Flagon
 

Well, I am a Airbus lover just because is the type I'm flying now, and I always love the aircraft I'm flying (mandatory for me). And I can tell you that I always and actually have control of the aeroplane, so I cannot understand what you say.

As in any other aircraft you may have abnormal/emergency situations you have to manage. Nothing new.

This is probably because you don't know the Airbus FBW aircrafts. If you do that you go to mechanical backup only, what isn't very wise. It's much better to go into alternate or direct law (through the computers). Maybe it sounds terrible for somebody who doesn't know about this situations, but I can tell you is quite simple.
ADR,s are controlled by pushbuttons. To push two buttons isn't difficult from my point of view.

I have flown B707 years ago (too many :{) and now A320. I love both, but for sure the Airbus is much much easier to fly (and in this one we are only two crewmembers :})

Trust me, it is just an aircraft. Of course you have to study as in any other, otherwise if you don't understand something you cannot complain. For sure there are things you don't like, again as in any other.

@Vilas:
 

I would suggest a change to (A380/A350) Multi Functional Probe.

I'm stuck on the 320 Mr Nooly and the bloody thing has been a constant headache for the past 10 years.

The Frogs can't help themselves complicating simplicity and have never got their act together since day one. For example their non-normal landing performance section has been changed FOUR TIMES during my tenure and gets more ridiculously complex each time.

Also their operating manuals (called FCOMs) were changed and became an even messier dogs dinner than the original ones they replaced. Here's an example - the procedure for refuelling with one engine running. Logic would dictate it would be found in the Supplementary ops section of the FCOM. Wrong! Its in the Aircraft Loading section FFS! :ugh:

I was waiting for this latest directive to dribble down to the 320 ever since that QF 330 did its dirty dive enroute SIN-PER a few years ago.

@ Gryphon

Good thots overall, but we have to face reality of the man-machine-interface of the aircraft.

As you know from reading my user background, I am very familiar with FBW and all it entails. And as you rightly point out, many folks do not understand. They think FBW is a glorified autopilot. It is not.


The curent architecture of the 'bus could easily allow for one or two backup modes, with last one being "direct" but with specified "gains and rate limits" based upon gear up or gear down and zero dependecne upon air data. If all the computers go tango uniform, all bets are off, but with just one and a clear indication it was the sole survivor, then a condition such as we had for the last 40 years would exist. No force feedback because most everything was a hydraulic pressure on an actuator. No auto throttle or VNAV, pure manual with the "standby gains and pitch rates". After all, no mechanical connections so you depend upon the electrons.

The current 'bus laws are confusing once outta "normal". Sheesh. Doze will jump in here and assert that the engineers programmed everything with pilot assent. But I question how many ever flew a FBW system with zero mechanical backup.

Seems that the engineers tried to preserve every "protection" they could as the overall system degraded. But there were a myriad of combinations and last thing I need is a multiple choice quiz when things go to hell in a handbasket.

So I think a reasonable reversion sequence would be:

- Loss of data, be it AoA or speed or altitude or attitude and maybe gee sensors. Autopilot disconnect and a clear indication of the reversion mode. Latch existing air/gee/AoA data as it existed for 10 or 20 seconds. Then go to the standby gains/rates and standby gee limits. No stall protection, overspeed protection, roll angle protection, no autothrottle, just a nice smooth flying jet with rate and deflection gains fixed upon gear up/down. You would think you were flying a neat design from the 70's or 80's.

What is wrong with that?

What I see from the drivers is the VNAV and other otto features that might help a single seat pilot as I was, but I was not carrying a few hundred pax.

If flying direct law is like flying the 737 then what exactly is the problem ... ?

CONF iture
Love it or hate it Airbus FBW is a different philosophy. The aircraft is designed with almost complete automation and very little requirements of raw piloting skills in mind. Perhaps it came before its time. I have said it before that the protection were designed to prevent the pilot from going beyond the flight envelope and it does a damn good job of it. What was perhaps not taken into consideration was that in a dynamic medium such as the air the aircraft could be pushed beyond those boundaries without any pilot action and that is where the design is found wanting. All these protections are triggered from data derived from one sensor or the other but the present system of sifting the data to ensure it's genuineness is being proved inadequate and is the cause of all these incidents. The answer to this will come from better sensors, better system of confirmation of data or even quantum leap of technology in measurement of airspeed, AoA etc. but definitely not from cables and vacuum gauges. Surely few automobile accidents are not going to bring back horse buggies. Direct law is short term condition from gear down to landing. It may not be vastly different from 737 but since you cannot practice it on line it is not your day to day experience so you are better off in alternate law which is almost similar to every day normal law minus the offending protections.

Vilas wrote:

Pretty bold statement there sport!

@ Gums

Sorry but I'm not prepared for designing a flight control system. I cannot help you in this task.

As I said there are things I would prefer in a different way (and I must say this is not the first of my wishes), as in any other aircraft I've flown.

My only intention was to fight against the legend, but you did it better:

Thanks.

Who's talking cables and vacuum gauges, what is needed is humility as our system, logic, sensors will never be 100% accurate and reliable so we provide a simple switch to get rid of any protection or automatism if required. Yes, you the pilot may have to protect the airplane from our protections ...
If a 320 pilot needs regular practice before flying simple direct law then something is obviously wrong, what happens the day the elevators quit ... ?

And AF447 would have been much better served with direct law than any other law ...

Derived AoA
 

I forgot to include one aspect of a good HUD that helps you when the AoA vanes are unreliable.

On both HUDs I flew, we had a fuselage reference symbol at the top of the display, An actual display of where the jet was "pointing", and it could have easily been just a piece of chewing gum or a grease pencil mark, heh heh. So in fairly wings-level flight the difference of the flight path vector from that fuselage reference line was your AoA.

CONF iture
You are misinterpreting what I am saying. I come from cable and vacuum gauges age but when I flew a320 I liked it as much as I liked the 747. I did not say Direct law is complicated but you are more familiar with alternate law so if possible why not keep to that. Elevators quitting cannot be easier than in A320. In direct law AF447 would have been better? I am sure you are joking but I am not laughing. AF447 would have been better served if all three pilots would have left the cockpit together. And I am not joking. A330 could not handle the pilots.

As flying on THS only is already so easy ... what's the deal about to have to trim for direct law ?

Inhibit that auto trim and AF447 reaches Paris.

CONF iture
I have no desire to restart AF447 all over again. AF447 wasn't going any where other than where it went. Put another two in front with same level of competence in a 747 and it will reach the same destination with another 150 Pax to give company. And sorry I meant stab jam and not elevator quitting

Nobody seems to have asked the question of WHY this is happening? Is it poor heating of the probes, or poor radars and poor manipulation and interpretation of the radar picture ? Could it be the weather becoming more extreme or is it because there are simply more aircraft in the air meaning there are more incidents?
I do not remember any aircraft of the previous generation reporting such problems.
The one thing that has surprised me is that the refined FBW laws and architecture of the A330 and later aircraft where it is very difficult to get the aircraft into Direct Law ,have not found their way back into the A320 family.

tubby, yes WHY … and yes, and yes, all of the above.
The difficulty is in identifying the dominant parameters; reduced heating, power consumption, etc, vs different airflow patterns around new designs.
I would start with the technical aspects, check the changes and the assumptions made about change … ‘there will be little or no effect’, then check why the designers thought that way, what assumptionswere made in the design and operation … why.

Previous types did not have/use AOA, its only now that we rely on it that the failures are noticed.

A small but important clarification I think
.. as an input to FBW control laws.

AOA sensors to drive various functions has been around for ages, and in some cases it's a safety-critical function, equally as much as for FBW. (I'm thinking any pusher-protected aircraft here, for example). So at least some aircraft have been "watching" the performance of AOA vanes for quite some time.

But it is odd that we seem to be getting more "issues" with novel forms of icing in the relatively recent past. At least some people are suggesting that the only logical explanation is that it's a change in the atmosphere of some kind - global warming? pollution? aircraft flying in different parts of the atmosphere more often (either vertically or geographically)

I think that you can safely assume that there are indeed people asking WHY - everyone building sensors, and everyone spec-ing them, is asking themselves what they have to do extra now that they didn't do before. There are already new regulations, and more on the way. but since we still dont understand all the physics behind this, it's a somewhat empirical reaction - better than nothing, and it should help, but how do we know it's enough?

MFS - safetypee has the answer, I think.

"Previous types did not have/use AOA, its only now that we rely on it that the failures are noticed."

I am convinced that the complexity of the current FBW systems leads to significant 'unexpected consequences' as designers add extra comparators and check logic to prevent malfunctions due to malfunctioning detectors, and each 'addition' adds its own failure complications such that driving to the root problem is extremely difficult. As has been said many times, having 'majority voting' was seen as the obvious and correct answer, but we appear now to be seeing 'majority errors' leading to isolation of the correctly functioning device with serious consequences.

Where then do we go? Do we add another sensor or 3 to the current group of 3 to give a 'casting vote'? Surely we unfortunately return to the need to have pilots who can

a) Easily wrest control from the malfunctioning system - DESIGN and
b) then fly the aeroplane as it should be flown until the wayward HAL can be sorted out - TRAINING.

The prevailing 'addiction' to the extremely clever FBW systems and an apparent undeniable belief in how 'wonderful' and 'infallible' it all is needs to change. We need to recognise that it is indeed 'wonderful' and 'infallible' when all works correctly, but when it doesn't, it can be a nightmare and push workload through the roof - and this does seem to be viewed as blasphemous by many.

Which method is preferred in the sim ?
Is it to set it on both SEC only ?

It may also be that the operating norm has changed a bit: folks are more willing to risk / fly into such weather due to the much better kit that is currently available.

@Flagon

Sorry, that's not the answer in my opinion - my point is that aircraft with stick pushers have been monitoring AOA (and AOA deltas side to side) for a long time now. One would have expected that those types would have been seeing AOA anomalies.

Part of the story may be that FBW aircraft are more "exciting" and so get more "press" - witness the enthusiastic discussion on these forums of the details of FBW implementations, compared to people asking about gain changers and non-linear gearings and such! So the AOA anomalies on FBW aircraft are better known.

I do agree that the more complex systems are difficult to get "perfectly right". I will say that no-one designing and certifying these systems is in any illusion over this complexity and its implications for the design - bold statements about how great a system or aircraft is coming from the mouths of marketing/sales people don't always reflect the opinion of the engineers. Any engineer releasing something is of course confident he's done the best he can, but any good engineer also knows nothing is perfect.

I'm afraid I disagree. For 'a long time', stick pushers worked on IAS alone, and for an AoA driven pusher to 'malfunction' would require it to 'achieve' a critical AoA in the first place - in which case its 'shout' was probably valid!

The problems are occurring because AoA is now so deeply embedded in the control system that a malfunction has a far more serious effect then ever before. If I recall PGF correctly, a 'sensible'/working AoA was 'voted out' through the logic circuits. The 447 AoA problem was caused - only once a stupid AoA had been achieved - and the IAS logic removed the stall warning. Not really a 'problem' with the AoA sensor itself which I understand worked correctly - again, a problem with its interface with the system. Agreed they should not 'freeze' but equally their effects when so frozen should be easily negated. While AoA represents an excellent performance guide, you do NOT need AoA to fly an aircraft safely under normal circumstances.

Quite honestly, i was surprised how many systems are affected by a failed AoA probe in a 737. We had quite a few problems with them a few years back and one ended up well past the end of a runway as a result.

Photos: Airbus A400M Atlas Aircraft Pictures | !!!!!!!!!!!!!!
It seems the A400 has such a switch - Is it the red guarded one on the left side on the upper panel ? - I don't know.
Now, following the last incidents with protections going crazy, when Airbus is going to install a similar switch on all types ... ?

I will guess that you meant one does not need an AoA indicator for a pilot to read in order to fly. AoA will be there whether we know what it is or not. :}
/pedantic mode off

I know of one type that's been using AOA driven pusher functionality since the late 70s, which was why i was saying a "long time". I'm actually quite surprised to hear of pushers functioning based on speed, since that would be no protection against stalling at elevated 'g', and stalls at 'g' have been part of the cert requirements for a long time as well.

While it's true to say that most scenarios for a stuck/frozen AOA require you to have been at that AOA when the system was working 9just before failure0 it doesn't mean that the warning will be valid. In a similar fashion to the scenario AB has laid out, I can conceive of the AOAs ona pusher equipped aircraft freezing at relatively low speeds (perhaps shortly after TO) at which point you are still well clear of pusher. if the crew was unaware and the system kept treating the AOA as valid 9albeit a constant value0 then as you accelerated and climbed the pusher activation angle would usually drop - an aircraft retracting slats would probably see a major reduction in the pusher AOA at that point, in fact. Which might bring the activation angle BELOW the frozen sensor value, triggering the pusher to fire. The only way to stop it would be to get slow and back in the original config - and slowing down is not something that comes to mind as a reaction to pusher activation.

We typically consider erroneous pusher activation as a potential loss-of-control event, so while it's not quite as bad as the Ab scenario, it'd be pretty bad news. (Its easier to turn off a pusher than to turn off FBW systems, and the pusher is only a small component of the FCS, so you degrade the aircraft less by turning it off. But it wouldn't be fun getting to that point)

Could someone explain what a modern 'software controlled' flight system would do in the following circumstances?

I am in the ITCZ, in cloud, with moderate turbulence and in significant airframe icing conditions but in a (reasonably) 'steady state' condition of speed and power:-

a) Two Air Data units decide my speed has fallen significantly and I appear to be flying at an unsafe speed OR

b) Two Air Data units decide my AoA has reached levels that are unsafe

So - does the system quickly take control and manouevre my aircraft for me OR does it just alert me to the issue and enable me to fly pitch and power while I sort it out?

Flagon

Details would require you clarifying deeper the exact issues, but in principle I would say:
a) This is a double failure, and (from your post) determined as such by the systems. Therefore Flt Ctrl laws will usually degrade e.g. to Altn Law, protections reduce i.e. you will be able to sort it out if you correctly assess the situation
b) If 2 ADRs determine they have a valid, and similar AoA, they will be believed and vote "out" the 3rd (potentially correct) AoA, and determine this as a single failure, hence you may not be able to directly override the ensuing protections. A major part of the unreliable airspeed drill is to potentially resolve the issue of the lone ASI being the correct one...

The 2nd scenario is essentially the recent OEB. However, the probability of 2 AoA probes going into error, in a similar fashion is low (very low). The issue the OEB raised is where the AoA probes, say "freeze", and you now alter the environment such that the frozen AoA value goes from "safe" to "hazard" e.g. reflecting reduced buffet AoA at high M number. What the OEB does is give you a course of action to degrade the Flt Ctrl laws.

It should be emphasised this has occurred once (only) in all the years of Airbus FBW Ops, and in the one case it occurred, in fact the system did drop itself into Altn Law IIRC? Easy to slam the system as a result, but as we have seen, obscure, or even simple but un-envisaged, failures in more classic designs result in (near) accidents (737 AMS, BOH etc.)

Flagon
Turbulence, ITCZ, airframe icing do not alter flight control laws. Like any other aircraft there is a system of redundancy to mitigate the effect of failure of a device. There are three ADRs which collect AoA info from three AoA sensors also they collect pressure data from Pitot/static probes . Normally the averaged reading of AoA info from ADR 1+2 is converted to speed as Valpha prot and Valpha max and displayed on the speed tape but these are not speeds but AoAs. If one ADR malfunctions and its reading strays it is automatically rejected and flight control laws do not change. This is termed as self detected failure. But if two ADRs fail at the same value which is different from the only correct ADR and is between these protection values then Alpha protection will be triggered and aircraft will maintain this speed(AoA) by doing whatever it takes normally pitch down but can also pitch up. Since it is treated as single failure normal law prevails and pilot cannot over ride it. So the OEB/AD tells you to get into alternate law and override. Pitot failures are also treated as ADR failures and handled similarly when single failure but when not self detected pilot has to switch of the faulty ones and fly with the correct one or has to diagnose all are faulty and apply memory items if required and/or apply paper procedure. Recognising unreliable speed is the tricky part.The ECAM will not tell you that. Erroneous AOA data can make system act on its own and with erroneous M/CAS data you must be able recognise and act immediately on your own.

[vilas - not quite sure why you posted "Turbulence, ITCZ, airframe icing do not alter flight control laws." - they certainly alter 'flight'.[

Why, then, does AB not offer the option to the crew to decide what is erroneous and what to do in the 2 ADR case rather than decide on its own course of action which might be wrong?

Anyone with other FBW system experience to comment?

Flagon
I posted Turbulence, ITCZ, airframe icing do not alter flight control laws because they don't. What changes the laws is failure of sensors or probes due to what ever reason. Every day aircrafts negotiate these conditions successfully. These are specific cases of equipment failure(anti ice) which can be rectified. Putting FBW technology in the dock is like throwing out the baby with bath water.

It is actually the third known case of AOA sensors blocking at a similar value. In 2 cases the crew had to select ADRs off to take back control of their pilot proof Airbus.

vilas - "I posted Turbulence, ITCZ, airframe icing do not alter flight control laws because they don't." - are you then under the impression that someone thought they did?

3rd on Goodrich AoA.

Goodrich Pitot and Thales AoA sensors seems to be the proper combination for Airbii.

Until some other still unknown malfunctions appear ... like in the Qantas case.
The logical way would be to implement the protection kill switch.

If icing of AoA sensors and Pitot/static probes have caused a few problems in some million hours the most logical thing to do is to improve the heating of those probes which should not require a technological marvel. Just because some people and many of them are non airbus pilots who are not comfortable with the idea of hard protections you introduce a Kill protection switch which will bring in the human element with human error. If a few aeroplanes are lost because of the operation of that killer switch at the wrong time then what? This cure may prove deadlier than the disease. In the interim period a method is given to override them. I do not agree you need to go in direct law at the drop of a hat. Don't bring in AF447 the only switch it needed was to switch the pilots with competent once. I say that with sadness because they lost their lives and there may be reasons why they were so.

As there is extensive experience with FBW planes that have a pilot override we could actually use that experience. As far as i'm aware there was no 777 incident because of that, unlike airbus where a few incidents have happened due to hard protections (bilbao, lufthansa, qantas etc).

However, given the extremely low number of incidents caused by the hard protections there is probably no regulatory need to change anything and apparently the insurance companies are quite happy as it is as well, otherwise they would require higher premiums.

Denti
Boeing FBW and AB FBW are based on different philosophies. AB is maximum automation with auto trim and alternate law in degraded mode. In case of double failure of ADRs or IRs when computers cannot self detect the job is given to the pilot, the direct law comes in as a short term phase and alternate law is recovered after pilot identifies and switches off the faulty component. The other case is in A320 where direct law comes in as a flare mode of alternate law after gear is down to help you land. Since there is no Q or any tactile feed back in the stick as is the case in conventional aircraft or Boeing FBW the direct law handling is different than in normal and alternate law. So there is a an interim procedure to enable you override protections, giving a switch to induce direct law in complicated situation for long term may not be a good idea and nor is it required if pilots follow correct procedures. Auto trim in alternate law driving the stab to its limit has happened as a result of mishandling and was pilot induced. Airbus philosophy has its own followers and is quite popular amongst them.

If it was that easy it would have been done by now since Perpignan in 2008.

Just train you guys with a proper procedure not a Mickey Mouse one.

Just train you guys with a proper procedure not a Mickey Mouse one.
As far as I know the unprotected 737 don't fall at a greater rate that the protected 320 then why ?

Nothing is interim, the procedure is here to stay forever.
As a manufacturer you have the responsibility to make it simple, not to go and play with unguarded switches on the overhead panel in the middle of a loss of control.

No you need to inhibit protections going mad at the drop of that hat.

It tells all how you see yourself ...

CONF iture
Perpignan was the result of wrong maintenance (washing) procedure. Just like the 757 or 767 I am not sure they failed to remove the masking tape from static and it resulted in fatal accident of the non FBW aircraft and Boeing shelled out a hefty sum for faulty design.
As far as 737 is concerned why has Boeing forsaken manufacturing of conventional aeroplanes and switched to FBW you can ask them. 737MAX was launched not because Boeing wanted to but their biggest customer threatened to switch to AB Neo.
whether the procedure stays or not time will tell because OEBs are not permanent changes and if it stays the alternate law meets the purpose and does not require direct law. AF447 I quoted with regret and only because you are fond of closing your eyes to crystal clear evidence of incorrect UAS and stall recovery procedure by the crew to shift the entire blame to the machine and It has nothing to do with my competence. There are any number of pilots out there who would have done what was required.

It does not matter, the valid sensor was silently discarded and the other sensors were lying together with already the potential to wrongfully trigger a protection. Whatever the reason, maintenance or anything else, known or still unknown reasons ... a simple tool is needed to inhibit wrongfully activated protections.

What was exactly the faulty design on that Aeroperu 757 ?
You tell me ...

If there are faulty design on B products, is it good enough to keep silent on deficiencies of the A ones ?

And your point is regarding the accident rates of the types ... ?

Quote ?

Actually you're the one blaming this crew 100% whatever the type they would have crashed :