Safety

Claude LELAIE
Experimental Test Pilot

A380: Development
of the Flight Controls
Part 1 on a quad than on a twin due to the
number of rotors involved. It is to
be noted that this scenario, while
thanks to wind tunnel tests. This
allows a first version of the com-
puters to be prepared. The next step
extremely rare, happened recently, is the installation of these comput-
This article is the first of a series on an A380 from Qantas taking off ers on a simulator where the latest
intended to explain what has been from Singapore. Even though the aerodynamic models have been
done for the development of the aircraft was in a severely damaged integrated. Evaluations can start,
flight controls laws of the A380. and degraded situation, the crew first with “development simulator”
had all the means to land safely, pilots specialized in this job, and
and the analysis of the event con- then with the test pilots nominated
firmed that the design, in terms of to follow the program. At the be-
The General Prin- reconfiguration choices, was appro-
priate.
ginning, numerous small problems
ciples of the Design Numerous other factors are taken
are found and there is a progressive
evolution of the computers. The
Very early in the development into account when choosing the real proof comes with the test flight
process, the design office has to general architecture. The most itself as, even if the models are gen-
take many important decisions re- important is the need to minimise erally reliable, they are rarely fully
lated to flight controls such as how weight, obviously whilst keeping representative of the aircraft at low
many computers, flight controls the same level of safety. speed, high speed and in the ground
surfaces, and hydraulic circuits are The development of the flight con- effect. Also, at the beginning of
needed. All that is dictated by the trols laws for a Fly-By-Wire aircraft the flight tests, for the first time,
analysis of failures, associated with is a complex process. It starts by pilots are exposed to the accelera-
a first estimation of the likely flight computations based on estimated tions of the aircraft in response to
characteristics. In case of multiple aerodynamic models of the aircraft, their commands. Flexibility of the
failures, the aircraft must remain Figure 1
which are then checked and adjusted structure can have consequences
flyable. A380 Iron Bird
One of the failures that could have
the most adverse consequences and
that leads to a lot of decisions is the
non-contained explosion of an en-
gine rotor disc. It is assumed that a
part of this disc will penetrate the
fuselage or the wing with “high”
energy. The engine is designed and
built in such a way that this should
not happen, but this is a supple-
mentary precaution. The potential
trajectories of this part are computed
according to very precise rules. It
must be checked that all the en-
ergy sources (mainly electricity and
hydraulic) will not be affected at
the same time, which could have
catastrophic consequences. Obvi-
ously, this study is far more complex

Safety first #13 January 2012 - 1/5

on comfort, but can also induce
effects on the flying characteris-
Fly-By-Wire Up Control Module (BCM). Any
of the three PRIMs can ensure the
tics.Often, the models used for and Associated full control of the plane without re-
computations or in the simula-
tor are correct so that after tun-
Improvements striction. The SECs do not provide
stabilized control laws as do the
ing on ground and validation in Fly-By-Wire has brought a lot to PRIMs but they are more robust to
flight, there is nothing else to aviation. Obviously the ease of the loss of some information. They
do. But it occasionally happens flying and the protections to avoid also have different software than
that the aircraft behaviour is not loss of control are well known, but the PRIMs so that a bug in one cat-
in line with the expectations and that is not all. egory of computer does not “con-
an aerodynamic identification in taminate” the others. All computers
In the past, flight controls were
flight is needed to allow further have a command and a monitoring
designed to meet two sets of criteria:
tuning of the models in order to lane. Finally, there is a BCM, avail-
they had to be “well harmonised”
enable the design office to define able in case of failure of all PRIMs
and had to meet the criteria for cer-
the next standard of the comput- and SECs.
tification. With Fly-By-Wire, three
ers. Sometimes it is difficult be-
possibilities have been added: im- The A380 has only two hydraulic cir-
cause the modelling of the ground
prove safety by restricting manoeu- cuits instead of three on the Airbus of
effect is not satisfactory or the
vres which could lead to a loss of the previous generations. The third
flexibility of the aircraft does not
control, reduce the weight of the circuit has been replaced by local
permit a correct simulation. In
structure with the prohibition of hydraulic generation: for some ser-
this case, the development has to
some actions, which may increase vo-controls, a small electrical mo-
be performed in two phases, first
the loads and finally improve com- tor creates the hydraulic energy to
with models and then directly in
fort for the passengers. Adding all power it. These systems are called
flight. When in flight, engineers
these functions leads to more and EHA (Electro Hydraulic Actuator)
and pilots decide in real time
more complexity for the flight con- or EBHA (Electro Backed up Hy-
what adjustments are necessary.
trols computers. draulic Actuator: fig. 2). This new
They are using their knowledge,
judgement, common sense and type of architecture with only two
circuits allows the saving of several
feelings (seat of the pants flying).
Some non-specialists consider The Main A380 hundred kilograms on the A380,
that the flight test task is only Characteristics mainly thanks to the reduction of the
number of pipes. It also creates a new
to validate results obtained in a
simulator. This is not correct, as, A general description of the main level of system segregation safety.
for a significant number of tests, characteristics of the A380 flight Some control surfaces have been
methodologies have not evolved controls will allow us to gain a better split into several parts controlled
since the last century, except for understanding of the tests performed. by different electrical and hydrau-
the help given by the computers. The A380 has seven flight controls lic sources. There are two rudders
Most of the time, qualitative computers: three Primary Com- instead of one on all other Airbus
feelings and impressions are still puters (PRIMs), three Secondary and four elevators instead of two. On
showing the way. Computers (SECs), and one Back each side, there are three ailerons

Figure 2
In order to save time, the flight A380 EBHA Rudder
test engineers have a tool called
AFDX Digital Injection System
(ADIS), which allows them to
modify in real time some char-
acteristics of the computers. For
safety reasons, all the new pos-
sible adjustments are checked in
a simulator before using them in
flight.
The development of the flight
controls laws is a fascinating ad-
venture: every day there are new
surprises, some good and some
bad. The A380 has not been the
most difficult aircraft in this re-
spect, thanks to the excellent aer-
odynamic characteristics.

Safety first #13 January 2012 - 2/5

 Safety

instead of one on the A320 family and

two on the A340 and A330. Each of
The Take-Off off, it is possible to improve what
the pilots are feeling and the flight
the surfaces (except the spoilers) is Rotation Law engineers have on their traces. As
activated by two servos using dif- an example, the law can be made
ferent hydraulic circuits or EHA or On the A340-600, the development more or less efficient at the initial
of the take-off control law proved pilot command. It is also possible
EBHA. Two or three different com-
to be rather difficult. It is worth ex- to reduce the pitch rate when ap-
puters (PRIM and SEC plus BCM)
plaining the issue here to show the proaching the take-off attitude,
control each of the servos. Therefore,
kind of obstacles that can be found. but not too early and not too late.
a lot of failures are needed to lose
the control of one surface. All the pilots agreed that, on the If there is a risk of tail strike, the
A340-300, the reaction in pitch pitch rate must also be controllable
When the four engines (or their gen- during the rotation at take-off, to almost zero very quickly. The
erators) and the APU are no longer whilst being acceptable, was a bit flight test engineers have to play
available, electricity is coming from sluggish. As the A340-600 was with a lot of variables such as pre-
a Ram Air Turbine (RAT). planned to be about 100 tons heavier command, damping, filtering and
than the A340-300 and longer so on, so as to reduce the take-off
by about 12 meters, a study was distances and ensure safety in all
The Identification launched to improve the reaction of the critical cases such as engine
of the Aircraft the -600 during the rotation. Nu-
merous tests were performed in the
failure, early rotation… To perform
this tuning well they must have a
To ensure that the adjustments to simulator and then the new control perfect understanding of the effect
the control laws are well adapted law was installed on the A340-300 of all parameters.
to the characteristics of the plane, used for development. The team This example shows the limits of
the design office needs a good was happy with the results. Sub- what is possible to perform with
aerodynamic model. This is ini- sequently, the take-offs of the first models or with the simulation for
tially achieved through simulation. two flights of the A340-600 were some flight phases, particularly
However some tuning can only be performed in direct law in order to close to the ground. However, the
f inalized and validated in flight. improve progressively our knowl- conclusion must not be that models
So, the identification of the aircraft edge of the aircraft. Following the have to be disregarded. Very good
stability and control characteristics landing from the second flight, it preparation is fundamental in order
in flight is among the first priorities was planned to perform another to have a solid starting point and
take-off with the brand new rota- to give to the flight test engineers
of the program. On the A380, about
tion law. It just happened that the well-adapted tools with the ADIS.
one month after the beginning of
Captain of the A340-600 had been
the flight tests, in April 2005, flight After the lessons of the A340-600,
in charge of the development of
16 was devoted to identification we decided to keep the same meth-
this law. At the beginning of the
of these characteristics in pitch. manoeuvre, the aircraft exhibited odology to develop the rotation law
Then, during the months of July and a strong Pilot Induced Oscillation of the A380: a basic and simple
August, about 15 flights were dedi- (PIO). The pilot reacted naturally preparation using models and simu-
cated to similar tests in roll, pitch, to an unexpectedly strong response lators followed by the development
effect of the engines… More were of the aircraft. The oscillations with flight tests.
performed during the following stopped after six cycles.
months.
Why this surprise, as everything For all these tests: development of a
These identification flights are was well prepared? The forward rotation law and, later on, measure-
completely different from those part of the A340-600 is longer than ments of take-off distances, there is
which must be done at the end of on the -300 and, with this lever, always a risk of tail strike because
the development in order to prepare the crew had the feeling of being we are frequently on the limit of
the aircraft models for installation projected too quickly into the air manoeuvrability of the aircraft.
in the training simulators. For these and therefore reacted immediately, Therefore, the aircraft is equipped
last flights a very specific process creating this PIO. All the work done with a tail bumper, the same that is
has to be followed. The training prior to the flight could not be used used for the VMU tests.
simulators do not need to represent as such. So, after a minimum of The first flight for development of
the flight characteristics in extreme development in the simulator, the A380 take-off rotation law was
situations. On the other hand, in to have a good starting point for performed on December 29th 2005
order to develop the flight control the control law, the tuning was with a very experienced crew: two
computers, the design office needs performed during a flight with test pilots, one test flight engineer
to have a good identification of the around 15 take-offs. (in the cockpit) and two flight test
aerodynamic characteristics at the The principle is rather simple: with engineers both specialists of flight
limits of the flight envelope. the help of the ADIS, at each take- controls. After 15 take-offs, the

Safety first #13 January 2012 - 3/5

 pilot encountered Pilot Induced
Oscillations (PIO) in this flight
phase. The reason is that the A340
touches down with a rather high
pitch attitude, and on the rear
wheels of the bogies having a “nose
up” position. Added to which, the
touchdown of the nose wheels is
performed with a slight nose down
attitude. The nose wheels, and ob-
viously the pilots, must “descend”
from a relatively large height at
landing. This “de-rotation” law
reduces the authority of the stick
in pitch during this phase in order
to be able to smoothly control the
nose gear to the ground, without
risk of PIO.
A similar law was installed on
the A380 by precaution, despite
the fact that the A380 has none of
results were satisfactory. Later on, Figure 3 lowed us to be efficient after each the characteristics of the A340. In
in February 2006, another flight
A380 take-off
take-off by executing overweight all cases, it appeared that this law
from Toulouse-
allowed the team to fine-tune the Blagnac Airport landings without overheating the was only engaged for two or three
protection, which was designed to brakes. These landings added to the seconds and therefore was prob-
avoid getting a tail strike. It is to difficulty of the tests. ably useless. In May 2006, during
be noted that during these tests, we flight 221 of aircraft 1, we used the
Immediately at the end of the de- opportunity provided by the tun-
did experience a slight tail strike velopment of this law, the flights ing of the pitch law for approach
on the tail bumper, proof that we for measurements of take-off dis- and landing to make the decision
were looking for the minimum tances started with EASA crews. to remove it, keeping the flare law
margin while keeping the safety
engaged during this phase. After
level. The computations performed
several landings, it appeared that
later on, demonstrated that the tail
strike would not have happened on
The Landing this was the right solution and from
the fuselage without the installa- Pitch Law then on, all landings were per-
formed with this modified law in
tion of the bumper. Finally, a last order to be sure that there was no
flight was performed at the begin- The development of the pitch law
at landing was quite quick. From adverse consequence.
ning of March 2006 to validate the
law at very heavy weights, as the the beginning, we were aware that Later on, some minor final adjust-
behaviour has to be checked for all landing the A380 was very easy. ments were made on the approach
the weight and CG combinations. However some adjustments were and flare law. The target was to
The first take-off was performed necessary for the various flight satisfy the majority of pilots! The
at 596,5 tons, more than 30 tons conditions: weights and CG posi- most important modification dur-
above the MTOW. Our experience tions. For the flight part, an initial ing this period was the increase of
has shown that it is always better to tuning was performed as the con- pitch authority when at high weight
be heavier for this type of flight as, trols were judged to be a bit too to reduce the risk of hard landing in
very often, our customers are ask- sensitive. case of emergency turn back.
ing for an increase of the MTOW But the main modification was the
very quickly after entry into serv- suppression of what is called the
ice. This way of working avoids “de-rotation” law on A340 and
launching, later on, new tests which A330. On these aircraft, as soon as
could even lead to a further modi- the main wheels touch the ground,
fication of the law. Additionally, this law is engaged and helps the pi-
sufficient fuel was necessary to fly lot to control the pitch attitude until Part 2 will include the devel-
to Istres Air Force Base (South of the front wheels are on ground. This opment of the lateral law (the
France) to perform all the tests. The law does not exist on the A320 family “ailerons waltz”) and the tun-
choice of Istres airport to perform but was installed during the develop- ing of the low speeds and high
this flight was due to the runway ment of the A340 because, during speeds protections.
length of 5000 meters, which al- a demonstration flight, an airline

Safety first #13 January 2012 - 4/5

 Safety

Safety First
The Airbus Safety Magazine
For the enhancement of safe flight through
increased knowledge and communications

Safety First is published by the All articles in Safety First are present- Contributions, comment and feed-
Flight Safety Department of Air- ed for information only and are not back are welcome. For technical
bus. It is a source of specialist safe- intended to replace ICAO guidelines, reasons the editors may be required to
ty information for the restricted use standards or recommended practices, make editorial changes to manu-
of flight and ground crew members operator-mandated requirements or scripts, however every effort will
who fly and maintain Airbus air- technical orders. The contents do not be made to preserve the intended
craft. It is also distributed to other supersede any requirements mandated meaning of the original. Enquiries
selected organisations. by the State of Registry of the Opera- related to this publication should
tor’s aircraft or supersede or amend be addressed to:
any Airbus type-specific AFM, AMM, Airbus
Material for publication is FCOM, MEL documentation or any
obtained from multiple sources Product Safety department (GS)
other approved documentation. 1, rond point Maurice Bellonte
and includes selected informa-
tion from the Airbus Flight Safety 31707 Blagnac Cedex - France
Confidential Reporting System, Articles may be reprinted without Fax: +33(0)5 61 93 44 29
incident and accident investiga- permission, except where copy- [email protected]
tion reports, system tests and right source is indicated, but with
flight tests. Material is also ob- acknowledgement to Airbus. Where
tained from sources within the Airbus is not the author, the con-
airline industry, studies and re- tents of the article do not necessarily
ports from government agencies reflect the views of Airbus, neither
and other aviation sources. do they indicate Company policy.

A320 © Airbus S.A.S. 2012 – All rights reserved. Proprietary documents.

Safety
Edition January 2012
The Airbus Safety Magazine
Close up on
CONTENT:
q A320 Family / A330 Prevention
and Handling of Dual Bleed Loss
q The Fuel Penalty Factor new A320 By taking delivery of this Brochure (hereafter “Brochure”), you accept on behalf of your company to
q The Airbus TCAS

sharklet
Alert Prevention (TCAP)

comply with the following guidelines:

q A380: Development of the
Flight Controls - Part 1
q Facing the Reality of Everyday
Maintenance Operations

3 No other intellectual property rights are granted by the delivery of this Brochure than the right to read
it, for the sole purpose of information.

3 This Brochure and its content shall not be modified and its illustrations and photos shall not be repro-
duced without prior written consent of Airbus.
Issue 13

Safety First, #13 January 2012. Safety First is 3 This Brochure and the materials it contains shall not, in whole or in part, be sold, rented, or licensed
published by Airbus S.A.S. - 1, rond point Maurice to any third party subject to payment.
Bellonte - 31707 Blagnac Cedex/France. Editor: This Brochure contains sensitive information that is correct at the time of going to press.
Yannick Malinge, Chief Product Safety Officer,
Nils Fayaud, Director Product Safety Information. This information involves a number of factors that could change over time, effecting the true public
Concept Design by Airbus Multi Media Support representation. Airbus assumes no obligation to update any information contained in this document or
Ref. 20111714. Computer Graphic by Quat’coul, with respect to the information described herein.
Fixion. Copyright: GS 420.0043/11. Photos copyright
Airbus. Photos by ExM Company: P. Masclet. Airbus S.A.S. shall assume no liability for any damage in connection with the use of this Brochure and
Printed in France by Airbus Print Centre. of the materials it contains, even if Airbus S.A.S. has been advised of the likelihood of such damages.

Safety first #13 January 2012 - 5/5