The C* continuum

This post is part of the Airbus aircraft family and system safety thread.

While there’s often a lot of discussion about short term response of aircraft to control inputs, in practice it’s often the long term response of the aircraft state vector at constant thrust and neutral control inputs that’s just as important to flight control system designers. In the case of Airbus the selection by the designers of a modified C* feedback loop (1) for primary pitch axis control law (Airbus 1998) in flight has led to what you’d call interesting consequences.

While C* feedback (a combination of vertical load and pitch rate) in concert with an auto thrust function to maintain constant airspeed can provide a stable ‘hands free’ vertical speed or flight path angle it doesn’t provide a zero deviation steady state flight path error, in the presence of external disturbances. As a result the pilot will need to intervene from time to time to maintain the required flight path. When the pilot does so the C* feedback will hold the vertical speed as a function of the integral vertical load factor, and whoops, away will drift the vertical speed (Niedermeier, Lambregts 2012). As in most engineering disciplines there are trade-offs and in this instance the trade-off for holding flight path angle stability is that you loose natural speed stability.

To state it another way there’s no inherent ‘trim speed’ for such an aircraft, or to put it yet another way you can’t trim out the controller force to hold a target speed. All of which is generally considered not good, and tends to violate the FAA’s Part 25 rules about longitudinal stability, which require amongst other things a specific controller pull force to correlate with a decrease in airspeed and likewise upon release of the controls requires the aircraft to return to the trim speed. To meet the intent of the longitudinal stability rules protection laws need to be put in place that provide speed stability, which is what Airbus have done (2).

To maintain the aircraft speed on the Airbus the auto thrust function is utilised to prevent divergence when the pilot inputs a pitch manoeuvre, while the C* feedback integrator commands elevator position to maintain flightpath independent of airspeed. As this could result in some fairly large elevator deflections, and reduced control authority, an auto-trim stabiliser function is also used by Airbus to transfer out the long term elevator deflections into the stabiliser.

And now we come to the question of stalls and the C* control algorithm. When an aircraft enters a stall both vertical load and pitch rate fall off as the aircraft looses lift and the nose pitches down, consequently the elevator is driven up due to integration of the increasing C* error. If the pilot is unfamiliar with stall recovery and inputs the natural (but absolutely wrong) side stick controller back command the situation gets even worse. Add an auto-trim stabiliser which offloads the elevator ‘up’ command further trimming nose up and you’ve exacerbated the situation even further.

This is in part what happened to the crew of AF447 after they entered the alternate flight law where envelope protection was removed (3), and stalling the aircraft became an all too real possibility (BEA 2012). While the aircraft was recoverable from the stall early in the incident once the stabiliser was at the hard stops the resultant authority meant that they ran out of time and altitude that much faster (4). As if this incident was ramming the point home, a similar scenario of a stabiliser auto-trimming delaying recovery of the aircraft from a stall condition doomed the crew of flight 888T only a few months before (BEA 2010).

Of course as long as the envelope protection laws are in place then the question of stall performance of an Airbus never arises and the performance of a C* pitch axis control law is a moot point. But once the aircraft has stalled the counter recovery performance of a C* pitch axis control law does become important. If we then add in an auto-trimming stabiliser that is unnoticed and unchecked by crew in both disasters, poor in cockpit support for unusual attitude recovery, crews with minimal training or poorly prepared for the demands of flying in alternate law (or recovering from a stall/unusual attitude event) and I’d submit you have a system that is robust, but also fragile.

This robust/fragile dichotomy, termed by some as Highly Optimised Tolerance, means that as long as the wrong combination of what we presuppose are highly unlikely events doesn’t occur the system we’ve built will act predictably, robustly and safely (5). But should that set of events occur then all bets are off. The concern that we now face with the loss of AirAsia Z8501 is whether a similar set of ‘unlikely’ events conspired to bring down that aircraft. Only time and the data recorders will tell.

References

Airbus,  “A319, A320, A321 Flightdeck and systems briefing for pilots“, STL 945.7136/97, Issued September 1998.

BEA, Report – “Accident on 27 November 2008 of the coast of Canet-Plage to the Airbus A320-232 registered D-AXLA operated by XL Airways Germany“, BEA, France, 2010.

BEA Report – “Final report on the accident on 1st June 2009 to the Airbus A330-203 registered F-GZCP operated by Air France flight AF 447 Rio de Janeiro – Paris“, BEA. France, 2012.

Corps, S.G., Airbus A320 side stick and fly by wire an update, Society of Automotive Engineers (SAE) Paper 861801, 1988.

Niedermeier, D., Lambregts, A.A., “Fly-by-wire augmented manual control – basic design considerations,” in ICAS 2012, 28th Congress of the International Council of the Aeronautical Sciences, Brisbane, Australia, 2012.

Notes

1. The C* control loop is based on vertical load and pitch rate feedback. In the Airbus modified C* loop the gain for the integral pitch rate feedback path is a function of calibrated airspeed, rather than fixed for the classic C* handling equation.

2. These are the high-speed protection law and high alpha protection laws for the high and low speed sides of the flight envelope respectively. In essence these laws prevent both overspeed and stall conditions from occurring, as  long as they are present.

3. In this case unreliable airspeed due to icing of the aircrafts air sensors caused the aircraft to degrade form normal control laws to alternate control laws, primarily due to the loss of a valid airspeed signal.

4. Any elevator control reversal needs to be big enough to overcome pitch up from thrust, stabiliser trim and adverse AoA if the aircraft has pitched nose up post-stall, as well as reduced elevator authority in a deep stall. The the proportional gain feedback loop can also initially delay aircraft response.

5. Our system of interest is not just the aircraft hardware and software, but also the aircrew and procedures.