Thierry Dubois is a freelance writer specializing in helicopters, business aviation and aerospace technology. He earned a degree in fluid dynamics from an engineering school in Toulouse, France in the mid-1990s. At an unexpected crossroads, he found his first job in journalism. In 1997, he started working for French aerospace weekly Air &amp; Cosmos in Paris. This lasted until 2000, when he moved south to Lyons. He then became a freelancer, working for various aerospace publications and has been part of the AIN team since late 2000. In addition to writing about business aviation, Thierry shares responsibility for the rotorcraft section. He also is a regular on-site writer for AIN’s daily editions at international airshows such as the Paris, Farnborough, Dubai and Singapore shows, as well as at EBACE in Geneva.
In 2007, he won the Honeywell award for “Best systems or technology submission” at the Aerospace journalist of the year awards. In 2013, he won an Aerospace Media Award for the "Best Safety, Training &amp; Simulation Submission."
In other activities, Thierry moderates international conferences on aviation technology topics. Thierry is married and has three children, who seem to begin enjoying the mountains–as their parents do.

Writer

Thierry Dubois

The pilot of the Falcon 7X that experienced runaway nose-up pitch trim in May 2011 over Malaysia used his military experience and applied a procedure he had learned for bombing to recover from an unusual and dangerous attitude, according to the recently released <a href="https://www.bea.aero/uploads/tx_elydbrapports/hb-n110525.pdf">final report</a> from the BEA, France’s aviation accident investigation authority. The incident caused Dassault to <a href="https://www.ainonline.com/aviation-news/business-aviation/2011-07-19/all-falcon-7xs-now-cleared-fly-again">ground the fleet</a> temporarily. Although the French OEM did provide details about the cause of the problem at the time, the report highlights what the BEA regards as deficiencies at manufacturers and at certification authorities.

 


When the pitch angle of the 7X increased rapidly, the pilot rolled the aircraft sharply to the right, applying a 40- to 80-degree bank angle for approximately 20 seconds. This quick thinking converted the pitch angle into a turning maneuver, thus arresting the climb and stabilizing speed. “The pilot had a very good reaction,” Dassault chief test pilot Philippe Deleume told AIN. The maneuver was incorporated into Dassault’s upset recovery training program in late 2014, added Frédéric Leboeuf, v-p of Falcon operational support directorate.

 


The BEA expressed concern that the successful execution of this maneuver contrasts sharply with the widespread “insufficient” training that pilots undergo for unusual-attitude recovery. In such situations, “identification of the problem is key,” Leboeuf noted. The EASA is preparing a new regulation it hopes to introduce in April 2018. The BEA also deemed “unsuitable” the operational documentation that Dassault provided to pilots at the time. “Our manual was requiring that pilots push the sidestick but the digital flight control system (DFCS, see sidebar) had already done the maximum it could,” according to the company.

 


Dassault told AIN that the DFCS did “see” the problem but lacked the authority to counter it. With the stick in the neutral position, the leading edge of the horizontal stabilizer was deflected down 11 degrees (providing nose-up pitch). The DFCS tried to counteract with elevator. However, although the elevator can apply a greater angle of deflection in the opposite direction, it has much less surface area than the horizontal stabilizer ahead of it. The best efforts of the DFCS were therefore insufficient to restore equilibrium.

 


(The horizontal stabilizer of simpler airplanes is a fixed surface, and the elevators—movable for pitch control and incorporating movable tabs for trim—are attached to that fixed forward surface. On more complex aircraft such as the 7X the horizontal stabilizer can be deflected up or down to provide, respectively, nose-down or nose-up trim.)

 


The pitch-trim failure lasted two minutes and 36 seconds, after which the temperature of an electric motor reached a limit that transferred primary trim control to a redundant system. During the trim upset, the aircraft climbed from 13,000 to 22,000 feet and its calibrated airspeed dropped to 125 knots from 300. The nose-up pitch angle peaked at 41 degrees and the highest load factor was 4.6g.

 


<h2>Training Changes Recommended</h2>

 


The report indicates that the pilots had limited experience with sidesticks. As a result, there were dual control inputs during two periods of about 10 seconds each. One factor behind the dual inputs, the BEA noted, was the sudden mental stress of the emergency. According to the BEA’s report, the pilots were counteracting each others’ movements. The pilot not flying briefly impeded the recovery the pilot flying had started.

 


Conflict between control inputs causes two alerts–an aural one (“dual input”) and a vibration felt through the sidestick. This enabled the pilots to identify and manage the situation. Under a defined procedure, one pilot did take priority by pushing a button (and keeping it pushed) on his sidestick. BEA investigators asserted that at the time of the incident above Malaysia, training to cope with conflicting control inputs was rudimentary. The BEA report says that 7X type rating training included only one exercise about dual input: the student pilot has to take priority control during the simulated incapacitation of the other crewmember.

 


The handling of conflicting dual inputs has since become part of the recurrent training curriculum on Falcons, but Deleume suggested a possible further improvement: urge the pilot to make a decision and declare “I’ll take control.” He said, “We are going to add examples more attuned to operations.”

 


BEA investigators want the EASA and airframers to include such training in initial and recurrent programs for all aircraft with passive sidesticks. Active sidesticks, which move together via an electronic coupling system, are currently flying on the in-development Gulfstream G500/G600. Dassault told AIN it mulled active sidesticks for the Falcon 7X. But despite the obvious benefit for situational awareness in normal operations, Deleume sees a major downside. To cope with an incapacitated pilot falling on his sidestick, he asserted, active sidesticks need automatic disconnection in the event of strong and conflicting dual input. The controls would therefore also disconnect in the event two stressed pilots make different inputs. The sidesticks would then switch to a passive mode, which would further complicate recovery because the setup would be foreign to the crew, Deleume contended.

 


During the incident over Malaysia, could the pilot/s have pulled a pitch trim circuit breaker? Or could they have pushed the autopilot disconnect switch to shut off the electric trim? The short answer is “no.”

 


On a Falcon with conventional controls, an emergency control can disconnect the trim’s normal actuator (thus switching to the backup actuator) in the event of a problem. On a fly-by-wire Falcon 7X, the DFCS may decide which actuator to use. “Digital controls do things the pilot cannot see,” said Jean-Louis Montel, Dassault's senior v-p of engineering. Therefore, the system is in charge of monitoring and can draw on redundancies as it deems necessary. “It is better and quicker [than a human pilot],” Montel asserted. During the incident, the DFCS received erroneous information, which was all the more hazardous because the system deemed it to be valid (no sensor failure was detected) and plausible. “Our design was not perfect,” chief test pilot Philippe Deleume acknowledged.

 


As one of the first actions after the fleet’s grounding, Dassault installed an emergency control that equips the pilot to switch to the trim’s backup actuator. On the Falcon 8X, Dassault has decided that the switch is no longer needed. “We improved the design and production and could thus revert to the DFCS philosophy,” Montel said.

 


The root cause of the 7X’s pitch problem was a production issue: a brazing defect in an inductance pin located in the horizontal stabilizer electronic control unit (HSECU). The HSECU sent erroneous commands to the tailplane, causing the aircraft to pitch up. Simultaneously, the computer was telling the monitoring system that the control surface was applying a pitch-down force. The HSECU is made by Rockwell Collins to Dassault’s specifications.

 


Because a single failure almost caused a catastrophe, the consequence of one component failure in the HSECU had been underestimated, the BEA said. It studied how the failure mode and effect analysis (FMEA) had been performed and identified shortcomings in human resources.

 


The BEA also suggests time pressure in the development and certification process compromised the FMEA. But this kind of analysis has its own limitations, the BEA said, in that it takes into account only known failure modes and single failures rather than multiple component failures. “FMEAs were developed in the late 1940s to deal with simple mechanical and electric equipment and can be unsuited to analyze complex systems, notably those [relying on] digital computers,” the report points out. It recommends that the EASA, FAA, SAE and Eurocae assess alternative or complementary methods to FMEAs for electronic hardware and software.

 


On a similar note, the report highlights a lack of independence between control and monitoring. The actuator control monitoring unit relied entirely on the HSECU, and it complied with certification requirements. The architecture, however, did not guarantee that an HSECU malfunction would be detected, demonstrating to the BEA that certification authorities have weaknesses in safety analysis.

 


See <a href="https://www.ainonline.com/aviation-news/business-aviation/2016-05-06/upset-training-age-fly-wire">related story</a> on upset training in the age of fly-by-wire.

 


<h2>By-wire or digital?</h2>

 


Although the words “fly-by-wire” (FBW) have long been used in the industry, Dassault believes “digital flight control system” (DFCS) better describes the Falcon 7X’s flight controls. Early FBW systems were analog, and “fly-by-wire” does not mean wires have replaced rods, cables and so on. Digital technology allows a pilot’s control inputs to be translated into the optimum combination of control surface deflections; a roll input translates into the ailerons, spoilers and rudder moving. While such distribution of action is common on digitally controlled aircraft, only some of them (including Airbus jets, the Embraer Legacy 450 and 500 and the Falcon 7X) have autotrim, which automatically trims the aircraft in response to pilot input, thus reducing workload.

 


<h2>Timeline</h2>

 


May 24, 2011 Incident happens during descent toward Kuala Lumpur, Malaysia.

 


May 26&nbsp;&nbsp;At Dassault’s request, EASA grounds Falcon 7X fleet.

 


May 27&nbsp;FAA follows suit.

 


June 16&nbsp;Additional monitoring is introduced, independent from the horizontal stabilizer electronic control unit (HSECU). A push-button is added, enabling the pilots to manually switch to the trim’s backup actuator.

 


These actions, combined with an inspection of the HSECU, allow operators to resume flying. The flight envelope is restricted at high speed, however, a limitation stemming from the time needed for the new monitoring function to kick in.

 


July 7 Potential mechanical interference between HSECU components is eliminated.

 


August 29&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Software is modified to improve monitoring, notably the deflection speed of the tailplane. Upgraded software also accelerates the detection of runaway pitch trim, restoring the full flight envelope.

 


(Source: BEA report)

News and information on safety procedures and concerns.

Falcon 7X Incident Prompts Training Changes

Serious incident caused Dassault to ground Falcon 7X fleet in 2011. Final report highlights organizational problems at industry and authority levels.

2024 Corporate Aviation Leadership Summit

Amy Wilder

News and issues relating to business, corporate and private aviation, primarily regarding turbine-engine-powered airplanes and helicopters. Subjects include aircraft, engines, maintenance, operations, personnel, acquisitions, accidents, safety, security, and training.

Altitude and course deviation, traffic proximity remain top categories

ACSF Data Shows Stable Bizav Risk Amid 2026 Pressures

Kerry Lynch

News and issues relating to international air transport and cargo carriers, national airlines and regional airlines, including aircraft, engines, personnel, acquisitions, accidents, safety, security and training.

Essential news and analysis on the defense aerospace business. Your trusted source for new and ongoing programs and requirements in military aircraft (manned and unmanned), engines, avionics, weapons and associated systems, including ground-based air defense.

Aircraft remained within separation guidance but neared each other after the presidential helicopter was unable to alert ATC

Faulty Comms Preceded Marine One/Envoy Close Call

Graham leaving agency within months of confirmation to another term

NTSB Vice Chair Michael Graham To Retire October 2

Stuart “Kipp” Lau

News about bills, laws, regulations and other governmental decisions affecting aviation and aerospace. Topics include FAA re-authorizations, taxes on fuel and aviation activities, environmental legislation, ICAO decisions, governmental mediation of labor conflicts and World Trade Organization disputes and decisions.

UK CAA concerned over rise in unstable approaches continuing to land

AINsight: Go-arounds Are a Normal and Expected Outcome

News about significant aircraft accidents and information from accident reports.

News and issues regarding all manner of civil and military rotorcraft and their powerplants, including helicopters, tilt rotors and unmanned air vehicles.

Helicopters more than twice as vulnerable to loss of visual reference accidents than airplanes

TSB: Rotorcraft More Prone To Loss-of-visual-reference Accidents

Charlotte Bailey

News about environmental issues relating to aircraft operations, including noise issues, emissisions, and regulations. See Fuel for biofuel.

News and issues relating to the aerospace industry that are related to the science, engineering and business of flight in space involving civil, industrial and military applications, and similar topics related to flight in the atmosphere of the Earth that are not covered more directly by other AINonline subject channels. In other words, both astronautical and aeronautical subjects, except for those aeronautical topics that are specifically covered elsewhere on this website.

More In Safety

ACSF Data Shows Stable Bizav Risk Amid 2026 Pressures

Altitude and course deviation, traffic proximity remain top categories

Faulty Comms Preceded Marine One/Envoy Close Call

Aircraft remained within separation guidance but neared each other after the presidential helicopter was unable to alert ATC

NTSB Vice Chair Michael Graham To Retire October 2

Graham leaving agency within months of confirmation to another term

AINsight: Go-arounds Are a Normal and Expected Outcome

UK CAA concerned over rise in unstable approaches continuing to land

TSB: Rotorcraft More Prone To Loss-of-visual-reference Accidents

Helicopters more than twice as vulnerable to loss of visual reference accidents than airplanes

EASA: Atmospheric Icing Insufficiently Understood

European air safety agency calls for more comprehensive studies into phenomenon

Embry-Riddle Introduces ‘Safer Skies’ Video Podcasts

First episode features three-time space shuttle veteranJanet Kavandi

Li-ion Thermal Runaways on the Rise in Aircraft Cabins

Numbers are rising and the risk of a serious incident is increasing

AIN Products

SUBSCRIPTIONS

RESOURCES

ABOUT AIN