Envelope protection methods
Avionics mfrs build autopilots to address inadvertent unusual attitudes and overloads.
Embraer Lineage 1000 cockpit, based on the Embraer 190 airliner, uses fly-by-wire to provide envelope protection.
The systems used by Airbus and Boeing have very different philosophies.
The Airbus system is an envelope limiting system in that it prevents the pilot from exceeding certain critical flight parameters by modifying and/or ignoring control inputs that would lead to an exceedance.
This includes hard limits for pitch and roll and limits on engine power dependent on flight mode. There has been some controversy revolving around the Airbus system and several occurrences have led some observers to think that these hard limits may have even prevented recovery from a situation and therefore been a contributing factor.
Proponents of the Airbus system have maintained that a more significant contributing factor could have been a lack of system knowledge on the part of the crew.
However, with some 25 years of experience, the system appears to be extremely reliable and "finger-trouble" free.
Boeing's envelope protection, according to Boeing Commercial Airplanes Engineering Communications Mgr Bret Jensen, deters pilots from exceeding certain predefined limits, but does not prohibit it. For example, if bank angle protection is set at 35°, the primary flight control system will significantly increase the wheel force a pilot encounters when attempting to roll the airplane past that bank angle.
The pilot may exceed 35° but must exert a great force to do so. Boeing's envelope protection also features turn compensation, stall and overspeed protection, pitch control, stability augmentation and thrust asymmetry compensation.
Both Embraer and Dassault FBW systems employ a hybrid philosophy. They do not prevent large excursions from straight-and-level unless they would place the aircraft structure at risk.
They evaluate gloads, aerodynamic loads, aircraft flightpath vector etc—and, should current inputs command the aircraft into an area outside the structural limits, the inputs are modified. In the case of the Falcon 7X, the load factor is limited to +3.5 g and –1.0 g (0.0 g with the flaps extended).
According to Dassault Falcon Jet Mgr Technical Programs Woody Saland, Dassault Falcons have also had sophisticated under/overspeed protection for a number of years, even before the introduction of the current EASy cockpits and the 7X FBW system.
The aircraft would deploy slats or speed brakes (as appropriate) and engage the autothrottles (if equipped) to protect the aircraft. The system was enhanced further with the introduction of EASy.
Dedicated envelope protection
Dassault Falcon 7X was the first corporate aircraft to use fly-by-wire.
Envelope protection, as a stand-alone system and not part of an FBW package, was introduced to the market last year by both Garmin and Avidyne.
While Avidyne is concentrating on single-engine aircraft, Garmin is also addressing a wide gamut of larger aircraft including Part 25 (transport category) aircraft.
Envelope protection is an option with the Garmin G1000 glass cockpit/GFC700 autopilot combination available on many aircraft, including King Airs, Mustangs and the Phenom 100 and 300, and it's part of the G3000 system, which is on the HondaJet, the PiperJet Altaire and the Cirrus Vision. It's also part of the G5000 avionics package, which launched last year on the new Citation Ten (and others to be announced).
Garmin's system, as described by Garmin Aviation OEM Sales Mgr Steve Mead, has 2 modes. One is active when the autopilot is engaged and the other, called ESP (for electronic stability and protection) is active when the pilot is hand flying. As ESP uses the autopilot computers and servos, it is really an "always on" mode of the autopilot.
Similar to the Boeing FBW protection, ESP does not prevent wild excursions—it just adds a restoring force to the controls so that the pilot has to exert an extra effort to go past, for example, a certain bank angle.
If the aircraft attitude is outside of predefined normal limits, either because of intentional actions by the pilot or because of an upset, ESP will work to re-establish the aircraft within those normal limits. Once back in the envelope, the system goes dormant.
The system is designed to prevent, among other things, development of a graveyard spiral. ESP will reduce the bank angle to 30° (actual values are installation-dependent) and pitch the nose up so that it is higher than 20° nose down.
The pilot should then be able to complete the recovery without further assistance. If, on the other hand, the pilot is still disoriented or otherwise not in effective control, the autopilot engages to return the aircraft to straight-and-level. (See below.)
Another trap, as illustrated by the MD82 incident described above, is an underspeed. A typical situation might be a descent (as part of an approach) followed by a leveling off. If the pilot forgets to add power, the aircraft will obviously slow down.
As the aircraft nears the stall, the system will initiate a slow descent to at least keep a small margin above the stall. The philosophy here is that, if the pilot is incapacitated, it is better to hit the ground at low speed with the wings level than it is to hit the ground in a spin as the result of a stall.
The newest avionics systems are starting to offer protection that is not, by strict definition, envelope protection. The most prevalent is emergency descent mode. The Gulfstream G650, all Falcons with the newer EASy II system (starting with the 900LX) and the Pilatus PC12 NG with Honeywell Primus Apex are recent examples.
According to Honeywell Aerospace Dir Media Relations Bill Reavis, auto descent mode (ADM) was released as early as 1991 on the Cessna Citation VI. Since then, a number of Citations, Bombardier Global Express models with the Primus 2000 and the Gulfstream G450 and G550 have all had ADM. When the aircraft is on autopilot above 30,000 ft, the system activates if the cabin altitude goes above 15,000 ft.