Airbus largely introduced us to digital fly-by-wire technology using its A320 fleet in 1988. Fly-by-wire technology, abbreviated FBW, is a flight control system that makes use of computers to relay pilots inputs in the flight deck to the flight control surfaces. It replaces mechanical linkage, thus eliminating use of pilot force to move the control surface actuators via cables and hydraulic fluid.
This loss of direct feedback from control surfaces, while instrumental in reducing pilot energy needed to control, created another problem – the pilot could inadvertently over-correct or over-steer the controls, leading to an aircraft upset in flight, or loss of control in flight (LOC-I). This called for a protection system to prevent these excess inputs. Airbus calls this system Flight Envelope Protection.
An aircraft’s flight envelope describes its performance margins in regards to minimum and maximum operating limits, structural strength and load factor, and angle of attack.
The Airbus flight envelope protection on its fly-by-wire aircraft prevents exceedance of the following critical operational limits in the baseline – or “normal law” – control mode:
- High angle-of-attack protection: This protects against the risk of an aerodynamic stall, including in situations of wind shear, as well as during dynamic manoeuvres or in gusty conditions;
- High-speed protection: The aircraft is protected against overspeed situations that may eventually result in potential control difficulties, as well as structural concerns due to high aerodynamic loads;
- Pitch attitude protection: The pitch angle is limited between a minimum and a maximum value to prevent climbs or descents that are too steep;
- Bank angle protection: The bank angle and roll rate are limited to maximum values to prevent excessive banking, along with turns that are too steep, as well as the risk of the aircraft becoming inverted;
- Load factor protection: The aircraft’s vertical acceleration is kept within safe limits for the airplane’s structure; and
- Low energy and alpha floor protection: They ensure that a suitable level of aircraft energy is maintained in flight, with corrections made via manual or automatic increases in engine thrust.
In order to maintain this flight envelope, Airbus aircraft are equipped with software algorithms that dictate the limits to which a pilot’s inputs will translate into control surface movements. These software algorithms are called flight control modes or flight control laws. The four Airbus control laws are Normal Law, Alternate Law, Direct Law and Mechanical Back-up.
Normal Law
Normal Law encompasses the full envelop protection. It is active when at least two out of three Air Data Inertial Reference Units agree on the data – hence it is the normal operating configuration of the system. It covers all three axes of control – longitudinal, lateral and normal axis and load alleviation. According to the aircraft’s phase of flight, it may run in any of its three sub-modes: Ground Mode, Flight Mode and Flare Mode.
Ground Mode is active when the aircraft is on ground as concluded by its Proximity Sensors Control Units (PSCUs). It primarily turns off auto-trim and resets the stabilizer trim to 0 or 4o depending on its settings. It also provides direct relationship between stick inputs and control surfaces.
Flight Mode is activated automatically 100 feet after takeoff and transitions the flight controls from a direct stick-to-surface response into a load factor (G-load) and roll rate command system. This means that sidestick deflection and load factor imposed on the aircraft are directly proportional, regardless of airspeed. At wings level, the system maintains a 1g load. Full forward and full aft sidestick deflection maintains a maximum load factor for flap position. When a pilot moves the side-stick forward or aft, the ELACs (Elevation Aileron Computers) calculate a load factor demand rather than a direct surface deflection. The ELACs move the elevators and automatically command the Trimmable Horizontal Stabilizers (THSs) to trim the aircraft so that it maintains a steady flight path hands-off. Lateral side-stick inputs are also processed by the ELACs to deflect the ailerons and select spoilers via the SECs (Spoiler Elevator Computers). Simultaneously, the Flight Augmentation Computers (FACs) automatically feed coordinated rudder signals to prevent adverse yaw during the roll entry, maintaining a smooth, balanced turn.
Flare mode is activated at 50 feet Radio Altitude (50′ RA) i.e. during landing. The flight control computers freeze the position of the Trimmable Horizontal Stabilizers and shift control from normal flight path/G-load demand to a more direct relationship (Ground mode). At 30′ it begins applying a nose down pitching moment ready for the pilot to counter with aft sidestick input to flare the aircraft more smoothly. The flare law remains active until the main landing gear compresses and activates the proximity sensors or shock-strut compression switches, at which point the system smoothly switches into ground mode. In the event of a go-around, transition to flight mode occurs again at 50′ RA.
The normal law protections include:
- Load factor limitation, which prevents pilot from overstressing the aircraft even if full sidestick deflections are applied.
- Attitude protection, which limits the pitch to 30o up, 15o down, and 67o bank.
- Alpha floor protection, which is an automatic auto-thrust feature that sets Take-Off/Go-Around (TOGA) power to prevent a stall in flight.
- Alpha protection, which lowers the nose to prevent the aircraft from exceeding its critical angle of attack (AOA).
- Alpha max protection, which actively prevents the aircraft from reaching its maximum angle of attack in flight, even if the sidestick is pulled all the way aft.
- High speed protection, which engages at maximum operating speed, VMO, and pitches the aircraft up to prevent overspeed.
- Low Energy Protection, which activates a repeating “SPEED SPEED SPEED” aural warning when flaps are extended (CONF 2, 3, or FULL), and between 100 and 2,000 feet AGL with TOGA thrust not selected.
Alternate Law
Alternate Law is activated when there are multiple failures on specific redundant systems, such as the sensors for air data, inertial referencing, and flight computers. On an Airbus, the ECAM (Electronic Centralized Aircraft Monitor) displays the message “ALTN LAW: PROT LOST“. It is triggered by events such as engine flameouts, loss of air data or inertial reference, hydraulic failures, multiple surface actuator failures causing spoiler and aileron inoperativeness.
Alternate Law is programmed into two configurations; Alternate Law 1 (ALT1) and Alternate Law 2 (ALT2), depending on the severity of the failures. ALT1 keeps normal roll and bank protection, while ALT2 drops down to direct roll control and losses bank protection. Both ALT1 and ALT2 keep load factor protection but lose stall and high angle of attack protections. Pitch Alternate Law degrades to Pitch Direct Law when the landing gear is extended to provide feel for flare and landing, since there is no flare mode when Pitch Normal Law is lost.
Direct Law
Direct law is the lowest level of computer flight control and occurs with certain multiple failures. The aircraft sidestick and rudder pedal inputs go straight to the aircraft’s physical control surfaces without computer filtering, automatic trimming, or flight envelope protections. Direct Law is triggered by events such as dual elevator faults, loss of all inertial reference units, loss of all primary flight computers and dual engine flameout with control computer loss.
On the Airbus Primary Flight Display (PFD), an amber message “USE MAN PITCH TRIM” usually appears to indicate that the aircraft has reverted to Direct Law, requiring the pilot to manually adjust the pitch trim using the mechanical trim wheel on the center pedestal.
There are no protections provided in Direct Law, however overspeed and stall aural warnings are provided. Automatic trimming is completely inoperative.
When the landing gear is extended under Alternate Law, with Autopilot OFF, Direct Law is automatically activated. If Autopilot is engaged, the airplane will remain in Alternate Law until the autopilot is disconnected.
Mechanical Backup
An aircraft can be temporarily controlled mechanically as a measure of last resort in case of complete loss of electronic and computer flight control.
A red “MAN PITCH TRIM ONLY” warning appears on the PFD during this mode.
Pitch control will only be achieved hydraulically through the horizontal stabilizer by using the manual trim wheel, while lateral control will be achieved using rudder pedals.
On an Airbus, a pilot is recommended to turn OFF Auto-thrust and to limit the bank angle to 15o or below to maintain stability. Usually the Ram Air Turbine will have deployed during this phase, and the pilot will be busy trying to restart the aircraft computer systems.
One of the most infamous aircraft incidences involving the Airbus flight control laws was the June 2009 crash of Air France Flight 447 in which all 228 passengers and crew died. The aircraft, a four year old Airbus A330-203, was subjected to icing at cruise level. Several ice crystals blocked the pitot tubes, which are used in airspeed calculation. And when the autopilot could not reliably determine airspeed, it disconnected, followed by the auto-thrust system. Thus the aircraft Normal Law degraded to Alternate Law 2. Under this phase, the aircraft lost both bank and stall protection. The first officer kept pulling aft on his sidestick without realizing that he was drawing the aircraft into a stall. Eventually, the aircraft climbed to Flight Level 380 (38000 feet) then began to descend even as AOA rose to 40o, until it crashed into the Atlantic. Terrible!
