Envelope protection methods
Avionics mfrs build autopilots to address inadvertent unusual attitudes and overloads.
By Mike Venables
Cessna Citation Ten is the newest aircraft to have a sophisticated envelope protection system.
Several years ago I was shopping for a personal aircraft and the short-list included a Piper Arrow—a retractable-gear Cherokee.
One of the features was an automatic gear extension system to save the day in case the pilot forgot. I had a fairly new commercial license and, somewhat arrogantly, didn't see the benefit at all. I thought, "I don't need no stinking automatic gear extension system!"
Other factors were more important and I ended up with the Arrow anyway. It was a great aircraft for me and, as I came to know the systems, I realized that the automatic system was genius in its elegance and simplicity.
While I never needed it for its primary purpose, I did need one emergency extension as a result of a minor electrical fault. The emergency system was actually a manual activation of the automatic system and it couldn't have been easier or more reliable.
The gear actually came down faster and the locks engaged more solidly than with the normal system. The other benefit came every year when I wrote the insurance check, as I got a discount because of the automatic system.
So it is with envelope protection systems. The initial reaction of professional pilots, particularly those operating larger aircraft requiring 2 crewmembers, is that they, too, "don't need no stinking envelope protection system!"
Unfortunately, the accident statistics expose the lie in that attitude. A review of the NTSB database from the beginning of 2000 through to the end of 2008 reveals a large number of turbine aircraft involved in incidents/accidents where loss of control is cited as a factor.
Discounting those associated with loss of control on the runway, loss of control following severe icing (in which, presumably, the pilot lost control because the aircraft became unflyable), agricultural operations and a few jet warbird mishaps, there were 62 incidents/ accidents.
These resulted in 130 fatalities, 14 serious injuries and 266 people with either minor injuries or none at all. (NTSB reports don't differentiate.)
Avro Canada CF105 Arrow was the first nonexperimental aircraft with an electronic FBW system.
While some of these occurrences involved nonprofessional single pilots flying lighter aircraft, many were Part 91 corporate and Part 135 charter operators flying Caravans (for cargo), Learjets, Citations, King Airs and some heavier bizjets.
There were also a few Part 121 operators flying a Boeing 717, an Embraer 145, a Saab 340 and a McDonnell Douglas MD82.
The most notable involved the MD82, which was operated by a well known flag carrier. In cruise, with both the autopilot and autothrottles engaged, the engine inlet probes evidently became blocked by ice crystals and caused a falsely high engine pressure ratio (EPR) indication.
The autothrottle system retarded the throttles all the way to flight idle and, as the airspeed decayed, the autopilot increased the pitch to maintain the selected altitude. After a few minutes, the aircraft had slowed to the point that it stalled. Loss of control in flight can happen in any aircraft.
Envelope protection and FBW
In the context of current usage, envelope protection goes way beyond previous generation systems that were generally nonintelligent stick pushers and pullers to provide some protection against a stall or an overspeed.
The first computer-driven envelope protection systems became available as part of fly-by-wire (FBW) flight control systems. The first application in a nonexperimental aircraft was in 1958 on the Avro Canada CF105 Arrow.
The system made an intentionally unstable (and therefore more maneuverable) aircraft very flyable at the same time as providing protection against exceeding the design flight envelope.
This philosophy continues today. For military aircraft, unstable aircraft are far more maneuverable in combat. Other mission objectives may make an aircraft otherwise unflyable without sophisticated flight control computers in the loop with the pilot.
The VTOL British Aerospace Harrier (and later McDonnell Douglas AV8) and the stealthy Lockheed F117 Nighthawk are but 2 examples. For civilian aircraft, pushing efficiency and speed at the same time, it is much easier to certify the flying qualities if they can be programmed into an FBW system rather than having to change the geometry of the aircraft to achieve the flyability requirements, probably at the expense of the design objectives.
First civilian use was in 1984 on the Airbus A320. Airbus took advantage of the opportunity to switch from the traditional yoke to a sidestick, which has ergonomic advantages.
The Dassault Falcon 7X, in 2005, was the first corporate aircraft to use FBW.
Now, all Airbus aircraft from the A320 onwards, the Boeing 777s and 787s and the Embraer E-Jets have FBW. In the corporate world, the Gulfstream G650 and the Embraer Legacy 450/500 and Lineage 1000 are (or will be) FBW-equipped.
Sidestick controllers in the A320 cockpit are connected to the first FBW system on a civil aircraft.
The envelope protection built into modern FBW systems would typically act to greatly reduce the risk of a recurrence of the Nov 2001 American Airlines Flight 587 accident—in which an Airbus A300 lost its vertical stabilizer after takeoff from JFK (John F Kennedy, New York NY)—and the Feb 2009 Colgan Air Flight 3407 accident—in which a Bombardier DHC8-Q400 stalled on approach to BUF (Buffalo NY).