Further Preventing Loss of Control In-flight

Source: Airbus Safety First URL: https://safetyfirst.airbus.com/further-preventing-loss-of-control-in-flight/ Published: 2025-01-23 Category: Flight Ops, autopilot availability, bank, BUSS, flight envelope protection, generation, loc-i, pitch, Safety beyond standard, SBS PDF: Original PDF

---

Loss of Control In-flight (LOC-I) has been one of the main categories of fatal accidents since the beginning of commercial jet aviation. While flight envelope protections in fourth-generation aircraft have reduced LOC-I incidents by 90% compared to third-generation aircraft, the continuous enhancement of aircraft systems is necessary to further prevent potential future accidents. Airbus has leveraged lessons learned from in-service events to implement advanced safety improvements in A350 aircraft, further mitigating the risk of LOC-I accidents. The objective is now to upgrade the A320 family, A330, and A380 aircraft to get as close as possible to the A350 standard for LOC-I prevention.

This article will describe these safety improvements, and outline a strategy for implementing them across the Airbus fleet.

Check the latest version of this article on safetyfrst.airbus.com and on the Safety first app for iOS and Android devices.

�6�D�I�H�W�\� 1�U�V�W -�D�Q�X�D�U�\�

�3�D�J�H�

�6�7�5�(�1�*�7�+�(�1�(�’ � 3�5�2�7�(�&�7�,�2�1�6

There are three barriers against LOC-I events that are available on fourth generation commercial jet aircraft.

1. Autoflight

Autoflight assists flight crew in phases such as high altitude flying and can maintain control of the aircraft when difficult conditions are encountered, like turbulence. Flight crew workload is also reduced when autoflight is used, allowing them to focus on management of system failures should they occur.

2. Flight Crew Awareness

When autoflight is not used, or if autoflight capability is lost due to a system failure, or autopilot domain exceedance, the flight crew’s awareness of the situation will enable them to react and perform appropriate manual flying inputs.

3. Flight Envelope Protections

In certain, but rare conditions, the flight crew may lose situational awareness, which can cause them to make inappropriate inputs on the flight controls. The crew may also need to make rapid flight control inputs to perform an avoidance maneuver. In these cases, the flight envelope protection introduced on the fourth generation of jet aircraft, provides the third barrier to prevent LOC-I events.

Lessons learned from inservice events have driven the design of additional enhancements for each of the three safety barriers on the A350 aircraft. The objective of the Safety Beyond Standard initiative is to also implement these enhancements on the eligible A320 Family, A330 and A380 aircraft to bring most of the Airbus fleet closer to the A350 standard.

(fig.1) The three barriers against LOC-I that are available on fourth generation jet aircraft and strengthened protections available.

�6�D�I�H�W�\� 1�U�V�W -�D�Q�X�D�U�\�

�3�D�J�H�

�(�1�+�$�1�&�(�’ � $�8�7�2�)�/�,�*�+�7� $�9�$�,�/�$�%�,�/�,�7�<

This increases the availability of the autopilot and autothrust, and reduces the risk of flight crew startle due to a sudden loss of autopilot and autothrust. The difference of the original configuration (pre-mod) and the increased availability after implementation (post-mod) is described for each enhancement.

Enhanced Autoflight: Robustness to FMS Failures

A majority of cases reporting loss of autoflight system are due to a failure or reset of the Flight Management System (FMS). In pre-mod configuration, when the FMS fails or resets, the autopilot (AP), Flight Director (FD) and autothrust (ATHR) disconnect (fig.2).

In post-mod configuration, the AP/FD/ATHR remain available in selected mode if the FMS fails or resets.

(fig.2) Enhanced Autoflight Robustness to FMS Failures

Availability of the robustness to FMS failures

This enhancement is available on all A320 family aircraft manufactured from 2021. It is available for retrofit on all A320 family aircraft manufactured before 2021.

A330 aircraft with GENEPI FMGEC hardware, which represents around 70% of the fleet, can have the enhancement after upgrade to the H7 FMGEC standard that is available from 2022.

This enhancement was installed as standard (or basic) on all A380 aircraft.

$	$	$	$	$	$	$	$	$	$	$	$	$

�6�D�I�H�W�\� 1�U�V�W -�D�Q�X�D�U�\�

�3�D�J�H�

Enhanced Autoflight Robustness to LGCIU Failures

Autoflight needs landing gear information (extended/retracted and compressed/uncompressed). As a consequence, in the initial design, AP/FD/ATHR are lost in the case of a �/�’ _�/��&�,�8�����������)�$�8�/�7 or �/�’ *�6�+�2�&�.���$�%�6�2�5�%�(�5�� �)�$�8�/�7 (fig.3). In post-mod configuration, the flight guidance uses an additional source for landing gear information. AP/FD/ATHR will remain available if both Landing Gear Control Interface Unit (LGCIU) fail or in the case of a �/�’ *�6�+�2�&�.���$�%�6�2�5�%�(�5���)�$�8�/�7 ECAM alert, maintaining capacity to perform CAT II or CAT III operations. This (fig.3) Enhanced autoflight enhancement was installed as standard (basic) on all A330 and A380 aircraft. robustness to dual LGCIU failure

Availability of the robustness to LGCIU failures

This enhancement is standard (basic) on all A320 family aircraft manufactured from 2021. It can be retrofitted on all previously built A320 family aircraft.

This enhancement was installed as standard (basic) on all A330 and A380 aircraft.

$	$	$	$	$	$	$	$	$	$	$	$	$

�6�D�I�H�W�\� 1�U�V�W -�D�Q�X�D�U�\�

�3�D�J�H�

Enhanced Autoflight Robustness to Air Data Failures

In pre-mod configuration, AP/FD/ATHR requires at least two independent and consistent airspeed sources to be available. As a consequence, AP/FD/ATHR are lost in the case of a loss of the data from 2 ADRs.

Speed Monitoring function (Unreliable Airspeed Mitigation Mean (UAMM) step 2)

In post-mod configuration, the use of an independent airspeed estimator, called “Digital Back-Up Speed” (DBUS) , is based mainly on angle-of-attack, load factor value, aircraft weight and configuration, which enables monitoring of the remaining ADR speed data. As a consequence, the following autoflight availability is reinforced in the case of loss of air data as follows:

Only one ADR available

The AP/FD/ATHR will remain available even if two ADRs are lost . Automatic landing is however no longer available. CAT I operations remain possible (G/S and LOC modes remain available).

(fig.4) Enhanced autoflight robustness to dual air data failure

• �3�D�J�H�

�6�D�I�H�W�\� 1�U�V�W -�D�Q�X�D�U�\�

Only digital backup speed available

If only the digital backup speed is available, the AP/FD/ATHR remain available, but in only selected modes. Automatic landing is however no longer available. CAT I operations remain possible (G/S and LOC modes remain available).

(fig.5) Enhanced autoflight robustness to triple air data failure

No air data available

If no air data is available, including the digital backup speed, the AP/FD/ATHR remains available in clean configuration, but it will be in a degraded mode that maintains the aircraft in level flight and heading only. The ATHR will adapt thrust to maintain the aircraft in the middle of the flight envelope.

(fig.6) Enhanced autoflight robustness to triple air data failure (digital backup speed not available)

Availability of the robustness to air data failures

�3�D�J�H�

( �1�+�$�1�&�( �’ � &�5�( �: $�: �$�5�( �1�( �6�6

Unexpected events in flight require appropriate action from the flight crew. Examples of events include: Approach to stall, unreliable airspeed and excessive bank angle. When these situations occur, flight crews must apply recovery actions in a controlled and calm manner. Improved alerting cues and additional speed information will assist flight crews to manage these unexpected events.

These enhancements improve situational awareness and aid in assessing the situation quickly. With better awareness and assessment, flight crews can apply the correct procedures safely and more effectively.

Digital Back-Up Speed/Altitude Display and Assistance to Speed Information Selection

In pre-mod configuration, the aircraft are equipped with a backup speed scale based on angle-of-attack value, providing speed information to the flight crew using color bands that they can use below FL 250 (fig.7).

In post-mod configuration, the introduction of a digital backup speed (fig.8) computed with angle of attack value, aircraft weight and load factor provides an additional speed indication to the flight crew that can be displayed on the PFD when necessary. The digital backup speed has an accuracy of +/- 15 kt, which means that the last digit of the speedscale is shown with a strikethrough line on the PFD. The flight crew can display or remove the digital backup speed by pressing a dedicated pushbutton for each PFD.

(fig.7) pre-mod backup speed scale

As the majority of pitot freezing events observed in-flight are temporary in nature, the display of digital backup speed is reversible, which enables it to be switched off and revert to the anemometric speed if the ADR data is recovered and reliable.

The independent airspeed source provided by the digital back-up speed also enables additional monitoring of the data from the ADRs. An enhanced ECAM procedure provides a status of the speed data from the 3 ADRs and of the digital backup speed. It also provides guidance to the flight crew for selection of the correct air data and will request the flight crew to switch the digital backup speed indication to ON when necessary.

(fig.8) post-mod digital back-up speed indication and assistance to ADR switching

�6�D�I�H�W�\� 1�U�V�W -�D�Q�X�D�U�\�

�3�D�J�H�

A380 aircraft: Same ADR monitoring and automatic airspeed switching as on A350 aircraft

On A380 aircraft, the same ADR monitoring function and automatic PFD airspeed display as on A350 aircraft will be available from Avionic batch 8.

Availability of the Digital Back-Up Speed/Altitude Display and Assistance to Speed Information Selection

An update of the EIS introduces a visual red alert on the PFD in addition to the existing aural stall warning. This improves the warning of an approaching stall situation and alerts the flight crew that they must apply corrective or recovery actions to avoid the stall condition.

(fig.9) “STALL” message on the PFD

Availability of the STALL message on the PFD

		$							$				$
									EIS1
upgrade)									L9E

�6�D�I�H�W�\� 1�U�V�W -�D�Q�X�D�U�\�

�3�D�J�H�

Excessive Bank Angle Alert in Alternate and Direct Laws

This enhancement introduces a message on the PFD and a “BANK BANK” aural alert when the aircraft reaches an excessive bank angle (above 45°) in alternate and direct laws where no excessive bank angle protections are provided.

(fig.10) “BANK BANK” message on the PFD

Availability of the excessive bank angle alert in alternate and direct laws

This enhancement is available for all manufactured aircraft , or for retrofit on all of the existing A320 family and A330 aircraft fleets. However, aircraft fitted with EIS 1 standard will only have the audio alert. This enhancement was installed as standard (basic) on all A380 aircraft.

		$						$						$
		EIS2	S16					FCDC	L27

�(�1�+�$�1�&�(�’ � )�/�,�*�+�7� (�1�9�(�/�2�3�(� 3�5�2�7�(�&�7�,�2�1�� �$�9�$�,�/�$�%�,�/�,�7�<

Enhancement of the flight envelope protection availability strengthens the third safety barrier that prevents LOC-I events.

Pitch Attitude Limitation in Alternate Law

In pre-modification configuration, there is no flight envelope protection available for the pitch axis in alternate law.

In post modification configuration, a pitch angle limitation is available in alternate law when the aircraft is in clean configuration (fig.11). This prevents rapid speed decay, reducing the risk of going too far outside of the flight envelope. Two limitations are introduced:

max is the maximum pitch angle that can be reached with the sidestick maintaining a pitch-up demand

�6�D�I�H�W�\� 1�U�V�W -�D�Q�X�D�U�\�

�3�D�J�H�

prot is the maximum pitch angle that can be maintained with the sidestick in the neutral position.

Both maximum pitch angles vary as a function of altitude. Potential stall situations are therefore limited in case of inappropriate flight crew nose-up inputs.

(fig.11) Pitch attitude limitation in Alternate law

Availability of the pitch attitude limitation in alternate law

In pre-mod configuration, in the case of a loss of the yaw damping function caused by loss of both yaw dampers or loss of both FAC computers , normal law and flight envelope protections are lost, leading to a reversion to Alternate law.

In post-mod configuration, the aircraft also reverts to Alternate law, but the protections from the normal law remain available with possible reduced efficiency due to the absence of yaw damping.

Availability of the maintained protections in case of yaw damping function loss

�3�D�J�H�

Avoid undue simultaneous FAC Resets on A320 family aircraft

In the case of a Rudder travel limiter fault on A320 aircraft, the ECAM procedure requests the flight crew to reset each FACs in a sequence to try to recover the function. The enhancement introduced improves the procedure by adding an “IF UNSUCCESSFUL:“ line to make it more obvious to the flight crew to avoid performing simultaneous resets of the FACs, which results in a temporary loss of the normal law and its associated flight envelope protections.

(fig.12) enhanced ECAM procedure to prevent simultaneous FAC reset

Availability of the enhanced AUTO FLT RUD TRV LIM SYS ECAM alert

Availability of the enhancedAUTO FLTRUD TRV LIM SYS ECAM alert	Availability of the enhancedAUTO FLTRUD TRV LIM SYS ECAM alert	Availability of the enhancedAUTO FLTRUD TRV LIM SYS ECAM alert	Availability of the enhancedAUTO FLTRUD TRV LIM SYS ECAM alert	Availability of the enhancedAUTO FLTRUD TRV LIM SYS ECAM alert	Availability of the enhancedAUTO FLTRUD TRV LIM SYS ECAM alert
$				$	$
	FWC	F12	Avail	Not applicable	Not applicable

�(�1�+�$�1�&�(�0 �(�1�7�6� ,�0 �3�/�(�0 �(�1�7�$�7�,�2�1

Making these safety enhancements available is part of the continuous enhancement of all Airbus aircraft. The opportunity to implement these enhancements as a retrofit solution on the existing Airbus fleet is key to further prevention of LOC-I events. Airbus has several monitored retrofit campaigns to encourage and assist Operators to implement these enhancements for their operational aircraft.

Software provided free of charge

To facilitate the retrofit of these enhancements on the compatible aircraft, Airbus provides the software updates free of charge to Operators.

Limited grounding time

The software updates that introduce these enhancements can be done in a relatively short time, limiting the time of aircraft on ground and limiting the cost of labor hours.

For more information on the monitored retrofit campaign, please contact the Retrofit Operations team at monitored.retrofit@airbus.com.

�6�D�I�H�W�\� 1�U�V�W -�D�Q�X�D�U�\�

�3�D�J�H�

Mixed Fleet considerations

Operators may have aircraft with different technical configurations that are not all compatible with the retrofit of certain enhancements. This should not prevent them from implementing the enhancement on their aircraft that are compatible. It is an essential step to take safety beyond the standard for those aircraft that are configured and capable of being retrofitted. This will enhance the overall safety resilience of the fleet.

Limited operational impact

All the listed enhancements have a limited operational impact since most of them are enhancement of the availability of already existing functions. The new displays, and new or updated procedures are described in the FCOM and QRH.

Limited training requirement

Analysis of the training requirements showed that either a level A (self Instruction) or level B (aided instruction) training is required to familiarize flight crews with these enhancements.

|---|---|---|---|---| |||Excessive Bank Angle Alert|A|FCOM, FCTM, AFM| |||Stall message on PFD|A|FCOM|

�6�D�I�H�W�\� 1�U�V�W -�D�Q�X�D�U�\�

�3�D�J�H�

�&�R�Q�W�U�L�E�X�W�R�U�V�

�7�K�L�H�U�U�\� %�2�8�5�5�(�7��

�)�O�L�J�K�W&�R�Q�W�U�R�O�� �’�H�Y�H�O�R�S�P�H�Q�W5�H�V�S�R�Q�V�L�E�O�H�� �’�H�V�L�J�Q�2�4�F�H��

• �4�X�H�Q�W�L�Q� %�5�8�&�<��

�’�R�P�D�L�Q���3�U�R�J�U�D�P���O�H�D�G�H�U���_�� �$�������� �’�H�V�L�J�Q�2�4�F�H��

• �(�U�L�F� -�(�$�1�3�,�(�5�5�(��

�3�U�R�G�X�F�W6�D�I�H�W�\�� �(�Q�K�D�Q�F�H�P�H�Q�W0�D�Q�D�J�H�U�� �$�Y�L�D�W�L�R�Q�6�D�I�H�W�\��

• �2�O�L�Y�L�H�U�-�2�6�(�3�+��

�$�Y�L�D�W�L�R�Q�6�D�I�H�W�\� 6�S�H�F�L�D�O�L�V�W �&�X�V�W�R�P�H�U�6�X�S�S�R�U�W

�0 �D�[�L�P�H� /�$�1�6�2�1�1�(�8�5��

�’�L�U�H�F�W�R�U�6�D�I�H�W�\� 7�U�D�L�Q�L�Q�J�� �D�Q�G� )�O�L�J�K�W2�S�H�U�D�W�L�R�Q�V�� �&�X�V�W�R�P�H�U�6�X�S�S�R�U�W

�1�L�F�R�O�D�V�: �$�5�7�2�1��

�$�L�U�E�X�V���K�D��G�H�Y�H�OV ��V�D�I H�W�\R�S�H ���H�Q�K�D�Q�F�HG ��I�R UP�H��W�K�HQ�W�V���H�O�L�J�$ ������L E O�H �I�D�P�L�$����O \ D�Q�$�������G D�L�F D�I�W �U W�R� D�G GH V�VU /�R�V�RV I&�R�Q�W�R�O, Q���2�LU J�K ���/�2�&���,��U�L�V�N�V7�K H�R�E�M�H�F�W�LR IW KY �H H�Q�K�D�Q�F�H�V�H P�H�Q�W�VL�VW�R� E�U�L�QW K�HJ �H�Q W�L�UH� $�L�U�E�X�V2�H�H�WD VF�O�R�D VV HS�R�V�V L�E�O�HZ�L�W$ ������K V�D�I�H�W�\V�W�D�Q�G�D��G�V �Z�L�W�K���D���I�R�F�X�V���R�Q���W�K�H���W H H��N�HK U \��D�U�H�D�V���R�I���(�Q�K�D�Q F�H�G��D�X�W�R�2�L�J�K�W �D�Y�D�L�O�D�E�L���L�P�S�UOR Y HL W�\��2 L�JG ��FK�WUH�Z���D�Z�D�U�H�Q�H ��D�QV�V� G�V�W�H Q�J�W�KU H�Q �2�L�J K�WH�Q�Y�H�O�R�S�HS�U�R H�F�WW L�R�Q��

�,�P�S�O�H�P�H�Q�W�D�W�L�R�Q���R I��W�K�H��H Q�K�D�Q�F�HV H �R�Q��W�KP H Q�W V�D�LH�F D�I�W �U ���Z�L�W�K �F�D�S�D E�O�HF�R�Q�1�J�X�U�D�W�L R�Q�VD�U�H� G�H�V�L�J�WQ�RH�GD�O�OUH WR �R 1Z U�Z�L�WW P L�Q�LK P�D �R�S�H�U�D�W�L ��L�P�S D�F�WR�Q�D O���R�S W�L�P�H�G��F�R�VL�] ��R I���L�Q�WW V �H�J�U�D�W L���H��R�Q��V�R�I�W�Z�D�J�� �H�� �X�S�G�D�W�H V��S�U�R�Y�L�G�H�G���I UH�H���R�I���F�J H���E�\���$�L�U�EK�D�U ��U�H�T�XX�V���� �H�O�LL U H�GP�L�W �D�G�G�L�W�L�RF UH�ZQW�UL�Q�L �D� O ��/H Y�HQ J $�RO U%����

�7�K�H V�H��H�Q�K�D�Q�F�H ��H�Q�K�DP�H�Q�W�V��/ 2 &���,���S�UQ F H �H�Y�H�Q�W�L�R�Q���Z�K�L �L�VF K���Z�K \� �R�S�H�U�D�W�R�U��Z�L�W�KV ���S�D�U�W�L ��F�R�P S�D�WD�O�O \ ��R U��P�LL E�O�H[H�G���2�H�H�W���F�R�Q�1�J�X�U�D�W�L R�Q �D�U�H���H�Q�F�R�X�D�J HU��WG�R���L�P�S�O�H�P��X S�J�UH Q WD�G�H�V���Z�K�H�U�H���S�R�V�V�L��D VE ���W�K�HO�H �V�D�I�H�W�\E�H�Q�H�R�X W�Z�H�L�J�K1�W V D�Q��S�R�W\ �H�Q�W�L�D�O2�H�H�WL�Q�F�R�Q�V�L�V�H�Q�F�L�H�V��W

�%�\���D�G�R�S�W�L���W K HQ J��L�P�S�UV�H�R�Y�H�P�H Q�W�V���R�S�H U�D�W�R�U�V���F�R�Q�W�U�H��WL�E�X�W�R���D�Q �L�Q�F�H D�V�HU L QR�Y HD O�OU2�H�H�WV�D�I�H�W�\7�K HH�Q�K�D�Q�F�H P�HD�U�H��D�QQ�W�VH�V�V�H Q�W �V�W�H�S���L ��W�D�N�L�Q�JQ ���V�D�I�H��E�H�\�RW�\ Q�V�W�D�Q�GG �G����WD�UR X�JK U ��O�H�Y�H�UK �D�J�L Q�J �R�S�H�U�D�W�L ��H[�S�H�U�L�H�Q�FR Q�D�O ���D�Q�WGH�H�F�K�Q�R ��WO�R�R��I�X�UJ�\�W�K��S�UH�Y�HH U ��/�2�&���,��Q�W �H�Y�H�Q�W�V�����$�L�U�E�X�V���K�D�V���O�D�X�Q�F�K���P R Q�L�WH G�R UH�G���U�H�W�R 1U��F�D�P�S�D�LW J�Q� �Z�R�U�N��Z�L�W�KL�Q�J���R�S�H�U�D�W�R�U��W�R���L�P�S�O�H�P�HV ���W K H�V�HQ WV�D�I�H�W�\H�Q�K�D�Q�F�H P�H �D�W���W�K�H���H�D�U�O�L�H�V�W���R�S�S�R�U�W�X�Q��U�H�L Q�IL�W \� F L�Q�JR U��R�X��F�R�O�O�HU �F� R�P�P�L�W�P�H�W�L�Y�H �W�R� D�Y�L�D�V�D�I�H�W�\W�L�R�Q

�)�O�L�J�K�W&�R�Q�W�U�R�O�� �’�H�Y�H�O�R�S�P�H�Q�W(�Q�J�L�Q�H�H�U�� �’�H�V�L�J�Q�2�4�F�H��

�6�D�I�H�W�\� 1�U�V�W -�D�Q�X�D�U�\�

�3�D�J�H�

Safety first, 2025. Safety first is published by Airbus S.A.S. 1, rond point Maurice Bellonte - 31707 Blagnac Cedex/France.

Editor: Yannick Malinge, SVP AViation Safety.

Editorial team: Guillaume Estragnat, Vanessa Sadi, Gwyneth Duggan, Javier Martinez Marina, Tim Roach.

Photos by Airbus, H. Goussé.

---

中文译文

来源: Airbus Safety First URL: https://safetyfirst.airbus.com/further-preventing-loss-of-control-in-flight/ 发布日期: 2025-01-23 类别: 飞行运营, 自动驾驶可用性, 坡度, BUSS, 飞行包线保护, 代际, LOC-I, 俯仰, 标准之外的安全, SBS PDF: 原始 PDF

---

飞行中失去控制（LOC-I）自商业喷气航空诞生以来一直是致命事故的主要类别之一。与第三代飞机相比，第四代飞机配备的飞行包线保护使 LOC-I 事故减少了 90%，但持续改进飞机系统对于进一步预防未来潜在事故仍然必要。空客公司借鉴运营事件中吸取的经验教训，在 A350 飞机上实施了先进的安全改进措施，进一步降低了 LOC-I 事故的风险。当前的目标是升级 A320 系列、A330 和 A380 飞机，使其在 LOC-I 防护方面尽可能接近 A350 标准。

本文将介绍这些安全改进措施，并概述在整个空客机队中实施这些措施的策略。

请在 safetyfirst.airbus.com 和 iOS 及 Android 设备上的 Safety First 应用上查看本文的最新版本。

图 1 - 三大防线

三大防线

LOC-I 的三大防线

第四代商用喷气飞机配备了三大防线来应对 LOC-I 事件。

1. 自动飞行

自动飞行在高原飞行等阶段为飞行机组提供辅助，并在遇到颠簸等困难条件时维持对飞机的控制。使用自动飞行还能减轻飞行机组的工作负荷，使他们在发生系统故障时能够专注于故障管理。

2. 飞行机组情景意识

当未使用自动飞行，或因系统故障或自动驾驶域超出限制而导致自动飞行能力丧失时，飞行机组的情景意识将使他们能够做出反应并执行适当的人工飞行输入。

3. 飞行包线保护

在某些但罕见的情况下，飞行机组可能失去情景意识，导致他们对飞行控制做出不适当的输入。机组也可能需要快速进行飞行控制输入以执行避让机动。在这些情况下，第四代喷气飞机引入的飞行包线保护提供了第三道防线来防止 LOC-I 事件。

从运营事件中吸取的经验教训推动了 A350 飞机三大安全防线附加增强措施的设计。标准之外的安全（SBS）倡议的目标是在符合条件的所有 A320 系列、A330 和 A380 飞机上实施这些增强措施，使大多数空客机队更接近 A350 标准。

（图 1） 第四代喷气飞机上针对 LOC-I 的三大防线及加强保护措施。

图 2 - 增强型自动飞行

增强型自动飞行

增强自动驾驶和自动推力的可用性

这提高了自动驾驶和自动推力的可用性，并降低了因自动驾驶和自动推力突然丧失而导致飞行机组惊吓反应的风险。实施前（改装前）和实施后（改装后）可用性提高的差异将在每项增强措施中描述。

增强型自动飞行：对 FMS 故障的鲁棒性

报告自动飞行系统丧失的大多数情况是由于飞行管理系统（FMS）故障或复位所致。在改装前的构型中，当 FMS 发生故障或复位时，自动驾驶（AP）、飞行指引（FD）和自动推力（ATHR）将断开 （图 2）。

在改装后的构型中，当 FMS 发生故障或复位时，AP/FD/ATHR 在选定模式下保持可用。

（图 2） 增强型自动飞行对 FMS 故障的鲁棒性

对 FMS 故障鲁棒性的可用性

此增强措施适用于 2021 年起生产的所有 A320 系列飞机。2021 年之前生产的 A320 系列飞机可通过改装获得此增强。

配备 GENEPI FMGEC 硬件的 A330 飞机（约占机队的 70%）在升级至 2022 年起可用的 H7 FMGEC 标准后可获得此增强。

此增强措施已作为标准配置（或基本配置）安装在所有 A380 飞机上。

| | | | | | | | | | | | | |---|---|---|---|---|---|---|---|---|---|---|---|---|

图 3 - 自动驾驶可用性

增强的自动飞行对 LGCIU 故障的鲁棒性

自动飞行系统需要起落架状态信息（放下/收起以及压缩/未压缩）。因此，在原始设计中，当单个 LGCIU 故障或 ECAM 警告时，AP/FD/ATHR 会失效。改装后的构型中，飞控系统使用额外的起落架信息来源。即使两个起落架控制接口组件（LGCIU）同时失效或出现相关 ECAM 警告，AP/FD/ATHR 仍将保持可用，维持执行 CAT II 或 CAT III 运行的能力。

（图 3）增强的自动飞行对双 LGCIU 故障的鲁棒性

LGCIU 故障鲁棒性的可用性

此增强功能是 2021 年起生产的所有 A320 系列飞机的标准（基本）配置。它可以改装到所有先前生产的 A320 系列飞机上。

此增强功能是所有 A330 和 A380 飞机的标准（基本）配置。

| | | | | | | | | | | | | |---|---|---|---|---|---|---|---|---|---|---|---|---|

A320 系列飞机 - 改装

A330/A380

增强的自动飞行对大气数据故障的鲁棒性

改装前构型中，AP/FD/ATHR 需要至少两个独立且一致的空速源可用。因此，当两个 ADR 的大气数据丢失时，AP/FD/ATHR 会失效。

速度监控功能（不可靠空速缓解措施（UAMM）第 2 步）

改装后构型中，使用了一个独立的空速估算器，称为”数字备份速度”（DBUS），其主要基于迎角、载荷因子值、飞机重量和构型，从而实现对剩余 ADR 空速数据的监控。因此，在大气数据丢失情况下，自动飞行的可用性得到加强，如下所述：

仅一个 ADR 可用

即使两个 ADR 失效，AP/FD/FD/ATHR 仍将保持可用。然而，自动着陆不再可用。CAT I 运行仍然可行（G/S 和 LOC 模式保持可用）。

（图 4）增强的自动飞行对双大气数据故障的鲁棒性

• A320 系列飞机

A330/A380

仅数字备份速度可用

如果仅数字备份速度可用，AP/FD/ATHR 保持可用，但仅在选定模式下可用。然而，自动着陆不再可用。CAT I 运行仍然可行（G/S 和 LOC 模式保持可用）。

（图 5）增强的自动飞行对三重大气数据故障的鲁棒性

无大气数据可用

如果无大气数据可用，包括数字备份速度，AP/FD/ATHR 在光洁构型下保持可用，但将处于降级模式，仅保持飞机平飞和保持航向。自动推力（ATHR）将调整推力以保持飞机在飞行包线中部。

（图 6）增强的自动飞行对三重大气数据故障的鲁棒性（数字备份速度不可用）

大气数据故障鲁棒性的可用性

• A320 系列飞机

飞行中的意外事件

飞行中的意外事件需要飞行员采取适当的应对措施。事件示例包括：接近失速、不可靠空速和过大坡度角。当这些情况发生时，飞行员必须以受控且冷静的方式执行改出动作。增强的警告提示和额外的速度信息将协助飞行员管理这些意外事件。

这些增强功能提高了情景意识，并有助于快速评估情况。有了更好的意识和评估，飞行员能够更安全、更有效地执行正确的程序。

数字备用速度/高度显示与空速信息选择辅助

在改装前的构型下，飞机配备基于迎角值的备用速度刻度，为飞行机组提供可使用彩色带的空速信息，适用范围在 FL 250 以下 (图7)。

在改装后的构型下，引入由迎角值、飞机重量和载荷因子计算得出的数字备用速度 (图8)，为飞行机组提供额外的速度指示，可在需要时显示在 PFD 上。数字备用速度的精度为 ±15 kt，这意味着 PFD 上速度刻度的最后一位数字以删除线显示。飞行机组可通过按压每个 PFD 上的专用按钮来显示或关闭数字备用速度。

(图7) 改装前的备用速度刻度

由于大多数飞行中观测到的皮托管结冰事件具有暂时性，数字备用速度的显示是可逆的，这使得当 ADR 数据恢复并可靠时可以关闭该显示，并恢复到空速数据。

数字备用速度提供的独立空速源还支持对 ADR 数据的额外监控。增强的 ECAM 程序提供来自 3 个 ADR 的速度数据和数字备用速度的状态信息。它还为飞行机组提供选择正确大气数据的指导，并在需要时请求飞行机组将数字备用速度指示切换至 ON。

(图8) 改装后的数字备用速度显示与 ADR 切换辅助

A380 飞机：与 A350 相同的 ADR 监控和自动空速切换

在 A380 飞机上，从电子设备批次 8 起将提供与 A350 相同的 ADR 监控功能和自动 PFD 空速显示。

数字备用速度/高度显示与空速信息选择辅助的可用性

EIS 的更新在现有听觉失速警告的基础上，在 PFD 上引入了视觉红色警告。这增强了对接近失速状况的警告，提醒飞行机组必须采取修正或改出动作以避免失速状态。

(图9) PFD 上的”失速”信息

PFD 上失速信息的可用性

|||$|||||||$||||$|||| |---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---| ||||||||||EIS1|||||||| |upgrade)|||||||||L9E||||||||

备用法则和直接法则中的过度倾斜角度警告

此项增强在备用法则和直接法则中，当飞机达到过度倾斜角度（超过 45°）时，在 PFD 上显示信息并发出 “BANK BANK” 听觉警告，因为在这些法则下没有过度倾斜角度保护。

(图10) PFD 上的”BANK BANK”信息

备用法则和直接法则中过度倾斜角度警告的可用性

此项增强适用于所有新制造飞机，或可对现有 A320 系列和 A330 飞机机队进行改装。但是，安装了 EIS 1 标准的飞机仅有音频警告。此项增强已作为标准（基本）配置安装在所有 A380 飞机上。

		$						$						$
		EIS2	S16					FCDC	L27

增强飞行包线保护的可用性加强了防止失去控制事故的第三道安全屏障。

备用法则中的俯仰姿态限制

在改装前的构型下，备用法则中没有俯仰轴的飞行包线保护。

在改装后的构型下，当飞机处于光洁构型时，备用法则中提供俯仰角度限制 (图11)。这可以防止速度快速衰减，降低偏离飞行包线过远的风险。引入了两个限制值：

max 是在侧杆保持抬头持续需求下能够达到的最大俯仰角度

prot 是侧杆在中立位置时能够保持的最大俯仰角度。

两个最大俯仰角度随高度变化。 因此，在飞行机组不当的抬头输入情况下，可以限制潜在的失速状况。

(图11) 备用法则中的俯仰姿态限制

备用法则中俯仰姿态限制的可用性

在改装前的构型下，如果由于两个偏航阻尼器失效或两个 FAC 计算机失效导致偏航阻尼功能失效，正常法则和飞行包线保护将失效，导致回复到备用法则。

在改装后的构型下，飞机同样回复到备用法则，但正常法则的保护仍然有效，只是由于缺少偏航阻尼可能效率有所降低。

偏航阻尼功能失效时保持的保护的可用性

避免在 A320 系列飞机上不当同时复位 FAC

对于 A320 系列飞机发生方向舵行程限制器故障的情况，ECAM 程序要求飞行机组按顺序复位每个 FAC 以尝试恢复功能。此次引入的增强功能通过添加“如果失败:”行来改进该程序，使飞行机组更容易注意到避免同时复位 FAC，因为同时复位会导致正常法则及其相关飞行包线保护暂时失效。

（图 12） 增强后的防止同时复位 FAC 的 ECAM 程序

增强型 AUTO FLT RUD TRV LIM SYS ECAM 警告的可用性

增强型 AUTO FLT RUD TRV LIM SYS ECAM 警告的可用性	增强型 AUTO FLT RUD TRV LIM SYS ECAM 警告的可用性	增强型 AUTO FLT RUD TRV LIM SYS ECAM 警告的可用性	增强型 AUTO FLT RUD TRV LIM SYS ECAM 警告的可用性	增强型 AUTO FLT RUD TRV LIM SYS ECAM 警告的可用性	增强型 AUTO FLT RUD TRV LIM SYS ECAM 警告的可用性
$				$	$
	FWC	F12	可用	不适用	不适用

这些安全增强功能的可用性

使这些安全增强功能可用是空客持续提升所有机型安全水平的一部分。在现役空客机队上实施这些增强功能的改装机会，对于进一步预防失控（LOC-I）事件至关重要。空客开展多项受监控的改装活动，以鼓励和协助运营商为其运营中的飞机实施这些增强功能。

免费提供的软件

为便于在兼容飞机上实施这些增强功能的改装，空客免费向运营商提供软件更新。

有限的停场时间

引入这些增强功能的软件更新可以在相对较短的时间内完成，从而减少飞机停场时间并降低人工成本。

有关受监控改装活动的更多信息，请联系改装运营团队：monitored.retrofit@airbus.com。

混编机队注意事项

运营商的飞机可能具有不同的技术构型，并非所有飞机都与某些增强功能的改装兼容。但这不应阻止他们为兼容的飞机实施增强功能。对于那些已配置且能够进行改装的飞机而言，这是将安全水平提升至标准之上的关键一步。这将增强整个机队的安全韧性。

有限的操作影响

所有列出的增强措施都具有有限的操作影响，因为其中大部分是对现有功能可用性的提升。新型显示器和新版或更新后的程序已在 FCOM 和 QRH 中描述。

有限的培训要求

对培训要求的分析表明，需要对飞行机组进行 A 级（自学）或 B 级（辅助教学）培训，以熟悉这些增强措施。

|---|---|---|---|---| |||过度坡度警告|Excessive Bank Angle Alert|A|FCOM、FCTM、AFM| |||PFD 上的失速信息|Stall message on PFD|A|FCOM|

Safety First，2025 年。Safety First 由空中客车公司出版。地址：法国布拉尼亚克，31707，邮编，1, rond point Maurice Bellonte。

编辑：Yannick Malinge，航空安全高级副总裁。

编辑团队：Guillaume Estragnat、Vanessa Sadi、Gwyneth Duggan、Javier Martinez Marina、Tim Roach。

照片由空中客车公司及 H. Goussé 提供。