AIAA Guidance, Navigation, and Control Conference and Exhibit AIAA 2006-6055

21 - 24 August 2006, Keystone, Colorado

AIAA-2006-6055, GNC Conference, Aug. 21-24, 2006, Keystone, Colorado

Aircraft Control Laws for Envelope Protection

Klaus H. Well*

Institute of Flight Mechanics and Control

University of Stuttgart, Pfaffenwaldring 7a, 70569 Stuttgart, Germany

klaus.well@ifr.uni-stuttgart.de

Envelope protection is considered for both the longitudinal and the lateral motion of an aircraft. Several con-
trollers for each motion are run in parallel and switched on or off by a simple linear switching logic. The feasi-
bility of this approach is shown in nonlinear simulations with a model of an F-16 aircraft.

I Introduction
Advanced flight control systems of commercial and military aircraft nowadays have provisions to prevent the pilot
from entering state- and control regions outside the safe flight regime of the aircraft. These features are commonly
referred to as “envelope protection” or “carefree handling”. In [1] a summary of protection features for the Airbus air-
craft is given. There are basically four sets of control laws: Normal Law, Alternate Law, Abnormal Alternate Law,
and Direct Law. Each set, again, has different modes like ground mode, flight mode, flare mode. In addition, each
mode has different protections. For instance, the normal law/flight mode becomes active shortly after takeoff and
remains active until shortly before touchdown. In this mode
• the sidestick deflection and load factor imposed on the aircraft are directly proportional, regardless of air-
speed,
• with sidestick neutral and wings level, the system maintains a 1 g load in pitch,
• there are no requirements to change pitch trim for changes in airspeed, configuration, or bank up to 33
degrees,
• at full aft/fwd sidestick deflection the system maintains maximum load factor for flap position,
• the sidestick roll input commands a roll rate request, roll rate is independent of airspeed, a given sidestick
deflection always results in the same roll rate response,
• turn coordination and yaw damping are provided automatically.

In that mode the following protections are active:

• Load factor Limitation prevents the pilot from overstressing the aircraft even if full sidestick deflections are
applied.
• Attitude Protection: Pitch is limited to 30 deg up, 15 deg down, and 67 deg of bank. Bank angles in excess of
33 deg require constant sidestick input. If input is released the aircraft returns to and maintains 33 deg of
bank.
• High Angle of Attack Protection (alpha): When alpha exceeds alpha prot, elevator control switches to alpha
protection mode in which angle of attack is proportional to sidestick deflection. Alphamax will not be
exceeded even if the pilot applies full aft deflection.
• High Speed Protection: Prevents exceeding VMO or MMO by introducing a pitch up load factor demand.
The pilot can NOT override the pitch up command.
• Low Energy Warning: Produces aural "SPEED SPEED SPEED" when change in flight path alone is insuffi-
cient to regain a positive flight path (Thrust must be increased).

The purpose of this paper is to develop a simple contral law architecture which satisfies not only required aircraft fly-
ing qualities but, in addition, provides some of the above mentioned protection features. The original motivation was
to apply this architecture to general aviation aircraft. However, in lack of good aerodynamic data of such aircraft over
the whole flight envelope, a model of the F-16 given in [2] is chosen. It is conjectured that the control law architec-
ture can easily be adapted to any other aircraft.
*Professor
and Director

Copyright © 2006 by Klaus H. Well. Published by the American Institute of Aeronautics and Astronautics, Inc., with permission.
 II The F-16 Model
The nonlinear model containing the 6-DOF equations of motion, aerodynamic and propulsive data have been pro-
vided by the first author of [2]. The state variables of this model are
T
x = [ V , α , β, φ , ϑ , ψ , p , q , r , x , y , z , T ] . (1)
These are: Flight path velocity, angle of attack, sidedlip angle, bank-, pitch-, and yaw angles, roll-, pitch-, and yaw
rates, kinematical position of the center of mass with respect to some initial position, and the thrust. The model has a
first order lag between commanded and actual thrust. The control variables are
T
u = [ T com, η, ξ, ζ ] (2)

with commanded thrust, elevator-, aileron-, and rudder deflection angles. The output variables are
T
y = [ a z, a y, …, M, α, β, φ, θ, ψ, p, q, r ] (3)

designating normal and lateral accelerations, Machnumber, and the angles and rates defined previously.
The data are valid in the regions
0 0
– 10 ≤ α ≤ 30
0 0
– 20 ≤ β ≤ 20
0 0
– 20 ≤ η ≤ 20 (4)
0 0
– 30 ≤ ξ, ζ ≤ 30
0 ,2 ≤ M ≤ 0 ,6
10000ft ≤ h ≤ 30000ft
with M, h as Machnumber and altitude. In this model the aerodynamic coefficients are defined as

c x = c x ( α, η )
c y = c y ( β, ξ, ζ )
c z = c z ( α, β , η )
∂c l ∂c
c l = c l ( α, β ) + ( α, β )∆ξ + l ( α, β )∆ζ . (5)
∂ξ ∂ζ
c m = c m ( α, η )
∂c n ∂c
c n = c n ( α, β ) + ( α, β )∆ξ + n ( α, β )∆ζ
∂ξ ∂ζ

These are the force- and moment coefficients along the body fixed axes. The ∆ variables are deviations from the
appropriate trim conditions.

III Control Law Architecture

For control law design of the individual controllers the 6-DOF motion is seperated in the usual way into longitudinal
and lateral motion. Linear controllers are then designed based on suitable trim conditions.

Longitudinal Controllers
As basic flight controller a pitch rate tracking controller is used. Full down command of the stick corresponds to a
maximum negative pitch rate, full up command corresponds to a maximum positive pitch rate. Alternatively, a load
factor tracking controller could easily be used.
For α -protection an angle of attack tracking controller is used, protecting the aircraft against flying beyond maxi-
mum or minimum angles of attack. Once a maximum angle of attack is reached the pitch rate controller is switched to
an angle of attack controller. If full stick commands are maintained maximum or minimum angles of attack are com-
manded. A neutral stick commands the value of angle of attack corresponding to the trim value for that particular
operational point. If the stick commands are away from their maximum values the pitch rate controller is reactivated.
For speed protection a Machnumber controller is used. If Machnumber becomes too small a pitch down command
and a thrust increase command are generated. If Machnumber becomes too large a pitch up command and a thrust
decrease command are generated.

stick unnorm alize

qcom q-controller eta
input q-com m and

qcom

unnorm alize eta nonlinear

alfcom switch eta
alfa-com m and alfa-controller 6-DO F EOM
alfa

Mach-
tcom
controller alfcom longitudinal
output
Mach, q, alfa, theta, phi

Fig. 1: Longitudinal Controllers

Fig. 1 shows the controller structure. The stick input which is in the range [ – 1, 1 ] is converted either into a pitch rate
command or an angle of attack command. Both the q-controller and the α -controller generate elevator signals. The
M-controller is a simple P-controller generating both a command for the q-controller and one for the α -controller as
well as a thrust command whenever needed. The bank angle φ is needed in the longituinal controllers in order to pre-
vent altitude loss during a turn

q com = r tan φ . (6)

All controllers are run in parallel. Their outputs are fed into the switch or directly into the nonlinear 6-DOF model.
Selection of the actual control signal is performed according to the following rule: Designating the elevator signal
from the q-controller by η q and the elevator signal from the α -controller by η α the actual signal η is computed
from

η = η q s α + ( 1 – s α )η α (7)

with s α the switching function. This function is

s α = 1 if α minprot < α < α maxprot (8)

α – α min
s α = max ⎛ -----------------------------------
- ⎞ if α ≤ α minprot
⎝ α minprot – α min, 0⎠
(9)

α – α maxprot
s α = max ⎛ 1 – ------------------------------------
-, 0⎞ if α maxprot ≤ α . (10)
⎝ α max – α maxprot ⎠

Here, α min, α minprot, α maxprot, α max designate a sequence of angle of attacks, say for instance (-2,-1,13,14) degrees.
Whenever α maxprot – α > 0 and α – α minprot > 0 s α = 1 and η = η q . Whenever α max – α ≤ 0 or α – α min ≤ 0
s α = 0 and η = η α .
Whenever the angle of attack is between the prot and the min or max values, η is a linear combination of η q and η α .
Lateral Controllers
A lateral sidestick command corresponds to a roll rate tracking controller. Maximum and minimum roll rates can eas-
ily be incorporated.
The bank angle protection is realized in a similar way as for the Airbus aircraft. Let us assume there is a “normal”
positive maximum bank angle of φ max1 and a “non-normal” maximum bank angle of φ max2 with φ max2 > φ max1 . As
soon as φ max1 is approached the commanded roll rate is reduced from its value to zero. In case the stick input is
retained at its maximum value the roll rate controller is switched automatically to a bank angle tracking controller.
This controller then has protections against the maximum bank angel φ max2 . In case the stick input is returned to neu-
tral the bank angle controller commands φ max1 . Whenever the stick input generates commands in the opposite direc-
tion the bank angle controller is switched back to the roll rate controller.

stick unnormalize
pcom p-controller xi, zeta
input p-command

unnormalize phi- xi, nonlinear

xi,
phi-command com zeta switch
phi-controller zeta 6-DOF EOM
phi

lateral
beta, phi, r, p, ay
output

Fig. 2: Lateral Controllers

Fig. 2 shows the signal flow for the lateral controllers. Both lateral controllers are run in parallel again producing con-
trol commands for aileron and rudder. Switching is accomplished in a similar way as for the longitudinal controller.
T T T
Designating u p = ( ξ p, ζ p ) and u φ = ( ξ φ, ζ φ ) the actual actuator control u = ( ξ, ζ ) is computed from

u = ( u p – u φ )s φ + u φ (11)

with s φ a switching function again. Whenever s φ is one the p-controller is active, whenever it is zero the φ -control-
ler is active. Whenever the φ -controller is active the φ command is computed according to

φ com = ( φ max2 – φ max1 )u stick + φ max1

if…u stick ≥ 0…or
(12)
φ com = ( φ min1 – φ min2 )u stick + φ min1
if…u stick ≤ 0

where u stick ⊂ [ – 1, 1 ] . The inequalities for u stick are to be understood such that if u stick has been positive before it
is switched to zero the upper equation applies. Correspondingly, if u stick has been negative before beeing switched to
zero the lower equality applies.

IV The Individual Controllers

q- and α - controllers
The controllers are designed as a tracking controllers for either commanded pitchrate q com or angle of attack α com .
 K0

w xI u x z
∫ KI B ∫ CZ
− +
−
A

Fig. 3: Signal flow for tracking controller

The design model has states α, q , control η , tracking variable q , so w = q com , z = q . The state space model is

x· A 0 x B u+ 0 w,
· = –C 0 x + (13)
xI z I 0 I

with C z = 0 1 for the q-controller and C z = 1 0 for the α -controller. The control law is

x
u = –K KI K0 xI . (14)
w

The gains K, K I are determined using linear quadratic controller design. The gain K 0 is determined from

–1 –1 –1 –1
K 0 = – [ C ( I – A BK ) A B ] . (15)

M-controller
Speed protection is accomplished through a M-controller. Designating

∆M = M – M min
or (16)
∆M = M max – M

a pitch- or α -command is generated with a simple proportional controller

q com = s M K q ∆M (17)

where the switching function s M is zero whenever Machnumber is between the lower and upper bound and 1 other-
wise.
In parallel a corresponding α command is produced using the same formulas with a gain K α . The same formula is
used to produce a thrust command where the gain is K thrust . K q, K α, K thrust are found by trial and error.

p- and φ - controllers
These are generated using output feedback tracking. Instead of feeding back the state as in Fig. 3 output y is fed back
T T T
in the inner loop. The states are x = [ β, r, p, φ ] , the output is y = [ a y, β, φ, p, r ] . The input is u = [ ξ, ζ ] and
T T
the tracking variables are z = [ p, a y ] for the p-controller and z = [ φ, a y ] for the φ -controller.
Thus, the control laws are

y
u = –K KI (18)
yI

with y I = x I and

· T · T
x I = ( φ com – φ ) – a y or x I = ( p com – p ) – a y (19)

respectively. Having a y as tracking variable ensures coordinated turns for both controllers. K K I are computed
using the algorithm of [3].

V Nonlinear Simulations

longitudinal motion
In order to demonstrate the feasibility of the approach taken the nonlinear EOMs are trimmed and linearized at
V = 500 ft/s, h = 12000 ft. The various controllers are designed at this operating point as described above. An arbi-
trary input sequence for the longitudinal stick is taken, the corresponding q com and α com are derived from this stick
input. The flight envelope limits are taken to be

α min = – 2°, α max = 14°

M min = 0, 35, M max = 0, 6 . (20)
q max ⁄ min = ± 30 ( ° ⁄ s )

Fig. 4 shows the simulation results. After a few seconds into the flight max. angle of attack is reached and the α -con-
troller kicks in, first for maximum then for minimum angle of attack.At around 20s a long period with α max is seen in
which the Machnumber drops below its lower limit. At around 26s the q-controller takes over again and thrust is
increased to full thrust. Once the lower Machlimit is no longer active the α -controller commands α min until about
46s where the q-controller takes over again. Maximum Machnumber is exceeded at around 51s resulting in a pitch-up
command and a reduction of the throttle until about 60s. From then on the q-controller is active.
The control system is such that the “pilot” has full authority on pitchrate control and on power setting as long as there
are no protections needed. The commanded thrust in the lower figure correspondends to the trimmed thrust value.

lateral motion
With same operating point as for the longitudinal motion the protections for the simulation are

φ max1 = 50°, φ max2 = 60°, φ mini = – φ maxi

. (21)
p max = 60° ⁄ s = – p min

An arbitrary sequence of lateral stick inputs is chosen which again are converted to p com, φ com . The tracking com-
mand for lateral acceleration is zero. Controller design is accomplished as described above.
Fig. 5 shows the results. After about 5s the phi-controller becomnes active commanding φ max2 . Once the stick is
released to zero the phi-controller commands φ max1 . The same situation occurs in opposite direction after around
13s.

VI Conclusions
A simple control law architecture for envelope protection is presented and shown to work in some simulations. This
architecture allows to add additional controllers like for attitude or even altitude protections. The individual control
laws can easily be modified. For instance, an auto-throttle function for both the q- and α -controller can be realized
by simply adding additional states, outputs, and inputs to the LQR design prozess.
Acknowledgement
The author wishes to thank Dr. Brian L. Stevens from Georgia Tech for beeing so kind as to provide Fortran routines
containing the F-16 dynamics as well as various routines for trimming and linearization. In addition, the author is
grateful to Prof. Ulrich Butter from the University of Stuttgart for suggesting some improvements concerning the
controller design.

Dedication
This paper is dedicated to the memory of my beloved wife Diane of 35 years who died after a long illness on Septem-
ber 30, 2005. Most of the material in the paper has been produced while sitting at her bedside in various hospitals or
on long, lonely evenings at home while she was in the hospital.

References
[1] www.airbusdriver.net/airbus_fltlaws.htm
[2] Stevens, B.L., Lewis, F.L., Aircraft Control and Simulation, John Wiley&Sons, Inc., 1992.
[3] Moerder, D.J., Calise, A.J., Output Feedback Control Algorithm, IEEE Transactions on Automatic Control, Vol.
AC-30, No. 9, 1985.
 qcom vs q
40

20

-20

-40
0 10 20 30 40 50 60 70

alfcom vs alf
20

15

10

-5
0 10 20 30 40 50 60 70

M cs time
0.7

0.6

0.5

0.4

0.3
0 10 20 30 40 50 60 70

thrustcom vs thrust
1

0.8

0.6

0.4

0.2

0
0 10 20 30 40 50 60 70

Fig. 4: Nonlinear simulations for longitudinal motion

 pcom vs p
60

40

20

-20

-40

-60
0 5 10 15 20 25 30 35 40

phicom vs phi
100

50

-50

-100
0 5 10 15 20 25 30 35 40

Fig. 5: Nonlinear simulations for lateral motion

Fig. 6: Longitudinal controllers for a particular input sequence