Fly-by-Wire and Flight Envelope Protection

Fly-by-wire replaces the cables, pulleys and push rods between the flight deck and the control surfaces with wires and computers. Sensors measure the pilot's inputs, flight control computers turn them into commands, and hydraulic or electric actuators move the surfaces. Because a computer sits between pilot and surface, it can shape the aircraft's response, trim automatically, co-ordinate turns and keep the aircraft inside its safe flight envelope.

Every Airbus airliner since the A320 flies this way, as do the Boeing 777 and 787 and most modern combat aircraft. For pilots the subject explains why an Airbus side-stick commands a flight path rather than an elevator angle, why the aircraft handles differently after certain failures, and why the protections that make it so hard to stall in normal operation can vanish when sensor data become unreliable.

Fly-by-wire principles

In a conventional powered control system the control column still moves a mechanical linkage that opens a valve on each actuator. In a fly-by-wire (FBW) system that linkage is replaced by electrical signalling. Concorde, which first flew on 2 March 1969, used analogue electrical signalling for its main flight controls, retaining a mechanical backup. Digital fly-by-wire began on 25 May 1972, when NASA pilot Gary Krier flew an F-8 Crusader controlled by a computer taken from the Apollo programme. It had no mechanical backup, only an analogue emergency system that was never needed. Airbus brought full digital fly-by-wire to airline service with the A320, first delivered in 1988, together with side-sticks and flight envelope protection. The 777 was Boeing's first fly-by-wire airliner.

The computers do not simply relay stick position. They apply a control law, a set of equations that links the pilot's input to the aircraft's response. In Airbus normal law, fore and aft stick demands a load factor and sideways stick demands a roll rate, up to 15° per second at full deflection on the A320. With the stick released the aircraft holds its flight path and bank angle and trims itself.

The benefits include lower weight, automatic trim and turn co-ordination, damping of unwanted motion, and on combat aircraft the freedom to design an airframe with relaxed or even negative stability. The penalty is that a computer failure can be sudden and total, where a mechanical system usually degrades gradually. Fly-by-wire software is therefore developed to the most demanding assurance level, level A of DO-178 (EUROCAE ED-12), and the architecture is built around redundancy.

Pilot inceptors: side-stick and yoke

An inceptor is any control through which the pilot commands the aircraft: stick, column and wheel, rudder pedals or thrust levers. Fly-by-wire frees the designer to choose its form.

Airbus fits a side-stick on each pilot's outboard console. The sticks are spring-loaded to neutral, give no feedback from the control surfaces, stay locked at neutral while the autopilot is engaged and are not mechanically coupled, so neither pilot can feel the other's input. If both pilots move their sticks, the computers add the inputs algebraically. Green lights flash on the glareshield and a "DUAL INPUT" voice message sounds.

Priority logic resolves the conflict. Pressing and holding the takeover push-button on a side-stick deactivates the other stick. The last pilot to press gets priority, a "PRIORITY LEFT" or "PRIORITY RIGHT" message sounds and a red arrow lights in front of the pilot who has lost authority. Holding the button for 40 seconds latches the priority until either pilot presses a button again.

Boeing kept a conventional column and wheel with artificial feel on the 777 and 787. On the 777 the controls are back-driven, so both pilots see and feel what the autopilot and the protections are doing. This is a design choice, not a technical necessity.

Command and monitor channels

Airbus builds each flight control computer with command and monitor channels. The command (COM) channel computes the surface orders and sends them to the actuators. The monitor (MON) channel receives the same inputs, performs its own computation and compares the results. If they disagree beyond a tolerance, the computer disconnects itself and another computer takes over. Each computer is therefore fail-passive: it either works correctly or stops. The system as a whole keeps working because several computers can do each job.

The A320 has seven flight control computers: two ELACs (elevator aileron computers) for normal pitch and roll control, three SECs (spoiler elevator computers) for the spoilers and standby pitch control, and two FACs (flight augmentation computers) for yaw damping, turn co-ordination, rudder trim and travel limiting, and the characteristic speeds shown on the speed scale. Two flight control data concentrators pass their data to the displays and maintenance system.

The Boeing 777 uses three primary flight computers, each with three computing lanes. In each computer one lane is in command and the other two monitor it, and the outputs of the three computers are voted by median selection before reaching the actuator control electronics.

Redundancy and dissimilar computers

Duplicating identical computers protects against random hardware failures, but not against a design error, which would affect every copy at the same moment. Dissimilar redundancy answers this by building the same function in different ways. On the A320 the ELACs and SECs come from different suppliers and use different microprocessors, and the COM and MON channels of each type run separately developed software, giving four different software packages. On the 777 the three lanes of each flight computer use three different processors, an Intel 80486, a Motorola 68040 and an AMD 29050, running the same Ada source code compiled by three different compilers.

Segregation adds further independence: computers are powered from different electrical buses, actuators from different hydraulic systems, and wiring is routed apart. The A320 keeps a final layer as well. In mechanical backup the pilot controls pitch with the trim wheels, which are mechanically linked to the hydraulically powered trimmable horizontal stabiliser, and controls the aircraft laterally with the rudder pedals. It exists to cover rare cases such as a temporary total loss of electrical power or of the fly-by-wire computers.

Common-mode failures

A common-mode failure is a single cause that disables several redundant channels at once, defeating redundancy. Candidates include a software error, a shared power supply, lightning, a maintenance error repeated on every unit, or corrupted data from a sensor that all channels rely on.

Air data is the classic weak point, because every computer uses the same angle of attack, airspeed and inertial information. On 7 October 2008 Qantas flight 72, an A330-303 cruising at 37,000 ft off Western Australia, was pitched nose-down twice without command. One of the three air data inertial reference units began producing intermittent spikes on all its parameters. The ATSB found that the flight control primary computers' algorithm for processing angle of attack data could not cope with multiple spikes 1.2 seconds apart, and the computers commanded nose-down elevator. The first pitch-down reached about 8.4° nose-down and 650 ft of height loss. At least 110 of the 303 passengers and nine of the 12 crew were injured. The lesson is that the logic which manages redundancy is itself a critical design item.

Airbus control laws

Airbus defines a normal law and a hierarchy of reconfiguration laws that the computers adopt as sensors, computers or hydraulic systems are lost.

In alternate law the high angle of attack protection is replaced by a gentle nose-down stability demand that starts about 5 to 10 kt above the stall warning speed and that the pilot can override. Alternate law without reduced protection loses even the low and high speed stability. Pitch attitude and bank angle protection and alpha floor are lost, and the pitch law becomes direct when the landing gear is selected down. In direct law stick deflection maps straight to surface deflection, auto-trim is lost and the flight deck displays "USE MAN PITCH TRIM". An abnormal attitude law also exists to recover the aircraft if it reaches extreme attitudes, for example more than 125° of bank.

View full schematic

Flight envelope protection

Flight envelope protection is the set of functions in the control laws that keeps the aircraft within limits whatever the pilot does. Airbus designs its protections to let the pilot use full stick instinctively in an emergency, such as a terrain escape or windshear, without overstressing or stalling the aircraft. The A320 normal law provides the following:

High angle of attack protection has priority over all other protections, while high speed protection guards against the overspeed and Mach effects described in high-speed flight. Alpha floor, an autothrust function, sets take-off and go-around thrust when the angle of attack passes a threshold between alpha prot and alpha max; it is available from lift-off to 100 ft radio height on approach. The rudder is not protected: the protections are not designed to prevent structural damage from inappropriate rudder inputs.

Hard and soft protection

The two main airliner manufacturers take different positions, usually described as hard versus soft envelope protection. Airbus uses hard protection. In normal law the limits cannot be overridden, so the pilot can pull fully back in an escape manoeuvre and obtain the aircraft's maximum performance without stalling it.

Boeing uses soft protection on the 777, and in the same way on the 787. Approaching a limit, the protections increase the force the pilot must apply, for example on the control wheel beyond a set bank angle, but a pilot who pushes or pulls hard enough can override them. In pitch, Boeing's CU law blends pitch rate and load factor (C) with a speed term (U) that returns the aircraft towards a trim reference speed. The pilot therefore trims much as in a conventional aeroplane and feels speed stability.

Both philosophies depend on valid sensor data. On Air France 447, on 1 June 2009, ice crystals blocked the pitot probes of an A330 at cruise altitude, leaving the crew with unreliable airspeed. The autopilot disconnected and the flight controls reverted to alternate law, removing the high angle of attack protection. Sustained nose-up inputs stalled the aircraft, and auto-trim moved the stabiliser from 3° to 13° nose-up within about a minute, where it stayed. When measured airspeed fell below 60 kt the angle of attack data were rejected as invalid and the stall warning stopped. All 228 occupants died. The lessons for fly-by-wire crews are to know the active law, to treat protections as a safety net that can be lost, and to fly the stall recovery like any other aeroplane once they are gone. The aircraft manufacturer's procedures take precedence; see stall and upset prevention and recovery.

Library articles are written for study and exam preparation. They do not replace your aircraft's approved documentation, your operator's procedures or the regulations themselves.