Fly-by-Wire Technology and Human Factors in Aviation Safety

Introduction to Fly-by-Wire Technology

This paper studies fly-by-wire technology on commercial aircraft. Fly-by-wire is a system that utilizes computer-configured controls, where a computer system is interposed between the pilot and the control actuators or surfaces. This modifies the manual inputs of the pilot in accordance with control parameters. The paper is organized in two parts: part one describes the technology and its application; part two examines the human factors involved with fly-by-wire systems. Together, these sections provide a fuller understanding of the technology itself, its application in modern commercial aircraft, and the human factors considerations of a working fly-by-wire system.

On May 25, 1972, Gary Krier took off from Edwards Air Force Base, California, in an F-8 bearing the tail number "NASA 802." What made this flight unique was that every command Krier gave the aircraft passed first through a digital computer before being relayed to the hydraulic systems that operated the control surfaces — flaps, elevators, rudder, thrust, and so on. This aircraft was the first experiment in digital fly-by-wire. Without the computer, Krier would have had extreme difficulty controlling the aircraft because the designers had sacrificed stability for speed and maneuverability. So began a one-way migration away from direct human control and toward computer-mediated control. It began with warplanes and may yet end with people and their cars (Wenham).

Conventional aircraft control systems rely on mechanical and hydraulic links between the aircraft's controls and the flight surfaces on the wings and tail, with controls and flight surfaces directly connected. Mechanical links are also used for engine control.

The words "fly-by-wire" (FBW) imply an electrically signaled-only control system. However, the term is generally used to mean computer-configured controls, where a computer system is interposed between the operator and the final control actuators or surfaces. This modifies the pilot's manual inputs in accordance with carefully developed and validated control parameters, in order to produce maximum operational effect without compromising safety (Aircraft flight control systems).

Fly-by-wire is a means of aircraft control that uses electronic circuits to send inputs from the pilot to the motors that move the various flight controls on the aircraft. There are no direct hydraulic or mechanical linkages between the pilot and the flight controls (Fly-by-wire).

The principle used is that of error control, in which the position of a control surface (the output signal) is continually sensed and "fed back" to its flight control computer (FCC). When a command input is made by the pilot or autopilot, the difference between the current control surface position and the desired control surface position is analyzed by the computer, and an appropriate corrective signal is sent electrically to the control surface (Fly-by-wire).

How Fly-by-Wire Systems Work

A digital fly-by-wire flight control system is built to interpret the pilot's intention and translate it into action, where the translation process considers environmental factors first. On older aircraft, pulling back on the control column raised the elevator flaps in direct proportion to how far the pilot pulled. On a fly-by-wire system, they generally raise in direct proportion as well, but the computer can make subtle adjustments to account for turbulence. The ratio between the control column in the pilot's hands and the flaps on the wing is not 1:1; it is not a direct influence (Wenham).

In February 1987, the first fly-by-wire A320 — which was also the first commercial aircraft with fly-by-wire — rolled off the line at Toulouse. The A320's fly-by-wire technology was not only a way of improving flight controls and reducing weight; it enabled Airbus to take safety to a new level by introducing flight envelope protection. Pilots flying the A320 were free to operate it normally, but the flight envelope protection prevented the aircraft from performing maneuvers outside its performance limits (Corporate information/history: Fly-by-wire).

Fly-by-wire also firmly established the concept of commonality, which is central to the appeal of Airbus aircraft to customers. No matter how one aircraft varies in size or weight from another, fly-by-wire commonality allows the pilot to fly them in the same way because the computer "drives" the aircraft's flight controls. This leads to considerable reductions in the time and costs involved in training pilots and crew (Corporate information/history: Fly-by-wire).

At Boeing, the first aircraft to enter service with a full three-axis fly-by-wire system was the 777, which entered service in 1995.

Because there are innumerable versions of fly-by-wire on commercial aircraft, this section focuses on how the system works on Airbus aircraft. Most systems share many similarities with the Airbus system, though differences exist.

The Airbus Fly-by-Wire Flight Control System

In the Airbus system, there are three primary flight control computers responsible for calculations related to aircraft control and for sending signals to the actuators associated with the control surfaces and engines.

There are also two secondary flight control computers that serve as backup systems for the primary computers. Control switches automatically from the primary to the backup if the primary becomes unavailable. Only one computer is required for flight control, so this architecture supports quintuple redundancy. All operational computers function in parallel, so there is no switching delay.

Two data concentrator computers gather information from the flight control system and pass it to warning and display systems, flight data recorders, and maintenance systems (Sommerfield).

System safeguards include the use of different processors in the primary and secondary flight control computers. The primary and secondary computers are designed and supplied by different companies, and the processor chips for the different computers are supplied by different manufacturers. All of this reduces the probability that common hardware errors will cause system failure (Sommerfield).

The design separates the command unit and the monitor unit into different channels within a single computer. Each channel has separate hardware and different software. If the results of the channels disagree — as checked by a comparator — or are not produced at the same time, an error is assumed and control switches to another machine. The software for the different channels in each computer is developed by different teams using different programming languages. The software for the primary and secondary flight control computers is also developed by different teams. For the secondary computers, different languages are again used for the different channels in each machine (Sommerfield).

The flight control system (FCS) may be dynamically reconfigured to cope with a loss of system resources. Dynamic reconfiguration involves switching to alternative control software while maintaining system availability. Three operational modes are supported:

Normal — full computer-mediated control plus workload reduction
Alternate — minimal computer-mediated control
Direct — no computer mediation of pilot commands

At least two failures must occur before normal operation is lost.

Diversity of controls is also built into the system. The linkages between the flight control computers and the flight surfaces are arranged so that each surface is controlled by multiple independent actuators. Each actuator is controlled by a different computer, so loss of a single actuator or computer does not mean loss of control of that surface. The hydraulic system is three-way replicated, with each path taking a different route through the aircraft (Sommerfield).

Fault tolerance is an integral part of the system. Fly-by-wire systems must be fault tolerant because there is no "fail-safe" state while the aircraft is in operation. In the Airbus, this is achieved by replicating sensors, computers, and actuators and by providing graceful degradation in the event of a system failure. In a degraded state, essential facilities remain available, allowing the pilot to fly and land the plane (Sommerfield).

There have been few Airbus accidents that may be related to problems with the FCS. One accident — the Warsaw runway overrun — was clearly identified as a problem with the system's specification rather than with the hardware or software itself. There is no evidence of any failures of the FCS hardware or software. However, pilots may misinterpret how the system operates and thus make errors that it cannot compensate for (Sommerfield).

Human Factors Considerations in Fly-by-Wire

In aviation, human factors is dedicated to better understanding how humans can most safely and efficiently be integrated with technology. That understanding is then translated into design, training, policies, and procedures to help humans perform better (Human Factors).

The term "human factors" has grown increasingly popular as the commercial aviation industry has recognized that human error, rather than mechanical failure, underlies most aviation accidents and incidents. Because technology continues to evolve faster than the ability to predict how humans will interact with it, the industry can no longer depend solely on experience and intuition to guide decisions related to human performance. Instead, a sound scientific basis is necessary for assessing human performance implications in design, training, and procedures — just as developing a new wing requires sound aerodynamic engineering (Human factors).

Because improving human performance can help reduce the commercial aviation accident rate, much of the focus is on designing human–airplane interfaces and developing procedures for both flight crews and maintenance technicians (Human factors).

Even if a faulty flight computer is not directly to blame for a given crash, fly-by-wire systems put distance between pilots and their aircraft, so that the first signs of problems may be obscured by the computer's automatic corrections. Decades ago, when pilots controlled airplanes mechanically with levers, cranks, and pushrods, they felt resistance from wind and could intuitively sense if something was wrong. Like power steering in cars, fly-by-wire makes flying easier and often smoother because computers are doing more of the work — but it also separates pilots from that touch-and-feel connection with the mechanics of the airplane (Milstein).

John Cox, an aviation consultant and former commercial pilot, noted that fly-by-wire technology can sometimes mask damage to an airplane by keeping it flyable even when human pilots could not. That could be beneficial if it allows a plane to move away from a populated area before crashing, but harmful if pilots are unaware there is a problem. "Fortunately the systems are very good about annunciating problems — if something goes wrong, they tell you," Cox said (Milstein).

For real-time technology, human-factors development involves collecting usability data from man-in-the-loop testing for components that will have a human interface (Why Use...). The development of fly-by-wire flight controls is one such example of usability testing.

Systems developers and testers have generally assumed that human compensation is measurable, or at least that a trained tester can identify and detect it. However, more than one study conducted at the Wright-Patterson Large Amplitude Multi-Mode Aerospace Research Simulator (LAMARS) facility indicates that this is not necessarily true. Test pilots were able to compensate sufficiently to fly and meet defined performance standards on intentionally flawed aircraft flight control designs. These flight control systems were designed to trigger pilot-induced oscillations, but in most cases, test pilots compensated well enough to prevent such oscillations and to control the simulated aircraft (Alford).

This points to a significant deficiency in the testing of highly augmented aircraft systems, such as fly-by-wire flight control systems — a deficiency that has been borne out by multiple real aircraft accidents. Natural pilot compensation is sufficient to allow faulty designs to reach production and operational service, while hiding critical handling quality problems that can lead to the loss of an aircraft. This observation, applied across the range of human factors experimentation, has vast implications for the testing, evaluation, and development of all human interface systems (Alford).

From a human factors standpoint, it is imperative that these systems take on roles and provide functions that are most supportive to the pilot, given the stress, time pressure, and workload they may experience following a FCS fault. For example, highly sophisticated fault-recovery systems may be able to fly the aircraft following dramatic FCS failures without even notifying the pilot. However, such systems are not only expensive, but may not be able to compensate for all failures, may fail themselves, or may allow a pilot — believing the aircraft to be fully airworthy — to place the aircraft in a dangerous condition (Pritchett).

The most important human factors questions concern the appropriate role for the technology and how it should function to fulfill that role. For these systems to be effective, they must meet two fundamental requirements: (1) they must alert pilots to problems early enough that the pilot can reasonably resolve the fault and regain control of the aircraft, and (2) if the aircraft's handling qualities are severely degraded, the health monitoring system (HMS) must provide the appropriate stability augmentation to help the pilot stabilize and control the aircraft (Pritchett).