the ALPA discussion ‘pilot authority and aircraft protections’
Perhaps there should be more focus on the human. Does the design philosophy affect the way in which the aircraft is flown?
Would Boeing pilots take more risks because they think that they have more control capability?
Are Airbus pilots more watchful as they believe that they may not have sufficient control capability?
I suggest that both points of view are true and also false; the issue is with human perception. Few line pilots really understand the design philosophies and the associated aerodynamic variables; instead they focus on specific situations that are central to the perceived hazard.
Boeing pilots could be mistaken about the ‘excess’ control capability available, as in many circumstances there is none. Conversely Airbus pilots falsely believe that they can fly the aircraft to its limit without thought of the consequences – Habshiem accident.
The hazard with either design is in human judgement; pilots believing that they can achieve a manoeuvre whereas they cannot. Is this the phenomenon that we have seen in recent military incidents? Or are they like many civil accidents, just errors of judgement, human fallibility? If the latter, then a carefree FCS will do little more to help, but technologies that monitor the overall aircraft capability and detect crew error might improve safety, EGPWS is a good example.
For me Airbus has the edge, not for their FCS philosophy, but for their better understanding of the capabilities and limitations of today’s pilots in the current aviation system; we all require much more protection from ourselves than ever before.
