A fly-by-wire future?

It was the early 1980s and Airbus was tasked with developing a new design capable of competing with the ever-popular Boeing 737. A highly respected Airbus engineering test pilot, Bernard Ziegler, set up a meeting with Airbus chief operating officer Roger Beteille. Ziegler’s background included a stint with Dassault Aviation, where he worked on the Mirage fighter program. The Mirage, like the General Dynamics F–16, was among the first airplanes to have fly-by-wire flight controls. Ziegler was a firm believer, and in the course of just 30 minutes, convinced Beteille that the A320 should have fly-by-wire. It was a momentous event in Airbus’ young history.

Since then, Airbus went on to produce not just the A320, but the A330, A350XWB, and A380 families of airliners—all of them FBW-controlled. This set Airbus philosophically apart from Boeing, which had a tradition that clung to conventional flight control systems. The U.S. military has opted for FBW controls for its fighters, among them the Lockheed Martin F–35 Lightning and F–22 Raptor, and the Boeing F/A–18 Hornet and later versions of the F–15E Strike Eagle. By 2007 the first business jet to have fly-by-wire, Dassault’s Falcon 7X, debuted, followed by Embraer’s Legacy 450 and 500 (now renamed as the Praetor 500 and 600, respectively) in 2014. And even Boeing went to fly-by-wire with its Dreamliner—the Boeing model 787.

Fly-by-wire replaces conventional flight control systems, with their cockpit controls connected to cables, push rods, bellcranks, pulleys, and other mechanical components, with a control system that relies on electrical systems. Instead of cockpit controls being directly connected to control surfaces and other systems, pilot inputs are conveyed by digital electronic controls over wiring, hence “fly by wire.” For example, when a pilot moves the control yoke its movements are converted into signals, instantaneously processed and analyzed by flight computers, and then sent to flight controls and other systems. To preserve the tactile feel pilots expect from a yoke (or more commonly, a side stick), there are springs and cams that give an artificial control feel.

Envelope protection, autotrim

Fly-by-wire’s flight control computers are programmed to keep the airplane within the limits of its flight envelope. If the airplane’s flying too close to the stall, too close to V_NE, or too close to its limit loads, the flight control computers will command a resolution. Let’s say you’re flying so slowly that your angle of attack is approaching the stall. If you didn’t notice the stick shaker and other warnings and did nothing, the flight control computers will automatically lower the nose and command full power. Zooming toward redline? The nose will trim up and power will be retarded. Because airplanes with fly-by-wire typically have autothrottles, power management is totally automated.

In a steep bank, stick forces will increase to the point where the control stick will offer more resistance if you insist on going past the bank limits programmed into the flight control computers. It depends on the airplane, but typical bank limits are near the 30-degree limit, and pitch limits can be 30 degrees nose up and 15 degrees nose down. Go any further, and the airplane will automatically trim nose-down or nose-up, respectively.

Another great feature is autotrim. When you’re flying by hand and set the pitch and bank of a fly-by-wire airplane, the airplane automatically trims itself. This “set and forget” functionality means that you have near-autopilot precision that lightens the workload, and boosts safety in engine-out situations. Autotrim, which ordinarily trims the airplane to a zero-sideslip condition, will remove most of the yaw/roll forces with one engine inoperative, but leave a noticeable amount of asymmetric yaw so that the pilot is still kept in the loop.

Redundancy

FBW’s reliance on electrical power demands high levels of redundancy. For power, the main sources are the engines’ generators, and if there’s an auxiliary power unit it will have a generator as well. Then there will be two or more batteries aboard. In the very unlikely case where all those sources fail, there’s the final backup: a ram air turbine that automatically extends into the slipstream to drive its generator.

There will be at least two actuators each for the ailerons, elevators, rudder, flaps, spoilers, and trim systems. Same thing for the engine and hydraulic system controls. Position switches are installed so that information about control deflection and position can be measured and sent back to the flight computers. At least two pitot-static, angle-of-attack, and air data probes are on the airplane, as well as two or more attitude and heading reference systems, which also feed their measurements into the flight computers. These are the hearts of the fly-by-wire system, and there are at least two of them; some FBW airplanes have four.

Control laws

Although fly-by-wire has demonstrated its safety and reliability, things can go wrong. The system’s integrity is constantly self-monitored, beginning with preflight built-in tests. But should signal processing errors, or computer or control malfunctions occur, control law protections kick in to preserve control. Tasks can be shared by computers, or one computer may be able to serve as a fallback for the functions usually carried out by another.

Absent any problems, the control laws’ logic fully observes all of a fly-by-wire airplane’s functions. This is called normal law, or normal mode.

But should failures occur, successive laws automatically kick in. With each step down from normal law, system capabilities are degraded. The autotrim function is the first to go. But pilot control is retained. Depending on the airplane, there can be as many as four layers of control laws, or as few as two. Of course, the whole idea is for pilots to always have a measure of control, even if it’s heavily compromised.

The A320, for example, has its normal law, followed by an alternate law. In alternate law, pitch and bank protections go away, replaced by cruder low- and high-speed stability rules; in this law, the airplane can be stalled. Then there’s what Airbus calls direct law, which provides no envelope protections. Through all this progressive degradation pilots retain control of the airplane, but workload goes up. The law of last resort is what’s called “mechanical backup.” Now you’re down to using the pitch trim wheel and rudders for flight controls.

The Falcon 7X has three main flight control computers and three secondary flight control computers. There are four layers of control: normal, alternate, direct, and backup. In backup mode you’re down to pitch trim and rudder control.

Embraer’s fly-by-wire systems have two flight control computers and two control laws—normal mode and direct mode. There’s a lot to do in direct mode—autotrim, autopilot, and envelope protection all go away, making the airplane a handful to fly.

An ongoing debate

Fly-by-wire has always been a point of contention within the pilot community. Some believe that it amounts to a surrender of control to automation, a loss of pilot-in-command authority, and an admission of pilot ineptitude. Proponents argue that fly-by-wire makes for safer flights, more situational awareness, and lower workloads; they point out that pilots are responsible for more loss-of-control and other accidents than fly-by-wire—by a long shot.

True, there have been accidents and incidents involving fly-by-wire airplanes. In 1988 an A320 crashed during its first public demonstration flight at the Mulhouse, France, airport. Ultimately, the captain of the flight bears the blame for making a high-angle-of-attack, low-airspeed pass at 30 feet agl. But some blame the control laws. In the low-speed protection mode—called alpha prot—up-elevator commands were limited. As the end of the runway neared the crew tried to go to full power, but it was too late. The airplane settled into trees, killing three of the 136 passengers. But the airplane didn’t stall. This accident generated considerable controversy. Some believe the captain disabled the autothrottles. There were even allegations that the flight data recorder was tampered with, or even swapped out. A conspiracy theory even held that the crash was a plot to discredit Airbus.

A September 1992 A320 crash in Strasbourg, France, occurred during a night, circling approach when the pilots selected the autopilot’s vertical speed mode instead of the flight path mode.

Fly-by-wire has always been a point of contention within the pilot community.In May 2011 a Falcon 7X experienced a pitch trim runaway caused by a manufacturing defect that erroneously signaled that the airplane’s stabilator was pitching down. The horizontal stabilizer control unit responded with nose-up commands. The 7X fleet was grounded until a fix was installed on all airplanes.

And in 2009 an Air France A330 crashed over the Atlantic Ocean after its pitot-static system iced up and gave incorrect information, which caused the autopilot to disconnect. The crew failed to recognize that the airplane had stalled, and subsequently lost control as they struggled to hand-fly the airplane.

These and other accidents and incidents show that, yes, fly-by-wire airplanes are not foolproof, and that pilot error can still play major roles in their probable causes. But manufacturers of fly-by-wire airplanes claim vanishingly small failure rates—on the order of 10-9, meaning a one in a billion chance. Some pilots don’t like those odds. Others—especially those who fly with fly-by-wire systems—have become comfortable with them.

In some ways, this polarization doesn’t matter. Fly-by-wire and other automation-heavy systems are making their way into smaller general aviation airplanes. Some business jets now have brake-by-wire systems and automatic spoiler deployment on touchdown. Garmin’s Electronic Stability and Protection (ESP) provides flight envelope protection and is available in late-model piston singles. Garmin’s Level feature returns an upset airplane to straight-and-level flight with the touch of a button. In case of pilot incapacitation at altitude, Garmin’s Emergency Descent Mode feature will descend at V_NE to a safe altitude, and then level off. The company’s new Autoland system will automatically land at the nearest airport—after notifying ATC, squawking 7700, lowering the landing gear, and managing power. The system will avoid terrain and adverse weather—and even stop on a runway centerline and shut down the engine. All by pressing one button. ESP and level mode are available on several piston singles, and Autoland is now available in the Cirrus SF50 Vision Jet, Piper’s M600/SLS, and Daher’s TBM 940 (under the Safe Return, HALO, and HomeSafe branding, respectively).

And this may be just the beginning of more such trends. If you can program an airplane to land automatically, then auto-takeoffs can’t be far behind.

Email [email protected]