Safety Innovation #7: Flight Envelope Protection

When aircraft are flown outside of their established operating limits – the flight envelope – and correction efforts are not made or occur too late, it can lead to loss of control in flight (LOC-I). Since the dawn of aviation, LOC-I was a leading cause of aircraft accidents. 

The aircraft’s flight envelope corresponds to the various critical operational limits, beyond which its controllability and the structural integrity may be at risk (low or high airspeeds, aerodynamic angle-of-attack, flight attitudes, etc.). 

The purpose of flight envelope protections is to allow the best aircraft performance and control authority while minimising the risk of over-controlling, losing control, overstressing, or damaging the aircraft.

Flight envelope protection has been a cornerstone of Airbus’ safety-related developments, and is applied across its product line, from commercial and military aircraft to helicopters.

Introduction of fly-by-wire on Airbus commercial aircraft 

Airbus extended the flight envelope protection function to cover all of the critical operational limits on its commercial aircraft, which was made possible through the integration of digital fly-by-wire technology, largely introduced in 1988 on the A320 (after being inaugurated on the Concorde). The flight envelope protections were integrated as standard on all Airbus programmes that followed since, including the A400M. 

Fly-by-wire flight control systems use computers to process the flight control inputs made by the pilot or autopilot, sending corresponding electrical signals to the flight control surface actuators. This technology replaces direct mechanical linkage.

Keeping the aircraft within its flight envelope limits

The flight envelope protections are embedded within the flight control laws generated by the onboard flight control computers, and are intended to keep the aircraft within the pre-established parameter limits.

The Airbus flight envelope protection on its fly-by-wire aircraft prevents exceedance of the following critical operational limits in the baseline – or “normal law” – control mode:

• High angle-of-attack protection: This protects against the risk of an aerodynamic stall, including in situations of wind shear, as well as during dynamic manoeuvres or in gusty conditions;
• High-speed protection: The aircraft is protected against overspeed situations that may eventually result in potential control difficulties, as well as structural concerns due to high aerodynamic loads;
• Pitch attitude protection: The pitch angle is limited between a minimum and a maximum value to prevent climbs or descents that are too steep;
• Bank angle protection: The bank angle and roll rate are limited to maximum values to prevent excessive banking, along with turns that are too steep, as well as the risk of the aircraft becoming inverted;
• Load factor protection: The aircraft’s vertical acceleration is kept within safe limits for the airplane’s structure; and
• Low energy and alpha floor protection: They ensure that a suitable level of aircraft energy is maintained in flight, with corrections made via manual or automatic increases in engine thrust.

To be noted is the protections in “normal law” mode remain available under any single system failure, but can become unavailable under certain multiple failures. In such situations, depending on the multiple failure cases, some or all protections may be unavailable.

A reduction in accident rates 

LOC-I accidents have been reduced by 89% for the latest generations of commercial aircraft equipped with such flight envelope protection.

Today, fly-by-wire flight control systems and flight envelope protection have become the norm. Beyond Airbus, the aircraft examples include Boeing’s 777 and 787, Embraer’s E-Jets and the Sukhoi Superjet.

Accompany the pilot throughout the helicopter mission

On the helicopter side, given the specificity of the missions carried out, the flight control laws target specific operational needs. Their purpose is to support the pilot so that he/she can carry out his/her mission with the highest level of safety. Many missions are carried out close to terrain or obstacles, which inherently makes them more risky. 

During winches at sea, for example, the pilot and the Flight Control System work in tandem with significant interaction between the two. These are neither hands-off automatic flight phases, nor pure manual piloting phases, but a mix of the two, even if the autopilot provides very significant assistance to the pilot, particularly in poor visibility conditions. 

The flight control laws are also there to regulate the control of the ground speed, in particular for hovering, a characteristic of vertical take-off aircraft. Then, rotorcrafts often operate near their maximum power in forward flight. To handle this constraint optimal vertical and longitudinal objectives command versus available power was developed in the early 2000s by Airbus Helicopters, and proved a differentiating factor for safety. 

Finally, the flight control laws also aim at supporting the pilot in the event of engine failure near the ground, with automatic establishment of the return trajectory to the touchdown point.

Most multi-engine helicopters are certified to operate in Category A. This means that, in the event of an engine failure during takeoff or landing, the helicopter can either land safely on the helipad or continue the takeoff and establish level flight. As part of an Airbus effort to improve flight safety, the Category A takeoff from helipads was automated and first certified on the H160 helicopter. Automatisation warrants correct maintenance of the flight path during takeoff and ensures a timely initial response to engine failure.

Another significant flight envelope protection is unique on the H160: the vortex pre-alerting system. It gives pilots advance warning when the H160 is about to enter a “vortex ring state” – when a helicopter loses main rotor lift and could experience loss of control. The alerting system gives a warning of five to seven seconds, enabling pilots to react and avoid encountering this condition.