Flightsafety, you seem to jump into "negative thinking" to quick. Try to find reasons why the system would work, instead of only why it wouldn't. You would not need a "second layer of software" to get this system to work and a minimum amount of 2,5G would always be available as it is now. So it would always provide you with minimum or additional performance. I think people are having problems accepting a system like this because they think it would be very compex. It is very simple to calculate that risk. Here is the logic:
1. Get me (from a database and/or G load and current mass quantity and distribution sensors) the maximum current G-loading the aircraft can handle at this moment before there being a risk of it breaking into two bits.
2. Get me the distance, size and closing rate of the nearest obstacle in the flight path. (Easy peasy, since EGPWS has got all that info ready and certified!) Calculate how much G I need to avoid it.
3. Do this 200 x per second and keep updating the FBW with the lowest of the two values.
Et voila, you have a system that will protect you the best it can.
The problem of a Direct law button is that people would misuse it. If a pilot pulls up for an obstacle and "guesses" he will not make it he WILL push that button. So that means that the whole point of having a protection system is wasted since the pilot will override it when he panics and might damage the aircraft, thereby increasing the risk unneccesarily. Don't think aircraft are infinitly strong. Ask any aircraft engineer: aircraft have very definite G limits, and going aver them WILL brake them. Of course the 2,5Gs AI takes as the maximum are very conservative and not addapted to the current state of the aircraft. If you want to minimise risk you have to calculate risk, not guess it. Take for example sheduled performance: I've seen so many pilots taking their hands of the thrust levers before V1 because they think "the aircraft will never stop before the end of the runway". But 1: it has been calculated to do this, 2: it has been tested and physically proven to be able to do this and 3: how are you going to know by just looking? Defenitly if you've probably never done an abort from V1 in your life (like a lot of pilots never have.
The problem is that in an emergency you don't have time to calculate your performance manually so you need to have done it either on forehand or have a really fast computer calculate it for you in real time.
So you see flightsafety, in my system the "risk analasys" software IS the FBW software and does not consist if an extra separate layer to be overriden...
[This message has been edited by Frederic (edited 12 June 2001).]