David R. Gingras and Billy P. Barnhart 

Bihrle Applied Research, Inc., Hampton, Virginia 

Richard J. Ranaudo and Borja Martos

University of Tennessee Space Institute, Tullahoma, Tennessee

Thomas P. Ratvasky

Glenn Research Center, Cleveland, Ohio

Eugene Morelli 

Langley Research Center, Hampton, Virginia 

Development and Implementation of a ModelDriven Envelope Protection System for 

In-Flight Ice Contamination 

NASA/TM—2011-216960

October 2011

AIAA–2010–8141
NASA STI Program . . . in Profile

Since its founding, NASA has been dedicated to the 

advancement of aeronautics and space science. The 

NASA Scientific and Technical Information (STI) 

program plays a key part in helping NASA maintain 

this important role.

The NASA STI Program operates under the auspices 

of the Agency Chief Information Officer. It collects, 

organizes, provides for archiving, and disseminates 

NASA’s STI. The NASA STI program provides access 

to the NASA Aeronautics and Space Database and 

its public interface, the NASA Technical Reports 

Server, thus providing one of the largest collections 

of aeronautical and space science STI in the world. 

Results are published in both non-NASA channels 

and by NASA in the NASA STI Report Series, which 

includes the following report types:

• TECHNICAL PUBLICATION. Reports of 

completed research or a major significant phase 

of research that present the results of NASA 

programs and include extensive data or theoretical 

analysis. Includes compilations of significant 

scientific and technical data and information 

deemed to be of continuing reference value. 

NASA counterpart of peer-reviewed formal 

professional papers but has less stringent 

limitations on manuscript length and extent of 

graphic presentations.

• TECHNICAL MEMORANDUM. Scientific 

and technical findings that are preliminary or 

of specialized interest, e.g., quick release 

reports, working papers, and bibliographies that 

contain minimal annotation. Does not contain 

extensive analysis.

• CONTRACTOR REPORT. Scientific and 

technical findings by NASA-sponsored 

contractors and grantees.

• CONFERENCE PUBLICATION. Collected 

papers from scientific and technical 

conferences, symposia, seminars, or other 

meetings sponsored or cosponsored by NASA.

• SPECIAL PUBLICATION. Scientific, 

technical, or historical information from 

NASA programs, projects, and missions, often 

concerned with subjects having substantial 

public interest.

• TECHNICAL TRANSLATION. Englishlanguage translations of foreign scientific and 

technical material pertinent to NASA’s mission.

Specialized services also include creating custom 

thesauri, building customized databases, organizing 

and publishing research results.

For more information about the NASA STI 

program, see the following:

• Access the NASA STI program home page at 

http://www.sti.nasa.gov

• E-mail your question via the Internet to help@

sti.nasa.gov

• Fax your question to the NASA STI Help Desk 

at 443–757–5803

• Telephone the NASA STI Help Desk at

443–757–5802

• Write to:

 NASA Center for AeroSpace Information (CASI)

 7115 Standard Drive

 Hanover, MD 21076–1320
David R. Gingras and Billy P. Barnhart 

Bihrle Applied Research, Inc., Hampton, Virginia 

Richard J. Ranaudo and Borja Martos

University of Tennessee Space Institute, Tullahoma, Tennessee

Thomas P. Ratvasky

Glenn Research Center, Cleveland, Ohio

Eugene Morelli 

Langley Research Center, Hampton, Virginia 

Development and Implementation of a ModelDriven Envelope Protection System for 

In-Flight Ice Contamination 

NASA/TM—2011-216960

October 2011

AIAA–2010–8141

National Aeronautics and

Space Administration

Glenn Research Center

Cleveland, Ohio 44135

Prepared for the

Guidance, Navigation, and Control Conference

sponsored by the American Institute of Aeronautics and Astronautics

Toronto, Ontario, Canada, August 2–5, 2010
Acknowledgments

The authors would like to thank the NASA Aviation Safety Program’s Integrated Vehicle Health Management Project 

for their sponsorship of the effort reported herein.

Available from

NASA Center for Aerospace Information

7115 Standard Drive

Hanover, MD 21076–1320

National Technical Information Service

5301 Shawnee Road

Alexandria, VA 22312

Available electronically at http://www.sti.nasa.gov

Trade names and trademarks are used in this report for identification 

only. Their usage does not constitute an official endorsement, 

either expressed or implied, by the National Aeronautics and 

Space Administration.

Level of Review: This material has been technically reviewed by technical management. 
NASA/TM—2011-216960 1

Development and Implementation of a Model-Driven Envelope 

Protection System for In-Flight Ice Contamination

David R. Gingras and Billy P. Barnhart

Bihrle Applied Research, Inc.

Hampton, Virginia 23666 

Richard J. Ranaudo and Borja Martos

University of Tennessee Space Institute

Tullahoma, Tennessee 37388

Thomas P. Ratvasky

National Aeronautics and Space Administration

Glenn Research Center

Cleveland, Ohio 44135

Eugene Morelli 

National Aeronautics and Space Administration

Langley Research Center

Hampton, Virginia 23681–2199

Abstract

Fatal loss-of-control (LOC) accidents have been directly related to in-flight airframe icing. The 

prototype system presented in this paper directly addresses the need for real-time onboard envelope 

protection in icing conditions. The combinations of a-priori information and real-time aerodynamic 

estimations are shown to provide sufficient input for determining safe limits of the flight envelope during 

in-flight icing encounters. The Icing Contamination Envelope Protection (ICEPro) system has been 

designed and implemented to identify degradations in airplane performance and flying qualities resulting 

from ice contamination and provide safe flight-envelope cues to the pilot. Components of ICEPro are 

described and results from preliminary tests are presented.

Introduction

The University of Tennessee Space Institute (UTSI) in partnership with Bihrle Applied Research 

(BAR) has completed a 3-year cooperative research effort with NASA in response to the NASA Research 

Announcement (NRA) NNH06ZEA001N under Appendix B of the Aviation Safety Program. A prototype 

Icing Contamination Envelope Protection (ICEPro) system was developed to meet the objectives defined 

under the Integrated Vehicle Health Management (IVHM) Project, topic IVHM 3.1, Environmental 

Hazards, which are caused by the “Effects of Icing on Aircraft State”. This paper presents the results of 

this research, which focuses on the concept, design, development, implementation, and evaluation of the 

real-time vehicle state assessment system.

Background

Airframe icing continues to be a threat to aviation safety across the globe. Icing-induced loss of 

control incidents and accidents have occurred and continue to occur on all classes of aircraft—from 

general aviation airplanes (Ref. 1) and business jets (Ref. 2), to transport category aircraft (Refs. 3 to 8)

NASA recently published results from statistical analyses that examined trends of icing-related events 

over a 16-year period (1988 to 2003) (Ref. 9). The study showed that nearly 9-percent of all fatal 
NASA/TM—2011-216960 2

accidents from Part 121 and Scheduled Part 135 operations occurred while flying in icing conditions. 

During an icing encounter, flight characteristics can be severely degraded if hazardous ice formations 

accrete on wings and tail surfaces due to improper use of the ice protection systems (IPS), IPS failure, or 

encountering “exceedance conditions”. Exceedance conditions occur when an aircraft is exposed to icing 

conditions outside of the FAR 25 Appendix C criteria, for which the aircraft is certificated. This is often 

referred to as Super-cooled Large Droplet (SLD) icing conditions. Each of these situations has caused 

serious aircraft handling problems and resulted in stall and/or departure from controlled flight. 

One notable accident referenced above involved an ATR 72 that flew through SLD icing conditions 

near Roselawn, Indiana on October 31, 1994. Even with the IPS operating normally, the aircraft 

experienced a roll control anomaly that led to the loss of control and impact into the ground. This accident 

and others since then have led to numerous safety recommendations from the National Transportation 

Safety Board (NTSB) (Refs. 10 and 11) and the Commercial Aviation Safety Team (CAST) (Ref. 12) and 

motivated research activities within NASA and the FAA. One NASA sponsored activity called the Smart 

Icing Systems was led by the University of Illinois, Urbana-Champaign (UIUC). The Smart Icing 

Systems took a systems level approach to detecting icing conditions, operating ice protection systems and 

alerting the flight crew to the status of the aircraft (Ref. 13). 

This work laid the foundation to continue research to develop and improve real-time state assessment 

methods for vehicle health management with application to detecting and mitigating icing hazards. This 

effort was performed under a NRA with the UTSI and BAR, in collaboration with the NASA Glenn and 

NASA Langley Research Centers. The development of real-time state assessment methods and their use 

in providing flight and control limit information to the pilot through cues and messaging on his displays 

are an essential aspect of this research effort. 

The final developed Icing Contamination Envelope Protection (ICEPro) system was evaluated by a 

group of pilots to assess their performance using the provided cues and messages while performing a 

typical IFR approach and landing compared to a control group who did not have the cues.

Details of the design, implementation, and verification process of this unique system, as well as a 

synopsis of the piloted evaluations and conclusions are contained herein 

ICEPro Concept

The ICEPro concept is best summarized by the hypothesis posed by the development team during 

preliminary stages of the design process.

By the real-time processing of measured state and control information, estimates of stability and 

control can be used in conjunction with a knowledge base, comprised of a-priori data, to provide 

pilots with envelope-limiting cueing in order to avoid loss-of-control or adverse conditions resulting 

from in-flight icing.

The ICEPro system was designed and implemented to identify degradations in airplane performance 

and flying qualities resulting from ice contamination and to provide safe flight-envelope cues to the pilot.

This is accomplished by the real-time processing of measured state and control information to provide 

estimates of stability and control characteristics that are then used in conjunction with a knowledge base, 

comprised of a-priori data, to provide pilots with envelope-limiting cueing in order to avoid loss-ofcontrol or adverse conditions resulting from in-flight icing. 

The ICEPro concept relies on the actions of a proficient pilot responding to appropriate cueing and 

information on the primary and secondary displays in the cockpit. It is believed that, with these cues, the 

pilot can make informed decisions as to how the airplane is being flown. The ICEPro concept provides 

envelope protection by issuing advisories, cautions, and warnings in the form of airspeed limits, angle of 

attack limits, flap position limits, and control effectiveness status. The indications are intended to be 

consistent with typical advisories and warnings that appear on flight displays such that they are intuitive 

and effective. Figure 1 provides a graphic illustrating the cueing that is used in the system.
NASA/TM—2011-216960 3

Figure 1.—ICEPro envelope protection cues on the primary flight display (left) and flight control status page (right).

When the system does not detect any change from the nominal a priori airplane characteristics, no 

cuing or messages appear and the instruments display the nominal flight information. When the system 

senses icing contamination that exceeds the system thresholds and latching logic, cues and possibly 

messages appear in conjunction with the normal display information.

There are three types of information that are provided when an icing contamination is determined:

• Airspeed limit carets and angle of attack limit brackets.

– These are displayed whenever an ice contamination is determined by the ICEPro system.

• Status messages

– These will appear, both on the primary flight display and on the Flight Control Display 

(FCD) page in the message box. They indicate that there is a control and/or stability 

degradation in the indicated axis. There is also a message that appears whenever the singleengine climb capability is outside of safe limits. A flap limit message will also appear when 

the flaps should be retracted back to a safer deflection.

• Flight control status indicators

– The FCD page includes a rough diagram of the airplane showing its control surfaces. The 

surfaces are colored and the color will change whenever degradation is determined in their 

axis. With no degradation, the surfaces are green and turn amber when there is a caution 

displayed for that axis and red when there is a warning.

The ICEPro System has three modes of operation: a MONITOR mode that provides initial detection of 

in-flight icing, an ID mode that provides a diagnosis of the condition, and a REPORTING mode, providing 

the prognosis of the condition and mitigation through cueing. Figure 2 presents a simplified flow diagram of 

the system modes and states. Details, such as latching and de-latching logic and specific logic for driving 
NASA/TM—2011-216960 4

each of the caution/warning messages have been omitted to reduce the complexity of the diagram. Details of 

the system design can be found in a paper presented by D.R. Gingras at the 2009 Aerospace Sciences 

Conference in Orlando, Florida (Ref. 14). As indicated in the diagram the system is heavily dependent on 

input from two components: The Dynamic Inversion Control Evaluation System (D-ICES), an algorithm 

that provides predictions of clean and iced aircraft flight characteristics, and a real-time parameter 

identification routine. Results from these components are used to determine an Icing Severity Parameter 

(ISP) which is used in logic for issuing pilot cues and warnings during the reporting mode. 

Figure 2.—Simplified ICEPro system state diagram.

Yes

Yes

Yes

No

a priori aero 

derivatives

PID aero derivatives

Yes

No

Monitor Mode

IMODE = 0

Flight Data

D-ICES Data

(drag + controls)

DRAG OR

CONTROL

DEVIATION

IMODE = 1

Go to ID Mode

IMODE = 0

Stay in Monitor Mode

ID Mode

IMODE = 1 Start RTPID

Calculate ISP

ISP > 

Report

Threshold?

DRAG OR

CONTROL

DEVIATION

IMODE = 0

Go to Monitor Mode

IMODE = 1

ID Mode

IMODE = 2

Go to Report Mode

Report Mode Check individual Stab & IMODE = 2

Control values + ROC

Deviation > 

Threshold?

Update Display

Cautions /Warnings

Update ISP ISP >

Report

Threshold?

IMODE = 1

Go to ID Mode

No

No

Yes

No
NASA/TM—2011-216960 5

Flight Characteristic Predictions

Development

The flight characteristics predictions of the vehicle are made using a system hosted flight model, 

which for the development was that of a DeHavilland DHC-6 Twin Otter. This flight model was derived 

from a comprehensive nonlinear 6-degree-of-freedom simulation that was developed by Bihrle Applied 

Research and engineers at the NASA Glenn Research Center (Ref. 15). This model was based on data 

from extensive wind-tunnel tests using sub-scale models of the Twin-Otter and supplemented with flight 

data provided by NASA. This model covers the entire flight envelope including stall and post-stall flight 

regimes with and without icing effects resulting from ice accretion on the main wing, horizontal tail, and 

vertical tail. 

During previous efforts this model had undergone extensive validation against flight data to achieve 

high confidence predictions of aerodynamic characteristics in clean, no ice configuration, as well as the 

aerodynamic characteristics from an iced configuration representing an IPS failure situation. Figure 3 

contains a flow diagram of the process used during this effort to ensure accurate predictions of the 

aerodynamic coefficients. Figure 4 contains an example of the resulting comparisons with flight data of 

an elevator doublet for the clean airplane.

Flight Test Data

Aerodynamic

Model

2nd-Order

Numerical

Differentiation

Mass Properties Remove

Inertial Contribution &

Other External Forces/ 

Moments

Summation & 

Store Results

Overplot

Comparison

Identify Differences

&

Refine Database

α, β, Speed, Altitude, 

Angular Rates (P, Q, R) & 

Control Deflections Angular Rates 

(P, Q, R)

Flight-extracted

CNf, CA, CY &

Cl, Cm, Cn @ c.g.

Sim-predicted

CNf, CA, CY &

Cl, Cm, Cn @ c.g.

Angular

Acceleration

Linear 

Accelerations

(Nx, Ny, Nz)

Other External 

Forces/Moments

(Thrust/Thrust Vectoring)

Figure 3.—Process used for aerodynamic model validation.
NASA/TM—2011-216960 6

Figure 4.—Example of comparisons of the simulation 

model and flight aerodynamic coefficients. 

In the ICEPro system this model is driven using a process similar to that show in Figure 3. Instead of 

recorded flight data as the input, predictions of clean and ice contaminated aerodynamic characteristics 

are determined using real-time flight measured state and control surface data. 

Real-Time Model Estimates

Because the system compares model predictions described above with the current state, real time 

estimates are used. These estimates are computed by invoking real-time parameter identification 

(RTPID). The RTPID algorithm being employed was developed by Morelli (Ref. 16), and is based on a 

frequency domain approach implemented in version 2.0 of System IDentification Programs for AirCraft 

(SIDPAC) (Refs. 17 and 18).

The approach uses a linearized model of the vehicle dynamics, Equation (1), where A, B, C, and D are 

matrices containing stability and control derivatives.

( ) ( ) ( ) ( )

( ) ( ) ( )

0 o x t Ax t Bu t x x

y t Cx t Du t

=+ =

= +



(1)
NASA/TM—2011-216960 7

Time-varying estimates of the stability and control derivatives are determined using measured 

airplane control surface deflections and measured states from air data, angular rates, and attitude. Outputs 

are rotational and translational accelerations. To determine the estimates, a cost function is formulated in 

the frequency domain from the Fourier transform of the model in Equation (1),

( ) ( ) ( )

( ) ( ) ( )

j x Ax Bu

y Cx Du

ω ω= ω+ ω

ω= ω+ ω





(2)

The cost function is

( ) ( ) ( ) 2

1

1

2

m

k nk k k

n

J j x n axn bun

=

=ω − − ∑   for m frequencies (3)

where ak and bk are the kth row of matrices A and B, respectively, and xn x un u   k kn k kn ( ) ≡ω ≡ω ( ), ( ) ( ) .

Each line in Equation (2) can be analyzed separately in this way, which implements an equation-error 

formulation (Ref. 16). The least squares cost function in each case can be formulated as

( ) ( ) 1 †

2

J YX YX = −θ −θ (4)

where † indicates complex conjugate transpose, 

( )

( )

1 1 k

m k

j x

Y

j xm

  ω

 

=  

      ω







 

( ) ( )

( ) ( )

1 1 T T

T T

x u

X

xmum

 

 

=  

 

 

 

 

 

(5)

and the unknown parameters from A and B are contained in the parameter vector θ. The least squares 

parameter vector estimate is obtained as the value of θ that minimizes the cost function in Equation (4)

(Ref. 19).

( ) ( )

( ) ( )( ) ( )

( ) ( )

1 † †

1 2 †

† 2

ˆ Re Re

ˆ ˆˆ cov ˆ Re

1 ˆ ˆ ˆ

T

X X XY

E X X

YX YX

m

−

−

  θ =  

    θ ≡ θ−θ θ−θ =σ      

σ= − θ − θ

(6)

Performing the identification in the frequency domain is advantageous for this application because of 

computational efficiency, robustness to noise and data dropouts, and reliable confidence bounds from the 

covariance matrix. To ensure reliable estimates, the ICEPro features a self checking algorithm that 

examines the confidence bound of the parameter estimates. Table 1 lists the parameters that are being 

identified in real-time.

If confidence of the estimated parameters falls below acceptable levels due to lack of data information 

content, an automated excitation of the aircraft control surfaces is triggered to improve data information 

content. This interface with the subject vehicle is performed as though an autopilot is driving control 
NASA/TM—2011-216960 8

deflections using multi-frequency orthogonal inputs (Ref. 19). Amplitudes of the inputs are adjusted to 

provide excitation while minimizing vehicle motion.

TABLE 1.—AERODYNAMIC PARAMETERS IDENTIFIED BY RTPID

CNα CYδa Cl

p

CNδe CYδr Cl

r

CNq CYp Cnβ

Cmα CYr Cnδa

Cmδe Cl

β

Cnδr

Cmq Cl

δa Cnp

CYβ

Cl

δr Cnr

System Implementation

The ICEPro system was developed and deployed in Bihrle Applied Research’s D-Six PC-based 

simulation environment. All of the ICEPro functions, including the software for driving the flight displays 

are provided in a single computer that runs the software in real time. The system can be interfaced with

NASA’s Ice Contamination Effects Flight Training Device, ICEFTD (Fig. 5), or mounted in the NASA 

Twin Otter aircraft for flight demonstrations. The system includes all of the Data Acquisition and 

Executive functions which control the various modules that make up the system.

Figure 5.—NASA’s Ice Contamination Effects Flight Training Device (ICEFTD).
NASA/TM—2011-216960 9

The data acquisition portion receives data from the data bus on the airplane or from an emulation of 

the airplane data system if it is working with the simulator and not the airplane. It then makes the 

appropriate data available to the various other modules for processing and to the cockpit displays. The 

Executive portion provides all of the logic and calculation modules required to determine the icing state 

and what cues should be provided to the pilot.

The ICEPro system was first developed using a desktop simulation running in D-Six. The module 

development and all of the initial check out and tuning were all done in this manner. Once the system was 

mature enough to permit piloted evaluations it was migrated to the ICEFTD, which also used the D-Six 

environment. On the desktop implementation, the ICEPro modules and the Twin Otter simulation were 

run on the same computer. For the ICEFTD implementation, a separate computer was used for the ICEPro 

modules. Communication with the ICEFTD was accomplished over an Ethernet connection. This 

implementation was used to closely emulate the hoped for eventual implementation in the actual airplane.

If this were to occur, the same computer could be similarly connected to the airplane’s data acquisition 

system. Because both the desktop simulation and the ICEPro computer attached to the ICEFTD were 

running in the D-Six environment, migration from one to the other entailed simply copying the module 

files from one to the other.

The ICEFTD piloted simulations provided synthetic environment to assess and tune the final 

thresholds and latching logic for the cues and messages. They also afforded the opportunity to assess the 

effect of control surface excitation for the RTPID routine on the pilot.The piloted simulation was also 

instrumental in evaluating the appearance and validity of the caution/warning messages, and for 

development and evaluation of aural and tactile cues that were incorporated for the guest pilot evaluations 

that were subsequently performed following the development stage. They were also used to develop and 

evaluate the scenario to be used for the guest pilot evaluations.

Engineering Station

An engineering station was set up that enabled the operator to set key parameters of the ICEPro 

system, monitor the performance of the system, and interact with the implemented logic during the 

development and evaluation phases of the program. The engineering station consisted of a set of 

Graphical User Interfaces (GUIs) that were displayed on two monitors attached to the computer running 

the ICEPro routines.

The first window (Fig. 6) shows the status of the system. It shows in which mode the system is 

currently operating (Monitor, ID, or Report), whether the controls are being excited, the duration and 

magnitude of the excitations in each axis, as well as the time since reset of both the D-ICES and Real 

Time Parameter Identification (RT-PID) modules. There is also a window that displays system status 

messages and buttons to reset the system modules and settings.

The duration and magnitude of the surface excitations can be adjusted in this GUI and the excitation 

can be manually triggered when the system is in the ID or Report modes. It is also possible to manually 

reset either the D-ICES or RT-PID routines from this window.

There are a series of default thresholds, time delays, etc. that are used by the ICEPro logic modules 

that are preloaded with the system. All of the default values of these parameters can be overridden by 

inputting new values in an included text file. There are two buttons at the bottom of the GUI to either 

update these system settings from the text file, or to reset them to the default values.

The D-ICES status window (Fig. 7) shows the a priori model values of the longitudinal and lateraldirectional derivates for both the clean and fully iced airplanes at the current aircraft states. These 

linearized derivatives are extracted at the current state from the stored non-linear model data contained in 

the D-ICES routines. The set of derivatives presented are the same ones that are extracted by the RT-PID 

module.

There is also a similar window for the RT-PID system that shows the comparable real time PID 

determined derivatives (Fig. 8). Because the RT-PID system only runs in the ID and Report modes, the 

values will not be updated when the system is operating in the Monitor mode. The operator can readily 
NASA/TM—2011-216960 10

compare the values from the D-ICES and RT-PID status windows to evaluate the differences between the 

a priori clean or iced values, and the current actual values as determined by RT-PID. A set of plots of 

such a comparison is presented in Figure 9.

Figure 6.—System status window.

Figure 7.—D-ICES status window.
NASA/TM—2011-216960 11

Figure 8.—RT-PID status window.

Figure 9.—Comparison of RT-PID results with D-ICES predictions, with and without contamination.

Because the ICEPro system modules are running within a D-Six project, all of the normal D-Six 

interface tools are also available at the engineering station. As a result, any of the aircraft variables that 

are passed from the ICEFTD as the simulated airplane data bus are available to monitor in real time 

listings, on strip charts, or as post-run engineering plots. Pertinent ICEPro variables are placed in data 

matrices that are also passed as D-Six variables and are similarly available for real time monitoring and CmAlpha U Theil Coefficient

Time [s]

0 5 10 15 20 0

0.1

0.2

0.3

0.4

0.5

CmAlpha U Theil Coefficient

Time [s]

0 5 10 15 20 0

0.1

0.2

0.3

0.4

0.5

Time [s]

[/GHJ]

Clean Airplane

0 5 10 15 20 -2

-1.5

-1

-0.5

0

0.5

1

Expected CmAlpha

Predicted CmAlpha

Confidence Interval

Time [s]

Ice Contaminated Airplane

0 5 10 15 20 -2

-1.5

-1

-0.5

0

0.5

1

Expected CmAlpha

Predicted CmAlpha

Confidence Interval

CmAlpha

CmAlpha

[/GHJ]
NASA/TM—2011-216960 12

post-run analysis. At the end of the run, the time histories of these variables can be recorded for later 

analysis or for play back. The system also provides for strip charts of any of the RT-PID derivative values 

along with their expected values and the calculated error bands of the data.

For the piloted evaluations, the ICEFTD was enclosed within a black curtain that was provided to 

isolate the evaluation pilots form the rest of the room, thus providing a more realistic environment with 

no outside distractions. Consequently, the person manning the engineering station could not see the 

ICEFTD instrument panel. Therefore, a copy of the PFD that duplicated the information displayed to the 

pilot was provided for monitoring at the engineering station.

System Calibration

A considerable amount of effort was expended fine-tuning the system to develop a tool that would 

provide adequate warning and guidance when an icing condition was encountered but which would not 

have any false indications or nuisance messaging. The efforts to accomplish this evolved into three main 

areas: determining which terms to include in the ISP calculation, tuning thresholds and latching and delatching logic, and developing logic for when the RT-PID routine gets reset.

Icing Severity Parameter Determination

As shown in Equation (7), the ISP was formulated as the sum of the difference between the actual 

(RT-PID derived values) and expected (a priori clean) derivative values divided by the difference between 

the a priori clean and fully iced values for the selected derivatives. It was found to be impractical to use 

all of the RT-PID derived terms. The yawing moment terms did not change appreciably for the icing 

condition for this airplane, and did not prove useful to include. The damping terms, such as mq C and p Cl , 

which did show differences with icing, were the most difficult for RT-PID to obtain with great accuracy, 

and proved to adversely affect the robustness of the ISP calculation and so were not used.

( )

( )

expected actual

1 expected iced

Value Value

Value Value

n i

i i ISP

n

=

  −  

−   =

∑

(7)

The control terms, i.e., the δe and δa moment derivatives, were generally determined with great 

accuracy by the RT-PID routine, and showed icing effects very well. Consequently, they were used for 

the calculation. Elevator deflection did not strongly affect the normal force coefficient, and therefore this 

term was not used. The terms for longitudinal and lateral stability, mα C and lβ C were also used. The 

final terms that ended up being used, were:

mα C β Cl

m e C δ a Clδ

Nα C

Additional logic was also added to consider the relative predicted error in each term, in the form of 

_ value

_ error

RT PID

RT PID

−

− (8)

If the relative error for any term became larger than an experimentally determined threshold, the term 

was dropped from the ISP calculation. As a result, any term whose error represented a sufficiently large 

portion of its total value would not adversely influence the ISP calculation. As will be discussed further, 
NASA/TM—2011-216960 13

the relative error in the pitching moment due to elevator deflection derivative was such a critical value to 

the ISP calculation and one of the earliest indicators of building errors in the RT-PID results, that its 

relative error build up was used as one of the keys to forcing a reset of the RT-PID routine.

Thresholds and Latching 

For each change in mode of operation as well as messaging, there were thresholds that needed to be 

met before the change could occur or the message appear. There was also latching and delatching logic 

that specified that the condition had to be met for a specified period of time before it would appear and, 

conversely, the condition had to disappear for a period of time for it to be removed. These were 

incorporated so that the messages would not “flash” off and on if the conditions were right on the edge of 

meeting the requirements for display.

RT-PID Reset

As was mentioned earlier, it was found that it was necessary to force a reset of the RT-PID routine 

periodically for best operation. The RT-PID calculations make use of past values which works well if 

there is no change in the aircraft configuration or flight condition. However, when there are changes, the 

time histories of past values can incorrectly influence the calculations at the new configuration and/or 

flight condition. Consequently, a reset, which flushes the buffers and essentially restarts the calculations, 

is required whenever those conditions occur. In addition, evaluations of the system showed that better 

results would occur with periodic resets even when no significant changes occurred. For the evaluation 

phase, the system was set to do an RT-PID reset after 50 sec if one did not occur before then for either of 

the other two specified reasons. While control excitations were not directly commanded upon reset, they 

generally did occur shortly after the reset because the reset created the conditions that caused the system 

to command the excitations.

Conditions for Warning/Caution Messages

Messages that warned of deficiencies in a particular axis or of aircraft performance limitations were 

displayed on the PFD. The conditions under which these messages would appear, and whether they 

appeared as cautions (amber messages) or warnings (red messages) were based on the amount of 

degradation in certain aerodynamic parameters from the baseline clean airplane values. Whenever a 

caution or warning message is displayed, the corresponding primary control surface on the airplane 

representation on the FCD page is also colored appropriate to the message (amber for cautions and red for 

warnings). The caution or warning message is also repeated in the message section of the FCD page.

The initial trials of the ICEPro system considered stability and damping terms in each axis, as well as 

control effectiveness to determine when a caution or warning message should be displayed. In practice, it 

was found that the meaningful stability and damping thresholds were rarely attained and so these terms 

were dropped and only the control effectiveness terms were used. Consequently, the conditions that will 

generate a pitch, roll, or yaw degraded message are as shown below (because the control derivatives are 

all negative terms, the inequality signs may seem reversed):

Cmδe no⋅ice Cmδe Cmδe no⋅ice ⋅ ≤ < ⋅ _ 25 _ 0.50 0. , then amber PTCH DGRD and amber δe on FCD

Cmδe Cmδe no⋅ice ≤ ⋅ 25 _ 0. , then red PTCH DGRD and red δe on FCD

Cnδr no⋅ice Cnδr Cnδr no⋅ice ⋅ ≤ < ⋅ _ 25 _ 0.50 0. , then amber YAW DGRD and amber δr on FCD

Cnδr Cnδr no⋅ice ≤ ⋅ 25 _ 0. , then red YAW DGRD and red δr on FCD

Clδa no⋅ice Clδa Clδa no⋅ice ⋅ ≤ < ⋅ _ 25 _ 0.50 0. , then amber ROLL DGRD and amber δa on FCD

Clδa Clδa no⋅ice ≤ ⋅ 25 _ 0. , then red ROLL DGRD and red δa on FCD
NASA/TM—2011-216960 14

Calculations of single engine rate of climb capability were made using the simulation data and Twin 

Otter handbook values. Tables of these values as functions of flap deflection, ice condition, and altitude 

were stored in the ICEPro routines. Whenever the system was in the Reporting mode and the flight and 

icing condition resulted in predicted single engine rate of climb levels below specified thresholds, a climb 

limit caution or warning message would appear on the PFD and in the FCD message box. In addition, a 

corresponding flap limit message would appear and the flaps on the airplane representation presented on 

the FCD page would be colored either amber or red, corresponding to the caution/warning messages. This 

was meant to alert the pilot that the flap deflection should be reduced for safe operation in the event of an 

engine failure. The thresholds used during the evaluations were:

0 fpm < SingEngROC ≤ 100 fpm, then amber CLMB LIM and FLAP LIM

SingEngROC ≤ 0 fpm, then red CLMB LIM and FLAP LIM

Stall Warning and Decluttering

A stall warning was added to the system that consisted of a large red STALL message appearing near 

the middle of the PFD and an aural two-note tone. The aural warning would come on whenever the 

calculated stall angle of attack was attained, and the message would appear on the PFD when the angle of 

attack was 2° above the calculated stall angle. During the system development, it was found that during 

the low-speed highly dynamic environment present during a stall, RT-PID data extraction evidently had 

trouble keeping up with the rapid change in aerodynamic characteristics in that region and some 

extraneous warning/caution messages would appear, and then would go away after the airplane was 

stabilized. Rather than spend a significant time refining the thresholds and logic, it was decided, based on 

piloted evaluations during the development, that it was best to eliminate the messaging entirely during a 

stall and recovery to allow the pilot to concentrate on recovering the airplane without the distractions of 

any messages. Consequently, logic was incorporated to “declutter” the PFD by eliminating all ICEPro

related messaging during this period. The angle of attack bars and speed carets did remain on the PFD, 

because these would aid the pilot during the recovery effort. While these cues do depend somewhat on the 

RT-PID results as it affects the ISP, the ISP calculation is heavily filtered to yield a more or less steadystate level and should be only marginally influenced by the rapid changes during a stall and recovery.

Accommodations for Pilot Evaluations

In preparation for the piloted evaluations that took place during August 2009, several additions were 

added to the simulation. To represent to the pilot that he was operating an aircraft without icing 

protection, a message stating “IPS failure” was displayed in the FCD message box along with an aural cue 

to indicate that the icing protection system had failed.

A stick shaker and stick pusher function were added to the longitudinal yoke loader. These were 

configured to operate in a manner consistent with real-world shakers and pushers and would act as a 

forceful cue to the pilot that wing stall was about to, or had occurred. The shaker was sufficiently rapid 

and forceful that it could not be missed during the most intense flight condition. The pusher was forceful 

enough that it would force the airplane back to an un-stalled angle of attack. Monitoring when the shaker 

or pusher was activated also proved to be an important tool in interpreting and assessing the performance 

during post-flight analysis.

The shaker was configured to come on at the same time as the angle of attack bars turned from white 

to amber, which was 2° below the stall angle of attack. The stick pusher came on at approximately the 

same time that the stall message appeared on the PFD.

Conclusion

In keeping with the NASA goal to improve the safety of commercial and general aviation aircraft, an 

envelope protection system was developed using no direct ice detection devices. Through the use of 
NASA/TM—2011-216960 15

measured data, a priori information, and real-time stability and control estimates, this system computes an 

icing severity parameter. This parameter is used to trigger appropriate pilot cueing to warn the pilot of 

hazardous conditions and provide guidance for action to mitigate the situation. The main advantage of the 

system is that it uses data that are readily available in modern avionics systems and once adjusted to 

specific aircraft makes and models, and mated to modern display systems, should provide sufficient pilot 

cueing for envelope protection against icing related incidents.

The utility of the Icing Contamination Envelope Protection (ICEPro) system for mitigating a 

potentially hazardous icing condition was evaluated by 29 pilots using the ICEFTD. The pilots 

participating in this test were divided into two groups; a control group using baseline displays without 

ICEPro, and an experimental group using ICEPro driven display cueing. Each group flew identical 

precision approach and missed approach procedures with a simulated ice protection failure icing 

configuration. Pilot performance, workload, and survey questionnaires were collected for both groups of 

pilots. Results showed that real time assessment cues were effective in reducing the number of potentially 

hazardous upset events and in lessening exposure to loss of control following an incipient upset condition.

Pilot workload with the added ICEPro displays was not measurably affected, but pilot opinion surveys 

showed that real time cueing greatly improved their situation awareness of a hazardous aircraft state. A 

detailed discussion of these evaluations and results are presented in another paper presented at this 

conference (Ref. 19).

NASA/TM—2011-216960 17

Appendix.—Symbols List

A Stability matrix

ak k-th row of matrix A

B Control matrix

bk k-th row of matrix B

C Stability matrix

b Reference span

c Mean aerodynamic chord

Cl

β Rolling moment due to sideslip angle derivative, ∂Cl ∂β

Cl

δa Rolling moment due to aileron deflection derivative, ∂Cl ∂δa

Cl

δr Rolling moment due to rudder deflection derivative, ∂Cl ∂δr

Cl

p Rolling moment due to non-dimensional roll rate derivative, C (pb V ) ∂ l ∂ 2

Cl

r Rolling moment due to non-dimensional yaw rate derivative, C (rb V ) ∂ l ∂ 2

Cmα Pitching moment due to angle of attack derivative, ∂Cm ∂α

Cmδe Pitching moment due to elevator deflection derivative, ∂Cm ∂δe

Cmq Pitching moment due to non-dimensional pitch rate derivative, ∂Cm ∂(qc 2V )

CNα Normal force due to angle of attack derivative, ∂CN ∂α

CNδe Normal force due to elevator deflection derivative, ∂CN ∂δe

CNq

Normal force due to non-dimensional pitch rate derivative, ∂CN ∂(qc 2V )

Cnβ Yawing moment due to sideslip angle derivative, ∂Cn ∂β

Cnδa Yawing moment due to aileron deflection derivative, ∂Cn ∂δa

Cnδr Yawing moment due to rudder deflection derivative, ∂Cn ∂δr

Cnp Yawing moment due to non-dimensional roll rate derivative, C (pb V ) ∂ n ∂ 2

Cnr Yawing moment due to non-dimensional yaw rate derivative, C (rb V ) ∂ n ∂ 2

CYβ Side force due to sideslip angle derivative, ∂CY ∂β

CYδa Side force due to aileron deflection derivative, ∂CY ∂δa

CYδr Side force due to rudder deflection derivative, ∂CY ∂δr

CYp

Side force due to non-dimensional roll rate derivative, ∂CY ∂(pb 2V )

CYr Side force due to non-dimensional yaw rate derivative, ∂CY ∂(rb 2V )

D Control matrix

FCD Flight Control Display

IPS Ice Protection System
NASA/TM—2011-216960 18

ISP Icing Severity Parameter

J Cost function

LSE Least-squared error

PFD Primary Flight Display

RMS Root-mean square

SLD Super-cooled Large Droplet

t Time

U Theil Coefficient

u Control vector

u

 Control vector predicted from inversion routine

uk

~ Control 

V True velocity, ft/s

y, yˆ Measured and predicted output

x State vector

x0 State vector initial condition

xk

~ State

θ Parameter vector

θ

ˆ Estimated parameter

σˆ Confidence bound

ω Frequency, rad/s
NASA/TM—2011-216960 19

References

1. National Transportation Safety Board, Factual Report on Cessna CE–208 Caravan Accident on Oct. 

21, 2001 at Dillingham, AK, NTSB ID DCA02MA003. 

2. National Transportation Safety Board, Crash During Approach to Landing, Circuit City Stores, Inc., 

Cessna Citation 560, N500AT, Pueblo, CO, Feb. 16, 2005, Aircraft Accident Report NTSB/AAR–

07/02. Washington, D.C., Jan. 2007.

3. National Transportation Safety Board, In-Flight Icing Encounter and Loss of Control, Simmons 

Airlines, D.B.A. American Eagle Flight 4184 Avions De Transport Regional (ATR) Model 72–212, 

N401am, Roselawn, IN, Oct. 31,1994, NTSB Aircraft Accident Report, NTSB/AAR–96/01, 

Washington, D.C., Jul. 1996.

4. National Transportation Safety Board, In-Flight Icing Encounter And Uncontrolled Collision With 

Terrain; Comair Flight 3272; Embraer Emb–120rt, N265ca; Monroe, MI, Jan. 9, 1997, NTSB Aircraft 

Accident Report, NTSB/AAR–98/04, Washington D.C., Nov. 1998. 

5. Transportation Safety Board of Canada, Loss of Control on Go-around (Rejected Landing), Air 

Canada Canadair CL–600–2B19 C–FSKI, Fredericton Airport, New Brunswick, Report Number 

A97H0011, Dec. 1997.

6. Aviation Safety Council, GE791 Occurrence Investigation Report, In-Flight Icing Encounter and 

Crash into the Sea Transasia Airways Flight 791, ATR72-200, B-22708, 17 Kilometers Southwest of 

Makung City, Penghu Islands, Taiwan, Dec. 21, 2002, ASC–AOR–05–04–001, Taipei, Taiwan.

7. Inflight Loss of Control due to Airframe Icing Saab 340B, VH–OLM, 28 Jun. 2002, Australian 

Transport Safety Bureau Air Safety Investigation BO/2002030704, Dec. 2003.

8. “Roll Oscillations on Landing, Air Canada, Airbus 321–211, C–GJVX and C–CIUF, Toronto/Lester 

B. Pearson International Airport, Ontario, 07 December 2002,” Transportation Safety Board of 

Canada Aviation Investigation Report A02O0406.

9. Jones, S.M., Reveley, M.S., Evans, J.K., and Barrientos, F.A., “Subsonic Aircraft Safety Icing 

Study,” NASA/TM—2008-215107, Jan. 2008.

10. National Transportation Safety Board, Safety Recommendation to Mitigate the Existing Risk to the 

Cessna 208 Fleet During the Current Icing Season. A–06–01 through –03, Jan. 17, 2006.

11. National Transportation Safety Board, Safety Recommendation to Mitigate the Existing Risk to the 

Saab 340 Fleet When Operating in Icing Conditions. A–06–48/51, Jul. 10, 2006.

12. Russell, P., and Pardee, J., “Joint Safety Analysis Team-CAST Approved Final Report Loss of 

Control JSAT Results and Analysis,” Dec. 2000. 

13. Bragg, M.B., Basar, T., Perkins, W.R., Selig, M.S., Voulgaris, P.G., Melody, J.W., Sarter, N.B., 

Smart Icing Systems for Aircraft Icing Safety, AIAA–2002–0813, Jan. 2002.

14. Gingras, D.R, Barnhart, B., Ranaudo, R., Ratvasky, T., and Morelli E., “Envelope Protection for InFlight Ice Contamination,” NASA/TM—2010-216072, AIAA–2009–1458, Jan. 2009. 

15. Barnhart B.P, Dickes, E, Gingras D.R., and Ratvasky, T.P., “Simulation Model Development for 

Icing Effects Flight Training,” NASA/TM—2003-212115, SAE 2002–01–1527, Apr. 2003.

16. Morelli, E.A., “Real-Time Parameter Estimation in the Frequency Domain,” Journal of Guidance, 

Control, and Dynamics, Vol. 23, No. 5, Sep.-Oct. 2000, pp. 812–818.

17. Morelli, E.A., “System IDentification Programs for AirCraft (SIDPAC),” AIAA–2002–4704.

18. Klein, V and Morelli, E.A., Aircraft System Identification Theory and Practice, American Institute for 

Aeronautics and Astronautics Inc., Reston, VA, 2006. 

19. Ranaudo, R., Martos, B., Norton, B., Gingras, D., Barnhart, B., Ratvasky, T., and Morelli, E., 

“Piloted Simulation to Evaluate the Utility of a Real Time Envelope System for Mitigating In-Flight 

Icing Hazards,” AIAA–2010–7987, Aug. 2010. NASA/TM—2011-216951. 
REPORT DOCUMENTATION PAGE Form Approved 

OMB No. 0704-0188 

The public reporting burden for this collection of information is estimated to average 1 hour per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the 

data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this 

burden, to Department of Defense, Washington Headquarters Services, Directorate for Information Operations and Reports (0704-0188), 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA 22202-4302. 

Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB 

control number. 

PLEASE DO NOT RETURN YOUR FORM TO THE ABOVE ADDRESS. 

1. REPORT DATE (DD-MM-YYYY)

01-10-2011 

2. REPORT TYPE

Technical Memorandum 

3. DATES COVERED (From - To)

4. TITLE AND SUBTITLE

Development and Implementation of a Model-Driven Envelope Protection System for InFlight Ice Contamination 

5a. CONTRACT NUMBER

5b. GRANT NUMBER

5c. PROGRAM ELEMENT NUMBER

6. AUTHOR(S)

Gingras, David, R.; Barnhart, Billy, P.; Ranaudo, Richard, J.; Martos, Borja; Ratvasky, 

Thomas, P.; Morelli, Eugene 

5d. PROJECT NUMBER

5e. TASK NUMBER

5f. WORK UNIT NUMBER

WBS 645846.02.07.11.02 

7. PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES)

National Aeronautics and Space Administration 

John H. Glenn Research Center at Lewis Field 

Cleveland, Ohio 44135-3191 

8. PERFORMING ORGANIZATION

 REPORT NUMBER

E-17565 

9. SPONSORING/MONITORING AGENCY NAME(S) AND ADDRESS(ES)

National Aeronautics and Space Administration 

Washington, DC 20546-0001 

10. SPONSORING/MONITOR'S

 ACRONYM(S)

NASA 

11. SPONSORING/MONITORING

 REPORT NUMBER

NASA/TM-2011-216960 

12. DISTRIBUTION/AVAILABILITY STATEMENT

Unclassified-Unlimited 

Subject Categories: 05 and 08 

Available electronically at http://www.sti.nasa.gov 

This publication is available from the NASA Center for AeroSpace Information, 443-757-5802

13. SUPPLEMENTARY NOTES

14. ABSTRACT

Fatal loss-of-control (LOC) accidents have been directly related to in-flight airframe icing. The prototype system presented in this paper 

directly addresses the need for real-time onboard envelope protection in icing conditions. The combinations of a-priori information and realtime aerodynamic estimations are shown to provide sufficient input for determining safe limits of the flight envelope during in-flight icing 

encounters. The Icing Contamination Envelope Protection (ICEPro) system has been designed and implemented to identify degradations in 

airplane performance and flying qualities resulting from ice contamination and provide safe flight-envelope cues to the pilot. Components of 

ICEPro are described and results from preliminary tests are presented.

15. SUBJECT TERMS

Aircraft icing; Flight safety; Flight simulation training; Ice protection system; Parameter identification 

16. SECURITY CLASSIFICATION OF: 17. LIMITATION OF

 ABSTRACT

UU 

18. NUMBER

 OF 

 PAGES

25 

19a. NAME OF RESPONSIBLE PERSON

STI Help Desk (email:help@sti.nasa.gov) 

a. REPORT

U 

b. ABSTRACT

U 

c. THIS 

PAGE

U 

19b. TELEPHONE NUMBER (include area code)

443-757-5802 

Standard Form 298 (Rev. 8-98)

Prescribed by ANSI Std. Z39-18