Jonathan S. Litt

Glenn Research Center, Cleveland, Ohio

Yuan Liu

N&R Engineering and Management Services, Parma Heights, Ohio

Thomas S. Sowers

Vantage Partners, LLC, Cleveland, Ohio

A. Karl Owen

Consultant, North Royalton, Ohio

Ten-Huei Guo

Glenn Research Center, Cleveland, Ohio

Piloted Simulation Evaluation of a Model-Predictive 

Automatic Recovery System to Prevent Vehicle Loss 

of Control on Approach

NASA/TM—2014-216644

March 2014

AIAA–2014–0036
NASA STI Program . . . in Profi le

Since its founding, NASA has been dedicated to the 

advancement of aeronautics and space science. The 

NASA Scientifi c and Technical Information (STI) 

program plays a key part in helping NASA maintain 

this important role.

The NASA STI Program operates under the auspices 

of the Agency Chief Information Offi cer. It collects, 

organizes, provides for archiving, and disseminates 

NASA’s STI. The NASA STI program provides access 

to the NASA Aeronautics and Space Database and 

its public interface, the NASA Technical Reports 

Server, thus providing one of the largest collections 

of aeronautical and space science STI in the world. 

Results are published in both non-NASA channels 

and by NASA in the NASA STI Report Series, which 

includes the following report types:

• TECHNICAL PUBLICATION. Reports of 

completed research or a major signifi cant phase 

of research that present the results of NASA 

programs and include extensive data or theoretical 

analysis. Includes compilations of signifi cant 

scientifi c and technical data and information 

deemed to be of continuing reference value. 

NASA counterpart of peer-reviewed formal 

professional papers but has less stringent 

limitations on manuscript length and extent of 

graphic presentations.

• TECHNICAL MEMORANDUM. Scientifi c 

and technical fi ndings that are preliminary or 

of specialized interest, e.g., quick release 

reports, working papers, and bibliographies that 

contain minimal annotation. Does not contain 

extensive analysis.

• CONTRACTOR REPORT. Scientifi c and 

technical fi ndings by NASA-sponsored 

contractors and grantees.

• CONFERENCE PUBLICATION. Collected 

papers from scientifi c and technical 

conferences, symposia, seminars, or other 

meetings sponsored or cosponsored by NASA.

• SPECIAL PUBLICATION. Scientifi c, 

technical, or historical information from 

NASA programs, projects, and missions, often 

concerned with subjects having substantial 

public interest.

• TECHNICAL TRANSLATION. Englishlanguage translations of foreign scientifi c and 

technical material pertinent to NASA’s mission.

Specialized services also include creating custom 

thesauri, building customized databases, organizing 

and publishing research results.

For more information about the NASA STI 

program, see the following:

• Access the NASA STI program home page at 

http://www.sti.nasa.gov

• E-mail your question to help@sti.nasa.gov

• Fax your question to the NASA STI 

Information Desk at 443–757–5803

• Phone the NASA STI Information Desk at

 443–757–5802

• Write to:

 STI Information Desk

NASA Center for AeroSpace Information

 7115 Standard Drive

 Hanover, MD 21076–1320
Jonathan S. Litt

Glenn Research Center, Cleveland, Ohio

Yuan Liu

N&R Engineering and Management Services, Parma Heights, Ohio

Thomas S. Sowers

Vantage Partners, LLC, Cleveland, Ohio

A. Karl Owen

Consultant, North Royalton, Ohio

Ten-Huei Guo

Glenn Research Center, Cleveland, Ohio

Piloted Simulation Evaluation of a Model-Predictive 

Automatic Recovery System to Prevent Vehicle Loss 

of Control on Approach

NASA/TM—2014-216644

March 2014

AIAA–2014–0036

National Aeronautics and

Space Administration

Glenn Research Center

Cleveland, Ohio 44135

Prepared for the

SciTech 2014

sponsored by the American Institute of Aeronautics and Astronautics

National Harbor, Maryland, January 13–17, 2014
Acknowledgments

The authors acknowledge the NASA Aviation Safety Program’s Vehicle Systems Safety Technologies Project for funding this work.

Available from

NASA Center for Aerospace Information

7115 Standard Drive

Hanover, MD 21076–1320

National Technical Information Service

5301 Shawnee Road

Alexandria, VA 22312

Available electronically at http://www.sti.nasa.gov

Trade names and trademarks are used in this report for identifi cation 

only. Their usage does not constitute an offi cial endorsement, 

either expressed or implied, by the National Aeronautics and 

Space Administration.

Level of Review: This material has been technically reviewed by technical management. 
NASA/TM—2014-216644 1 

Piloted Simulation Evaluation of a Model-Predictive Automatic 

Recovery System to Prevent Vehicle Loss of 

Control on Approach 

Jonathan S. Litt 

National Aeronautics and Space Administration 

Glenn Research Center 

Cleveland, Ohio 44135 

Yuan Liu 

N&R Engineering and Management Services 

Parma Heights, Ohio 44130 

Thomas S. Sowers 

Vantage Partners, LLC 

Cleveland, Ohio 44135 

A. Karl Owen 

Consultant 

North Royalton, Ohio 44133 

Ten-Huei Guo 

National Aeronautics and Space Administration 

Glenn Research Center 

Cleveland, Ohio 44135 

Abstract 

This paper describes a model-predictive automatic recovery system for aircraft on the verge of a 

loss-of-control situation. The system determines when it must intervene to prevent an imminent accident, 

resulting from a poor approach. It estimates the altitude loss that would result from a go-around maneuver 

at the current flight condition. If the loss is projected to violate a minimum altitude threshold, the 

maneuver is automatically triggered. The system deactivates to allow landing once several criteria are 

met. Piloted flight simulator evaluation showed the system to provide effective envelope protection 

during extremely unsafe landing attempts. The results demonstrate how flight and propulsion control can 

be integrated to recover control of the vehicle automatically and prevent a potential catastrophe. 

Introduction 

On July 6, 2013, an Asiana Airlines Boeing 777 on final approach to San Francisco International 

Airport (SFO) came in too low and too slow. Shortly before reaching the runway threshold, the throttles 

moved forward (Ref. 1) to increase power and thus airspeed, possibly in an attempt to perform a goaround. However, before the additional power could have an effect, the aircraft pitched up and the tail 

section hit the seawall at the end of the runway. The impact broke off the empennage and landing gear, 

and the craft skidded, spinning and burning, down the runway. 

On this fateful flight, the aircraft was below glideslope and going too slowly during approach 

(Ref. 2). A common method of maintaining glideslope is for the pilot to manipulate pitch. Directed by the 

glideslope indicator, the pilot pulls the nose up if the craft is too low, and pushes the nose down if it is too 

high. Simultaneously, the pilot should be monitoring and maintaining airspeed by adjusting the throttle 
NASA/TM—2014-216644 2 

(Ref. 3). Alternatively, the autothrottle can perform the latter function, if engaged. Sometimes, the pilot 

neglects airspeed for some reason (workload, distraction, concentration on maintaining glideslope, 

mistaken belief that the autothrottle is engaged, etc.) and lets airspeed get too low. In the case of Asiana 

Flight 214, there may have been some confusion about the autothrottle setting (Ref. 2), which could have 

been a contributing factor. If airspeed gets too low, it can be addressed automatically by an autothrottle 

“wake up” mode. This is a form of emergency protection that can activate to increase thrust when the 

plane is approaching stall speed (Ref. 4), but it is not available in all autoflight modes (Ref. 5). 

The glideslope itself is an approximately 3° path down to the ground, crossing the runway threshold at 

an altitude of about 50 ft before intersecting it at the aiming point 1000 ft further on. In a stabilized 

approach (Ref. 6), the plane generally flies down the glideslope at a relatively constant pitch; once it has 

passed the threshold and enters the ground effect, it flares to reduce sink rate and touches down. Rushed 

and unstabilized approaches are the largest contributing factor to approach and landing accidents. 

Continuing an unstabilized approach is a causal factor in 40 percent of all approach and landing accidents 

(Ref. 7). Combined, high and/or fast approaches and low and/or slow approaches are a causal factor in 

66 percent of such events (Ref. 7). 

The Asiana Airlines accident is currently under investigation and much is not known. It is known, 

however, that 8 sec prior to impact, the throttles began moving forward; at that time, altitude was below 

glideslope at 125 ft, and air speed was approximately 112 knots, well below the 137 knot reference 

landing speed. It is not known at the time of this writing whether the pilots moved the throttles manually, 

or if the autothrottle wake up mode had activated. In any case, at about 3 sec before impact, when the 

speed had dropped to 103 knots, the engines were only at about 50 percent power and increasing. By time 

of impact, airspeed had increased to about 106 knots (Ref. 1). 

Federal Aviation Administration (FAA) regulations require a time of not more than 5 sec to accelerate 

from 15 to 95 percent of takeoff power (Ref. 8). Furthermore, the thrust achieved after 8 sec from power 

application (starting from minimum flight idle) must allow a climb gradient of not less than 3.2 percent 

for go-around (Ref. 9). However, if the aircraft is descending, i.e., on approach, when the go-around 

maneuver is initiated, it will continue to experience an altitude loss before achieving this climb. 

Generally, the lower the initial airspeed and thrust, the greater the altitude loss and time required before 

sink rate is reversed, especially when the aircraft is flying below approach speed and near idle power. 

Lack of thrust in particular is strongly correlated with altitude loss (Ref. 10). During an automatic go-around 

initiated at 50 ft, a Boeing 777 will lose approximately 30 ft of altitude (Ref. 4). If a go-around is required, 

the procedure given in the Boeing 777 Flight Crew Training Manual is to push the takeoff/go-around 

(TO/GA) switch, set flaps to 20, apply go-around thrust, and rotate smoothly to 15° pitch attitude (Ref. 4). 

Deceleration to below final approach speed can be acceptable under certain circumstances, but 

throttles must be advanced to maximum thrust when initiating the go-around maneuver (Ref. 10). If an 

extremely low airspeed is achieved while the throttles are at idle, it may be the result of an unstabilized 

approach. If, in addition, the aircraft is close to the ground, as was the case with Asiana Flight 214, the 

altitude loss while the engines are spooling up can be catastrophic. 

The previously mentioned autothrottle wake up mode is part of a larger envelope protection scheme 

on the Boeing 777 and other aircraft. In general, the purpose of envelope protection is to keep the vehicle 

within its safe performance limits by inhibiting violations of parameters such as minimum and maximum 

operating speeds, bank angle, and aerodynamic forces. It deters the pilot from trying to operate outside of 

this safe range, although pilot override is possible (Ref. 11). Much of this envelope protection is 

accomplished automatically with the autopilot, and as with the autothrottle, it is not available in all flight 

modes (Ref. 5). This leads to the question of Asiana Flight 214 and the automation crack through which it 

fell. If no envelope protection was available, an unchecked confluence of events caused the aircraft to 

enter into a loss-of-control situation from which it could not recover. On the other hand, if the 

autothrottles woke up and advanced the throttles as the airspeed approached stall speed, it was already too 

late to save the plane given the altitude and engine spool-up time. 
NASA/TM—2014-216644 3 

Figure 1.—Model-predictive automatic recovery system demonstrating altitude loss prediction. The green line 

indicates that the predicted altitude loss due to a go-around from high up on the glideslope will not cause a 

threshold violation. As the aircraft continues to descend and it approaches the altitude threshold, the 

prediction of altitude loss (red line) indicates a threshold violation will occur. 

This is one of several recent accidents that occurred on approach and resulted in fatalities. For some 

of them, investigations are ongoing and no cause has yet been determined, but there is speculation that 

pilot error could be to blame (Refs. 2, 12, and 13). Cases of unstabilized approaches and crash landings 

short of the runway have generated discussions about automation confusion and the erosion of piloting 

skills due to overreliance on automation (Ref. 14). These are training and human factors concerns that 

must be addressed, but ironically, some of the direst consequences of these automation-related problems 

can be prevented by adding another layer of automation (Ref. 15): a supervisory envelope protection 

scheme that anticipates loss-of-control accidents and intercedes to prevent them. 

The remainder of this paper describes a new model-predictive automatic recovery system that 

determines if the landing is salvageable. It gives the pilot the benefit of the doubt that he/she can land the 

aircraft safely until the last instant, at which time the system automatically takes over and initiates a goaround. The following sections describe the philosophy behind the design, which is followed by a 

description of the implementation approach. Then the test bed is described and examples of the system in 

operation are presented. This is followed by a discussion and conclusions. 

Philosophy of the Model-Predictive Automatic Recovery System 

The proposed model-predictive automatic recovery system looks ahead over a time horizon to 

ensure that the aircraft will not experience premature contact with the ground, and initiates an automatic 

go-around if necessary. It can be considered a very specialized integrated flight and propulsion control 

system, since it coordinates both the throttle and aircraft attitude commands for this single purpose. It is 

fully contained onboard the aircraft, with landing information available from sources such as an 

Instrument Landing System (ILS) or Global Positioning System (GPS). The functionality fits naturally 

within the envelope protection system of the aircraft, which imparts a design philosophy to it: it should 

not interfere with flight operation until the situation has reached the edge of becoming unrecoverable, at 

which point the system must recognize this and automatically recover from it; additionally, it must be 

able to be overridden for emergency landings, for instance. The system was designed with the assumption 

that the pilot intends to land the aircraft safely on the runway, and it determines whether this is possible. 

Its purpose is to prevent the aircraft from approaching too close to the ground unless it is near the runway 

and at an appropriate airspeed to avoid crashing. It does not require a stabilized approach; it gives the 
NASA/TM—2014-216644 4 

pilot leeway to continue flying as long as an accident is not imminent. The system only reacts once it 

concludes that, without intervention, an accident will take place. Here an accident is defined as a situation 

in which, even if an immediate go-around is performed, the craft’s altitude will drop below a given 

threshold, when it is not over the runway. Because the system identifies the brink of when safe landings 

are no longer possible and there is no alternative but to go around, it can handle a variety of situations: 

low and slow, high and fast, stabilized descent short of the runway, and other conditions that have a very 

strong likelihood of disaster. 

The system predicts the altitude loss that would be sustained during an immediate go-around 

maneuver from the current flight conditions. If that altitude loss would result in the aircraft dipping below 

a given altitude threshold prior to reaching the runway, an immediate go-around is initiated. Otherwise, 

the flight continues on under pilot control and the altitude loss prediction is repeated at discrete intervals, 

as illustrated in Figure 1. The threshold is designed to provide a buffer to allow for prediction error, 

obstacles, etc., but be small enough that the airplane would never reasonably get that low under normal 

circumstances unless it is near the runway. The system turns off to enable landing when the flight path 

brings the craft near to and aligned with the runway and below a specified altitude (Fig. 2). At this point, 

it is assumed that the plane is positioned for the pilot to perform a safe landing. It is important to 

emphasize again that if this situation is realized, there has been no intervention and the pilot has 

performed a satisfactory approach; the system protects against dangerously unsatisfactory approaches, it 

does not make the approach better. Details of the system implementation are provided in the next section. 

Figure 2.—Notional view of the aircraft passing through the altitude threshold (yellow line) to the runway. The 

overhead view (top) depicts the aircraft descending into the safe landing zone for the runway. Prediction of 

go-around induced altitude loss, designated by green lines along the glide path (bottom), turns off once the 

aircraft enters the runway area on a safe landing trajectory. This situation is indicated by the aircraft’s location 

within the safe landing zone without experiencing an altitude threshold violation. 
NASA/TM—2014-216644 5 

Figure 3.—Flow chart of the model-predictive automatic recovery system. 

If the aircraft has not met the landing criteria, it predicts if the flight is 

about to become unrecoverable, and if so, triggers a go-around. 

Procedure 

The model-predictive automatic recovery system consists of three primary components: the flight and 

propulsion control override mode, the flight path predictor, and the trigger system. When activated, the 

override mode exerts full authority over the primary flight and propulsion controls in order to modify the 

flight trajectory and avoid ground contact. The flight path predictor detects the onset of unsafe operation 

(i.e., impending ground contact). The trigger system utilizes current and projected flight conditions to 

activate or disable the override mode (Fig. 3). This approach is conceptually similar to the Ground 

Collision Avoidance System (GCAS) developed for military aircraft. Both manually (Ref. 16) and 

automatically (Refs. 17 and 18) activated recovery systems have been previously investigated for military 

aircraft. However, these systems are tailored towards the higher energy regime of the flight envelope. For 

civil transport applications, it is at least as important to focus on recovery from low-altitude, low-speed 

(e.g., approach) loss-of-control situations. 

Override Mode 

The Override (OR) Mode modifies the aircraft flight trajectory to avoid premature ground contact. 

Thus, the control mode is functionally similar to the go-around (GA) flight mode for modern transport 

aircraft. For this work, relatively simple control logic was developed for demonstration purposes, but a 

GA mode could alternatively be used, if available. Here, pitch and roll control algorithms were utilized to 

build a control mode that executes a rudimentary GA maneuver. Specifically, when triggered, the OR 

Mode will: 

 Command full throttle 

 Manipulate elevator position to achieve approximately 15° nose-up pitch angle 

 Manipulate aileron position to achieve approximately 0° roll angle 

 Maintain aircraft configuration (i.e., flaps and landing gear are not retracted) 
NASA/TM—2014-216644 6 

Figure 4.—Altitude loss during a go-around performed using the model-predictive automatic 

recovery system. The runs comprise various initial airspeeds and glide path angles; in all 

cases the throttle is at or near idle. True Air Speed, TAS, in knots, and sink rate in feet per 

minute at initiation are given for each case. The time to minimum altitude is approximately 

ordered by initial airspeed. At the longest, the minimum altitude occurred about five seconds 

after the maneuver was triggered. 

These characteristics are similar to those in a standard GA procedure (Ref. 4). In simulation testing, 

maintaining the flaps in landing configuration resulted in the smallest altitude loss. 

Additionally, simulation results from a variety of initial airspeeds and glide path angles with throttle 

at flight idle showed that the minimum altitude achieved before climb occurred less than 10 sec after 

initiation of the GA maneuver. Figure 4 demonstrates this for several examples of altitude loss with 

different initial airspeeds and sink rates. These results correspond well to the FAA time requirement for 

go-around climb (Ref. 9), suggesting that the OR Mode produces a reasonable representation of a 

standard GA maneuver. 

Flight Path Predictor 

The flight path predictor (FPP) is a simplified, two-dimensional, rigid-body physics model of the 

aircraft, used to determine the altitude loss that would result from a go-around maneuver. Lateral 

dynamics of the aircraft are neglected (i.e., constant heading, zero roll/sideslip, etc.) since the primary 

application considered for this work is the approach/landing phase. Wind is also neglected for simplicity. 

Thus, applying Euler’s Laws of Motion to the aircraft longitudinal characteristics yields the following 

equations of motion: 

Fx mVx



Fz mh

 



yy M  I

0 1 2 3 4 5 6 7 8 9 10

-150

-100

-50

0

50

100

150

200

250

300

350

Time Since Trigger, s

Altitude Change From Trigger, ft

TAS: 156 kts; Sink Rate: 3128 fpm

TAS: 108 kts; Sink Rate: 857 fpm

TAS: 109 kts; Sink Rate: 1262 fpm

TAS: 116 kts; Sink Rate: 664 fpm

TAS: 124 kts; Sink Rate: 761 fpm
NASA/TM—2014-216644 7 

Assuming a Flat Earth inertial reference frame with the positive x-axis in the direction of aircraft 

heading and the positive z-axis pointing downward, the quantities in the equations are defined as: 

m aircraft mass 

Iyy aircraft pitching moment of inertia 

Fx net force along the x-axis 

Fz net force along the z-axis 

M net pitching moment 

Vx air speed along the x-axis 

h altitude 

pitch angle 

The model accounts for longitudinal forces and moments due to aerodynamics and propulsion. The 

model assumes knowledge of the airframe aerodynamic characteristics due to angle of attack, Reynolds 

Number, and control surface deflections. Engine thrust is approximated as the response of a second-order 

dynamical system to throttle position input, which is a function of starting position (e.g., flight idle) and 

speed of engine response. Hence, once the physical characteristics of the airframe (mass, moment of 

inertia, etc.) and control parameters (control surface deflections and throttle) are specified, the system of 

equations is well-defined; all other relevant parameters (angle-of-attack, air speed, etc.) can be derived 

from the state variables. 

The previously described OR Mode control logic is applied to the simplified aircraft model in a 

closed-loop feedback configuration to provide the necessary control inputs (e.g., elevator deflection, 

throttle position, etc.). This interconnection represents the complete FPP architecture (Fig. 5). 

Figure 5.—Block diagram of the flight path predictor. The simplified model is initialized to the current flight 

condition. The go-around commands are applied and the maneuver is simulated over a 20 sec time horizon. The 

minimum altitude prediction is used to trigger the override mode, if necessary. This process is repeated as long 

as the override mode has not triggered and the trigger system has not deactivated. 
NASA/TM—2014-216644 8 

Trigger System 

The purpose of the trigger system is to determine if the OR Mode must be activated to avoid 

unintended ground contact. The trigger system queries the FPP at regular time intervals (once per second 

in this implementation) to obtain an estimate of the maximum altitude loss the aircraft would experience 

if it were to execute the full-throttle go-around maneuver implemented by the OR Mode. At each request, 

the FPP computes ahead 20 sec starting from the current measured flight conditions, using simulated 

flight and propulsion control inputs from the OR Mode. This time horizon is chosen to ensure the full 

altitude loss and recovery trajectory is captured. The FPP runs much faster than real-time; for this work, 

approximately 0.4 sec of computational time is required for the 20-sec time horizon. If the reported 

altitude loss will cause the aircraft to fly below a preset minimum altitude threshold, the OR Mode is 

activated, initiating the go-around and superseding pilot commands. To account for prediction errors, this 

minimum altitude threshold was chosen to be 50 ft above ground level everywhere except within a 

predetermined distance of the runway. 

To allow the aircraft to land, the trigger system deactivates the protection system if a set of conditions 

are satisfied. Assuming that the heading is correct for approach on the designated runway, the criteria are: 

 The aircraft is within about 1000 ft (horizontal distance) of the runway threshold. At this point, the 

FPP altitude threshold is set to zero

 The aircraft is less than 50 ft above ground level 

If these conditions are met simultaneously without triggering a predicted trajectory violation from the 

FPP, the OR Mode is disabled, permitting the aircraft to touch down. 

Experimental Test Bed 

Piloted evaluation of the model-predictive automatic recovery system was performed in the NASA 

Glenn flight simulator. The aircraft model was the NASA-developed Transport Class Model (TCM) 

(Ref. 19), a generic, mid-sized, single-aisle transport aircraft with two wing-mounted engines. Two copies 

of the Commercial Modular Aero-Propulsion System Simulation 40k (C-MAPSS40k) (Refs. 20 to 21), 

the NASA-developed, 40,000-lb thrust class, high-bypass ratio turbofan engine model, represented the 

power plants. The closed-loop C-MAPSS40k engine meets the relevant FAA thrust response criterion, as 

shown in Figure 6. The C-MAPSS40k simulations were modified to include the detrimental effect of inlet 

distortion due to high angle of attack on engine thrust output, which can be significant in a loss-of-control 

event (Ref. 22). This combination of aircraft and engine models provides a realistic, nonlinear, fullenvelope aircraft simulation. Furthermore, the cockpit has a reasonably comprehensive, fully configurable 

pilot interface, which delivers an immersive environment for highly representative testing and evaluation. 

Examples 

The experiments were based on situations that could lead to loss of control, such as the Asiana 

Airlines Flight 214 accident. Although the flight simulator models a different aircraft, the outcomes 

should be qualitatively similar. The demonstration flights were initiated at 3 nm out from SFO runway 

28L, lined up on the correct heading, airspeed of 135 kts, and 1000 ft above ground level (AGL) 

(Fig. 7). The stall speed of the TCM is about 100 kts. It has spoilers that can be used as speed brakes, 

although they were not for these experiments. The landing configuration is with the gear down and flaps 

fully extended. 
NASA/TM—2014-216644 9 

Figure 6.—C-MAPSS40k Response to FAR 33.73b—Power or thrust response. Rise 

time requirement from not more than 15 percent of the takeoff thrust to 95 percent of 

the takeoff thrust in not over 5 sec. 

Figure 7.—Flight simulator test bed demonstrating approach into SFO Runway 28L. 
NASA/TM—2014-216644 10 

-0.5 0 0.5 1 1.5 2 2.5 3

0

500

1000

AGL, ft

AGL

AGL predicted

-0.5 0 0.5 1 1.5 2 2.5 3

-2000

-1000

0

1000

Vert. Speed, fpm

-0.5 0 0.5 1 1.5 2 2.5 3

-80

-60

-40

-20

0

Predicted Alt. Change, ft

-0.5 0 0.5 1 1.5 2 2.5 3

0

10

20

30

Throttle, %

Distance to Runway, nm

Figure 8.—Example of stabilized approach showing altitude and the predicted 

minimum altitude due to a go-around, vertical speed, prediction of altitude 

loss, and throttle percent of full range. 

Several example flights were flown by the pilot from the starting point toward the runway. The pilot 

performed variations of regular landings from a stabilized approach, but also flew a stabilized approach 

on a glideslope with the aiming point short of the runway threshold, and various unstabilized approaches, 

coming in high and fast, and low and slow. A nominal run is illustrated in Figure 8; all variables are 

plotted versus distance from a safe landing spot just beyond the runway threshold, meaning that 

trajectory/time is shown from right to left. The top graph shows the altitude of the aircraft (solid blue line) 

along with the predicted minimum altitude that would result from initiating a go-around at each point 

along its flight path (red dashed line). The black dashed lines indicate the safe landing criteria: the 

horizontal line indicates the 50-ft altitude threshold, and the vertical line indicates the distance before the 

runway (about 1000 ft) where the altitude threshold drops to zero. As previously mentioned, the 

protection system is deactivated to allow landing once the aircraft is within 1000 ft of the runway and 
NASA/TM—2014-216644 11 

under 50 ft AGL with no predicted threshold violation. The point where this occurs is indicated by the 

blue circle. This is followed by a plot of vertical speed (sink rate), which is slightly faster than 

recommended for a stabilized approach (greater than 1000 ft per minute) (Ref. 6), but is not sufficient 

cause to reject the landing. The third plot down is the altitude loss prediction, which is repeatedly 

generated throughout the approach; the discretization is due to the relatively low frequency at which the 

FPP is executed (once per second). Note that the profile of the altitude loss prediction is quantitatively 

similar to that of vertical speed. This is not surprising since the aircraft generally requires more altitude to 

recover from higher sink rates. Finally, throttle position (percent of full range) is displayed (both throttles 

move together). 

Figure 9 depicts five failed approaches that were automatically rejected by the model-predictive 

automatic recovery system. The circle on each curve indicates the point at which the automatic go-around 

triggered, so for each variable shown for a specific run, the circles coincide. Here again the top plot shows 

the aircraft’s altitude. On this plot it is clear that the prediction and go-around initiation system worked as 

it should, because the curves all come close to or dip below the threshold (the horizontal dashed line) and 

start increasing again, and all but the green line change direction in the vicinity of the threshold. The 

upper portion of Figure 10 zooms in on the section of this altitude plot where the flight path nears the 

altitude threshold. The lower part of Figure 10 shows the predicted threshold violation that initiated the 

go-around, again marked with a circle; note that although a threshold violation was predicted by the 

simplified model, the actual maneuver did not necessarily result in a violation. Continuing with Figure 9, 

the second plot down shows airspeed in knots, followed by vertical speed (sink rate) in feet per minute 

(third plot). The fourth plot shows pitch angle, and it is clear that after mode initiation, in all cases the 

pitch tends toward the 15° setpoint. The final plot shows throttle position, which goes to 100 percent 

immediately upon mode initiation. The five cases demonstrate the versatility as well as a limitation of the 

system. 

In the case of the blue curve, the aircraft came in high and fast. The top plot shows it continued at a 

nearly constant altitude until about 0.8 nm out, at which point it started to dive toward the runway. 

Airspeed and corresponding sink rate increased, as pitch angle dropped rapidly into the dive, until the 

automatic go-around initiated, the throttles went to 100 percent, and the nose pulled up sharply toward the 

15° commanded pitch. Because of the large sink rate, the OR Mode is triggered well above the altitude 

threshold. 

The red curve demonstrates a good, stabilized approach at an appropriate, consistent airspeed, but on 

a glide path that ends short of the runway. In this case, the pilot had opportunity to modify the glide path 

and head for the runway, but did not, which eventually triggered the system as the aircraft neared the 

altitude threshold. The magenta curve is similar to the red curve, but at a lower airspeed. Here too, the 

mode triggers very close to the altitude threshold. 

The cyan and green lines represent cases in which the airspeed drops dangerously low during the 

approach, similar to Asiana Flight 214. In these cases, because of the low airspeed, the mode is triggered 

further from the altitude threshold than in the two previous, more stabilized approaches. 

Interesting to note is that for the green curve, the aircraft comes relatively close to the ground before 

beginning to climb. This can be explained by the latency associated with the prediction mechanism. 

Recall that the FPP is executed once per second to predict a 20-sec time horizon; this frequency is about 

two orders of magnitude slower than that at which the propulsion and flight control systems operate. The 

circle on the green curves indicates where the mode was triggered, and on the pitch trace, the pilot 

commanded a sudden pitch down, with corresponding increase in sink rate, just prior to mode initiation. 

The pitch rate of change was relatively high compared to the update rate of the altitude loss estimation, 

overwhelming the ability of the protection system to “keep up” with the flight dynamics. Thus accurate 

prediction of the altitude loss can be thwarted by rapid aerodynamic changes that can occur during the 

update cycle of that calculation. 
NASA/TM—2014-216644 12 

0 0.5 1 1.5 2 2.5 3

0

500

1000

AGL, ft

0 0.5 1 1.5 2 2.5 3

100

120

140

160

Air Speed, kts

0 0.5 1 1.5 2 2.5 3

-4000

-2000

0

2000

4000

Vert. Speed, fpm

0 0.5 1 1.5 2 2.5 3

-20

-10

0

10

20

Pitch Angle, deg

0 0.5 1 1.5 2 2.5 3

0

50

100

Throttle, %

Distance to Runway, nm

Figure 9.—Examples of failed approaches showing altitude, airspeed, 

vertical speed, pitch angle, and throttle percent of full range. The 

circle on each curve indicates the point at which the automatic 

go-around triggered. 
NASA/TM—2014-216644 13 

0 0.5 1 1.5

0

100

200

300

400

500

AGL, ft

0 0.5 1 1.5

0

100

200

300

400

500

Predicted AGL, ft

Distance to Runway, nm

Figure 10.—Detail of the initiation of the go-around maneuvers for the rejected 

approaches. The actual altitude is shown (top), along with the predicted altitude, 

showing the predicted threshold violations. Note that the prediction stops once 

the go-around is initiated. 

The current research implementation does not provide a way to disengage the Override Mode once it 

has been initiated; doing this correctly is a human factors issue. However, one can conceive of several 

reasonable approaches. For example, once a given climb rate or altitude is achieved, the autopilot could 

initiate an altitude and speed hold, at which point the pilot could retake control. 

Discussion 

The system was tested on a variety of acceptable stabilized approaches, as well as types of approaches 

that can lead to loss-of-control accidents. While the system worked as expected, several potential 

improvements were identified. The previously mentioned latency associated with the altitude loss 

estimate has the potential to cause significant underprediction. Speeding up the calculation cycle would 

help to eliminate this source of error. There is significant built-in margin here currently, with the 

estimation performed every second, while the 20-sec time horizon takes only about 0.4 sec to execute. 

Using an 8- to10-sec time horizon with less idle time could reduce the cycle by about 80 percent. 

An integrated flight and propulsion approach was used to perform the go-around maneuver. The 

coordinated commands were based on documented procedures, but were developed outside of the existing 

flight control system for proof of concept. Utilizing an actual TO/GA mode might produce better results 

in terms of reducing altitude loss. 
NASA/TM—2014-216644 14 

-0.5 0 0.5 1 1.5 2 2.5 3

0

200

400

600

800

1000

AGL, ft

AGL

AGL predicted

Figure 11.—Flight path of a successful landing showing altitude and predicted altitude 

loss versus distance from runway. Although this landing was acceptable, it nearly 

triggered a go-around. The blue circle indicates where the system disengaged to allow 

landing. 

On occasion, the fixed altitude threshold has caused the system to trigger on what appeared to be an 

acceptable flight path toward the runway. Figure 11 shows an example of an approach in which the 

prediction just missed touching the corner before the threshold dropped to zero; had the prediction 

dropped below 50 ft while the aircraft was still slightly farther than 1000 ft from the runway, the goaround would have triggered, even though it turned out to be a good landing. The location of this corner is 

the result of a trade-off between avoiding false alarms and minimizing the distance before the runway 

threshold that could be violated on a steep approach. A way to reduce the need to make this trade-off is to 

ramp the altitude threshold down to a point beyond the runway threshold. 

A related improvement involves accounting for the predicted go-around trajectory, as shown in 

Figure 2. While the altitude loss prediction is fundamental to the process and continuously updated, the 

aircraft’s corresponding forward movement, which is determined concurrently, is not used. This is 

inconsequential when the altitude threshold is of a fixed height, but not when it changes, e.g., the ramp 

proposed above, which varies with distance from the runway. Projecting the altitude loss forward 

accounts for the threshold at the point where the minimum altitude would actually occur. The current 

approach effectively creates an artificial altitude buffer at the threshold lip because it simply subtracts the 

predicted altitude loss from the altitude at the present location; it does not project it forward. The 

predicted minimum altitude that just missed the threshold lip in Figure 11 would actually occur at some 

point ahead of the aircraft, where the threshold had already dropped to zero, so it would not come close to 

triggering a go-around. 

Areas that require further evaluation involve updates to the FPP that would be necessary for a real 

application. Currently, the FPP uses actual values of aircraft mass, moment of inertia, and aerodynamic 

forces available from the simulation. A more realistic implementation would require estimates of these 

values, which could lead to larger error in the predictions. 

Also, lateral dynamics of the aircraft are neglected in the model, although testing showed this did not 

add much uncertainty for the approach cases considered. 

Finally, wind is not accounted for in the prediction, which could have an effect on the prediction 

accuracy. Certainly, consideration of crosswinds would strengthen the need to incorporate some lateral 

control and dynamics parameters into the flight path prediction algorithm. 
NASA/TM—2014-216644 15 

Conclusions 

A new model-predictive automatic recovery system, an envelope protection algorithm to help guard 

against unintended ground contact, has been proposed and demonstrated. It determines when ground 

contact is about to become inevitable, and at that point automatically initiates a go-around. The type of 

accidents it addresses are due primarily to pilot error, and it acts in a supervisory capacity to ensure that 

such concerns as confusion about the autopilot and autothrottle modes cannot result in loss of control. It 

provides a safeguard by overriding the flight and propulsion control commands once it determines that 

inaction will result in a crash. Piloted simulations demonstrated that the system worked as intended, 

allowing normal operation in all instances, but intervening consistently when an unrecoverable situation 

was imminent. A variety of unstabilized approaches were tested, as well as stabilized but otherwise 

deficient approaches. Analysis of these runs identified adjustments that could both reduce potential false 

alarms and reject marginally unacceptable landings. There is a fine line between acceptable and 

unacceptable landings, so making the decision to initiate a go-around in a borderline situation is difficult 

and requires some level of autonomy. Any adjustments that might result in an overall improvement rather 

than a tradeoff are very positive developments and should be investigated. Luckily the types of accidents 

addressed here are rare and the vast majority of landings are squarely in the acceptable range. However, 

in those rare cases in which some type of error on approach would normally result in premature ground 

contact, the model-predictive automatic recovery system has the potential to prevent the situation from 

turning deadly. 

References 

1. Transcript: Press briefing remarks by NTSB Chair Deborah Hersman on Asiana Flight 214 - July 8, 

2013, view-source:http://www.whatthefolly.com/2013/07/08/transcript-press-briefing-remarks-byntsb-chair-deborah-hersman-on-asiana-flight-214-july-8-2013-part-5/, accessed 11/16/2013. 

2. Croft, John, “Automation Paralysis,” Aviation Week & Space Technology, July 15, 2013, pp. 22–24. 

3. Federal Aviation Administration, “Airplane Flying Handbook,” FAA-H-8083-3A, 2004. 

4. The Boeing Company, “777 Flight Crew Training Manual, Qatar Airways,” Document Number FCT 

777 QTR (TM), August 1, 2007, Revision Number: 1, Revision Date: April 28, 2008, The Boeing 

Company. 

5. The Boeing Company, “777-240/-240LR/-340ER, Flight Crew Operations Manual,” Pakistan 

International Airlines. Corporation, Document Number D632W001-PIA, June 16, 2003, Revision 

Number: 20, Revision Date: June 15, 2013, p. 4.20.9. 

6. Flight Safety Foundation, “Approach-and-landing Accident Reduction: FSF ALAR Briefing Note 

4.2 – Energy Management,” Flight Safety Digest, August-November 2000. 

7. “Flying Stabilized Approaches,” Operations Briefing Notes, Approach Techniques, Airbus Customer 

Services, Flight Operations Support and Services, 2005. 

8. FAR Part § 33.73: Power or thrust response. 

9. FAR Part § 25.119: Landing climb: All-engines-operating. 

10. “Aircraft Energy Management During Approach,” Flight Operations Briefing Notes, Approach 

Techniques, Airbus Customer Services, Flight Operations Support and Services, 2006. 

11. Bartley, G.F., “Boeing B-777: Fly-By-Wire Flight Controls,” in The Avionics Handbook, Cary R. 

Spitzer (Editor), CRC Press, 2001. 

12. Levin, A., “Recent U.S. Air Crashes Highlight Leading Cause of Deaths,” Bloomberg, 9/6/13, 

www.bloomberg.com/news/print/2013-09-06/recent-u-s-air-crashes-highlight-leading-cause-ofdeaths.html, accessed 12/4/ 2013. 

13. White, G.L., “Pilot Error Suspected in Russia, Human Fault the Reason for Many Recent Crashes in 

the Country,” Wall Street Journal, Nov. 19, 2013, 

http://online.wsj.com/news/articles/SB10001424052702303985504579207781618907064, accessed 

12/4/ 2013. 
NASA/TM—2014-216644 16 

14. PARC/CAST Flight Deck Automation Working Group, “Operational Use of Flight Path 

Management Systems,” Federal Aviation Administration, released 11/21/2013. 

15. Sutcliffe, P. L., “The Boeing 7J7 Advanced Technology Airplane,” IEEE Control Systems 

Magazine, February 1987, pp. 9-15. 

16. Combs, S.R., Gousman, K.G., and Tauke, G.J., “Pilot Activated Automatic Recovery System on the 

F-117A,” AlAA 92-1126, 1992 Aerospace Design Conference, Irvine, CA, February 3-6, 1992. 

17. Fitzgerald, T.R. and Brunner, M.T., “Use of High-Fidelity Simulation in the Development of an 

F/A-18 Active Ground Collision Avoidance System,” AIAA 92-4140-CP, AIAA/AHS Flight 

Simulation Technologies Conference, Hilton Head Island, SC, August 24-26, 1992. 

18. Swihart, D.E., Barfield, A.F., Griffin, E.M., Lehmann, R.C., Whitcomb, S.C., Flynn, B., Skoog, 

M.A., and Processor, K.E., “Automatic Ground Collision Avoidance System Design, Integration, 

and Flight Test,” IEEE A&E Systems Magazine, May 2011, pp. 4-11. 

19. Hueschen, R.M., “Development of the Transport Class Model (TCM) Aircraft Simulation From a 

Sub-Scale Generic Transport Model (GTM) Simulation,” NASA/TM–2011-217169, August 2011. 

20. Csank, Jeffrey, May, Ryan D., Litt, Jonathan S., and Guo, Ten-Huei, “Control Design for a Generic 

Commercial Aircraft Engine,” AIAA-2010-6629, 46th AIAA/ASME/SAE/ASEE Joint Propulsion 

Conference and Exhibit, Nashville, TN, July 25-28, 2010. 

21. May, Ryan D., Csank, Jeffrey, Lavelle, T.M., Litt, Jonathan S., and Guo, Ten-Huei, “A HighFidelity Simulation of a Generic Commercial Aircraft Engine and Controller,” AIAA-2010-6630, 

46th AIAA/ASME/SAE/ASEE Joint Propulsion Conference and Exhibit, Nashville, TN, July 25-28, 

2010. 

22. Liu, Yuan, Claus, Russell, Litt, Jonathan, Guo, Ten-Huei, “Simulating Effects of High Angle of 

Attack on Turbofan Engine Performance,” AIAA 2013-1075, 51st AIAA Aerospace Sciences 

Meeting including the New Horizons Forum and Aerospace Exposition, Grapevine, TX, January 7-

10, 2013.