How safe is (airbus) fly by wire? Airbus A330/340 and A320 family emergency AD

[A33Zab]

Found following article in my archive folder, I don know the source nor date published.

5. ENHANCED DUAL INPUT AWARENESS

All Airbus FBW aircraft are fitted with uncoupled sidesticks. This choice of the sidestick was taken prior to the launch of the A320 due to the obvious benefits it provided for the operation of a Fly-by-Wire aircraft. The choice of non-coupled sticks, also taken at that time, was dictated by the available technology. With the technology of the eighties the only real choice was to couple both sidesticks mechanically; this would have unduly increased the complexity of the system and would have left the aircraft prone to failure cases (stick jamming) and common point typical of (and unavoidable) "mechanical" aircraft. With over 10 million FH of the AI FBW aircraft and over 15000 pilots qualified the initial debate on the merits and drawbacks of non-coupled sidesticks has ceased because flight crews have learnt to appreciate the advantages brought by the current system.

The feed-back received at Airbus from operators and pilot unions and the routinely analysis of in-service events indicate that there are still two areas where some pilots would appreciate some enhanced feed-back of "what the other pilot is doing".


These areas are:

• Training flights.
• In a high stress environment there have been prolonged and undetected dual input situations.

Airbus Industrie continues to explore all possible features available which might provide a reply to these concerns. Research activities have been conducted over the past months in the following areas:

1. Evaluation of electronically coupled sidesticks
2. Evaluation of features which may prevent prolonged dual input situations

5.1. Electronically coupled sidesticks

Electronically coupled sidesticks (so called active sidesticks) offered by various aerospace equipment manufacturers have been evaluated and analyzed by Airbus Industrie. Despite the diversity of the proposed solutions, all the systems rely on high speed torque motors to move one sidestick to the same position of the other sidestick. All suppliers provide adjustment capabilities (forces, thresholds, displacements...) to match the sidestick characteristics and feel to the current Airbus sidesticks.
The evaluations of electronically-coupled sidesticks covered the following issues: System safety analysis, integration to the AI FBW/AUTOPILOT architecture, pilot interface and simulator tests in normal/abnormal/emergency scenarios.
Our underlying premise during this evaluation was that the coupled sidesticks should not degrade the reliability, the feel, the consequences of failure cases and the pilot interface of the current non-coupled sidesticks.

The main items identified during this activity were:

a) The increased complexity of the coupled sidestick makes it very difficult to closely match the current feel of the Airbus sidestick which is appreciated by flight crews.
The "copy" function of the active sidestick is accurate.
The implementation of coupled sidestick would require a modification of the current simple principle of "algebraical addition of both sidesticks orders".

c) The current capability for the PNF to instinctively take control of the a/c, with or without the use of the priority pushbutton, must be kept.
The identification of the sidestick movements of a trainee under normal circumstances is improved. There is a clear benefit for the training scenario.

e) Due to the small deflections of the Airbus sidestick in high stress situations it is difficult to clearly identify what the PF is doing with the sidestick, namely if the motions are small and rapid.

f) When the PNF makes a small correction to the PF, here again in abnormal or emergency situations, the input from the PNF will, in most of these cases, go undetected.

g) Motion of the PNF sidestick can be distractive and in most circumstances can drive the attention away from the most important parameters or cues to be monitored.

h) There is a clear risk for injury if the sidestick hits the hand of either pilot following any runaway of the control system.

i) The active sidesticks introduce a number of new failure situations (runaway, jam...) and a common point which are significantly more severe than with the current AI system. To minimize the impact of these failure cases major modifications to the current flight control system architecture would be required.

Based on the analysis of these results it was concluded that:

a) The current technology for active sidesticks provides a marked improvement relative to that available at the time of launch of the A320: it improves the PNF awareness of the PF actions during training flights.

b) With characteristics of the AI sidestick, dual input situations can remain undetected with coupled sidesticks specially under stress situations (which is where the dual inputs tend to occur).

c) The increased complexity of the sidestick assembly and of the integration to the AI FBW architecture will unavoidably reduce the overall reliability of the system.

d) Work should be launched to develop alternative means to improve the detection of dual inputs situations since it was demonstrated that the coupled sidestick cannot provide a 100% detection rate.

5.2. Dual input detection enhancements

5.2.1. Description
As a complement to the active sidestick evaluations, various new features have been developed to improve the crew awareness of dual input situations on the FBW aircraft. The main objective of these features is to provide warnings which will prevent long duration dual input situations.
The following visual, aural and tactile cues have been tested with the active participation of pilots from Airbus, airlines (Cathay, DLH, Sabena), unions (ALPA, SNPL, German Cockpit) and Airworthiness Authorities (CEV, CAA, FAA, Transport Canada).

VISUAL CUE

When both sidesticks are deflected simultaneously (for more than 0.5 sec), the CAPT and F/O captions of the Sidestick Priority Light on both glareshields are illuminated flashing in green. As soon as the priority p/b is pressed on either sidestick, the glareshield lights revert to the classical priority configuration (CAPT and arrow or F/O and arrow). The principles of this visual indicator are identical for all FBW aircraft.

AURAL CUE

A "DUAL INPUT" audio message is triggered when both sidesticks have been simultaneously deflected for a certain time. The timing of the audio message has been adapted on the A320/A321/A31 and A330/A340 families due to the different systems architecture such that, on all cases, the message is triggered after the illumination of the glareshield lights. In this way, there is a degree of sequencing such that the aural warning will only be triggered if the dual input situation is prolonged.
The "DUAL INPUT" audio is repeated every 5 sec. It has the lowest priority of all the audio (voice) messages but can be generated simultaneously with any other non-voice audio warnings.
When the priority p/b is pressed on either sidestick the warning is canceled except if it has already started (i.e. it cannot be interrupted).

TACTILE CUE (BUZZER)

The sidestick is fitted with a small electrical motor which rotates an unbalanced weight and thus generates a vibration of the sidestick. The level of vibration depends on the rotation speed and on the weight of the rotating mass.
When both sidesticks are deflected for a certain time, the buzzer on both sidesticks are activated to produce a series of intermittent vibrations. Since the level of buzzer vibration could not be increased at will due to various reasons (e.g. rattling noise on the lateral console) the principle of intermittent "shots" was selected to improve the detection of the buzzer activation.
The timing of the buzzer activation has been adapted on all the FBW aircraft such that the buzzer is activated simultaneously or slightly after the illumination of the glareshield lights.
When the priority p/b is pressed on either sidestick the buzzer is stopped immediately.

5.2.2. In-flight evaluation campaign

The in-flight evaluation process was split into two phases: An initial period devoted to the definition of the various features and a demonstration phase where the visual, aural and tactile cues were presented to non-AI pilots in various scenarios. The tests were conducted on the in-house test A340 and A330-200 aircraft.

The initial development and definition phase concentrated on:

a) Adjustment of the activation thresholds

b) Relative timing of the three features

c) Adjustment of the buzzer vibration levels and frequencies

d) Adjustment of the quality and level of the audio message

c) Simulator and in-flight evaluation in various normal, abnormal and emergency scenarios

d) Definition of an evaluation program for non-AI pilots (airlines, unions, Authorities)


During the demonstration phase the modifications were presented to pilots from airlines, Airworthiness Authorities and Unions. In each flight the guest pilot flew the aircraft and the AI pilot made unannounced dual inputs. The dual inputs were performed in the following scenarios:

• Precise tracking tasks in the normal flight envelope (tight turns, manual ILS approach)
• Take-off rotation
• Flare for landing and GA
• High speed dives entering the HSP and triggering the Overspeed Warning
• Stall Warning in Alternate law
• Low speed maneuvering during approach
• Maneuvering in the AOA-prot range (Avoidance maneuvers and GPWS pull-ups).

At the end of the flight the guest pilot debriefed the flight and gave his overall opinion of the different features presented; the AI pilot indicated the number of cases where the dual input situation went undetected.

5.2.3. Results of the in-flight evaluation campaign


There was a clear consensus of the evaluating pilots on the following issues:

• The sidestick buzzer does not interfere in the normal piloting tasks
• The illumination of the glareshield lights may go unnoticed specially in daylight conditions
• The sidestick buzzer is probably the only useful cue in high stress situations
• All of the features improve the dual input detection capability

There was also a general consensus that these features, even if frequently requested by the pilot community, are not really mandatory since nothing, other than crew discipline, can prevent dual input situations. The proposed features will reduce the likelihood that these situations last while remaining undetected but will not prevent them.

5.2.4. Conclusion

a) The definition and inflight evaluation of the aural and tactile warnings is completed.

b) These features will be presented for Certification.

c) The visual, aural and tactile cues will enhance the detection of dual input situations. These features will not prevent dual inputs, but the likelihood of having prolonged dual input situations will be greatly reduced.

d) These features may be proposed as Standard Options grouped as follows:

• Light only (option already available)
• Light + Audio
• Light + Buzzer