There are three barriers against LOC-I events that are available on fourth generation commercial jet aircraft.

Autoflight assists flight crew in phases such as high altitude flying and can maintain control of the aircraft when difficult conditions are encountered, like turbulence. Flight crew workload is also reduced when autoflight is used, allowing them to focus on management of system failures should they occur.

When autoflight is not used, or if autoflight capability is lost due to a system failure, or autopilot domain exceedance, the flight crew's awareness of the situation will enable them to react and perform appropriate manual flying inputs.

In certain, but rare conditions, the flight crew may lose situational awareness, which can cause them to make inappropriate inputs on the flight controls. The crew may also need to make rapid flight control inputs to perform an avoidance maneuver. In these cases, the flight envelope protection introduced on the fourth generation of jet aircraft, provides the third barrier to prevent LOC-I events.

Lessons learned from inservice events have driven the design of additional enhancements for each of the three safety barriers on the A350 aircraft. The objective of the Safety Beyond Standard initiative is to also implement these enhancements on the eligible A320 Family, A330 and A380 aircraft to bring most of the Airbus fleet closer to the A350 standard.

(fig.1) The three barriers against LOC-I that are available on fourth generation jet aircraft and strengthened protections available.

This increases the availability of the autopilot and autothrust, and reduces the risk of flight crew startle due to a sudden loss of autopilot and autothrust. The difference of the original configuration (pre-mod) and the increased availability after implementation (post-mod) is described for each enhancement.

A majority of cases reporting loss of autoflight system are due to a failure or reset of the Flight Management System (FMS). In pre-mod configuration, when the FMS fails or resets, the autopilot (AP), Flight Director (FD) and autothrust (ATHR) disconnect (fig.2).

In post-mod configuration, the AP/FD/ATHR remain available in selected mode if the FMS fails or resets.

This enhancement is available on all A320 family aircraft manufactured from 2021. It is available for retrofit on all A320 family aircraft manufactured before 2021.

A330 aircraft with GENEPI FMGEC hardware, which represents around 70% of the fleet, can have the enhancement after upgrade to the H7 FMGEC standard that is available from 2022.

This enhancement was installed as standard (or basic) on all A380 aircraft.

Autoflight needs landing gear information (extended/retracted and compressed/uncompressed). As a consequence, in the initial design, AP/FD/ATHR are lost in the case of a L/G LGCIU 1+2 FAULT or L/G SHOCK ABSORBER FAULT (fig.3).

In post-mod configuration, the flight guidance uses an additional source for landing gear information. AP/FD/ATHR will remain available if both Landing Gear Control Interface Unit (LGCIU) fail or in the case of a L/G SHOCK ABSORBER FAULT ECAM alert, maintaining capacity to perform CAT II or CAT III operations. This enhancement was installed as standard (basic) on all A330 and A380 aircraft.

This enhancement is standard (basic) on all A320 family aircraft manufactured from 2021. It can be retrofitted on all previously built A320 family aircraft.

This enhancement was installed as standard (basic) on all A330 and A380 aircraft.

In pre-mod configuration, AP/FD/ATHR requires at least two independent and consistent airspeed sources to be available. As a consequence, AP/FD/ATHR are lost in the case of a loss of the data from 2 ADRs.

In post-mod configuration, the use of an independent airspeed estimator, called “Digital Back-Up Speed” (DBUS), is based mainly on angle-of-attack, load factor value, aircraft weight and configuration, which enables monitoring of the remaining ADR speed data. As a consequence, the following autoflight availability is reinforced in the case of loss of air data as follows:

The AP/FD/ATHR will remain available even if two ADRs are lost . Automatic landing is however no longer available. CAT I operations remain possible (G/S and LOC modes remain available).

If only the digital backup speed is available, the AP/FD/ATHR remain available, but in only selected modes. Automatic landing is however no longer available. CAT I operations remain possible (G/S and LOC modes remain available).

If no air data is available, including the digital backup speed, the AP/FD/ATHR remains available in clean configuration, but it will be in a degraded mode that maintains the aircraft in level flight and heading only. The ATHR will adapt thrust to maintain the aircraft in the middle of the flight envelope.

Unexpected events in flight require appropriate action from the flight crew. Examples of events include: Approach to stall, unreliable airspeed and excessive bank angle. When these situations occur, flight crews must apply recovery actions in a controlled and calm manner. Improved alerting cues and additional speed information will assist flight crews to manage these unexpected events.

These enhancements improve situational awareness and aid in assessing the situation quickly. With better awareness and assessment, flight crews can apply the correct procedures safely and more effectively.

In post-mod configuration, the introduction of a digital backup speed (fig.8) computed with angle of attack value, aircraft weight and load factor provides an additional speed indication to the flight crew that can be displayed on the PFD when necessary. The digital backup speed has an accuracy of +/- 15 kt, which means that the last digit of the speedscale is shown with a strikethrough line on the PFD. The flight crew can display or remove the digital backup speed by pressing a dedicated pushbutton for each PFD.

As the majority of pitot freezing events observed in-flight are temporary in nature, the display of digital backup speed is reversible, which enables it to be switched off and revert to the anemometric speed if the ADR data is recovered and reliable.

The independent airspeed source provided by the digital back-up speed also enables additional monitoring of the data from the ADRs. An enhanced ECAM procedure provides a status of the speed data from the 3 ADRs and of the digital backup speed. It also provides guidance to the flight crew for selection of the correct air data and will request the flight crew to switch the digital backup speed indication to ON when necessary.

(fig.8) post-mod digital back-up speed indication and assistance to ADR switching

On A380 aircraft, the same ADR monitoring function and automatic PFD airspeed display as on A350 aircraft will be available from Avionic batch 8.

This enhancement is available for all manufactured aircraft , or for retrofit on all of the existing A320 family and A330 aircraft fleets. However, aircraft fitted with EIS 1 standard will only have the audio alert. This enhancement was installed as standard (basic) on all A380 aircraft.

Enhancement of the flight envelope protection availability strengthens the third safety barrier that prevents LOC-I events.

In pre-modification configuration, there is no flight envelope protection available for the pitch axis in alternate law.

In post modification configuration, a pitch angle limitation is available in alternate law when the aircraft is in clean configuration (fig.11). This prevents rapid speed decay, reducing the risk of going too far outside of the flight envelope. Two limitations are introduced:

• θmax is the maximum pitch angle that can be reached with the sidestick maintaining a pitch-up demand
• θprot is the maximum pitch angle that can be maintained with the sidestick in the neutral position.

Both maximum pitch angles vary as a function of altitude. Potential stall situations are therefore limited in case of inappropriate flight crew nose-up inputs.

In pre-mod configuration, in the case of a loss of the yaw damping function caused by loss of both yaw dampers or loss of both FAC computers, normal law and flight envelope protections are lost, leading to a reversion to Alternate law.

In post-mod configuration, the aircraft also reverts to Alternate law, but the protections from the normal law remain available with possible reduced efficiency due to the absence of yaw damping.

In the case of a Rudder travel limiter fault on A320 aircraft, the ECAM procedure requests the flight crew to reset each FACs in a sequence to try to recover the function. The enhancement introduced improves the procedure by adding an “IF UNSUCCESSFUL:“ line to make it more obvious to the flight crew to avoid performing simultaneous resets of the FACs, which results in a temporary loss of the normal law and its associated flight envelope protections.

Making these safety enhancements available is part of the continuous enhancement of all Airbus aircraft. The opportunity to implement these enhancements as a retrofit solution on the existing Airbus fleet is key to further prevention of LOC-I events. Airbus has several monitored retrofit campaigns to encourage and assist Operators to implement these enhancements for their operational aircraft.

To facilitate the retrofit of these enhancements on the compatible aircraft, Airbus provides the software updates free of charge to Operators.

The software updates that introduce these enhancements can be done in a relatively short time, limiting the time of aircraft on ground and limiting the cost of labor hours.

For more information on the monitored retrofit campaign, please contact the Retrofit Operations team at monitored.retrofit@airbus.com.

Operators may have aircraft with different technical configurations that are not all compatible with the retrofit of certain enhancements. This should not prevent them from implementing the enhancement on their aircraft that are compatible. It is an essential step to take safety beyond the standard for those aircraft that are configured and capable of being retrofitted. This will enhance the overall safety resilience of the fleet.

All the listed enhancements have a limited operational impact since most of them are enhancement of the availability of already existing functions. The new displays, and new or updated procedures are described in the FCOM and QRH.

Analysis of the training requirements showed that either a level A (self Instruction) or level B (aided instruction) training is required to familiarize flight crews with these enhancements.