34
$\begingroup$

Under the investigation section of US Airways Flight 1549, it is noted that

[The pilot] asserted that insufficient credit was given to the A320's fly-by-wire design, by which the pilot uses a side-stick to make control inputs to the flight control computers.

The computers then impose adjustments and limits of their own to keep the plane stable, which the pilot cannot override even in an emergency. This design allowed the pilots of Flight 1549 to concentrate on engine restart and deciding the course, without the burden of manually adjusting the glidepath to reduce the plane's rate of descent.

Sullenberger said that these computer-imposed limits also prevented him from achieving the optimum landing flare for the ditching, which would have softened the impact.

Although this design aids pilots most of the time, why is there not a 'last resort' option to override the computer-imposed limits? It could have been that in this incident, it was the difference between life and death / a 'hard landing' vs a complete hull loss.

Improve this question
$\endgroup$
5
  • 3
    $\begingroup$ Related and a must read to avoid some of the biases associated with the Boeing vs Airbus fly-by-wire systems: How does envelope protection work in Airbus vs. Boeing aircraft? $\endgroup$
    – user14897
    Commented Jun 1, 2018 at 8:35
  • 8
    $\begingroup$ The only real answer here can be "That is the design philosophy of that product." Certainly, a large and complex discussion can be had on the pros and cons of each approach. But there's no specific, denormalized, single-shot answer. If Airbus, as it were, were asked this (say in a documentary, history or investigation), all that they could say is "on balance" and "after considering everything" their team decided their way is best. $\endgroup$
    – Fattie
    Commented Jun 1, 2018 at 12:07
  • 1
    $\begingroup$ They're awesome, except they're the sole reason for the injuries which put one of the flight attendants out of her job permanently, the only blemish on what would've been a perfect landing. $\endgroup$
    – Harper - Reinstate Monica
    Commented Jun 1, 2018 at 13:50
  • 2
    $\begingroup$ How are software limits really different from mechanical limits? That is, the controls & control surfaces on a purely mechanical design have only so much travel built into them. $\endgroup$
    – jamesqf
    Commented Jun 1, 2018 at 20:36
  • $\begingroup$ @Harper Can you elaborate or link to the information regarding that please? $\endgroup$
    – Cloud
    Commented Jun 4, 2018 at 6:20

6 Answers 6

Reset to default
39
$\begingroup$

Disabling the protections can technically be achieved. I say technically because there is not one scenario that Airbus has envisioned that would require the pilots to deliberately go into direct-law.

The imposed limit in the question is something called alpha-protection -- a protection against pulling back too much that the plane stalls. Stalling is bad. The system was receiving the correct information and functioning as designed, so what did Captain Sullenberger mean?

Sullenberger said that these computer-imposed limits also prevented him from achieving the optimum landing flare for the ditching, which would have softened the impact.

This is what Wikipedia says. The reference is a Talks at Google lecture (around the 40-minute mark). What is left out from Wikipedia, which Captain Sullenberger covers in the talk right away -- and is present in the accident report -- is that the issue was not with the protection, but with the innards of the protection that Airbus did not cover in the training material. Below is the relevant section from YouTube's transcript:

I was commanding for more, pulling back full aft on the stick and the flight control computers prevented me from getting more lift therefore we hit harder than we would have (...) It turns out there's a little-known software feature known only then to a few Airbus software engineers, and to no pilots to no airlines that was the case. It's called a phugoid mode. And it was not the way we were trained the airplane should work, apparently it is the way the airplane does work. But that was not apparent to us.

This was addressed as a recommendation in the final report:

Require Airbus operators to expand the angle-of-attack-protection envelope limitations ground-school training to inform pilots about alpha-protection mode features while in normal law that can affect the pitch response of the airplane.

Providing training on the innards of the 'good' system, is far better than taking out a vital protection. Vital because of one thing the report points out (which is in no way a disparagement of the crew):

The NTSB concludes the captain’s difficulty maintaining his intended airspeed during the final approach resulted, in part, from high workload, stress, and task saturation.

Protections are good for such high workload, stressful, and task saturated situations.

Improve this answer
$\endgroup$
10
  • 3
    $\begingroup$ The task saturation was pretty clear from e.g. the fact that the "ditch switch" wasn't used, which would have reduced the water influx keeping the plane longer afloat. $\endgroup$
    – MSalters
    Commented Jun 1, 2018 at 11:25
  • 4
    $\begingroup$ @Harper: phugoid mode is a well-known flight dynamic mode, it's in fact the first mode mentioned by the Wikipedia article on flight dynamic modes. I am entirely confident that Capt Sullenberger was familiar with the existence of this mode, as is any decent pilot. It affects two critical quantities, speed and height. You can't ignore those while flying. $\endgroup$
    – MSalters
    Commented Jun 1, 2018 at 14:11
  • 2
    $\begingroup$ And the problem here is that in phugoid mode, the plane can suddenly drop. This is of course rather problematic if it drops hard on the ground. This was a real risk, because the NTSB established Sully was 17 kts below stall speed when this happened, which he didn't realize at the time (again, see task saturation). Can't blame Airbus for that; you have to choose between hitting the ground hard or fast. $\endgroup$
    – MSalters
    Commented Jun 1, 2018 at 14:34
  • 7
    $\begingroup$ @MSalters Well maybe it's not the phugoid mode per se, but a hidden feature of that mode. Regardless: too many chefs. As far as Sully's "error", it's not an error to fly below stall speed when your entire plan is to skim the water, maintaining the correct ditching AoA until it stalls. That extra 17kts is probably courtesy of ground effect. $\endgroup$
    – Harper - Reinstate Monica
    Commented Jun 1, 2018 at 14:42
  • 3
    $\begingroup$ I think there's some confusion over the word "mode." Phygoid mode is not a setting on the flight computer. It is actually a type of natural eigenmode that is part of the dynamics of flight. I'm not sure what "software feature" they are referring to. $\endgroup$
    – TomMcW
    Commented Jun 1, 2018 at 18:17
16
$\begingroup$

Computer limits can be overridden on an Airbus as a ‘last resort’, though I have serious doubts that would have helped with the landing on the Hudson incident.

Granted, getting out of Normal Law is not SOP, or a normal procedure..but then again, why would it be?

People complaining about the computer limits on flight controls, are similar to people complaining about traction control on cars....yes, so you floored the acceleration and the car decided to disconect the drive! There is probably one freak accident in a billion that could have been saved by the driver disconecting traction control and then manually skidding to safety, but by-and-large the traction control has saved your butt a hundred times already.

Control laws will protect the aircraft/airframe in the same way. Or like an automatic shift will protect from overreving your engine by shifting up. Can you still blow up an engine on an automatic? probably yes, you just have to try harder....

Really wished pilots who never flew Airbus (or better yet Airbus and Boeing) stop issuing opinions and comparisons on this matter. FBW system in Boeing’s 777 is very similar to Airbus for instance, so the very discussion of Boeing trusts the pilots vs Airbus trusts the computers is starting from a very wrong assumption.

Improve this answer
$\endgroup$
6
$\begingroup$

There are 2 philosophies in civil aircraft FBW systems...
* Don't tell the pilot they're exceeding the limit, and don't let them exceed the limit.
* Tell the pilot they're exceeding the limit, but then let them.

As seems to be usual, Airbus and Boeing have differing points of view based upon their experience of working with pilots - guess which is which.

So the answer to your question is simply the manufacturer's philosophy.

Improve this answer
$\endgroup$
6
  • $\begingroup$ @ymb1 Is that similar to alternate-law? Sorry if a stupid question :p $\endgroup$
    – Cloud
    Commented Jun 1, 2018 at 8:33
  • 2
    $\begingroup$ sorry, I have to ask... :-)) what flight limitation is Boeing FBW letting the pilots exceed, that Airbus is not? $\endgroup$
    – Radu094
    Commented Jun 1, 2018 at 10:49
  • 2
    $\begingroup$ @Radu094 For example Boeing 777 allows bank angle beyond 67° - it’s trying to resist very sternly, but will still let you do it. An FBW Airbus won’t. $\endgroup$
    – Cpt Reynolds
    Commented Jun 1, 2018 at 20:47
  • $\begingroup$ @Radu094 ... obviously my previous comment applies to Normal Law/Mode only. $\endgroup$
    – Cpt Reynolds
    Commented Jun 1, 2018 at 22:21
  • 1
    $\begingroup$ @Radu094 True. In a way, protecting against overloading makes more sense than limiting bank angle which is only an indirect measure of load and only in a steady level turn. But then, there shouldn’t be any reason to bank that much, anyway... so I feel it’s an academic discussion. The only points I really don’t like in an Airbus (as an engineer) are Alternate Law without low speed protection (very odd design, in my mind) and independent sticks (not helpful for common mental model among crew). $\endgroup$
    – Cpt Reynolds
    Commented Jun 2, 2018 at 22:11
5
$\begingroup$

Why there is no switch? Because having it could be dangerous.

The purpose of the computerized system is to reduce pilot's workload. It's achieved by allowing him to pull the yoke all the way back and the computer would give him the highest safe AoA. Adding a switch would increase pilot workload, because he would have to make a very deliberate decision whenever to override the computer or not. Spending time considering cons and pros of overriding the computer diverts pilot's attention from actually flying the plane. Nobody wants that, especially during an emergency.

Mere presence of such option could contribute to the accident, therefore you can't have it.

Improve this answer
$\endgroup$
2
  • $\begingroup$ An emergency can mean that the airplane no longer looks or behaves like the computer assumes it does? $\endgroup$
    – rackandboneman
    Commented Sep 29, 2019 at 18:48
  • $\begingroup$ @rackandboneman Yes. But usually the computer knows that and Sadly, humans may not notice it, stall the plane and kill everybody, like Air France Flight 447. Airplane manufacturers seem to be coming from assumption that having the switch would only cause more AF447 to happen. $\endgroup$
    – Agent_L
    Commented Sep 30, 2019 at 17:48
4
$\begingroup$

The control laws can be downgraded to alternate law, which removes the alpha protection.

The QRH recommends this only in certain situations, and dual engine failure is not one of them. One place where this is recommended in the QRH is for an unreliable airspeed indication. Usually an unreliable airspeed will be recognized by the aircraft and it will automatically switch into alternate law. This is what occurred on AF447. But there are scenarios where the computer may discard the correct data, or none of the airspeed data is valid, yet they match, so the computer doesn't catch it.

Airbus realizes that this may cause incorrect response of the alpha protection, so they have a procedure for dealing with it. They have the pilot switch off the ADR's* one at a time to see if they can isolate the faulty data. If they can't, or none of the ADR's are providing good data, they are instructed to shut down two of the ADR's to force the system into alternate law. The third ADR is to be left on because the stall warning can still function on a single ADR.

from the A346 QRH: A336 QRH excerpt

This doesn't involve pulling circuit breakers. There are buttons on the overhead panel for this. Pulling circuit breakers can negatively affect other control computers, as occurred in QZ8501.

*The ADR (Air Data Reference) is part of the ADIRU (Air Data Inertial Reference Unit) which is the computer that supplies airspeed, Mach number, angle of attack, temperature and barometric altitude data to the FBW system.

Improve this answer
$\endgroup$
3
$\begingroup$

For the Airbus fly by wire system there are different so-called control laws which govern the behavior of the aircraft according to the input provided by the pilots. These control laws are determined automatically by the aircraft for different phases of the flight envelope.

This is also the main difference in design philosophy between Boeing and Airbus. Boeing aircraft assume that the pilot is always right and Airbus has a computer between the sticks and control surfaces. In this way they can filter the input from the pilot such that the aircraft does not exceed its designed airframe loads. Another benefit of this system is that they can make their range of aircraft handle in a similar fashion.

Can you override the control laws on an Airbus jet? No, you can't. Why can't you? Simply, Airbus design philosophy is that if the computer can't save the aircraft you can't either. You can however force it by pulling circuit breakers since after an electrical failure you as a pilot have direct control over the aircraft without the computer imposing limits. However, this is not possible during an emergency.

You can read more on the control laws here: Airbus Flight Control Systems

There have been incidents where the computer almost crashed an aircraft by switching too early to a different control law (Lufthansa LH-44):

[Report: Lufthansa A320 at Hamburg on Mar 1st 2008, wing touches runway in cross wind landing][10]

Improve this answer
$\endgroup$
2
  • 4
    $\begingroup$ Airbus philosophy is not that if computers cannot save the aircraft, pilots cannot either. That is nonsense, and internet fodder. Control laws can be changed/downgraded even w/out pulling circuit brakers, though procedure is indeed complicated and involves pushing two buttons. Airbus recommends using appropriate amount of automation and taking control when things don’t go as expected $\endgroup$
    – Radu094
    Commented Jun 1, 2018 at 10:52
  • $\begingroup$ Comments are not for extended discussion; this conversation has been moved to chat. Also, please consider the words you're choosing when engaging in the aviation equivalent of "Apple vs Microsoft". $\endgroup$
    – Federico
    Commented Jun 4, 2018 at 8:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .