Essay

The FAA wants the software to admit its own limits

The FAA’s newest condition for Skyryse’s fly-by-wire Robinson R66 requires the aircraft to tell the pilot when the controls are running out of authority. The sentence is copied word for word from a 2018 rule for the Bell 525. Its key clause dates to the Airbus A320. And it does not contain a number.

The helicopters I trained in tie the cyclic to the rotor with push-pull tubes and bellcranks. How much control you have left is where the stick sits. A cyclic near its stop means a rotor near the end of its travel, and nothing on the panel has to say so. The FAA’s proposed special condition describes the same baseline in drier terms. In a hydro-mechanical helicopter, it says, “pilot awareness of control margins is provided by cyclic and pedal position relative to cockpit control stops.” Hydraulic boost never changed that. The stock R66’s servos “eliminate cyclic and collective feedback forces,” per Robinson’s own flight manual, so its stick already gives no push-back. The pilot keeps geometry.

Skyryse applied in April 2023 to take all of it out. SkyOS removes the R66’s cyclic, collective, and pedals, along with the pull tubes and hydraulics. In their place go a single centrally mounted control stick and two touchscreens. There is “no mechanical link between the inceptor and the receptor,” so the stick’s position becomes a request to a computer. The FAA’s filing says it without euphemism. The system “will replace the tactical feedback from pushrods with a position calculated by a computer.”

Jobs the linkage did for free. The FAA is writing them back one special condition at a time. It finalized conditions on how the flight control system interacts with the structure in December 2024, and on static longitudinal stability this May. On August 12 it required a display of where the computer has commanded the controls, “because of the loss of pilot awareness that would have been provided by mechanical system feedback to the cyclic.” The August 28 proposal is the fourth, and it covers the margin itself. “The system design must ensure that the flight crew is made suitably aware whenever the means of primary flight control approaches the limits of control authority.” The only definition it offers is for “suitable,” which “indicates an appropriate balance between nuisance and necessary operation.”

A requirement with no acceptance test. It names no threshold, no warning time, and no tolerable rate of false alarms. Each of those is a design decision, and each fails in both directions. Set the cue too eager and it nags through ordinary maneuvering until the pilot learns to ignore it, which is how a warning stops being one. Set it too late and the pilot meets the limit the way pilots meet an unmarked one, by arriving at it. Where that line sits is the entire design. The rule leaves it to the certification program.

Thirty-eight years of the same word. That is the strongest case against worrying. The FAA’s 1988 special conditions for the A320 demanded “suitable flight control position annunciation.” The reason was “the lack of surface deflection feedback to the sidestick controller,” and the text closed on a familiar note: “The term suitable also indicates an appropriate balance between nuisance and necessary operation.” The A350 proposal carried “suitably aware” forward in 2013. Bell’s fly-by-wire 525, a 20,500-pound twin with a crew of two, got the identical paragraph in 2018, and “No comments were received.” Performance language leaves the number out on purpose. The number belongs to the design and gets judged in certification flight test, and fly-by-wire airliners have flown under that word for decades. Concede it. Concede, too, that the old stop never told the whole truth. Robinson’s low-G safety notice warns that “the rotor must be reloaded before lateral cyclic can stop any roll.” That is full stick travel under your hand and no authority at the rotor. Every margin cue is a proxy.

What does not transfer is the calibration. The A320 kept “conventional mechanical control” for “the rudder and tailplane trim.” The Bell 525 was designed around a crew of two. The R66 is a 2,700-pound, single-engine helicopter, and this installation leaves no mechanical path at all. The FAA’s own filings call fly-by-wire “new to part 27 rotorcraft.” A Federal Register search for “control margin awareness” returns five documents: Bell’s two, airworthiness criteria for Joby’s and Archer’s powered-lift aircraft, and this one, the only Part 27 helicopter on the list. Whoever judges “suitable” here brings decades of airliner calibration to a class of aircraft with none. The evidence stays sealed, too. A commenter on the stability docket asked for “a non-proprietary, substantive summary of the technical basis and safety case.” The FAA answered that “the additional information requested by the commenter is proprietary.” That is ordinary as well.

The comment period closes October 13. The software would be required to admit its limits. How early it admits them is a number the docket will only ever call suitable.

Sources: