Safety and economy spur drive to high-tech flightdeck

航空

游客，如果您要查看本帖隐藏内容请回复

航空

hen Dassault’s Falcon
7X takes wing—an
event due to take place
in the first quarter of 2005—it will
be a full fly-by-wire (FBW) aircraft.
FBW has been used for decades
in military aircraft—in fact, Dassault’s
own Mirage 2000 flew back
in 1978 with full FBW. In the civilian
world, however, only the Airbus
A320/330/340 series and the
Boeing 777 are FBW. The A319CJ is
marketed as a bizjet, but clearly it’s
an airliner with modifications.
Dassault’s Falcon 7X will be the
first FBW business jet.
FBW’s genesis
Airplanes first flew with mechanical
controls, and some of today’s
turbojets still use them. Heavier,
faster aircraft encounter Mach
effects and require hydraulic actuation
of controls. Since cables or
push/pull tubes mechanically move
the selector valves of the hydraulic
control actuators, there is still a
direct correspondence between the
position of the control yoke and the
position of the control surfaces.
It was air combat that forced the
next step. Initially, the military
became interested in FBW for its
potential to improve the chances of
aircraft surviving small arms fire
damage.
There were other advantages.
Turn rate is crucial in a dog fight.
The tightest turn can be generated
when both the wing and stabilizer
are lifting together—but this places
the center of gravity well aft, producing
an unstable aircraft that a
human pilot cannot control.
Computers, though, are able not
only to control the aircraft while it’s
in an unstable condition—they also
relieve the pilot of worry about a
high-speed stall and allow him to
concentrate on the enemy. All in
all, a perfect argument for FBW.
FBW debuted on fighters like the
McDonnell F4 Phantom and early
Mirages which had traditional control
systems (mechanically-controlled
hydraulic actuators) augmented
by computer feedback in stability
augmentation systems (SAS).
SAS had limited-authority (about
5%) servos linked in series with the
pilot’s controls. The aircraft could
be flown and landed with a total
failure of the SAS, though they’d fly
more like drunken cows than their
usual tightly-wound selves.
Ultimately, mechanical connections
and backups were dispensed
with and full FBW fighters like the
Mirage 2000 and the F16 emerged.
Now the pilot’s sidestick sent signals
electronically to a flight computer
(FC), which “knew” what was
happening from its own sources of
air data (pitot/static and angle of
attack from the ADCs) and aircraft
motion (from the IRSs.) The “control
laws” in its program decided what
to do with the controls, and signaled
hydraulic control actuators
electrically. Sensor feedback loops
supplied info on how the controls
responded. There was no direct
mechanical connection between
control surfaces and the pilot, who
never actually knew what the control
surfaces were doing.
The FC could move the controls
faster than a pilot’s mind could
react. Not only could it fly the statically
unstable airplane perfectly
well, it could do a lot of other
things, such as smoothing out the
effects of configuration changes
and protecting the airplane from
exceeding limitations such as load
factor and AOA limits. The latter
was big for the military. Prior to
FBW they lost many fighters in
94 PROFESSIONAL PILOT / September 2004
By Don Witt
ATP/CFII. Boeing 737, 757,
Airbus A320, Learjet series.
AVIONICS
Introducing full FBW for business av
Safety and economy spur drive to high-tech flightdeck.
Dassault’s Falcon 7X, with full FBW flight controls, is due to fly in the first quarter of 2005.
Illustrations and photos courtesy Dassault
W
combat when their pilots pulled
through the AOA limit in the heat
of battle and the aircraft departed
into an unrecoverable spin.
Soon the civilian world saw
advantages to FBW too—specifically
safety and ease of control. With
built-in “hard limits” an FBWequipped
aircraft cannot be stalled
or over-G’d. Just as important, it’s
easier to fly, freeing the pilot’s
attention for higher-order tasks.
Airbus Industrie, followed by
Boeing, chose FBW for its new airliners.
Fly-by-wire is not a simple technology,
nor is it without hazard. In
fact, it has the potential for new
kinds of accidents—for example,
certain combinations of control system
lag (measured in fractions of a
second) and actuator rate limits
(how fast a control surface can be
moved) can allow aircraft-pilot
coupling events, similar to PIOs,
that have caused loss of control,
such as the Aug 1993 crash of a
Saab Gripen in Sweden.
In FBW systems, multiple computation
channels are required for
safety in case of failure. Multiple
channels monitor each other and/or
“vote.” This is a highly complex
communication task, and Boeing
struggled with this aspect of the
777’s FBW until late in its development
program.
Dassault and FBW
Dassault’s experience with FBW
goes back as far as 1963, when the
Balzac—a VTOL development of
the Mirage III fighter—transitioned
to horizontal flight through FBW
control of its tailpipes.
Since 1954 Dassault has manufactured
most flight control components
in house. The Mirage 2000 is
full-FBW with 4 analog computers.
The Dassault Rafale fighter, which
flew in 1986, has 3 digital FCs and
an analog backup.
According to Dassault Senior VP
Civil Aircraft Olivier Villa, the
Falcon 7X will be significantly
more fuel-efficient than its predecessors.
In part this is due to the
7X’s FBW system, which is a major
contributor to reducing the drag
induced by the horizontal stabilizer.
Overall, Dassault says it has
reduced the size of the stabilizer by
roughly 20%.
Flying the Falcon 7X
When Dassault brought the 7X
simulator to EBACE, I was able to
fly it with Test Pilot Philippe Deleume.
The 7X’s sidestick is comfortable
to the hand. Dassault has put much
thought into ergonomics. For example,
the artificial feel or force needed
to displace the sidestick has
been tailored and is not symmetrical
from left to right. This is
because a pilot (or anyone else) has
less strength available to rotate the
wrist outboard than to rotate it
inboard.
The sidestick has 4 switches available
to thumb and forefinger. They
are the radio push-to-talk switch,
the TCS switch (TCS is an autopilot
mode—the FBW equivalent of control
wheel steering), the HUD declutter
switch, and a 4th switch
which serves 2 functions—autopilot
disconnect and sidestick priority.
In the 7X, as in the A320, dual
sidestick inputs are summed algebraically.
For example, if the captain
has full left stick and the FO
has full right, the algebraic sum is
zero and the aircraft will not roll. A
sidestick priority switch gives one
pilot priority over the other if both
are trying to fly at the same time.
Lights on the instrument panel illuminate
to indicate who has control.
This switch can also be used to
negate a malfunctioning sidestick.
Flight operations quality assurance
(FOQA) sprang up at the airlines
shortly after arrival of the sidestick-
equipped Airbus A320. One
of the first problems FOQA identified
was dual inputs—as when a
captain assists the FO with his
landing without telling him, which
can lead to significant confusion in
the cockpit. As a result, Airbus
added a voice annunciation of
“Dual input!” to the A320 fleet. In
the Falcon 7X an eccentric cam
inside the sidestick vibrates both
sidesticks when 2 pilots are on the
controls together. This tends to get
pilots’ attention more readily than
voice annunciation.
PROFESSIONAL PILOT / September 2004 95
Falcon Test Pilot Philippe Deleume in the right
seat of the 7X simulator at this year’s EBACE.
The Falcon 7X simulator at Saint-Cloud is linked to the “global test bench,” where a full complement
of electrical and hydraulic systems and flight computers will “fly” together as in the aircraft.
Flightpath stability
In normal flight the pilot does not
trim—thus there is no trim switch
on the sidestick. Instead, switches
on the center pedestal can be used
during manual reversion or if the
FC defaults to direct law. In normal
control law the 7X is a flightpath
stable airplane (C* in engineer parlance)
and trim is fully automatic.
With no control deflection the FC
will maintain a 1G constant flightpath.
Sidestick inputs cause a
G/rate response. Pull or push the
sidestick and you get a G load proportional
to your deflection at higher
speeds, or a pitch rate proportional
to deflection at slower
speeds. Left/right sidestick gets you
a roll rate proportional to deflection.
Maximum sidestick deflection
on the 7X gives an impressive roll
rate of 40° per second, compared
to the A320’s 15°/sec max.
Kinesthetic cues are, naturally,
missing in the fixed simulator, but
rates of pitch and roll response and
control stick forces seemed just
right. This being the world of FBW,
stability was perfect. Stability and
maneuverability are not mutually
exclusive—you can have both in
whatever combination you want.
Just write the laws that way.
Like Airbus, Dassault Falcon
chose C* control laws, which give
flightpath stability but apparent
neutral speed stability. For example,
let’s say you are flying straight
and level at a steady 250 knots.
Take your hand off the sidestick
and pull the throttles to idle. In a
traditional aircraft the nose will fall
as the speed bleeds off and the aircraft
seeks its trimmed airspeed—a
speed stable response. In an FBW
aircraft, such as the A319CJ or 7X,
the flightpath remains constant
(level in this case) as speed bleeds
off and the FC raises the nose to
maintain the flightpath constant—a
flightpath stable response. The FC
automatically trims the stabilizer.
FAR25.173 discusses the requirement
for static longitudinal stability
(speed stability.) Certification of
FBW aircraft falls under special
conditions of a different section of
the FAR. The speed stability
requirement is in effect waived, in
part due to the protections FBW
provides which compensate for it.
Not everyone has chosen this
approach. Boeing made the 777
speed stable and therefore not
flightpath stable. The 777 control
laws are termed C*U (U representing
speed.) Which is better is essentially
a matter of pilot preference.
Hard vs soft limits
In the 7X simulator, Deleume let
me sample the protections programmed
into the 7X laws. From
level flight I pulled the nose up
sharply—it would go no steeper
than +35° up, the positive pitch
limit. This is a “hard limit” that the
pilot cannot exceed no matter what
he/she does. I held the nose there
while the speed bled off, keeping
the sidestick full aft against the
stop. When the angle of attack
(AOA) reached its maximum limit
(something just safely below
stalling AOA), the nose began to
lower smoothly in spite of the aft
stick, keeping the AOA at this maximum
safe value. This protection, a
hard AOA limit, would work well
in a windshear or CFIT recovery situation
if the pilot required max
AOA. He need only hold the sidestick
firmly against the aft stop and
let the computer do the work.
In a steep downward pitch, the
7X would allow only –25°, the
negative pitch limit, no matter how
hard I pushed.
According to Deleume, Dassault
had chosen not to set a limit in
bank angle. I rolled the 7X past 90°
to sample this, enjoying the
40°/second available rate. I then
rolled to about 80° of bank and
pulled the sidestick rapidly back to
the stop. The G indication displayed
on the HUD showed slightly
over 3 G. Falcon 7X FCs will allow
3.0–3.5 G with full aft sidestick.
Like the pitch and AOA limits, this
is a hard limit.
Hard limits are not universal in
civil FBW aircraft. Boeing chose
soft limits for the 777, which pilots
can exceed with more effort.
Boeing argues that the pilot should
always be in control in case of situations
where, for example, he/she
needs to exceed the design load
limit in a pull-up to avoid hitting a
mountain.
In emergency situations, however,
there are advantages to hard
limits. In 1999 members of an
ALPA committee studied CFIT
avoidance maneuvers using actual
aircraft—a Boeing 777 (soft protections)
and an Airbus A330 (hard
protections). In a pull-up from slow
speed the A330’s measured loss of
altitude was less than the 777’s. The
test pilots felt that the 777’s soft
96 PROFESSIONAL PILOT / September 2004
Computer-generated view of Falcon 7X’s EASy cockpit.
Left seat position shows sidestick, four 14-in flat panels,
pitch trim switches in center console and pull-out tray.
limits had allowed them to overshoot
optimum AOA, resulting in a
“mush” effect and greater altitude
loss. In high-speed pull-ups 777
pilots had to respect G limits, while
in the A330 they merely pulled the
sidestick to the aft stop and let the
computer give them 2.5 G.
The ALPA committee approved of
what it called “the carefree handling
afforded by hard limits” but
added, “We would like the pilot to
retain the authority to override limits
and protections.”
Unfortunately, that isn’t possible—
it’s simply an either/or choice
between hard and soft limits.
The 3.0–3.5 G limit of the 7X is a
significantly harder pull-up than
Airbus control laws allow (2.5 G).
While 3.5 G is a stroll in the park
to a fighter pilot or an aerobatic
competitor, a typical business jet
pilot will have had zero experience
pulling Gs and would probably not
obtain that load in an emergency
unless he panicked (and thus risked
pulling the wings off).
In a roll, Airbus FBW aircraft are
hard limited to 67° bank. The 7X
has no bank limit, so in terms of
maneuverability its hard limits are
quite a different proposition—the
Falcon 7X has 90° of roll in just
over 2 seconds and 3.5 G available,
giving it high maneuverability
and hard limit protection at the
same time.
The throttles for the 7X move with
thrust changes, whether the autothrottle
is on or off. Boeing too
backdrives the 777’s throttles with
its autothrottle engaged, so the pilot
can always see or feel thrust selection
in moving the throttles. On the
other hand, even in the A380, Airbus
continues with throttles that
remain stationary (in the climb
detent) with the autothrottle operating.
ALPA and IFALPA have criticized
this system.
Redundancy means safety
Dassault designed the 7X with 3
main flight computers (MFCs), each
of which is dual-channel (A and B),
and 3 secondary flight computers
(SFCs), each with one channel (C).
It has programmed channels A, B
and C independently to guard
against common faults.
In normal operation MFC number
1 is flying the airplane. Its channel
A generates the control commands,
while its channel B performs parallel
calculations. Comparator software
checks A against B outputs to
be sure they agree within tolerance.
If MFC 1 fails, loses power or
declares itself faulty, MFC 2 will fly.
If MFC 2 subsequently fails, MFC 3
flies. If all 3 MFCs fail, the SFCs fly
the airplane. SFCs are single-channel
but they cross-monitor each
other. If one SFC fails the other 2
continue—1 flying, 1 monitoring. If
a second SFC fails, the lone
remaining SFC will not fly because
it has no monitor.
To sum up, we would have to
lose 5 flight computers (MFC 1, 2
and 3 and 2 SFCs) in order to lose
our FBW ability. This level of
redundancy is greater than that
required for safety—in fact, it may
permit dispatch with single FC failure
once the MEL is finalized and
approved.
Certain system failures (hydraulic,
electrical, etc) will cause the FCs to
degrade from normal control law
first to alternate law and then to
direct law, in which sidestick position
corresponds directly with control
position. SFCs always operate
in direct law, with the pilot using
the center pedestal switches for
pitch trim.
If all FCs are lost the 7X will be
flown in manual reversion, with
electric pitch trim and rudder.
While the upper main rudder of the
7X is hydraulically actuated, the
lower rudder is electrically actuated
with high-speed electric motors.
Manual reversion employs this
lower rudder and is thus 100%
electric.
Electrical power in the 7X is thus
necessary both for FBW and for its
backup. At the Dassault equipment
facility at Saint-Cloud I took the opportunity
to fly another 7X simulator,
this one linked to the 7X “global
test bench” (GTB).
The GTB has complete electrical,
hydraulic and flight control systems
working together. The Falcon 7X
has 3 engine-driven electrical generators
and 2 permanent magnet
generators (PMGs), which are driven
by engines 1 and 2.
The 3 engine-driven generators
power MFC 1 and 2 and SFC 1 and
2 through the left and right essential
busses. These will be backed up
by the emergency RAT generator
and by the aircraft’s 2 batteries.
MFC 3 and SFC 3 are each powered
by one of the 2 PMGs.
Dassault has built significant
redundancy into the 7X’s electrical
system—in all there are 6 generators
and 2 batteries.
PROFESSIONAL PILOT / September 2004 97
Don Witt is a former
Airbus A320 captain
with United. He has
also worked as a
meteorologist, CFI,
charter/ corporate
pilot and FSI Learjet
instructor. He flew
McDonnell F4s in Vietnam.
Falcon 7X sidestick has 4 switches, including
a sidestick priority function to allow one
pilot to take control if both pilots are trying
to fly at once. As trim is entirely automatic,
the sidestick has no trim switch.
The 7X’s center pedestal has pitch trim
switches for electrically actuating the stabilizer
if FCs revert to direct law or when operating
in manual reversion. In normal flight
(FCs in normal law) pitch trim is automatic.