Jeffrey T. Csank and Jeffrey C. Chin

Glenn Research Center, Cleveland, Ohio

Ryan D. May

ASRC Aerospace Corporation, Cleveland, Ohio

Jonathan S. Litt and Ten-Huei Guo

Glenn Research Center, Cleveland, Ohio

Implementation of Enhanced Propulsion Control 

Modes for Emergency Flight Operation

NASA/TM—2011-217038

July 2011

AIAA–2011–1590
NASA STI Program . . . in Profile

Since its founding, NASA has been dedicated to the 

advancement of aeronautics and space science. The 

NASA Scientific and Technical Information (STI) 

program plays a key part in helping NASA maintain 

this important role.

The NASA STI Program operates under the auspices 

of the Agency Chief Information Officer. It collects, 

organizes, provides for archiving, and disseminates 

NASA’s STI. The NASA STI program provides access 

to the NASA Aeronautics and Space Database and 

its public interface, the NASA Technical Reports 

Server, thus providing one of the largest collections 

of aeronautical and space science STI in the world. 

Results are published in both non-NASA channels 

and by NASA in the NASA STI Report Series, which 

includes the following report types:

• TECHNICAL PUBLICATION. Reports of 

completed research or a major significant phase 

of research that present the results of NASA 

programs and include extensive data or theoretical 

analysis. Includes compilations of significant 

scientific and technical data and information 

deemed to be of continuing reference value. 

NASA counterpart of peer-reviewed formal 

professional papers but has less stringent 

limitations on manuscript length and extent of 

graphic presentations.

• TECHNICAL MEMORANDUM. Scientific 

and technical findings that are preliminary or 

of specialized interest, e.g., quick release 

reports, working papers, and bibliographies that 

contain minimal annotation. Does not contain 

extensive analysis.

• CONTRACTOR REPORT. Scientific and 

technical findings by NASA-sponsored 

contractors and grantees.

• CONFERENCE PUBLICATION. Collected 

papers from scientific and technical 

conferences, symposia, seminars, or other 

meetings sponsored or cosponsored by NASA.

• SPECIAL PUBLICATION. Scientific, 

technical, or historical information from 

NASA programs, projects, and missions, often 

concerned with subjects having substantial 

public interest.

• TECHNICAL TRANSLATION. Englishlanguage translations of foreign scientific and 

technical material pertinent to NASA’s mission.

Specialized services also include creating custom 

thesauri, building customized databases, organizing 

and publishing research results.

For more information about the NASA STI 

program, see the following:

• Access the NASA STI program home page at 

http://www.sti.nasa.gov

• E-mail your question via the Internet to help@

sti.nasa.gov

• Fax your question to the NASA STI Help Desk 

at 443–757–5803

• Telephone the NASA STI Help Desk at

443–757–5802

• Write to:

 NASA Center for AeroSpace Information (CASI)

 7115 Standard Drive

 Hanover, MD 21076–1320
Jeffrey T. Csank and Jeffrey C. Chin

Glenn Research Center, Cleveland, Ohio

Ryan D. May

ASRC Aerospace Corporation, Cleveland, Ohio

Jonathan S. Litt and Ten-Huei Guo

Glenn Research Center, Cleveland, Ohio

Implementation of Enhanced Propulsion Control 

Modes for Emergency Flight Operation

NASA/TM—2011-217038

July 2011

AIAA–2011–1590

National Aeronautics and

Space Administration

Glenn Research Center

Cleveland, Ohio 44135

Prepared for the

Infotech@Aerospace 2011 Conference

sponsored by the American Institute of Aeronautics and Astronautics

St. Louis, Missouri, March 29–31, 2011
Acknowledgments

The authors would like to thank Diana Drury of ASRC Aerospace Corporation, who handled the version control system

for C-MAPSS40k. Our thanks go to the NASA Aviation Safety Program’s Integrated Resilient Aircraft Control Project

for funding this work.

Available from

NASA Center for Aerospace Information

7115 Standard Drive

Hanover, MD 21076–1320

National Technical Information Service

5301 Shawnee Road

Alexandria, VA 22312

Available electronically at http://www.sti.nasa.gov

Level of Review: This material has been technically reviewed by technical management. 
NASA/TM—2011-217038 1 

Implementation of Enhanced Propulsion Control Modes for 

Emergency Flight Operation 

Jeffrey T. Csank and Jeffrey C. Chin 

National Aeronautics and Space Administration 

Glenn Research Center 

Cleveland, Ohio 44135 

Ryan D. May 

ASRC Aerospace Corporation 

Cleveland, Ohio 44135 

Jonathan S. Litt and Ten-Huei Guo 

National Aeronautics and Space Administration 

Glenn Research Center 

Cleveland, Ohio 44135

Abstract

Aircraft engines can be effective actuators to help pilots avert or recover from emergency situations. Emergency 

control modes are being developed to enhance the engines’ performance to increase the probability of recovery 

under these circumstances. This paper discusses a proposed implementation of an architecture that requests 

emergency propulsion control modes, allowing the engines to deliver additional performance in emergency 

situations while still ensuring a specified safety level. In order to determine the appropriate level of engine 

performance enhancement, information regarding the current emergency scenario (including severity) and current 

engine health must be known. This enables the engine to operate beyond its nominal range while minimizing overall 

risk to the aircraft. In this architecture, the flight controller is responsible for determining the severity of the event 

and the level of engine risk that is acceptable, while the engine controller is responsible for delivering the desired 

performance within the specified risk range. A control mode selector specifies an appropriate situation-specific 

enhanced mode, which the engine controller then implements. The enhanced control modes described in this paper 

provide additional engine thrust or response capabilities through the modification of gains, limits, and the control 

algorithm, but increase the risk of engine failure. The modifications made to the engine controller to enable the use 

of the enhanced control modes are described, as are the interaction between the various subsystems and importantly, 

the interaction between the flight controller/pilot and the propulsion control system. Simulation results demonstrate 

how the system responds to requests for enhanced operation and the corresponding increase in performance.

Nomenclature 

Accel Acceleration Limit (rpm/s) 

Alt Altitude (ft) 

C-MAPSS40k Commercial Modular Aero Propulsion System Simulation 40k 

CMS Control Mode Selection and Risk Management 

EPR Engine Pressure Ratio 

HPC High Pressure Compressor 

Nc Core Speed (rpm) 

Nf Fan Speed (rpm) 

Pxx Pressure at Station xx (psia) 

PI Proportional-Integral controller 

PLA Power Lever Angle 

Ps3 Compressor Discharge Static Pressure (psia) 

RU Ratio Unit Limiter 

Txx Temperature at Station xx (°R) 
NASA/TM—2011-217038 2 

I. Introduction 

The ability of an aircraft to use its engines to avert or recover from emergency situations is being investigated. 

The focus is on two general types of emergencies: (1) runway incursion, and (2) rudder/tail failures. In the runway 

incursion scenario, the aircraft’s available takeoff distance is suddenly decreased; this can be due, for instance, to an 

object entering the runway in the plane’s path. The availability of additional contingency thrust may enable safe 

takeoff in a shortened distance because the aircraft would reach takeoff speed sooner, thus averting disaster (Ref. 1). 

The rudder/tail failure scenario encompasses such problems as stuck or broken actuators, airframe damage, and 

damaged or missing flight control surfaces. Previous piloted studies (Refs. 2 and 3) with simulated total hydraulic 

failure demonstrated that landing an aircraft using only the throttles to maneuver the aircraft is extremely difficult 

due to the slow engine response times and the inability to damp out the phugoid and dutch roll modes. For this type 

of emergency situation, increasing the responsiveness of the engines in order to counter the phugoid and dutch roll 

modes is the primary goal. 

Both of these scenarios assume that the flight control can request additional performance from the engines. This 

requires a more tightly coupled flight and propulsion control system, and that the normal restrictions on engine 

performance for life and operability assurance be relaxed. In current aircraft, the pilot integrates the flight and 

propulsion systems manually though manipulation of the cockpit controls (“stick and rudder”) for maneuvering and 

throttle for thrust. In order to provide a more integrated approach that enables the propulsion system requirements to 

be set by the flight control system, a new flight control/engine control architecture must be implemented to allow for 

more information flow between the two systems. With the condition that the engine performance can be modified by 

the flight control system, the notion of risk management is introduced. A risk management architecture for enhanced 

engine operation is shown in Figure 1 (Ref. 4). In Figure 1, the pilot command (dashed) to the Engine Controller is 

diverted to the Enhanced Flight Control block which is connected to the Engine Controller. The architecture allows 

the flight control side to interact with the propulsion system in two ways. First, it can modify the engine controller 

directly to enable enhanced operation, as will be discussed below. Second, it can command thrust through the 

Enhanced Flight Control block to enable more coordinated use of the engines as flight control effectors. This type of 

integrated flight and propulsion control system augments the pilot’s interaction with the engine. The use of 

contingency thrust for runway incursion mitigation, symbolized by the idea of a virtual beyond maximum throttle, is 

the simplest implementation of this integrated mode. 

In this proposed risk management architecture, the flight control side is responsible for identifying the type of 

upset condition, e.g., airframe damage or obstruction in the runway, and the severity of the condition, and 

determining the engine performance requirement and the corresponding risk of engine failure that is acceptable. The 

engine control side is responsible for implementing the enhanced control mode to achieve the required response 

within the specified risk range or, if infeasible, reporting back what is achievable, and carrying out the command 

from the pilot and/or flight control system. Additionally, in a multi-engine aircraft, the flight controller must 

coordinate the enhancement of the engines’ performance to avoid creating an asymmetric thrust situation or other 

dangerous conditions that can arise as a result of the enhancement; these situations are beyond the scope of this 

paper since they are airframe integration issues. A detailed explanation of this proposed architecture may be found 

in Reference 4; some specifics of the implementation relative to this work are described below. 

The Engine and Controller subsystem in Figure 1 is represented by the Commercial Modular Aero-Propulsion System 

Simulation 40k (C-MAPSS40k), a 40,000 lb thrust class, two spool, physics-based, component level, high bypass turbofan 

engine simulation and closed loop controller written in the MATLAB/Simulink (The MathWorks, Inc.) environment 

(Ref. 5). The C-MAPSS40k simulation contains a representative commercial aircraft engine controller (Ref. 6), which will 

be summarized in Section III of this paper. 

The Control Mode Selector and Risk Management subsystem modifies the nominal engine controller to initiate 

“enhanced control modes.” These modes are designed and tuned off-line based on the risk of the modifications. The 

implementation of greater than nominal thrust is handled via the “overthrust” enhanced control mode. To increase 

the speed of the engine’s response to throttle commands, three different control modes are combined by the control 

mode selector: (1) increased controller bandwidth, (2) increased allowable core shaft acceleration, and (3) high 

speed idle. Each of these control modes has a different effect based on the current flight condition as well as the 

operational state of the engine. The implementation and details of each of these control modes will be discussed in 

Section III. 

 
NASA/TM—2011-217038 3 

Figure 1.—Proposed risk management architecture for enhanced operation (adapted from Ref. 4). In the 

proposed architecture, the pilot command (dashed) to the Engine Controller is diverted to the Enhanced 

Flight Control block which is connected to the Engine Controller. 

This paper focuses on the implementation of a proposed risk management architecture in the C-MAPSS40k 

simulation and the integration of enhanced engine modes. The enhanced control modes do not require any new 

actuators, rather they change engine control limits, change controller protection logic, and modify existing actuator 

inputs. Section II discusses the control mode selection and risk management subsystem. Section III describes both 

the nominal and enhanced engine control laws, and the engine life and operability prognosis subsystem is described 

in Section IV. A brief discussion of the pilot and flight control subsystems can be found in Section V. Section VI 

focuses on simulation results, and a summary can be found in Section VII. 

II. Control Mode Selection and Risk Management 

The Control Mode Selection and Risk Management (CMS) subsystem is responsible for ensuring that the engine 

provides the desired response within the specified risk range. The CMS system acts as a supervisor and coordinator 

of the propulsion control system by communicating with all the necessary subsystems to provide the enhanced 

performance as shown in Figure 2. The CMS receives information including the type of enhanced control required 

(overthrust, fast response, or both), flight condition, and acceptable risk from the flight control system. The 

acceptable risk indicates how aggressive the control mode selector can be in extending the current engine limits. The 

CMS provides the flight control with an estimate of the engine’s performance capability to allow the flight controller 

to update the performance request if required. The CMS evaluates each engine on a multi-engine aircraft 

independently; the flight controller coordinates the overall propulsion control enhancement based on the situation 

and each engine’s capabilities. 
NASA/TM—2011-217038 4 

Figure 2.—The interaction of the control mode selection and risk management subsystem with the proposed risk 

management architecture. 

In Reference 7, the risk of engine failure as a function of the time and amount of requested overthrust operation 

was quantified; increasing the operating time increased the risk of failure. Therefore, the flight controller is 

responsible for determining the expected duration for the requested additional power. In a case where the additional 

thrust is requested for takeoff, the flight controller may select a short duration, say 15 min, which anticipates a need 

for maintained excess power while the aircraft clears the runway and ground effect, into climb and includes a safety 

margin since the actual time to clear the ground effect and climb is less than 15 min. Alternately, when additional 

thrust is required to overcome excessive drag due to airframe damage, the flight controller may request additional 

thrust for 90 min, a worst case time estimate required to land at the nearest airport in the continental United States 

from the current position. Allowing the flight controller to only select a few discrete time durations (short: less than 

15 min, medium: less than 45 min, or extended: less than 90 min) greatly simplifies the communications and 

maintains somewhat conservative operation since the time estimate used in the risk calculation is greater than 

necessary. 

The CMS implements changes in the engine control by modifying the engine limits, controller bandwidth, and 

the protection logic. To determine the engine limits, the CMS passes information regarding the flight condition and 

acceptable risk to the Engine Life and Operability Prognosis subsystem. The Engine Condition Monitoring 

subsystem contains health management algorithms and life usage algorithms that determine the remaining engine 

life and operating margins. The Engine Life and Operability Prognosis subsystem, discussed in Section IV, 

computes the risk of activating a proposed control mode given the current conditions and state of the engine. Based 

on this query of the Engine Life and Operability Prognosis subsystem and concurrence from the flight controller, the 

CMS initiates modification of the engine controller’s limits and implements the desired enhanced control mode. 
NASA/TM—2011-217038 5 

III. Engine and Controller Subsystem 

The engine and controller subsystem is responsible for providing the additional engine performance in a way that 

ensures operation below the specified risk level. The interaction of the engine and controller subsystem is shown in 

Figure 1. This section discusses the changes made to the engine controller. 

The C-MAPSS40k simulation package contains a representative commercial aircraft engine controller (Ref. 6), 

which is shown in Figure 3. The engine controller is divided into two sections, the Power Management controller 

and Protection Logic controller. The power management controller is responsible for providing (1) the requested 

thrust and (2) an acceptable response (highest bandwidth possible with no overshoot) when transitioning from one 

thrust level to another. The amount of thrust produced is determined by converting the throttle position from the 

pilot to a controlled engine variable, typically Engine Pressure Ratio (EPR) or fan speed (Nf); C-MAPSS40k uses 

EPR. The conversion from throttle position to controlled variable is carried out by the setpoint function. When 

transitioning from one thrust level to another, the setpoint controller ensures that the engine does not exceed the 

desired value. The protection logic controller is responsible for ensuring that the engine does not violate any of its 

physical or operational limits. The limits of concern are the maximum rotor speeds, Nf max and Nc max; combustor 

pressure limits, Ps3 min and Ps3 max; acceleration limit, Accel; and a Ratio Unit limit, RU min. Reference 6 

contains a detailed description of the structure and function of the nominal control system found in C-MAPSS40k. 

In order to determine the effect of modifying the various limits in the nominal controller, a sensitivity study has been 

performed (Ref. 7). The results of the study led to the selection of the various enhanced control modes. A summary 

of the modifications required to enable the enhanced control modes for both overthrust and faster engine response 

(FastER) based on the results of the sensitivity study is found below. 

Figure 3.—C-MAPSS40k closed loop control system. 
NASA/TM—2011-217038 6 

A. Overthrust Operation 

In order for the engine to produce additional thrust, there are several modifications made to the engine control 

system. First, the setpoint function has to be extended beyond the current designed thrust level. To do this the tables 

that describe the engine pressure ratio (EPR) and fan speed (Nf) setpoints based on throttle position or Power Lever 

Angle (PLA) are linearly extrapolated out to 120 percent of maximum power. This also requires extending the 

C-MAPSS40k throttle limit from 80 to 90, where 90 correlates to 120 percent maximum power. The pilot would 

indicate that the emergency control mode is initiated and the setpoint commands to the engines would adjust to the 

appropriate values. To avoid a potential thrust asymmetry, these setpoints would be determined individually by the 

flight controller. 

Next, the nominal control logic might need to be altered. The protection logic controller is designed to prevent 

the engine from exceeding any of its physical and/or safety limits, which may constrain the additional thrust 

produced by the engine. From Reference 7, the engine is capable of producing additional thrust without extending 

the current engine limits, but it is often less than the 120 percent maximum power thrust sought. To allow the flight 

controller/pilot to determine the maximum thrust, logic is added to the individual control limiters to allow the CMS 

system to modify their limits in real time. 

The results of the sensitivity study showed that even with the nominal safety and operability limits in place, the 

risk of engine failure during overthrust can be unacceptably high due to an increase in the turbine temperatures. The 

turbine temperatures are typically not automatically controlled in commercial aircraft engines; therefore, to be able 

to produce additional thrust while minimizing the risk of failure, a turbine temperature limiter is added to the 

protection logic controller that will be activated only in emergency scenarios. The temperature limiter added to 

C-MAPSS40k is an exhaust gas temperature (T50) limiter, as that is the only temperature sensor found in the hot 

section of the engine. 

B. Faster Engine Response 

In this implementation there are three modifications made to the controller to increase the responsiveness of the 

aircraft engine. They address different types of throttle changes, so their impact depends on the way the engine is 

used. The first modification is to increase the bandwidth of the setpoint controller. This is accomplished by 

increasing the integrator term of the proportional-integral (PI) controller by a value determined by the control mode 

selector. The sensitivity study determined that the integrator term can be safely increased by a factor of up to 1.6 

without causing unacceptable loss of stability margins (Ref. 7). 

The second modification made to the engine controller is to add an offset to the acceleration schedule. This 

allows a faster response to large throttle transients, which are mainly limited by the acceleration schedule, at the cost 

of decreasing the minimum high pressure compressor (HPC) surge margin. This offset must be determined as a 

function of the flight condition, engine health estimate, and the desired minimum surge margin. The desired 

minimum surge margin is determined by the control mode selector based on the risk level the flight controller is 

willing to accept. The closer the minimum surge margin is to zero, the greater the risk that this engine will surge. 

The final modification to increase the responsiveness of the engine is to implement a control mode known as 

High Speed Idle (HSI) (Ref. 8). High Speed Idle is an enhanced control mode that is only active when the pilot has 

the throttle near the Flight Idle setting—typically used on approach and landing. When in flight idle the engine is 

operating at very low power, with correspondingly low fan and core shaft speeds. These low speeds inhibit rapid 

acceleration because of the large difference in the fan and core inertias, resulting in shaft acceleration mismatch that 

can lead to HPC surge. The idea of this control mode then is to force the engine to operate at a higher internal power 

setting while still producing the low level of thrust the pilot needs to land. By maintaining higher flight idle shaft 

speeds, the engine can accelerate more quickly than a nominal engine, regardless of the size of the throttle transient, 

age of the engine, ambient conditions, etc. In order to maintain the nominal thrust level, the HSI control mode 

modifies the HPC inlet variable stator vane angle, the customer bleed, and the idle setpoint. More information 

regarding this control mode can be found in References 7 and 8. 

IV. Engine Life and Operability Prognosis 

The extent to which engine limits can be adjusted while ensuring that the acceptable risk level is not exceeded is 

determined by the current condition of the engine. Various blade speeds, component temperatures, and the overall 

component deterioration levels must be factored into the risk calculation (Ref. 9). Depending on the requested 

enhancement, the prognosis system will use different methods to calculate risk: the overthrust mode requires 

calculations based on steady state turbine blade characteristics, while the faster engine response mode depends upon 
NASA/TM—2011-217038 7 

available surge margin and the transient-related reduction. In the case of overthrust, the engine is exposed to harsh 

temperatures and speeds necessitating that the life of individual components be tracked to avoid catastrophic failure. 

Within the prognosis system there is a database of engine characteristics to compute the expected turbine blade life 

based on stress and temperature. The lives of a population of similar parts subjected to the same conditions will vary 

according to a distribution. Assuming that component life is probabilistic, the combined risk for many parts can be 

quantified into a single tangible risk distribution. The Weibull distribution is a continuous probability distribution 

used to calculate the risk of failure versus time. By combining risk distributions for various failure modes and 

operating conditions, it is possible to determine whether the overall risk is within the specified range. 

For a faster engine response, the potential for HPC surge becomes the foremost issue. Engines are normally 

operated well below their surge line to account for worst case uncertainty in destabilizing influences while still 

ensuring safety. In order to be able to increase engine response aggressively, this safety surge margin must be 

reduced. By accounting for random and systematic variances, it is possible to estimate the current engine surge 

margin to within some degree of error (Ref. 10). This improved knowledge allows limits to be set closer to engine 

surge with high confidence that the engine will continue to operate with steady flows even during transients. 

Using the life prognosis subsystem, it is possible to calculate the risk of operating in a desired state for a given 

time based on the current engine state. The interaction between the CMS and the Engine Life and Operability 

Prognosis Subsystem should result in obtaining controller limits that guarantee that a maximum level of risk will not 

be exceeded. To avoid time-consuming and computationally intensive iterations during a crucial time, in this 

implementation lookup tables were generated. For these tables, data are pre-saved at multiple trim points throughout 

the flight envelope, and scheduled across four dimensions: risk, altitude, temperature, and engine life. Due to the 

high non-linearity of risk, these tables require many interpolation points in every dimension. In order to reduce the 

size of these tables, the risk dimension is limited to a few discrete levels. This method is adequate under the 

assumption that the acceptable risk provided by the flight controller will always be relatively inexact. When creating 

the risk tables, the risk is rounded up to the closest predetermined risk level, resulting in additional conservatism. 

This combination of discrete risk levels and look-up tables allows engine limits to be calculated with a single series 

of interpolations. 

V. Pilot and Flight Control 

There are many viewpoints on the interaction between pilot and flight controller in an emergency. For the 

purposes of this work, it is assumed that the pilot initiates the automatic restructuring of the control system to enable 

enhanced engine operation. Consider the runway incursion emergency. In this situation, while the aircraft is 

approaching takeoff speed, the pilot notices or is notified of an obstruction in the runway. If the pilot determines that 

stopping or turning to avoid the obstacle is not viable options, he/she could, for instance, press an EMERGENCY 

switch, alerting the flight control system that there is an emergency. Since the flight controller is aware that the 

aircraft is on the runway attempting to take off, the flight controller indicates to the control mode selector to enter 

the overthrust control mode and to allow the pilot to command additional performance for a short duration, 

sufficient to enter climb, and below a determined risk level. The engine control system will then update to provide 

the additional performance, in accordance with the specified acceptable risk level, allowing the pilot to move the 

throttle to a higher power setting and clear the obstruction. 

The rudder/tail failure scenario is a little more complicated. After airframe, flight control surface, or actuator 

damage, maneuverability might be severely degraded. In this situation, either the flight controller identifies and 

isolates the problem with the airframe and notifies the pilot, or the pilot notices that the handling capabilities have 

suddenly changed dramatically. If the loss of maneuverability is significant enough, the pilot may need to use the 

engines as additional flight control actuators. In this case, the pilot presses the EMERGENCY switch to request 

additional performance from the engine. The flight controller analyzes the situation, determines that that the engine 

responsiveness needs to increase, determines the engine risk level that the aircraft is willing to accept, and passes the 

information to the control mode selector. Again, the CMS will get the current state of the engine from the Life and 

Operability Prognosis subsystem and command new control limits and/or logic changes. This will result in the 

engines responding faster to the pilot’s commands, giving the pilot a better chance to land the plane safely. 
NASA/TM—2011-217038 8 

VI. Simulation Results 

To demonstrate how the enhanced control operation works, the engine control system enhanced operation 

functions are implemented in the C-MAPSS40k closed loop engine simulation. A block diagram of this controller 

architecture is shown in Figure 4. The inputs to the control mode selector simulation are assumed to be the actual 

outputs from the flight controller: the type of enhanced control mode, acceptable risk level, and flight condition. 

To fully test this architecture, both a runway incursion and rudder/tail failure emergency scenario will be 

simulated. First consider the runway incursion scenario. In this simulation, the pilot will identify the situation and 

indicate it by pressing the EMERGENCY switch at 10 sec into the run. This causes the flight controller to determine 

that there is an obstruction on the runway, request additional thrust, and specify the maximum risk level and the 

approximate time the additional thrust is requested for. The pilot indicates that the engine setpoint is to move past 

the maximum power setting (PLA = 80) to maximum emergency full power thrust (PLA = 90), which in this 

implementation is up to 120 percent full power. Note that the required thrust is dictated by the situation and the 

available thrust is limited by the acceptable risk, so the maximum may not reach 120 percent full power. An engine 

response for each of four different levels of acceptable risk is shown in Figure 5. This scenario depicts an aircraft 

with an end of life engine (severely deteriorated) taking off from Denver International Airport (altitude of 5,431 ft 

above sea level), which is a worst case take-off scenario. 

Figure 4.—CMS and engine controller interaction implemented in C-MAPSS40k. 
NASA/TM—2011-217038 9 

Figure 5.—Overthrust engine response for an end of life engine at 5,431 ft elevation, 

0.17 Mach, at standard day temperature for different levels of acceptable risk 

(shown in legend). 

Figure 5 shows that increasing the acceptable risk increases the thrust produced by the engine and 

correspondingly increases the other engine variables. For an acceptable risk level of 5 percent, only the nominal 

turbine temperature limit (1500 °R) is violated, however increasing the acceptable risk to 10 percent or greater, the 

fan speed also violates its limit. With increased engine outputs and risk, the thrust output also increases. 

Now consider an approach scenario with a damaged airframe where at a time of 20 sec the pilot executes the 

emergency control mode. After pressing the EMERGENCY switch, the pilot moves the throttle from a flight idle 

position (43) up to 50. The engine response compared to the nominal engine response is shown in Figure 6. The 

engine response for the same scenario, but a throttle input from flight idle to maximum power is shown in Figure 7. 

Figures 6 and 7 depict an aircraft approaching JFK International Airport in New York (which is at an elevation of 

13 ft above sea level). In this situation the aircraft is 2,000 ft above the runway. 

In the simulations shown in Figures 6 and 7, at a time of 20 sec the high speed idle control mode is activated 

since an emergency situation has been detected and the engine is near flight idle. When High Speed Idle is initiated, 

there is an increase in the core speed and exhaust gas temperate (T50) and a decrease in the HPC surge margin, as 

shown in both figures. The improvement with the enhanced operation is greater in Figure 7 than that shown in 

Figure 6 due to the fact that, with the nominal control, a large throttle transient encounters more limits than a small 

transient. Thus there are more potential controller modifications available to improve the response to a large throttle 

transient. For the smaller throttle transient (Fig. 6), the PI gain modification and the high speed idle control mode 

affect the engine response. For the larger throttle transient (Fig. 7), the PI gain modification, the high speed idle 

control mode, and the acceleration schedule modification affect the engine response.

0 5 10 15 20 25 30

2.7

2.8

2.9

3

3.1

3.2

3.3

3.4

x 104

Thrust, lbf

0 5 10 15 20 25 30

3900

3950

4000

4050

4100

4150

4200

4250

Nf, RPM

0 5 10 15 20 25 30

1.15

1.16

1.17

1.18

1.19

1.2

1.21

1.22

x 104

Nc, RPM

Time, s

0 5 10 15 20 25 30

1450

1500

1550

1600

1650

T50,  R

Time, s

Critical High Medium Low Limit
NASA/TM—2011-217038 10 

Figure 6.—Enhanced operation compared to the nominal response for a new 

engine at 2,013 ft above sea level (2,000 ft above the runway), 0.26 Mach, at 

standard day temperature for a small throttle transient (7) starting at flight idle. 

Figure 7.—Enhanced operation compared to the nominal response for a new engine 

at 2,013 ft above sea level (2,000 ft above the runway), 0.26 Mach, at standard 

day temperature for a large throttle transient from flight idle to full power. 

20 25 30 35

2000

4000

6000

8000

10000

Thrust, lbf

20 25 30 35

9000

9500

10000

10500

Nc, RPM

20 25 30 35

1000

1100

1200

1300

T50,  R

Time, s

20 25 30 35

15

20

25

30

35

40

Surge Margin, %

Time, s Nominal Enhanced

20 25 30 35

0

0.5

1

1.5

2

2.5

3

x 104

Thrust, lbf

20 25 30 35

0.9

0.95

1

1.05

1.1

1.15

1.2

x 104

Nc, RPM

20 25 30 35

1000

1100

1200

1300

1400

1500

1600

T50,  R

Time, s

20 25 30 35

0

10

20

30

40

Surge Margin, %

Time, s

Nominal Enhanced
NASA/TM—2011-217038 11 

VII. Summary 

This paper focused on one implementation of a control architecture intended to increase the performance of 

aircraft engines under emergency scenarios. In order to increase the survivability of the aircraft in some situations, it 

may be necessary to overstress the engines to obtain additional thrust or increase their responsiveness to the pilot’s 

throttle command. In this new architecture, the flight controller is tasked with analyzing the aircraft’s situation and 

determining engine requirements with a corresponding maximum risk the engine should incur. The engine control 

system is responsible for determining the current state of each engine (life and health), determining how to extend 

the engine limits to maximize performance for the risk level determined by the flight controller, and for producing 

the additional performance without exceeding the acceptable risk level. The engine control system functions have 

been integrated with a version of the Commercial Modular Aero-Propulsion System Simulation 40k and the flight 

control system commands have been added as inputs to the simulation to illustrate the concept. 

References 

1. Litt, J.S., Frederick, D.K., and Guo, T.-H., “The Case for Intelligent Propulsion Control for Fast Engine 

Response,” AIAA–2009–1876, AIAA Infotech@Aerospace Conference, Seattle WA, June 6–9, 2009. 

2. Burcham, F.W., Jr., and Fullerton, C.G., “Controlling Crippled Aircraft—With Throttles,” NASA TM-104238, 

1991. 

3. Burcham, F.W., Jr., Fullerton, C.G., and Maine, T.A., “Manual Manipulation of Engine Throttles for 

Emergency Flight Control,” NASA/TM—2004-212045, January 2004. 

4. Guo, T.-H, and Litt, J.S., “Risk Management for Intelligent Fast Engine Response Control,” AIAA–2009–1973, 

AIAA Infotech@Aerospace Conference, Seattle, WA, April 6–9, 2009. 

5. May, R.D., Csank, J., Lavelle, T.M., Litt, J.S., and Guo, T.-H., “A High-Fidelity Simulation of a Generic 

Commercial Aircraft Engine and Controller,” AIAA–2010–6630, 46th AIAA Joint Propulsion Conference & 

Exhibit, Nashville, TN, July 25–28, 2010. 

6. Csank, J., May, R.D., Litt, J.S., and Guo, T.-H., “Control Design for a Generic Commercial Aircraft Engine,” 

AIAA–2010–6629, 46th AIAA Joint Propulsion Conference & Exhibit, Nashville, TN, July 25–28, 2010. 

7. Csank, J., May, R.D., Litt, J.S., Guo, T.-H., “A Trade-off Study of Commercial Aircraft Engine Response for 

Emergency Situations,” To be published as a NASA TM. 

8. Csank, J., May, R.D., Guo, T.-H., Litt, J.S., “Improving Engine Responsiveness during Approach through High 

Speed Idle Control,” To be published with AIAA. 

9. Litt, J.S., Sharp, L.M., and Guo, T.-H., “A Risk Assessment Architecture for Enhanced Engine Operation,” 

AIAA–2010–3469, AIAA Infotech@Aerospace 2010, April 20–22, 2010, Atlanta, GA., July 2010. 

10. Litt, J.S., and Guo, T.-H., “Fast Thrust Response for Improved Flight/Engine Control under Emergency 

Conditions,” AIAA–2008–6503, AIAA Guidance, Navigation and Control Conference and Exhibit, Honolulu, 

HI, August 18–21, 2008. 
REPORT DOCUMENTATION PAGE Form Approved 

OMB No. 0704-0188 

The public reporting burden for this collection of information is estimated to average 1 hour per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the 

data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this 

burden, to Department of Defense, Washington Headquarters Services, Directorate for Information Operations and Reports (0704-0188), 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA 22202-4302. 

Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB 

control number. 

PLEASE DO NOT RETURN YOUR FORM TO THE ABOVE ADDRESS. 

1. REPORT DATE (DD-MM-YYYY)

01-07-2011 

2. REPORT TYPE

Technical Memorandum 

3. DATES COVERED (From - To)

4. TITLE AND SUBTITLE

Implementation of Enhanced Propulsion Control Modes for Emergency Flight Operation 

5a. CONTRACT NUMBER

5b. GRANT NUMBER

5c. PROGRAM ELEMENT NUMBER

6. AUTHOR(S)

Csank, Jeffrey, T.; Chin, Jeffrey, C.; May, Ryan, D.; Litt, Jonathan, S.; Guo, Ten-Huei 

5d. PROJECT NUMBER

5e. TASK NUMBER

5f. WORK UNIT NUMBER

WBS 284848.02.05.03.10 

7. PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES)

National Aeronautics and Space Administration 

John H. Glenn Research Center at Lewis Field 

Cleveland, Ohio 44135-3191 

8. PERFORMING ORGANIZATION

 REPORT NUMBER

E-17744 

9. SPONSORING/MONITORING AGENCY NAME(S) AND ADDRESS(ES)

National Aeronautics and Space Administration 

Washington, DC 20546-0001 

10. SPONSORING/MONITOR'S

 ACRONYM(S)

NASA 

11. SPONSORING/MONITORING

 REPORT NUMBER

NASA/TM-2011-217038 

12. DISTRIBUTION/AVAILABILITY STATEMENT

Unclassified-Unlimited 

Subject Categories: 07 and 63 

Available electronically at http://www.sti.nasa.gov 

This publication is available from the NASA Center for AeroSpace Information, 443-757-5802

13. SUPPLEMENTARY NOTES

14. ABSTRACT

Aircraft engines can be effective actuators to help pilots avert or recover from emergency situations. Emergency control modes are being 

developed to enhance the engines’ performance to increase the probability of recovery under these circumstances. This paper discusses a 

proposed implementation of an architecture that requests emergency propulsion control modes, allowing the engines to deliver additional 

performance in emergency situations while still ensuring a specified safety level. In order to determine the appropriate level of engine 

performance enhancement, information regarding the current emergency scenario (including severity) and current engine health must be 

known. This enables the engine to operate beyond its nominal range while minimizing overall risk to the aircraft. In this architecture, the 

flight controller is responsible for determining the severity of the event and the level of engine risk that is acceptable, while the engine 

controller is responsible for delivering the desired performance within the specified risk range. A control mode selector specifies an 

appropriate situation-specific enhanced mode, which the engine controller then implements. The enhanced control modes described in this 

paper provide additional engine thrust or response capabilities through the modification of gains, limits, and the control algorithm, but 

increase the risk of engine failure. The modifications made to the engine controller to enable the use of the enhanced control modes are 

described, as are the interaction between the various subsystems and importantly, the interaction between the flight controller/pilot and the 

propulsion control system. Simulation results demonstrate how the system responds to requests for enhanced operation and the 

corresponding increase in performance. 

15. SUBJECT TERMS

Turbofan; Control; Engine control 

16. SECURITY CLASSIFICATION OF: 17. LIMITATION OF

 ABSTRACT

UU 

18. NUMBER

 OF 

 PAGES

17 

19a. NAME OF RESPONSIBLE PERSON

STI Help Desk (email:help@sti.nasa.gov) 

a. REPORT

U 

b. ABSTRACT

U 

c. THIS 

PAGE

U 

19b. TELEPHONE NUMBER (include area code)

443-757-5802 

Standard Form 298 (Rev. 8-98)

Prescribed by ANSI Std. Z39-18