Fly-by-wire (FBW) is a system that replaces the conventional manual flight controls of an aircraft with an electronic interface. The movements of flight controls are converted to electronic signals, and flight control computers determine how to move the actuators at each control surface to provide the ordered response. Implementations either use mechanical flight control backup systems or else are fully electronic. [1] Improved fully fly-by-wire systems interpret the pilot's control inputs as a desired outcome and calculate the control surface positions required to achieve that outcome; this results in various combinations of rudder, elevator, aileron, flaps and engine controls in different situations using a closed feedback loop. The pilot may not be fully aware of all the control outputs acting to affect the outcome, only that the aircraft is reacting as expected. The fly-by-wire computers act to stabilize the aircraft and adjust the flying characteristics without the pilot's involvement, and to prevent the pilot from operating outside of the aircraft's safe performance envelope. [2][3] Mechanical and hydro-mechanical flight control systems are relatively heavy and require careful routing of flight control cables through the aircraft by systems of pulleys, cranks, tension cables and hydraulic pipes. Both systems often require redundant backup to deal with failures, which increases weight. Both have limited ability to compensate for changing aerodynamic conditions. Dangerous characteristics such as stalling, spinning and pilot-induced oscillation (PIO), which depend mainly on the stability and structure of the aircraft rather than the control system itself, are dependent on the pilot's actions. [4] The term "fly-by-wire" implies a purely electrically signaled control system. It is used in the general sense of computer-configured controls, where a computer system is interposed between the operator and the final control actuators or surfaces. This modifies the manual inputs of the pilot in accordance with control parameters. [2] Side-sticks or conventional flight control yokes can be used to fly fly-by-wire aircraft. [5] A fly-by-wire aircraft can be lighter than a similar design with conventional controls. This is partly due to the lower overall weight of the system components and partly because the natural stability of the aircraft can be relaxed (slightly for a transport aircraft; more for a maneuverable fighter), which means that the stability surfaces that are part of the aircraft structure can therefore be made smaller. These include the vertical and horizontal stabilizers (fin and tailplane) that are (normally) at the rear of the fuselage. If these structures can be reduced in size, airframe weight is reduced. For this reason, most fly-by-wire systems incorporate either redundant computers (triplex, quadruplex etc.), some kind of mechanical or hydraulic backup or a combination of both. A "mixed" control system with mechanical backup feedbacks any rudder elevation directly to the pilot and therefore makes closed loop (feedback) systems senseless. [1] Aircraft systems may be quadruplexed (four independent channels) to prevent loss of signals in the case of failure of one or even two channels. High performance aircraft that have fly-by-wire controls (also called CCVs or Control-Configured Vehicles) may be deliberately designed to have low or even negative stability in some flight regimes – rapid-reacting CCV controls can electronically stabilize the lack of natural stability. [3] Pre-flight safety checks of a fly-by-wire system are often performed using built-in test equipment (BITE). A number of control movement steps can be automatically performed, reducing workload of the pilot or groundcrew and speeding up flight-checks. [citation needed] Some aircraft, the Panavia Tornado for example, retain a very basic hydro-mechanical backup system for limited flight control capability on losing electrical power; in the case of the Tornado this allows rudimentary control of the stabilators only for pitch and roll axis movements. [8]

For each of these threats, the applicable airworthiness requirements are summarized; the solutions used on Airbus Fly-by-Wire are described, along with challenges to these solutions and future trends. The paper focuses on piloting aids, summarizing other threats. More details can be found in [2]. FAR/JAR 25.1309 that requires demonstrating that any combination of failures with catastrophic consequence is Extremely Improbable typically addresses failures. "Extremely Improbable" is translated in qualitative requirements (see § 3 to 5) and to a 10-9 probability per flight hours. Specifically for flight controls, FAR/JAR 25.671 requires that a catastrophic consequence must not be due to a single failure or a combination of a single failure with a hidden one (unless very stringent maintenance requirement on this failure) or a control surface jam or a pilot control jam. This qualitative requirement is on top of the probabilistic assessment. To deal with the safety issue (the system must not output erroneous signals), the basic building blocks are the fail-safe command and monitoring computers. These computers have stringent safety requirements and are functionally composed of a command channel and a monitoring channel. To ensure a sufficient availability level, a high level of redundancy is built into the system. Functionally, the computers have a command channel and a monitoring channel (see Fig. 1a/ Fig. 1b). The command channel ensures the function allocated to the computer (for example, control of a moving surface). The monitoring channel ensures that the command channel operates correctly. This type of computer has already been used for the autopilot computers of Concorde, and the Airbus aircraft. Fig. 1a. Computer Global Architecture Fig. 1b. Computer Monitoring Architecture These computers can be considered as being two different and independent computers placed side by side. These two (sub) computers have different functions and software and are placed adjacent to each other only to make aircraft maintenance easier. Both command and monitoring channels of one computer are active simultaneously, or waiting, again simultaneously, to go from stand-by to active state. When in stand-by mode, computers are powered in order to activate potential dormant faults and isolate them. The monitoring channel acts also on associated actuator: when deselecting the COM order, it switches off the actuator solenoid valve to set it in stand-by mode (Fig. 1b). Two types of computers are used in the A320 flight control system: the ELAC's (ELevator and Aileron Computers) and the SEC's (Spoiler and Elevator Computers). Two types of computers are also used on the other FbW Airbus, named differently: the PRIM's (primary computers) and the SEC's (secondary computers). The redundancy aspect is handled at system level. This paragraph only deals with the computer constraints making system reconfiguration possible. The functions of the system are divided out between all the computers so that each one is permanently active at least on one subassembly of its functions. For any given function, one computer is active the others are in standby ("hot spares"). As soon as the active computer interrupts its operation, one of the standby computers almost instantly changes to active mode without a jerk or with a limited jerk on the control surfaces. Typically, duplex computers are designed so that they permanently transmit healthy signals and so that the signals are interrupted at the same time as the "functional" outputs (to an actuator for example) following the detection of a failure. Fig. 2. A340-600 System Architecture The computers and actuators are redundant. This is illustrated by the A340-600 pitch control (Fig. 2, left and right elevator, plus Trimable Horizontal Stabilizer - THS). Four command and monitoring computers are used, one is sufficient to control the aircraft. In normal operation, one of the computers (PRIM1) controls the pitch, with one servocontrol pressurized by the Green hydraulic for the left elevator, one pressurized by the Green hydraulic on the right elevator, and by electric motor No. 1 for the THS. The other computers control the other control surfaces.

In my case study of the Boeing 737 MAX aircraft’s anti-stall mechanism, I examined how relying on data from only one Angle-of-Attack (AoA) sensor caused two accidents and the aircraft’s consequent grounding. A single point of failure is a system component, which, upon failure, renders the entire system unavailable, dysfunctional, or unreliable. In other words, if a bunch of things relies on one component within your system, and that component breaks, you are counting the time to a catastrophe. As the Boeing 737 MAX disaster has emphasized, single points of failure in products, services, and processes may spell disaster for organizations that have not adequately identified and mitigated these critical risks. Reducing single points of failure requires a thorough knowledge of the vital systems and processes that an organization relies on to be successful. Since the dawn of flying, reliance on one sensor has been anathema. The Airbus A380 aircraft, for example, features 100,000 different wires—that’s 470 km of cables weighing some 5700 kg. Airbus’s wiring includes double or triple redundancy to mitigate the risk of single points of failure caused by defect wiring (e.g., corrosion, chafing of isolation or loose contact) or cut wires (e.g., through particles intruding aircraft structure as in case of an engine burst.) The Airbus fly-by-wire flight control system has quadruplex redundancy i.e., it has five flight control computers where only one computer is needed to fly the aircraft. Consequently, an Airbus aircraft can afford to lose four of these computers and still be flyable. Of the five flight control computers, three are primary computers and two are secondary (backup) computers. The primary and the secondary flight control computers use different processors, are designed and supplied by different vendors, feature different chips from different manufacturers, and have different software systems developed by different teams using different programming languages. All this redundancy reduces the probability of common hardware- and software-errors that could lead to system failure. The multiple redundant flight control computers continuously keep track of each other’s output. If one computer produces deviant results for some reason, the flight control system as a whole excludes the results from that aberrant computer in determining the appropriate actions for the flight controls. By replicating critical sensors, computers, and actuators, Airbus provides for a “graceful degradation” state, where essential facilities remain available, allowing the pilot to fly and land the plane. If an Airbus loses all engine power, a ram air turbine can power the aircraft’s most critical systems, allowing the pilot to glide and land the plane (as happened with Air Transat Flight 236.) When you devise a highly reliable system, identify potential single points of failure, and investigate how these risks and failure modes can be mitigated.

e design of a Fly-By-Wire system is described which is based on applications of active redundancy and electrical feed- back techniques. The replacement of mechanical flight control systems with Fly-By-Wire systems for flight control of large high-speed aircraft is advocated because of performance deficiencies in mechanical systems. The Fly-By-Wire system incorporates three redundant channels over which three electrical flight command signals are continuously trans- mitted to the aircraft control surface power actuator. A breadboard model of one axis of the Fly-By-Wire system was fabricated and evaluated for performance under various failure conditions. Results of the tests demonstrate the feasibility of design techniques with which the three electrical signals are converted to me- chanical signals and combined to provide The ability of a pilot to control the flight path of a high performance aircraft de- pends largely on the precision with which his flight commands are transmitted to the control surface actuators. Tradition- ally, the pilot's effort was applied direct- ly to the elevator, aileron, and rudder over a system of cables, cranks, and pulleys. However, the power required for surface control in high speed, mili- taTy aircraft far exceeds the pilot's capa- bilities. Flight control systems installed in these aircraft are fully powered -- that is, none of the force required to overcome, the aerodynamic moment on the control - stick or pedals. power is supplied from hydraulic pumps driven by the aircraft engines. Typically, the hydraulic power to the surface actuator is controlled by a slide valve, the rate of flow of the hydraulic fluid to the actuator being proportional to the displacement of the valve" slide. The valve is driven by a mechanical device according to the difference between the position of the control surface and the position commanded by the pilot's control stick or pedals. The Fly-By-Wire flight control system is a triply redundant electrical system which controls the position of a hydraulic power mechanism according to flight control commands originating at a pilot's control stick. The system evaluated under the program reported herein is depicted in simplified form in the schematic diagram of Figure 1. Components of the system are combined and arranged, employing feedback control system techniques, to position an aircraft control surface (elevator, aileron, or rudder) for the con-trol of the flight path of the aircraft according to electrical flight commands transmitted from the pilot's cockpit to the power mechanism. signal inputs; three channels of electronic demodulators and amplifiers; and four sets of electrical position transducers. The primary component of the Fly-By- Wire system is the servo actuator assembly. The servo actuator package is shown on Figure Z. It is an assembly of electromechanical, electrohydraulic, and hydromechanical devices, designed low-level signal inputs. The following housing. These devices are single-stage valves, each consisting of a dc electric torque to the position of the slide as determined J by the voter mechanism position. The --that is, it has a single slide with two sets of lands and grooves. The slide valve controls power to the tandem power cylinder from two hydraulic supplies. The power cylinder is the output device of the servo actuator assembly.

An outline of the philosophy of fly-by-wire flight control systems is given, the evolution of fly-by-wire is discussed, the ad-vantages of fly-by-wire over mechanical systems are listed, current fly-by-wire techniques are outlined, and a brief review of, the Air force Flight Dynamics Laboratory proposedcin-house and contracted fly-by-wire development programs is given.' Before discussing fly-by-wire, it is important to understand what is meant by the term "fly-by-wire". Two other terms, "electrical primary flight control system" and "pseudo fly-by-wire", are often used in discussions of fly-by-wire and therefore also require definition. The following definitions of these three terms apply throughout this paper and have been generally accepted by the Air Force Flight Dynamics Laboratory. Electrical Primary Flight Control System (EPFCS) -A flight control system mechanization wherein the pilot's control commands are transmitted to the moment or force p/roducer only via electrical wires. Fly-by-Wire - A fly-by-wire flight control system is an electrical primary flight control system employing feedback such that vehicle motion is the controlled parameter. Pseudo Fly-by-Wire -A fly-by-wire flight control system with a normally disengaged mechanical backup. to many of the control system problems associated with modern high performance aircraft and aerospace vehicles. However, there exists system designers to remove all flight control cables and mechanical linkages and rely solely on electrical signals and electronic devices. The state-of-the-art in electronic circuits and redundancy techniques has now antiquated this approach. It is now possible to talk realistic-ally about building a pure fly-by-wire flight control system that is more reliable than its mechanical counterpart. Until it is actually done, however, and successfully demorstrated in flight tests, the Missourian in many of us will prevail and the security stigma associated with mechanical control systems will predominate. Our fly-by-wire effort is orientated towards fulfilling this need. night, but rather it evolved slowly through the years as aircraft flight control system requirements changed. With progressive increases in aircraft size and speed, power-boosted control quickly became a requirement in order to enable the pilot to utilize the full maneuver capability of the aircraft. Hydraulic boost, wh'ere a hydraulic actu- T-33, 707 rudder, and 727 elevators and ailerons. Shortly after World War II, fully powered controls came into being. Here the control to the control surface Feel is introduced into the systen artificially with springs, dash pots, bob weights, and in some :ases "q"bellows. This artificial feel, while not required in moving the control surfaces, is needed to give the pilot the proper handling quelities characteristics for control of the aircraft. Hence, although the pilot has no direct physical connection with the control surfaces, the artificial feel system gives him the impression that he has. Examples of aircraft using fully powered controls are the F-86, F-4C, F-104, F-105, and 727 rudder. One of the primary reasons for using fully powered cont-ol is that in the transonic region the forces on the surfaces vary gi-atly and are highly nonlinear. The resulting stick forces with direct mechanical connection to the control surfaces were unacceptable from a handling qualities point of view.

This article presents a distributed dissimilar redundancy architecture of fly-by-wire Flight Control System. It is based on many dissimilar flight control compu

Redundancy levels in fly-by-wire systems are critical components that enhance the safety and reliability of modern aircraft. As aviation technology advances, understanding the intricacies of redundancy becomes paramount for both engineers and pilots. The implementation of various redundancy levels not only safeguards against system failures but also instills confidence in flight operations. Examining these levels provides insights into how aircraft achieve unprecedented safety standards in an increasingly complex aerospace environment. Redundancy levels in fly-by-wire systems refer to the methodologies employed to ensure system reliability and safety in aircraft operations. These systems utilize multiple independent channels to process flight controls, thereby minimizing the risk of failure. By incorporating redundancy, aircraft designers enhance control integrity, even in the event of a system malfunction. The structures of redundancy can vary, typically involving a minimum of two control channels that function simultaneously. If one channel experiences a failure, the other continues to operate, ensuring that pilots retain control of the aircraft. This design principle is vital, as it addresses the potential for single points of failure, which can compromise overall safety. Each redundancy level is strategically designed to cater to specific operational requirements, from basic systems with dual-redundant architectures to more advanced quadruple-redundant configurations found in commercial airliners. These levels of redundancy are critical in maintaining safety during various phases of flight, thereby instilling confidence in both pilots and passengers. Therefore, understanding redundancy levels in fly-by-wire systems is fundamental to grasping how modern aircraft maintain safe and reliable operation. By integrating such sophisticated mechanisms into flight systems, the aviation industry significantly mitigates the risks associated with mechanical failures. Redundancy levels in fly-by-wire systems are vital for ensuring aircraft safety and operational reliability. Redundancy levels in fly-by-wire systems can be classified primarily into three distinct types: single, dual, and triple redundancy. Each level serves a critical function in ensuring the safety and reliability of aircraft control systems during flight operations. Single redundancy implies that there is only one system in place to perform critical functions. While this approach may simplify design, it lacks the fail-safe capabilities necessary to handle potential system failures effectively. Dual redundancy enhances safety by incorporating a secondary system that can take over if the primary system fails. This configuration, common in commercial aircraft, provides immediate backup capabilities, ensuring that control remains intact even in the event of a malfunction. Triple redundancy offers the highest level of security by utilizing three independent systems. This setup not only enhances reliability but also allows for continuous monitoring and comparison of the systems, providing comprehensive fault tolerance. Each type of redundancy level plays a vital role in optimizing the performance and safety of fly-by-wire systems. Fail-safe mechanisms in fly-by-wire systems are designed to maintain the aircraft’s operability and safety in the event of a failure. These mechanisms ensure that if a malfunction occurs in any part of the control system, alternative solutions are immediately available to maintain functionality and prevent catastrophic outcomes. Monitoring system health plays a critical role in these mechanisms.

In the realm of aviation, system redundancy standards play a pivotal role in the safety and reliability of fly-by-wire systems. These standards ensure that critical functions remain operational, even in the event of component failures. Understanding the intricacies of system redundancy standards reveals their significance in maintaining aircraft performance and enhancing pilot confidence. Without these standards, the evolving landscape of fly-by-wire technology would pose substantial risks to flight safety. System redundancy standards refer to protocols designed to ensure that critical systems maintain operational capability despite failures. In fly-by-wire systems, these standards play an integral role by duplicating essential components, allowing continued control even when primary systems fail. In the context of aircraft, the importance of system redundancy standards cannot be overstated. For fly-by-wire technology, which relies heavily on electronic systems for flight control, these standards enhance safety and reliability, significantly mitigating risks associated with system malfunctions. The implementation of these standards ensures that multiple pathways exist for data transmission and control commands. Such redundancy allows for the use of backup systems that can seamlessly take over in the event of a failure, thus maintaining safety throughout the flight. Understanding system redundancy standards in fly-by-wire systems is vital for the development of newer aircraft technologies, ensuring that safety and operational integrity remain at the forefront of aviation advancements. This approach not only optimizes performance but also instills confidence in the flying public. System redundancy standards refer to the established protocols and frameworks designed to ensure the reliability and safety of critical systems, particularly in aviation. These standards aim to create multiple layers of backup within aircraft systems, thereby minimizing the risk of failure during operation. The importance of system redundancy standards in aircraft safety cannot be overstated. They provide a safeguard against single points of failure, thereby enhancing the overall robustness of fly-by-wire systems. Such redundancy is critical, as these systems rely heavily on electronic controls that replace traditional mechanical linkages. In the context of fly-by-wire technology, system redundancy standards involve the integration of multiple sensors, actuators, and control units. Should one component fail, alternate systems can take over seamlessly, ensuring continued functionality and safety. This automatic fallback mechanism is vital for maintaining control under adverse conditions. Compliance with system redundancy standards is not merely regulatory but also a matter of safeguarding lives. By adhering to these standards, manufacturers and operators can significantly enhance the reliability of fly-by-wire systems, ultimately contributing to safer aviation practices.

The new technologies in flight control avionics systems selected for the Boeing 777 airplane program consist of the following: Fly-By-Wire (FBW), ARINC 629 Data Bus, and Deferred Maintenance. The FBW must meet extremely high levels of functional integrity and availability. The heart of the FBW concept is the use of triple redundancy for all hardware resources: computing system, airplane electrical power, hydraulic power and communication paths. The multiple redundant hardware are required to meet the numerical safety requirements. Hardware redundancy can be relied upon only if hardware faults can be contained; fail-passive electronics are necessary building blocks for the FBW systems. In addition, FBW computer architecture must consider other fault tolerance issues: generic errors, common mode faults, near-coincidence faults and dissimilarity. The NASA FBW projects [1],[2] provide the numerical integrity and functional availability requirements for FBW computers. A finding from the research, Byzantine General problem [3], also serves as a design consideration to assess robustness of FBW computer architectures. Past Boeing and other industry experiences in dealing with generic faults [4], near-coincidence faults [5] provide ground rules for the Boeing 7J7 FBW program. The experiences on the 7J7 program [6],[7],[8],[9] and the academic research on design diversity [10],[11], design paradigm [12] are carried over to the 777 FBW program [13],[14],[15]. Furthermore, to certify the 777 FBW program, the flight controls design and development process considers all requirements from: airplane functional groups, certification agencies, customers, in-service experiences, technology trends and design paradigm. The Boeing 777 FBW requirements were then derived and developed. Based on Life Cycle Cost study for an optimum redundancy level for airlines, these computer architectures contain one level of redundancy beyond that required to achieve the functional integrity for airplane dispatch. Consequently, repair of random hardware failures can be deferred to a convenient time and place, resulting in reduction of dispatch delays or cancellations. The triple-triple redundant PFC architecture, triple channels with triple dissimilar lanes in each channel, has been described [14]. The PFC can be dispatched with one failed lane: maintenance alert is generated for maintenance attention. The PFC can also be dispatched with one failed channel: flight deck status message is generated requiring replacement of a PFC channel within three flights. The ADIRS and AIMS architectures can be summarized as follows. This system evolved from the Air Data Computers and Inertial Reference Systems on previous airplanes. The system consists of traditional triple-redundant pitot and static ports, whose signals are converted to electrical signals by Air Data Modules mounted near the probes. Digital signals are sent via Flight Control ARINC 629 buses to the ADIRU and SAARU for processing, as shown in Figure 6. The ADIRU and SAARU are fault tolerant computers with angular rate sensors and accelerometers mounted in a skewed-axis arrangement [17]. The ADIRU can be dispatched with one failure of each of the following assemblies: angular rate sensor, accelerometer, processor, and I/O module.

Abstract: In order to improve the safety of fly-by-wire flight control system and meet the airworthiness requirements, this paper takes the fly-by-wire flight control system of a manned airship as an example, and proposes a dual-redundancy flight control computer. The redundant architecture is designed based on redundancy technology and combined with an effective redundancy management algorithm, so that the fly-by-wire flight control computer can detect and isolate faults quickly and accurately. The results show that the flight control computer scheme has clear structure, reasonable redundancy design and implementation, improves the safety and reliability of fly-by-wire flight control system, meets the technical requirements of a manned airship, and can be used as a reference scheme for the design of high safety and high reliability unmanned airship. Conferences > CSAA/IET International Confer... In order to improve the safety of fly-by-wire flight control system and meet the airworthiness requirements, this paper takes the fly-by-wire flight control system of a manned airship as an example, and proposes a dual-redundancy flight control computer. The redundant architecture is designed based on redundancy technology and combined with an effective redundancy management algorithm, so that the fly-by-wire flight control computer can detect and isolate faults quickly and accurately. The results show that the flight control computer scheme has clear structure, reasonable redundancy design and implementation, improves the safety and reliability of fly-by-wire flight control system, meets the technical requirements of a manned airship, and can be used as a reference scheme for the design of high safety and high reliability unmanned airship. Need Help? A public charity, IEEE is the world's largest technical professional organization dedicated to advancing technology for the benefit of humanity. © Copyright 2025 IEEE - All rights reserved, including rights for text and data mining and training of artificial intelligence and similar technologies.