How safe is (airbus) fly by wire? Airbus A330/340 and A320 family emergency AD

[DozyWannabe]

Even with the "button" activated, the T7 remains computer- (or at least electronically-) controlled. The only difference is that the protections are disabled and some of the functions are bypassed. Airbus's temporary solution of switching off ADRs will essentially give you the same result.

It's not an ideal situation, certainly - but at least the problem has been diagnosed and a fix is forthcoming. I think this only affects a relatively small number of the current fleet.

Additionally, those calling for a manual switch to Direct Law demonstrate either a lack of understanding of, or in some cases wilful disregard for, the way the system was designed (by a team that included pilots) to operate. Hard protections of the kind identified as an issue in this case are disabled in any law outside of Normal and the aircraft will follow any command given by the pilot in this circumstance. Alternate Law is far closer in response terms to the handling characteristics Airbus FBW pilots encounter on a daily basis and as such makes far more sense than Direct in terms of keeping aircraft behaviour as consistent as possible in an abnormal situation.

It's also worth pointing out that in the situation described in the EAD and OP, Alpha Prot will not suddenly order a fistful of control input.

[Bpalmer]

Stall AOA change due to Mach

The stall angle of attack does not start to increase with Mach until above about .3M, which in the "shortly after takeoff" range is about 200 knots. Obviously, the indicated equivalent to that goes down with altitude.


So, you have to be maneuvering with a high enough g load to have a fairly high angle of attack, then be in the right kind of icing conditions for the vanes to freeze in position, then increase your Mach.


If crews are made aware of it (and they certainly should be made aware), and they see the warning signs (alpha prot on airspeed indicator in an unusually high place), then they can take preventive measures : Don't go any faster, and turn off two ADRs to disable the alpha protect.

AF447: >>ALT II (b) killed 447.<<
ALT 2 b, didn't kill them. They killed themselves. More specifically, the PF in the right seat killed them all by not being able to fly straight and level without the flight director.

[737Jock]

The OEB does identify the warning signs to look for PRIOR to activation of the ALPHA PROT. So we should realise "what is going on". Admittedly, switching off ADRs is not very comforting.

I was Saying that the system is giving no feedback on what it is doing. In other words there is no feedback given that alpha prot is active. No Ecam, no message on PFD, no feedback through sidestick. If the system would drive the sidestick to the FWD stop and you can't pull hard enough to make the nose come up you know what is going on.

The OEB's identifies warning signs after an A330 nearly fell from the sky... So I conclude that it is NOT that easy to realise what is going on. And even the original solution of turning all ADR's off was based on a wrong diagnosis, although it fixed the problem by returning control to the pilots.

But why does airbus design a protection that cannot be overrided by the pilots through simple sidestick input/ possibly holding the AP disconnect button to get full control and deactivate the protection.

It's also worth pointing out that in the situation described in the EAD and OP, Alpha Prot will not suddenly order a fistful of control input.

How would you call a gradual and continouos nose-down input that cannot be overrided by the sidestick? Half a fist full?

It's clear that you have zero understanding of what is going on. A pilot is trained to intervene through control-inputs, initial pilot training is the basis for this.
The airbus system, thinks it is superior and does not allow the pilot to override protections that are not always correct.
In short the system is designed to create a struggle for control between pilot and FBW system, that can only be resolved by turning off ADR's.

[roulishollandais]

After 10 -15 and more threads about "what killed AF447" nobody cood explain in detail the laws, the stability, the systems of that damned flying computer. The best of us trie during three years and a half. How may it be sure pilots would succed??

But it has been made sure that INDEPENDANT AoA sensors could help.
And now they continue with embeded AoA!!
It is CRIMINAL.
rh

[rudderrudderrat]

Hi 737Jock,

A pilot is trained to intervene through control-inputs, initial pilot training is the basis for this.

I agree.
It is interesting to note that Airbus went in the direction of the computer has control; Boeing designed the 777 so the pilot has ultimate control.
See para 11.3 of B777TheAvionicsHandbook

"What should be noted, however, is that none of these features limit the action of the pilot. The 777 design utilizes envelope protection in all of its functionality rather than envelope limiting . Envelope protection deters pilot inputs from exceeding certain predefined limits but does not prohibit it. Envelope limiting prevents the pilot from commanding the airplane beyond set limits. For example, the 777 bank angle protection feature will significantly increase the wheel force a pilot encounters when attempting to roll the airplane past a predefined bank angle. This acts as a prompt to the pilot that the airplane is approaching the bank angle limit. However, if deemed necessary, the pilot may override this protection by exerting a greater force on the wheel than is being exerted by the backdrive actuator."

[DozyWannabe]

Truth be told, both approaches are designed around the pilot - the only difference is the philosophy behind the implementation. With respect, I'm not really inclined to open that can of worms again for now...

[Young Paul]

With regard to the OP - how safe is (airbus) fly by wire? The answer is - statistically, very safe. What is the hull-loss rate for airbus FBW aircraft, and how does this compare with (say) Boeing non-FBW aircraft? And how many of those hull losses can be classified as a failure either of FBW or of SOP associated with the FBW system?

Now let's imagine we put in a big red button that switches off the FCCs and returns the aeroplane to direct law (say). Please can someone do a risk analysis which compares the current setup with the benefits of switching off all these protection systems and replacing them with a pilot seeking to interpret raw data at short notice in extreme circumstances. And then add to that the risks of people overriding safety systems at times when it's not appropriate, or because they want to get a bit more out of the aeroplane - perhaps like switching off the alpha floor system so that they can do a demonstration high angle of attack flyby at 100 feet ....

[FANS]

moving side sticks and moving throttles - can't understand why they don't (but then I'm not French)

[A and C]

In answer to the question

The Airbus is very safe !

Is the A320 as safe as the Boeing 737NG, as an aircraft the Boeing is probably marginally more safe as if all the electrics & hydrulics fail the flight controls have manual reversion. Having said that I can't think of an incident were an airbus has lost enough systems to force the crew to fly it on the rudder & stab trim.

Rather than a debate about the merits of the aircraft I think an examination of why the crew from a major airline could not set a safe pitch & power combination when the airspeed system was malfunctioning or why three pilots let the Autothrottle come back to flight idle and the airspeed drop to the point were the aircraft stalled into the ground when simply pushing the throttles forward would have resolved the situation.

I would suggest that the de-skiling of pilots who are being forced by the SOP's in some companies to be over reliant on the automatic systems is far more of a threat to flight safety than the mechanical reliability of the aircraft be it Boeing or Airbus.

[DozyWannabe]

Originally Posted by FANS

moving side sticks and moving throttles - can't understand why they don't (but then I'm not French)

That approach has its own problems, mainly in increased complexity (i.e. more things to go wrong) and limited benefits, once the design is understood as a whole. The T7 feedback relies on the same kind of sensors that are causing a problem here. Thus far there has not been a well-known incident where bad data caused problems for the feedback, but that doesn't mean it won't happen.

For the record, the Airbus FBW design team was multi-national, not just French.

[FANS]

That approach has its own problems, mainly in increased complexity (i.e. more things to go wrong

The complexity & reliability of having two side sticks moving in tandem isn't a valid argument; yes there's more to go wrong but you'd hope that risk associated to this would be miniscule.

limited benefits, once the design is understood as a whole

From a training perspective, I'd say say there are huge benefits to having them both move, as cadets rarely understand the "design as a whole" from the outset!

It's still a very safe aircraft!

[DozyWannabe]

There are benefits and drawbacks to both connected/force-feedback and independent implementations which I've detailed in depth before. I don't think either approach is inherently better than the other in an objective sense - some may feel differently, and that's fine!

[IcePack]

Sometimes if an aircraft starts "gyrating about" pulling G's etc it can be nigh impossible to get your hands on any switch/knob to turn it off. Those that think differently have not been in the rough stuff. So trying to turn 2 ADR's off or get into emg elec config may not be that easy.

[CONF iture]

Originally Posted by Young Paul

Now let's imagine we put in a big red button that switches off the FCCs and returns the aeroplane to direct law (say). Please can someone do a risk analysis which compares the current setup with the benefits of switching off all these protection systems and replacing them with a pilot seeking to interpret raw data at short notice in extreme circumstances.

But the aim to switch 2 ADRs OFF is just exactly what is requested from a crew to deactivate a mad protection, with the associated risk to turn off 2 IRs instead ... Not easy to locate the proper switches on the overhead panel in the middle of such critical situation.
What about a single red guarded switch in the middle of the dash to give back control to the crew ... ?

[Kimon]

@ Confiture

Yes, the A400M has a red panic button to go into Direct Law.

[BOAC]

Originally Posted by yp

replacing them with a pilot seeking to interpret raw data at short notice

- I suppose it depends whether an AB pilot can do that? You may well have a point there.

Well done A400M. Why, I ask? Is it because it will be flown by pilots?

[A4]

Not easy to locate the proper switches on the overhead panel in the middle of such critical situation.

ADR is simple push button, IR is a rotary knob which has also to pulled before being turned so you'd have to be pretty hamfisted to get the wrong one.

They're just above the Captains head so it's a bit of a stretch for the FO. Who's going to be PF in the reversion from uncommanded Alpha Floor to ALTN Law..... CM1 I would imagine so not an ideal set up for carrying out the switching - but if you're wise to it and practice reaching across before hand it may relieve a bit of the drama.

A4

[CONF iture]

Originally Posted by A4

ADR is simple push button, IR is a rotary knob which has also to pulled before being turned so you'd have to be pretty hamfisted to get the wrong one.

An IR pb is very similar to an ADR pb.
An IR rotary knob is something else.
At least that's the setup for a 330 ...

Originally Posted by Kimon

Yes, the A400M has a red panic button to go into Direct Law.

That's very interesting ... would you have more info ?

[Kimon]

@ Confiture

The A400M was engineered ground-up with the French Air Force's savoir-faire.
When you are transporting hundreds of dedicated military personnel who've cost the taxpayer many trillions, you don't have time to start fiddling with PRIMs, SECs, ADRs, IRs AFM, FCTM and FCOM.
As soon as I got the exact details, I shall gladly share them.
Now, hazarding a guess, I'd bet the A330 MRTT has the same setup but I can't confirm it but I'll find out.
The A350 will surely have the panic mode.

[DozyWannabe]

Originally Posted by IcePack

Sometimes if an aircraft starts "gyrating about" pulling G's etc it can be nigh impossible to get your hands on any switch/knob to turn it off.

The Alpha Prot response is not going to cause significant gyrations - it's a gradual thing - unlike the A300 protections it will not command significantly opposite pilot input because it is designed to hold a steady flightpath while giving as much authority to the pilots commands as it can within the flight envelope.

Personally I think this talk of panic switches is premature, but whatever floats your boat, I guess...