Computers that vote: how fly-by-wire earned trust

In 1988 an airliner went on sale in which no cable, rod or lever connected the pilot to the control surfaces — only wires, and computers with opinions. The engineering achievement was not making that work; simulators had flown that way for years. It was making it trustworthy enough to carry your family — and the answer is less about clever software than about organised disagreement.

Signals instead of cables

In a classical aircraft the pilot's muscles, geared through cables and hydraulic valves, move the surfaces directly — the yoke's position isthe elevator's position, more or less. Fly-by-wire breaks that bargain. The sidestick sends a request; flight computers read it alongside airspeed, attitude and load factor, decide what the surfaces should do to deliver the manoeuvre the pilot asked for, and command the actuators electrically. The pilot commands intent; the machine handles execution. Everything else about the system follows from one question: what if the computer is wrong?

Earning trust: vote, and disagree

The answer is never to have a computer. The A320 carries multiple flight computers, continuously cross-checking, arranged so any one of them can fail — loudly or silently — without taking the aircraft with it. Crucially, the redundancy is dissimilar: different processor families, different software, written by separate teams to the same specification. Identical computers running identical code would fail identically on the same bad input — the one failure redundancy cannot catch. Dissimilar machines voting is how you make a common-cause software failure vanishingly unlikely.

The fence around the envelope

Once computers sit in the loop anyway, they can do something cables never could: refuse. The A320's normal law draws a fence around the flight envelope — maximum angle of attack, bank and load factor — and full stick simply commands the aircraft to the fence and no further. A startled pilot can pull hard in a windshear escape and get the maximum the wing has to give, without stalling it. The philosophy has its critics, and its edge cases keep courtrooms and pilot forums busy — but the accident statistics of protected aircraft made the argument for it, one uneventful flight at a time.

What the trust bought

The wires themselves bought weight savings and relaxed stability margins. The trust bought something bigger: once the aircraft's handling lives in software, every aircraft can be made to feelthe same. Airbus gave the A319, A320, A321, A330 and A340 one cockpit and one set of manners, so crews convert between types in days rather than months — an economic revolution wearing an engineering one's clothes. Boeing followed with its own philosophy on the 777. Today a new airliner without fly-by-wire would be as unthinkable as one without jet engines; the argument the A320 started is simply over.