The Flight Envelope Function

Of the FMGEC's four residents (article 01), FG and the A/THR have had their articles (05–17). This is the third: FE — Flight Envelope. It guides nothing and pushes no thrust; it is the system's medical department and boundary sentry — computing the characteristic speeds, keeping a backup set of weight-and-balance books, watching the aft CG, detecting windshear, and acquiring and monitoring nearly every sensor the FM and FG consume. Per FCOM DSC-22_40:

The Flight Envelope (FE) part of the FMGES performs the following functions : ‐ Acquisition and monitoring of parameters used by FE and FG parts ‐ Characteristic speeds computation ‐ Back-up weight and CG computation ‐ Aft CG monitoring ‐ Windshear detection.

1. The system's data front desk

Per FCOM DSC-22_40:

Acquisition and monitoring of buses common to FM, FG or FE are performed by the FE. Only ARINC buses specific to the FM part are acquired by the FM itself. Dialogue between FM, FG and FE is achieved through common memories.

FE is the front desk: shared buses all pass through it, the FM self-acquires only its private lines (VOR, datalink…), and the three parts converse through common memory. The AMM's architecture detail (per AMM 22-60, attributed summary): FE itself runs command/monitoring dual channels (article 01's dual-dual continued inside FE); two common RAM blocks exist (FE–FG and FG–FM), the monitoring channel holding only FE–FG (FM lives on the command side); and the two channels' sensor acquisition is deliberately asymmetric — IR: three units on command, two on monitoring; ADR: two on command, three on monitoring — the two channels see slightly different worlds, which is what makes their comparison meaningful.

Monitoring works three moves (per AMM 22-61 throughout): decode each label's sign/status matrix; compare parameters pairwise; and reconfigure — switch sources — around failed peripherals. Each parameter's acquisition verdict is a boolean confirmed only after several computation cycles (transients don't convict), and when a parameter stream stops, the control laws ride on the last value.

2. Sensor management — voting, passivating, and overriding the pilot

The essentials of AMM 22-61 (attributed summary, figures as printed):

• Three-tier IR processing: fast parameters (accelerations, rates) are passivated, medium ones (attitudes) voted, slow ones (speeds) switched. The passivator is a voter biased toward its first input: OWN is preferred; the other two sources (3 and OPP) define a tolerance band, and OWN is passivated the moment it strays outside.
• The latching rule: failures a sensor confesses itself (via SSM) are not latched — repent and return. Failures found only by pairwise comparison are latched for as long as an AP is engaged: a liar its own self-test cannot catch is never trusted again that flight.
• Reconfiguration and its price: losing IR/ADR OWN or 3 forces a switch to a valid source regardless of the crew's switching-panel selection, and triggers a landing-capability downgrade (article 12's ADR/IR table rows, mechanised). Losing two IR or two ADR costs the FG function — AP/FD disengage (article 05's common condition) — while FE itself may fight on.
• LGCIU and SFCC as mutual configuration backups: both LGCIUs dead, the system infers gear from the flap computers — clean means gear up, slats/flaps out means gear down; both SFCCs dead, it infers configuration from the gear — gear up means clean, gear down means full flaps.
• Assorted verdicts: FCPC source priority OWN→3→OPP; a single bad FCMC label switches to the opposite FCMC whatever its state; ILS validity = LOC and GLIDE deviation labels valid plus runway/frequency coherent; RA validity = height label delivered NO-status — with deviations and radio height both rate-limited to blunt transients.

The counter-intuition to teach: ADIRS switching set to CAPT ON 3 is a suggestion. When FE judges a source bad it overrides the manual selection (per AMM 22-62, the ADR feeding the characteristic-speed display "overrides pilot switching"). The pilot selects a preference; FE rules on fact.

3. Characteristic speeds — the author of every mark on the speed tape

Per FCOM DSC-22_40:

FE part computes the characteristic speeds and sends them to : ‐ The FG which uses them as limits for guidance modes. ‐ The EFIS for display on the PFD speed scale.

Two destinations: the FG's mode fences (every VLS/VMAX number in articles 10 and 17 is born here) and the PFD tape. The nine-speed system (per AMM 22-62, attributed summary): VLS = f(VS1g) — 1.13 × VS1g at takeoff with flaps, 1.18 in CONF 1 slats-only, 1.23 for landing; clean VLS is the greater of 1.23 × VS1g and the 0.3 g buffet-margin speed, floored by VMC at low weight — VS1g itself supplied by the FCPCs (ATA-27 interface). V3/V4 — the F and S symbols (V3 = K1 × √GW; V4 = 1.21 × VS1g, with approach-phase reductions and caps). Green dot (VMAN) = f(GW, altitude), available only airborne (strut extended) and clean. VMAX = the current one of VMO/VLE/VFE (the red barber strip). VMAX OP = clean VMAX − 5 — never displayed, a pure FG internal fence (the birthplace of article 17's "VMAX−5"s). VFE NEXT — computed from the lever position, not the surfaces, drawn (two amber ticks) only below 20 650 ft and not in CONF FULL. The speed-trend arrow — displayed above 30 kt, pointing at the speed 10 s ahead.

The display chain: FMGEC 1 feeds the captain's PFD, FMGEC 2 the first officer's (via the DMCs), each checked by a label status matrix and the FE HLTY hardwire — one bad and the DMC switches sides. A first ADR failure changes nothing visible; a second leaves only the associated side — unless the survivor is ADR 3, which feeds both. Validity exhausted, or both FEs dead: the SPD LIM flag rises at the bottom of the tape. Which underwrites the counter-intuition: airspeed is the ADR's, but every protection mark on the tape is FE's — with both FMGECs lost you keep the airspeed and lose VLS, green dot, F, S, with the SPD LIM flag flying (article 29's display symptom, planted early).

4. Weight and CG — the backup bookkeeper

Per FCOM DSC-22_40:

The FMGC uses the weight and center of gravity from the FCMC (Fuel Computer) when available. The GW and CG, computed by the FE part, are used : ‐ As backup, in case of a dual FCMC failure. ‐ To trigger the aft CG caution and warning signals (independently of the FCMC).

The fuel computers keep the official books; FE keeps a second set — for the day both FCMCs fail, and to police the aft CG independently of the thing it polices. The two-regime arithmetic:

‐ When the aircraft is below 14 625 ft, and 255 kt : GW = f(α, CAS, N1/EPR actual, CG from FE part, altitude) ‐ When the aircraft is above 14 625 ft, or 255 kt : GW = TOGW – WFU

Low and slow: weigh the aircraft aerodynamically — invert the lift equation from angle of attack, airspeed and thrust. High or fast: accountancy — takeoff weight minus the FADECs' accumulated fuel used. And the CG:

The CG is computed from the position of the horizontal stabilizer, and is function of the N1/EPR, Vc, ALT, MACH and GW from FE part.

The trim angle betrays the balance — no fuel-distribution data touched. Two AMM additions (per AMM 22-62): the TOGW is initialised by the FM at takeoff and lives in the FM's battery-backed memory (article 01's power tiers); and in approach mode the selected weight/CG are frozen into memory — an FCMC or FE failure during the autoland cannot step the landing computation's weight (article 12's latch philosophy, kin).

5. Aft CG monitoring — a two-stage sentry

Per FCOM DSC-22_40:

If the CG > CG limit -1 %, an aft CG caution signal is sent to the FCMCs. The target CG is then shifted forward by 1.5 % (only one time). If the CG becomes higher than the CG limit, the aft CG warning signal is sent to the FWCs, which trigger a red warning. Note: AFT CG monitoring is available above 20 000 ft, if the aircraft is in clean configuration with the speedbrakes retracted.

Stage one is diplomacy: one percent short of the limit, FE whispers to the fuel computers and the trim-tank target CG shifts 1.5 % forward — once. Stage two is the red warning to the FWCs. The teaching point: the caution stage is essentially invisible to the crew — it is FE-to-FCMC back-channel traffic (fuel quietly moving forward). By the time you see red on the ECAM, the gentle remedy has already been spent. (Source note: the AMM prints the availability altitude as 20 652 ft — and 20 650 ft at VFE NEXT — where the FCOM uses the round 20 000 ft; this series teaches the FCOM figure.)

6. Windshear detection — the reactive energy sentry

Per FCOM DSC-22_40:

A windshear detection signal is generated whenever the aircraft encounters a windshear and the predicted energy level falls below a predetermined safe minimum energy threshold (reactive windshear detection). Note: The energy threshold is expressed as an angle of attack threshold αo. The aircraft predicted energy level is α + Δα where: ‐ α is the current angle of attack ‐ Δα is the equivalent AOA computed from measured vertical drafts and longitudinal shears. If α + Δα > αo the windshear conditions are detected.

Reactive — it measures what the air is already doing to you (the predictive cousin is the weather radar's PWS, ATA-34): drafts and shears are converted into an equivalent angle-of-attack increment, and when current α plus that increment crosses the threshold, the energy is judged about to fail. The window and the shout:

The windshear detection function is provided in takeoff and approach phase under the following conditions: ‐ At takeoff, 3 s after liftoff, up to 1 300 ft RA ‐ At landing from 1 300 ft RA to 50 ft RA ‐ With at least CONF 1 selected. The warning consists of: ‐ A visual 'WINDSHEAR' red message displayed on both PFDs for a minimum of 15 s. ‐ An aural synthetic voice announcing 'WINDSHEAR' three times.

At least CONF 1 — clean-configuration turbulence in cruise is not windshear's business. AMM additions (per AMM 22-62): the detection runs in the FE command channel only; sensor losses or clean configuration inhibit it and raise WINDSHEAR DET FAULT — the sentry announcing it has left its post, not a shear encounter; and after the warning, a manual TOGA buys SRS-law guidance (the SRS family's third appearance — article 07, article 14). (Source note: the AMM's takeoff window reads "within 30 s of takeoff, below 250 ft", inconsistent with the FCOM's 3 s-to-1300 ft; this series teaches the FCOM text, the AMM passage likely reflecting an older standard.)

7. The alpha-floor letter box — and the beta target

AMM 22-62 settles a question article 17 left open (attributed summary): alpha floor is detected by the FCPCs — the fly-by-wire computers that own angle-of-attack protection (ATA-27). FE's role is the letter box: it relays the FCPC condition to the FG, where at least one of the three FCPCs reporting the condition triggers the A/THR's TOGA, with the FG's command/monitor comparison providing the oversight. Detection in flight controls, execution in autothrust, FE carrying the mail.

Same section, the lateral errand: FE compares left and right thrust to generate the engine-asymmetry boolean (consolidated as "at least one engine not running"), feeding the FCPCs for the beta target — the blue sideslip index on the PFD and the lateral control law's target. That blue bean you step on the rudder for during a single-engine takeoff: its data chain starts in FE.

8. Operations

Abnormal V Alpha Prot (the protection speed itself misbehaving — typically the black-and-amber strip's top climbing above green dot in high-altitude level flight). Per a representative operator QRH:

If V Alpha Prot (top of the black and amber strip) exceeds Green Dot speed during stabilized flight path (level flight or stabilized climb) with steady heading. V ALPHA PROT ..................................................................................... MONITOR Abnormal V Alpha Prot does not cause unreliable speed indications. … During stabilized flight path with steady heading, if margin between V Alpha Prot and current airspeed decreases below 15kt: ALTITUDE.........................................................................DO NOT INCREASE MACH............................................................................... DO NOT INCREASE

Step one is only MONITOR — and note the clarification: this is not an unreliable-speed case, the airspeed itself is good. Margin below 15 kt: stop climbing, stop accelerating in Mach — deny the alpha protection its excuse to intervene (article 31 continues).

Windshear warning response, chained: red WINDSHEAR + triple shout → TOGA (full detent — article 14's ignition; SRS guidance follows), configuration untouched, fly the SRS — and recall LVR CLB stays silent in shear (article 17's exemption closing the loop). Dual FCMC failure: the ECAM fuel procedure leads (ATA-28); the ATA-22 meaning is that weight/CG silently switch to FE's backup books — FM predictions coarsen (article 25) while the aft-CG protection stays independently on watch.

[!warning]- Four misconceptions this article corrects (1) The ADIRS switching panel does not have the last word — FE overrides pilot source selection when it judges a source invalid; you choose preference, FE rules fact. (2) The speed tape's protection marks are not the ADR's — lose both FMGECs and airspeed remains while VLS/green dot/F/S vanish under a SPD LIM flag. (3) The aft-CG red warning is not the first line of defence — a silent caution already moved the trim-tank target 1.5 % forward once; red means diplomacy is spent. (4) WINDSHEAR DET FAULT does not mean windshear — it means the reactive sentry is off duty (sensor loss or clean configuration).

Self-test

[!note]- Q1. FE's five duties — and who acquires the shared buses? How do the three parts talk?

Parameter acquisition and monitoring for FE/FG; characteristic speeds; backup weight and CG; aft-CG monitoring; windshear detection. FE acquires all shared buses (FM self-acquires only its private ones); the parts converse through common memories.

[!note]- Q2. The three-tier IR processing — which parameters get which treatment, and whom does the passivator favour?

Fast (accelerations/rates): passivated. Medium (attitudes): voted. Slow (speeds): switched. The passivator favours its first input — OWN — passivating it only when it leaves the band defined by sources 3 and OPP.

[!note]- Q3. Which failures stay latched until the AP disengages?

Those detected only by pairwise comparison — a fault the sensor's own self-test missed. SSM-confessed faults are not latched and may return when healthy.

[!note]- Q4. Both LGCIUs fail — how does the system know whether the gear is down?

It infers from the flap computers: clean configuration → gear up; slats/flaps extended → gear down. (Both SFCCs failed, the inference runs the other way.)

[!note]- Q5. The three VS1g factors behind VLS — and what does clean VLS also have to beat?

1.13 (takeoff with flaps), 1.18 (CONF 1 slats only), 1.23 (landing). Clean VLS is the greater of 1.23 × VS1g and the 0.3 g buffet-margin speed, with a VMC floor at low weight.

[!note]- Q6. Is VMAX OP shown on the PFD — and what is it for?

Never displayed. It is clean VMAX − 5 kt, a pure internal FG fence — the source of the "VMAX−5" limits in the guidance and autothrust chapters.

[!note]- Q7. FE's two weight-computation regimes and their boundary — and which surface betrays the CG?

Below 14 625 ft and 255 kt: aerodynamic weighing from α, CAS, actual thrust, FE CG and altitude. Above either: TOGW minus fuel used. The CG comes from the horizontal-stabiliser position.

[!note]- Q8. The aft-CG two-stage response — who is told at each stage, and is stage one visible?

Stage one (limit −1 %): caution to the FCMCs, trim-tank target CG shifted 1.5 % forward, once — essentially invisible to the crew. Stage two (limit exceeded): warning to the FWCs — red ECAM warning. Available above 20 000 ft, clean, speedbrakes retracted.

[!note]- Q9. The reactive-windshear formula and the three window conditions — and the warning's form?

Detection when α + Δα > αo, Δα being the equivalent AOA from measured drafts and shears. Windows: takeoff from 3 s after liftoff to 1300 ft RA; landing 1300 ft to 50 ft RA; at least CONF 1. Warning: red WINDSHEAR on both PFDs at least 15 s, plus the synthetic voice three times.

[!note]- Q10. Who detects alpha floor, what is FE's role — and the QRH's margin red line for abnormal V Alpha Prot?

The FCPCs detect it (flight-controls AOA protection); FE is the letter box relaying it to the FG, where the A/THR executes TOGA. The QRH line: margin below 15 kt → do not increase altitude, do not increase Mach.

Key takeaways

References

FE functions, acquisition split, characteristic-speed destinations, backup GW/CG computation, aft-CG two-stage logic and windshear detection per FCOM DSC-22_40 (all sections). Channel architecture, monitoring methods, sensor processing and latching, reconfiguration and override behaviour, configuration inference, the nine-speed computation set, display-chain reconfiguration, approach freezing, the alpha-floor letter box and the beta-target chain per AMM 22-60/22-61/22-62 (attributed summaries of the description-and-operation text; figures as printed). Abnormal V Alpha Prot per a representative operator QRH. Source notes: the AMM's aft-CG altitude (20 652 ft) and takeoff windshear window (30 s/250 ft) differ from the FCOM's figures — this series teaches the FCOM values. Maintenance-layer detail (label lists, BITE) is intentionally excluded.

Independent study material, not an Airbus publication and not endorsed by the manufacturer. Always defer to the current operator FCOM, FCTM, and QRH for operational use.