Why do passenger jets accept input that will cause the aircraft to perform dangerous maneuvers it was not designed for?

Question

Examples:

• A bank angle > 45 degrees is considered an “upset,” putting the plane in a position that can lead to a loss of control.
• A pitch > 20 degrees can possibly be dangerous and cause the aircraft to stall (depends on many factors or course).

These are just a few examples of limits that most passenger jets have. Now why is it that the plane actually accepts input that will cause the aircraft to go beyond these limits? What possibly use could “diving” straight towards the ground or towards the sky have? Or having a high bank angle that will almost certainly cause stalling and loss of control?

Answer 1

Generally speaking, pilots don't like it when a computer interprets or limits their actions. They want final control. They don't always get their way on this but that's their preference.

If I recall correctly, Boeing tends to stick with the philosophy that "the pilot is the final arbiter." Airbus is more likely to preempt pilot inputs and modify them.

Although the majority of crashes and incidents wind up being pilot error, there is a serious flaw to modifying pilot inputs. That flaw is in the case of systems failure.

By definition, failure modes involve things going wrong. When things go wrong it's effectively impossible to plan, in automation, for all contingencies. People are much better at responding to the unknown than automation systems are.

Take for instance the rule that "bank angles > 45 degrees are dangerous, and are therefore prohibited". How does the plane know that the bank angle is > 45 degrees? Well it's a sensor of course, but what if the sensor has failed? A failed sensor will either signal to take action when none is needed or fail to signal when action is called for. What if the control surfaces have failed and the plane cannot correct the bank angle?

The usual answer to that is redundant systems, high reliability parts and design, etc. All those are great of course and certainly help a lot. However we still have incidents and accidents.

In the end the question is: Who do you trust more? A pilot or a machine? And statistics and science only help you part-way here. A person's experience, biases and feelings will have a lot to say about how they answer. And by "person", understand that I'm including the customers, the paying public.

Answer 2

The philosophy is that the pilot knows best. If they need to make a maneuver, they should be trusted to do so.

Although there are absolute limits such as structure, other limits are less exact and depend on conditions (and even structure is built to withstand additional margins, failure, and damage). Something that qualifies as an "upset" is certainly not routine, but it is not necessarily fatal either, and can be used to deal with certain situations.

A big reason for abrupt maneuvers would be avoiding an obstacle. In the case of terrain, this would generally be a steep climb, or possibly a steep turn. But this could also be another aircraft, in which case the pilot may want to descend quickly.

Answer 3

Let's just focus on roll. The same command that can be used to roll the aircraft from 0° roll angle to 30° can be used to roll it from 30° to 60°. Who is to decide at what roll angle the airplane is and that from now on no further roll commands are acceptable?

A computer-controlled FCS, obviously, if we decide the pilots cannot be trusted. But can we trust the FCS more? What would be the basis for it to establish the correct roll angle?

1. Gyros? They need to be calibrated once in a while, because all gyros drift. Some more, some less, but no technology can prevent them from showing dangerously wrong readings when they are left running long enough.

2. Accelerometers which show the gravity vector? As soon as the airplane flies a coordinated turn, it should be obvious that they point only away from the lift vector. No dice.

3. Radar altimeter at the wingtips? Fly high enough and they become useless. This might work for low-level flight, but not in all flight phases.

4. Camera and image processing to find the attitude towards the horizon? Stops working at night or in fog.

I could extend the list, but by now it should become clear that this is not as easy as it sounds. Especially the FCS design for autonomous UAVs is quite tricky and needs to correlate the inputs of different sensors in order to establish level flight. This was learned the hard way by Aurora Flight Sciences when flight-testing their Perseus A prototype. Relying on the gyro alone, the team did not realize that the sensor drifted away and commanded increasingly steep bank angles. When the aircraft disintegrated, the team did not even immediately realize what had happened because the maximum sink rate value on the flight data downlink corresponded to just 20 m/s - it just got stuck at -1023 counts. The aircraft prototype was totally destroyed in the accident.

Perseus A before its final 21st flight.

I guess this is the last forum on the whole Internet where it needs to be explained that relying on perfectly functioning software is foolish. Somehow, human pilots are still better at resolving unforeseen difficulties, for the same reasons why they sometimes screw up in inexplainable ways.

Answer 4

Most new designs do not accept such inputs. That includes:

• Airbus models from A320 onwards (includes A318 and A319 that are variants of A320).
• Boeing models B777 and B787.
• Sukhoi SuperJet Su100.

Airbus has roll limit 65°, not 45°, but it automatically returns to at most 33° without constant pressure on the stick. I can't find explicit pitch limit, but it has alpha-limit (angle-of-attack, depends on type, 17° for A320, pitches down not to exceed it), maximum speed and Mach limit (pitches up if exceeded) and minimum and maximum wing loading (vertical acceleration, -1G to +2.5G clean, 0G to +2G with flaps)

Answer 5

The pilot must be trusted over anything else (and even Airbus planes accept any input in Direct law, Normal law doesn't always apply). Any unforeseen situation may arise during the flight. Computers cannot handle every abnormal situation.

A good example of such a situation is the case of FedEx Flight 705. The pilots were attacked with a sledgehammer by a hijacker. They would probably be dead, if not for the extreme maneuvers attempted. They pushed their DC-10 plane far beyond its limits (bank angle up to 140°, overspeed near mach 1.0). Had the computer prevented them to do this, the plane may have crashed and they'd be all dead.

Answer 6

As an airline pilot (and test pilot) I like to keep my airplane under control (like all other airline pilots do). There is Boeing school and the Airbus school. Boeing airplanes will warn you not to get into those envelopes. Airbus won't allow you to get in that regime (envelope protection). In any case you can override that by changing law or disconnecting flight computers. In extreme cases where the situation is desesperate, I won't hesitate to overrule the computer and go into the extreme envelopes if I need to save lives. Bear in mind that everything in aviation is designed with a safety factor of 30% to 60% in some cases.

So to answer your question: You are at FL370, sipping coffee, you have a fire on board. The aircraft limits your vertical speed and speed during descent (or bank angle if you want to turn back). Would you be OK with such limits? Myself, no. We are paid big bucks in the front to make decisions.

Second scenario (fake). FL340, cruise, your TCAS failed but you don't know (like I said it is fake scenario). Suddenly you see the other guy heading towards you. Same FL. But your computer says "sorry you cannot pull hard because of the G protection", you hit the other guy: you are legally dead because you have not stressed the airframe.

Last example: Just after departing for a 16-hour flight you have fire in cargo. The fire extinguishing systems are unsuccessful. You must land, but you cannot because you are overweight (by 100 tons I would say at least). What would you do?

Hope I've triggered something about your question. BTW I'm on 777.

Answer 7

A couple of reasons, but essentially it comes down to "Because sometimes it may be the lesser of two evils"

1. Instruments go wrong. Pitot tubes break, gyroscopes go wonky etc... Sometimes, the pilot really does know best. Autopilots disengage when they aren't sure what to do, the same applies to autopilots limiting the control in a fly by wire setup... what happens when the aircraft thinks it's stalling but it isn't? It tries to prevent the nose being raised, or actually lowers the nose, until the aircraft hits the ground.

2. A "virtually guaranteed stall" may one day be a better option than an "actually guaranteed collision" - if your choices are pull up hard or fly into a mountain, I'll take my chances with attempting to recover from a stall.

1 is unlikely (and considering how often aircraft fly under IFR, would likely affect the pilot the same as the autopilot), 2 is probably even more unlikely, but is the situation which would prompt thousands of "Why can't the pilot over-ride the autopilot?" questions.

At the end of the day, people still mistrust computers. They may get it right 99.9999% of the time, but they still can't "think on their feet" like a human.

Now, there are elements of this already in aircraft design. For example all modern airliners have audible/visual warnings when dangerous situations are presented (high sink rates, stall warnings etc). And Airbus goes further, using "fly by wire" controls which do indeed prevent most "normal" stall situations in what's called "Normal law". Airbus does, however, give final control to the pilot if the computer is not 100% sure of the situation.

Answer 8

Another thing to consider is that knowledge required for controlling the aircraft is increasing with such systems in place.

There nearly was a plane crash in Germany some years ago (see this video showing the landing), when a plane was landing during strong side winds. The problem was that the flight controls reacted differently when the plane touched ground or not. That was not known by the pilots. They managed the situation, but it could have been easier for them with knowing that behavior. This behavior even was not documented in the manual.

EDIT:
From the investigation report (thanks to @DeltaLima): Section 3.1

The pilots could not have been aware of the specific flight system control response characteristics during a landing with a gusty crosswind und were, therefore, unable to incorporate it into their decision taking process.

And later on in this section

• When the left main landing gear first touched the runway, the lateral control system condition thus met all the requirements for the transition from Flight Mode to Ground Mode, so, the system switched from lateral Flight Mode to lateral Ground Mode even though the aircraft was once again in the air.

• The aircraft was designed so that the effect of lateral controls (along the longitudinal axis) would reduce by about one half of full deflection as soon as one main landing gear touched down.

• The reduced effect of controls was not documented in the system description and was unknown to pilots or the training department.

• During the landing, the aircraft's system behaviour contributed to a flight attitude which was unintended and undesired by the pilots and ground contact with the wingtip could not be prevented anymore.

Answer 9

One of the problems with commercial aircraft is the sheer number of hours of flight that any given aircraft type will see and the vast number of different conditions and failures that will inevitably arise during all that flying.

I had the job of writing the software that validated the control laws for the center of gravity management systems of several of these beasts. There's really no way to completely analyse all possible 'modes of flight'. The FCGMS system wasn't quite in the same category with the flight controls, but it WAS a 'safety of flight critical system'. There was a lot of validating involved, and this was just purely functional test, not all the vast array of unit level testing that went into the flight software. The thing is you have 20 boxes on these planes, all doing critical stuff, all built by different people, etc.

In the end someone has to be able to take hold of the stick and PULL UP! when its required and get a direct response. Its quite true that this capability might be as often detrimental, but you just cannot and never will be able to, completely analyse code and know what it will do when pieces are falling off the airplane.

Answer 10

Let's think of this from a different angle. Sometimes it's not just pilot input that would put the plane into an unsafe attitude. Now if the plane is forced into a heavy bank, climb, or dive through external forces but the pilot is limited in what response he can give to the plane to adjust....

Also think of high fog and communication issues. and two planes are in risk of collision. The plane says to the pilot "nope you can't bank because that would put us at risk".

Under normal flying conditions, you'd want to fly within operating parameters. But when the proverbial stuff hits the fan, you want full control to attempt to avoid a tragedy.

Answer 11

Your question can be answered by a simple reductio ad absurdum argument. If the airplane knew what inputs were safe, then why have any pilot at all?

In fact modern commercial flights already pretty much fly automatically, and they do have mechanisms to avoid potentially dangerous inputs. The problem is that failure detection is hard because when something has failed, the system (by the definition of failure) does not have valid data to make decisions. It is the same reason crazy people may not know they are crazy. The pilot is there to make decisions in the face of ambiguity.

Of course sometimes the pilot makes the wrong decision too, and the airplane crashes. See Air France 447.

But more often they make the right decision, and everyone lives. See the Gimli Glider.

Answer 12

Generally limiters are optimized and designed to fulfill a specific function or role relation such as the Airbus full stick aft to achieve max AoA during terrain avoidance. However, not all limiters are foolproof, despite what is advertised by the manufacturers. Limits can be exceeded depending on how the limiter functions and FCS are implemented eg using dynamic manoeuvres such as repeated pushing and pulling at reasonant frequency or sudden manoeuvres at speeds for which the FCS wasn't designed for or in degraded aircraft modes. Although these possibilities exist, they are usually not relevant because these are corner cases unlikely to be encountered.

Answer 13

About the AF accident. The basic of flight: PITCH, POWER, PERFORMANCE. Meaning that when something is wrong you disconnect all automation and get manual control of the ship. The key beyond the PPP is that for almost any given situation applying a pitch, a power setting and a configuration (flaps, slats, gear....) you will kee you flying. With automation those things are long gone. During a flight, each hour I was writting down power setting, wind direction, temperature (among fuel and other legal stuff). Those whom started flying without autothrust and on turbo props know what it s like.

Answer 14

Pilots want to have control over the aircraft. Personally, if I was an ATP I would never fly an automated FBW aircraft like an Airbus for that exact reason.

You don't to be in a spin or death spiral and then find out you can't get out of it because "the computer will not allow that input", and trust me if you are in an aircraft that goes into a spin you most definitely want the pilot to have FULL control over the aircraft.

You may think: if the computer is controlling the aircraft it will never enter a spin. Not so. Some thunderstorms can arise very quickly and unexpectedly and are so violent they can force the aircraft into a spin or other attitude which the computer has zero chance of reacting to correctly. "Good" computers turn themselves off at that point.

The most advanced FBW aircraft have a feature called "automated recovery" which allows them to automatically recover from some stall conditions, but in extreme conditions the changes in attitude will be happening so fast that you need a human to do it.