Flight envelope protection

China Airlines Flight 006 damaged by going outside its flight envelope to gain control after a drop of 3,000 m in 20 seconds

Flight envelope protection is a human machine interface extension of an aircraft’s control system that prevents the pilot of an aircraft from making control commands that would force the aircraft to exceed its structural and aerodynamic operating limits.[1][2][3] It is used in some form in all modern commercial fly-by-wire aircraft.[4] Its advantage is that it restricts pilots in emergency situations so they can react quickly without endangering the safety of their aircraft.[5][6]

Function

Aircraft have a flight envelope that describes its safe performance limits in regard to such things as minimum and maximum operating speeds, and its operating structural strength.[1][2][3] Flight envelope protection calculates that flight envelope (and adds a margin of safety) and uses this information to stop pilots from making control inputs that would put the aircraft outside that flight envelope.[5] For example, if the pilot uses the rearward side-stick to pitch the aircraft nose up, the control computers creating the flight envelope protection will prevent the pilot pitching the aircraft beyond the stalling angle of attack. As a result, even if the pilot tried to apply more and more rearward control, the flight envelope protection would cause the aircraft to ignore this command.[4][5] Flight envelope protection can in this way increase aircraft safety by allowing the pilot to apply in an emergency maximum control forces while not at the same time inadvertently putting the aircraft outside the margins of its operational safety.

Examples of where this might stop air accidents are when it allows a pilot to make a quick evasive maneuver in response to a ground proximity warning system warning, or in quick response to an approaching aircraft and a potential mid air collision.[4] In this case without a flight envelope protection system, "you would probably hold back from maneuvering as hard as you could for fear of tumbling out of control, or worse. You would have to sneak up on it [2.5 G, the design limit], and when you got there you wouldn't be able to tell, because very few commercial pilots have ever flown 2.5 G. But in the A320, you wouldn't have to hesitate: you could just slam the controller all the way to the side and instantly get out of there as fast as the plane will take you."[5] Thus the makers of the Airbus argue: "envelope protection doesn't constrain the pilot. It liberates the pilot from uncertainty-and thus enhances safety."[5]

Airbus and Boeing

The Airbus A320 was the first commercial aircraft to incorporate full flight-envelope protection into its flight-control software. This was instigated by former Airbus senior vice president for engineering Bernard Ziegler. In the Airbus, the flight envelope protection cannot be overridden completely, although the crew can fly beyond flight envelope limits by selecting an alternate "control law".[4][7][8][9] Boeing in the Boeing 777 has taken a different approach by allowing the crew to override flight envelope limits using excessive force on the flight controls.[4][10]

Incidents

China Airlines Flight 006

Further information: China Airlines Flight 006

One objection raised against flight envelope protection is the incident that happened to China Airlines Flight 006, a Boeing 747SP-09, northwest of San Francisco in 1985.[5] In this flight incident, the crew was forced to overstress (and structurally damage) the horizontal tail surfaces in order to recover from a roll and near-vertical dive. (This had been caused by an automatic disconnect of the autopilot and incorrect handling of a yaw brought about by an engine flame-out). The pilot recovered control with about 10,000 ft of altitude remaining (from its original high-altitude cruise). But to do that the pilot had to pull the aircraft with an estimated 5.5 G, or more than twice its design limits.[5] If the aircraft had a flight envelope protection system, this recovery could not have been performed. Against this objection, Airbus has responded that an A320 in the situation of Flight 006 "never would have fallen out of the air in the first place: the envelope protection would have automatically kept it in level flight in spite of the drag of a stalled engine".[5]

FedEx Flight 705

FedEx Flight 705, a McDonnell Douglas DC-10-30, was a case of a FedEx Flight Engineer who, facing a dismissal, attempted to hijack the plane and crash it into FedEx Headquarters in order for his family to collect his life insurance policy. After being attacked and severely injured, the flight crew was able to fight back and land the plane safely. In order to keep the attacker off balance and out of the cockpit the crew had to perform extreme maneuvers, including a barrel roll and a dive so fast the airplane couldn't measure its speed. Had the crew not been able to exceed the plane's flight envelope, the crew might not have been successful.

American Airlines Flight 587

Further information: American Airlines Flight 587

American Airlines Flight 587, an Airbus A300, crashed when the vertical stabiliser broke off due to large rudder inputs by the pilot. A flight-envelope protection system could have prevented this crash, though it can still be argued that an override button should be provided for contingencies when the pilots are aware of the need to exceed normal limits.

US Airways Flight 1549

Further information: US Airways Flight 1549

US Airways Flight 1549, an Airbus A320 experienced a dual engine failure after a bird strike and subsequently landed safely in the Hudson River. The NTSB accident report[11] mentions the effect of flight envelope protection: "The airplane’s airspeed in the last 150 feet of the descent was low enough to activate the alpha-protection mode of the airplane’s fly-by-wire envelope protection features... Because of these features, the airplane could not reach the maximum AOA attainable in pitch normal law for the airplane weight and configuration; however, the airplane did provide maximum performance for the weight and configuration at that time... The flight envelope protections allowed the captain to pull full aft on the sidestick without the risk of stalling the airplane."

Notes

  1. ↑ 1.0 1.1 Pratt, R. (2000). Flight control systems: practical issues in design and implementation. Institution of Electrical Engineers. ISBN 978-0-85296-766-9
  2. ↑ 2.0 2.1 Abzug MJ, Larrabee EE. (2002). Airplane stability and control: a history of the technologies that made aviation possible. Cambridge University Press, ISBN 978-0-521-80992-4
  3. ↑ 3.0 3.1 Risukhin V. (2001). Controlling Pilot Error: Automation. McGraw-Hill Professional. ISBN 978-0-07-137320-3
  4. ↑ 4.0 4.1 4.2 4.3 4.4 North, David. (2000) "Finding Common Ground in Envelope Protection Systems". Aviation Week & Space Technology, Aug 28, pp. 66–68.
  5. ↑ 5.0 5.1 5.2 5.3 5.4 5.5 5.6 5.7 Waldrop MM. (1989). Flying the Electric Skies. Science, 244: 1532-1534. JSTOR 1704109
  6. ↑ Alizart R. Fulford GA. (1989) Electric Airliners. Science, 245: 581-583. JSTOR 1704444
  7. ↑ Traverse P. Lacaze I. Souyris J. (2004). Airbus Fly-By-Wire: A Total Approach To Dependability. IFIP International Federation for Information Processing: Building the Information Society. 156: 191-212. doi:10.1007/978-1-4020-8157-6_18
  8. ↑ Briere D. and Traverse, P. (1993) “Airbus A320/A330/A340 Electrical Flight Controls: A Family of Fault-Tolerant Systems” Proc. FTCS, pp. 616-623.
  9. ↑ Rogers R. (1999). Pilot authority and aircraft protections. Cockpit (Jan.-Mar. issues). 4-27.
  10. ↑ Aplin JD. (1997). Primary flight computers for the Boeing 777. Microprocessors and Microsystems. 20: 473-478. doi:10.1016/S0141-9331(97)01112-5
  11. ↑ http://www.ntsb.gov/investigations/AccidentReports/Reports/AAR1003.pdf in particular section 1.6.3 and 2.7.2

See also