Gregory E. McGlynn

Northwestern University, Evanston, Illinois

Jonathan S. Litt

Glenn Research Center, Cleveland, Ohio

Kimberly A. Lemon 

Wichita State University, Wichita, Kansas

Jeffrey T. Csank

Glenn Research Center, Cleveland, Ohio

A Risk Management Architecture for 

Emergency Integrated Aircraft Control

NASA/TM—2011-217143

December 2011

AIAA–2011–1568
NASA STI Program . . . in Profile

Since its founding, NASA has been dedicated to the 

advancement of aeronautics and space science. The 

NASA Scientific and Technical Information (STI) 

program plays a key part in helping NASA maintain 

this important role.

The NASA STI Program operates under the auspices 

of the Agency Chief Information Officer. It collects, 

organizes, provides for archiving, and disseminates 

NASA’s STI. The NASA STI program provides access 

to the NASA Aeronautics and Space Database and 

its public interface, the NASA Technical Reports 

Server, thus providing one of the largest collections 

of aeronautical and space science STI in the world. 

Results are published in both non-NASA channels 

and by NASA in the NASA STI Report Series, which 

includes the following report types:

• TECHNICAL PUBLICATION. Reports of 

completed research or a major significant phase 

of research that present the results of NASA 

programs and include extensive data or theoretical 

analysis. Includes compilations of significant 

scientific and technical data and information 

deemed to be of continuing reference value. 

NASA counterpart of peer-reviewed formal 

professional papers but has less stringent 

limitations on manuscript length and extent of 

graphic presentations.

• TECHNICAL MEMORANDUM. Scientific 

and technical findings that are preliminary or 

of specialized interest, e.g., quick release 

reports, working papers, and bibliographies that 

contain minimal annotation. Does not contain 

extensive analysis.

• CONTRACTOR REPORT. Scientific and 

technical findings by NASA-sponsored 

contractors and grantees.

• CONFERENCE PUBLICATION. Collected 

papers from scientific and technical 

conferences, symposia, seminars, or other 

meetings sponsored or cosponsored by NASA.

• SPECIAL PUBLICATION. Scientific, 

technical, or historical information from 

NASA programs, projects, and missions, often 

concerned with subjects having substantial 

public interest.

• TECHNICAL TRANSLATION. Englishlanguage translations of foreign scientific and 

technical material pertinent to NASA’s mission.

Specialized services also include creating custom 

thesauri, building customized databases, organizing 

and publishing research results.

For more information about the NASA STI 

program, see the following:

• Access the NASA STI program home page at 

http://www.sti.nasa.gov

• E-mail your question via the Internet to help@

sti.nasa.gov

• Fax your question to the NASA STI Help Desk 

at 443–757–5803

• Telephone the NASA STI Help Desk at

443–757–5802

• Write to:

 NASA Center for AeroSpace Information (CASI)

 7115 Standard Drive

 Hanover, MD 21076–1320
Gregory E. McGlynn

Northwestern University, Evanston, Illinois

Jonathan S. Litt

Glenn Research Center, Cleveland, Ohio

Kimberly A. Lemon 

Wichita State University, Wichita, Kansas

Jeffrey T. Csank

Glenn Research Center, Cleveland, Ohio

A Risk Management Architecture for 

Emergency Integrated Aircraft Control

NASA/TM—2011-217143

December 2011

AIAA–2011–1568

National Aeronautics and

Space Administration

Glenn Research Center

Cleveland, Ohio 44135

Prepared for the

Infotech@Aerospace 2011 Conference

sponsored by the American Institute of Aeronautics and Astronautics

St. Louis, Missouri, March 29–31, 2011
Acknowledgments

The authors thank Ryan May for his help and contributions, and the Integrated Resilient Aircraft Control project of the Aviation 

Safety Program for funding this work. In addition, Greg McGlynn thanks the NASA Aeronautics Scholarship Program for financial 

support. 

Available from

NASA Center for Aerospace Information

7115 Standard Drive

Hanover, MD 21076–1320

National Technical Information Service

5301 Shawnee Road

Alexandria, VA 22312

Available electronically at http://www.sti.nasa.gov

Trade names and trademarks are used in this report for identification 

only. Their usage does not constitute an official endorsement, 

either expressed or implied, by the National Aeronautics and 

Space Administration.

Level of Review: This material has been technically reviewed by technical management. 
NASA/TM—2011-217143 1

A Risk Management Architecture for 

Emergency Integrated Aircraft Control

Gregory E. McGlynn

Northwestern University

Evanston, Illinois 60208

Jonathan S. Litt

National Aeronautics and Space Administration

Glenn Research Center

Cleveland, Ohio 44135

Kimberly A. Lemon*

Wichita State University

Wichita, Kansas 67260

Jeffrey T. Csank

National Aeronautics and Space Administration

Glenn Research Center

Cleveland, Ohio 44135

Abstract

Enhanced engine operation—operation that is beyond normal limits—has the potential to improve the 

adaptability and safety of aircraft in emergency situations. Intelligent use of enhanced engine operation to 

improve the handling qualities of the aircraft requires sophisticated risk estimation techniques and a risk 

management system that spans the flight and propulsion controllers. In this paper, an architecture that 

weighs the risks of the emergency and of possible engine performance enhancements to reduce overall 

risk to the aircraft is described. Two examples of emergency situations are presented to demonstrate the 

interaction between the flight and propulsion controllers to facilitate the enhanced operation.

1.0 Introduction

In emergency situations, aircraft engines can be used as actuators to improve the capability and 

controllability of the aircraft. There are several examples of pilots using this technique in an attempt to 

recover and land a severely impaired aircraft. In 1972, an American Airlines DC-10 landed safely in 

Detroit after suffering damage that resulted in a stuck, offset rudder as well as partial elevator loss;1 the 

pilot used asymmetric thrust to maintain heading.2 In the 1985 JAL 123 accident, the Boeing 747 lost all 

hydraulics as well as suffering severe vertical tail loss, which excited the dutch roll (coupled yaw and roll

oscillations) and phugoid (long period pitch oscillations) modes. The pilots used asymmetric thrust to 

regain limited directional control but ultimately failed to recover and crashed with tremendous loss of 

life.

3 In the 1989 DC-10 accident in Sioux City, Iowa, the plane lost hydraulic power to all flight control 

surfaces, and there was some tail damage. Here, the phugoid was much more of a problem than the dutch 

roll, and the crew was able to maintain enough control through modulation of engine thrust to crash land 

the aircraft and save a majority of the passengers.

4 In 2003, a DHL cargo plane climbing out of Baghdad 

was hit by a missile, causing loss of all hydraulics and wing damage. The pilots were able to successfully 

return to the airport and land using only the throttles to control the aircraft.

 *

NASA Co-op student
NASA/TM—2011-217143 2

In the aftermath of the Sioux City accident, NASA began investigating the use of throttles-only flight 

control. Several airframe configurations were studied, and it was found that the severity of the dutch roll 

and phugoid modes depends on multiple factors, but in general the engine response is too sluggish to be 

used to damp out the dutch roll, and the administration of thrust pulses to damp dutch roll may actually 

exacerbate it.

5 As the above examples demonstrate, use of the engines to modulate the aircraft’s dynamic 

behavior can improve the chance of survival in an emergency; however, the engine response may need to 

be improved to fully realize this benefit.

In this paper we consider two specific emergency scenarios: vertical tail damage and runway 

incursion. Damage to the vertical tail can be detrimental in two ways. First, a reduction in the area of the 

vertical tail will reduce the directional stability of the aircraft. Second, if the rudder is disabled, the main 

control surface used for active yaw damping is lost. In the event of vertical tail damage, the dutch roll 

mode, which involves coupled yaw and roll oscillations, becomes much harder to control and in the worst 

case may be unstable. The dutch roll is often the least stable lateral-directional mode, and many planes 

rely on an automatic yaw damper to keep it manageable. One way to help recover directional stability is 

to use differential engine thrust to produce yawing moments. However, flight tests and simulator studies 

have shown that landing a plane safely using only engine thrust is extremely difficult, in part because 

engine response times, which are on the order of seconds, are much slower than conventional flight 

control surfaces.6 This is problematic because the dutch roll period is also on the order of seconds. For 

this reason, controlling the dutch roll with engine thrust is difficult and can even be counterproductive, 

possibly resulting in pilot induced oscillations that exacerbate the situation.

6

Engine response time to a throttle input can be improved by modifying the engine controller. Such a 

modification carries risk, however, because it might cause a compressor stall. A throttle transient produces a 

temporary drop in compressor stall margin, and the amount of this drop increases (i.e., the stall margin is 

further reduced) if the acceleration of the engine is increased to improve response time. The stall margin 

cannot be directly measured, but in normal operation engine acceleration is conservatively limited to 

provide positive stall margin even in worst-case circumstances (end-of-life engine, high inlet distortion, 

etc.). If the engine acceleration is pushed faster than normal, the risk of compressor stall increases.

The second emergency scenario we consider is runway incursion. Several serious accidents or nearaccidents have resulted when pilots mistakenly attempted to take off on a runway that is too short or when

an obstacle was present on the runway during takeoff.

7,8 The ability to command more than the nominal 

maximum thrust (overthrust) in emergencies, pushing the engines beyond their normal safety limits,

might enable pilots to avert such disasters by shortening the runway distance required for takeoff.

In this paper we present an architecture for an on-line intelligent system for managing multiple sources 

of risk to an aircraft. The structure proposed is a general one that is able to balance the risk of exceeding 

engine limits with the risk of the emergency situation. Examples of the risk management architecture’s 

application to both the vertical tail damage case and the runway incursion case are presented. Finally the 

challenges that future work presents are discussed.

2.0 Risk Management Architecture

The risk management architecture9 shown in Figure 1 consists of the flight and propulsion control 

systems and the interactions between them. Components of the architecture compute the risk to the engine 

of operating in an enhanced control mode, and in conjunction with the flight control, determine which 

propulsion control mode to implement based on the type of emergency and the severity of the situation.

Looking at Figure 1, the Engine Operability Risk Models block estimates the increased risk due to engine 

stall to achieve a faster-than-normal engine response; this enhanced propulsion control mode can be used 

for yaw control. The Engine Life Prognosis Models block estimates the increased risk of engine failure 

due to operating the engine beyond its normal maximum for a given time; this enhanced propulsion 

control mode can be used to provide additional thrust to avoid an object on the runway.
NASA/TM—2011-217143 3

2.1 Balancing Risks

During an emergency situation it may be acceptable to assume a reasonable additional risk of engine 

failure in order to safely land or control the distressed aircraft. The question is how to balance the risk that 

enhanced operation poses to the engine against the risk that the emergency situation poses to the plane. 

The goal is to maximize the probability that the plane is able to land safely.

The two risks (to the engine and to the aircraft) are modeled as independent probabilities and 

combined to get a total probability of failure for the mission. Only two outcomes are recognized for the 

engine: it will either perform as desired or not. Aggressive use will significantly increase the probability 

of damage or stall; in either case, the engine will not be able to fulfill its mission. Even if the engine 

suffers a relatively mild, recoverable compressor stall, its unavailability at a critical moment could be 

disastrous. Therefore, the engine risk is modeled as a continuous function valued from essentially zero for 

normal operation up to one for extremely aggressive operation, representing the probability that the 

engine will not be able to perform as desired. That is, as the desired performance becomes more 

demanding, the probability of failure increases.

The situational risk is a continuous function based on a model of airframe recovery and landing, 

representing the likelihood that the passengers can be saved given the situation and an assumed engine 

performance. After the Sioux City accident, the National Transportation Safety Board conducted 

simulator studies and concluded that the crippled aircraft “could not have been successfully landed on a 

runway with the loss of all hydraulic flight controls,” and that “under the circumstances the UAL flight 

crew performance ... greatly exceeded reasonable expectations.”4 This underscores that a spectrum of 

success can be identified. The probability of achieving some level of success depends on many factors 

including the level of uncertainty in the pilot’s awareness of the situation, variation in pilot skill, and 

weather conditions; the combination of these enables the situational risk to be defined.

Figure 1.—Risk management architecture.
NASA/TM—2011-217143 4

Figure 2.—Risk minimization.

In the presence of these competing risks, the optimal action is the engine response that results in the 

highest probability of overall success. The probability of success is the probability that the engine does 

not fail multiplied by the probability that the plane lands relatively safely. The total probability of failure 

should be minimized. If risk is the probability of failure (1 minus the probability of success), then the 

quantitative relationship between engine risk, Rengine, situational risk, Rsituation, and total risk, Rtotal, is

defined as follows.

Rtotal = 1 – (1 – Rengine) × (1 – Rsituation)

Both of these are functions of the capability of the engine: engine risk is higher when the engine is pushed 

to respond faster, but situational risk is lower because the plane can better respond to the emergency. This 

inverse relationship is shown in Figure 2. Combining the two sources of risk in this way gives the overall 

risk to the plane as a function of the capability of the engine, which can be used to determine the optimal 

level of enhancement to request from the engine.

Casting the problem of balancing risk as a minimization problem is useful because it is a simple 

process that is straightforward to generalize. For instance, consider a plane that has four engines and each 

has a different risk model. In this case, the problem is to decide on the appropriate enhancement 

commands to send to each of the engines. The situational risk model will take as inputs the capabilities of 

each of the four engines. The overall problem becomes the minimization of the total risk on the multidimensional domain of all possible engine enhancement configurations. 

2.2 Risk Communication Model

The process of risk estimation and minimization is accomplished via cooperation between the engine 

controller and the flight controller. The engine controller possesses a risk model that gives the relationship 

between engine risk and engine capability. The flight controller possesses a risk model that gives the 

relationship between situational risk and engine capability. Since the propulsion system is being used as a 

flight control actuator, the flight controller is the one “in charge.” In appropriate emergency situations, the 

flight controller initiates a process in which it queries the engine controller to obtain the engine risk vs. 

capability model and combines that with its situational risk model to determine the optimal level of 

engine enhancement. It then delivers the enhancement command to the engine controller, which 

implements the enhancement. This process might run once or repeatedly, depending on the nature of the 

emergency and changing circumstances. The relationships between the three risks and engine capability 

are shown in Figure 2.
NASA/TM—2011-217143 5

2.3 Engine Risk

Knowledge of the relationship between engine risk and engine performance is necessary to minimize 

the total risk. Such a relationship is very complex as it relies on many variables including operating 

conditions, size of throttle transients, and engine degradation. For the overthrust case, using the engine 

beyond its designed maximum speed and temperature can severely shorten its life, and it significantly 

increases the risk of turbine blade liberation or disk burst. For fast response, the engine has a greatly 

increased likelihood of stalling. The controller is designed to maintain engine operation within bounds so 

that, under normal circumstances, the engine life and operability are predictable and safe. Once these 

bounds are exceeded through the use of an enhanced operation mode, there is greater uncertainty, and the 

risk is significantly increased. Any failure that prevents the engine from performing as desired can be 

catastrophic in an emergency.10

2.4 Situational Risk

2.4.1 Vertical Tail Damage

Damage to the vertical tail has a significant impact on the aircraft’s ability to damp out dutch roll. 

This has the effect of driving the flight dynamics toward instability, making the plane potentially much 

harder to land. We estimate a quantitative probability that a plane can land safely based on observed 

relationships between Cooper-Harper ratings of flying qualities11 and objective quantitative information 

about the handling of the aircraft. Several studies have investigated the effect of the natural frequency and 

damping ratio of the dutch roll oscillation on flying qualities ratings.

12,13,14 They have found useful 

correlations between Cooper-Harper ratings and the damping ratio, natural frequency, and roll-to-sideslip 

ratio of the dutch roll. These studies provide a basis for an automatic quantitative assessment of the risk of 

landing in a given aircraft configuration. Any analysis of the controllability of the aircraft makes an 

assumption about the vehicle’s dynamic behavior, which is influenced by not only the damage, the extent 

of which might not be known, but the flight condition.

We construct an example of an automatic risk assessment of the dutch roll oscillation based on flying 

qualities specifications for military aircraft, found in the handbook MIL-HDBK-1797. This document sets

three minimum requirements: one on the natural frequency, one on the damping ratio, and one on the 

product of the two, which can be modified depending on the roll-to-sideslip ratio of the oscillation.

15

Additionally, MIL-HDBK-1797 specifies three “levels” of flying qualities: Level 1, “satisfactory,” Level 

2, “acceptable,” and Level 3, “controllable.” Level 3 is “not necessarily defined as safe.” It is assumed

that an aircraft that satisfies the military Level 2 requirements for the dutch roll will be safe to land. This 

gives a region in the parameter space of flying qualities that carries 0% risk. On the other hand, it is

assumed that an aircraft with a dutch roll natural frequency of zero or damping ratio of zero cannot be 

landed safely. The dutch roll natural frequency is related to the sideforce due to the sideslip term. A dutch 

roll natural frequency of zero would represent an aircraft with no tendency to automatically correct 

sideslips, and so it would be very difficult to maintain heading accurately enough to land. Zero damping 

would mean that dutch roll oscillations, once excited, would have no natural tendency to decrease with 

time, and these constant oscillations would again make landing very difficult. A negative damping ratio 

would be even worse, corresponding to exponentially growing oscillations. This region in the parameter 

space carries 100% risk. 

In the region between 0% and 100% risk, interpolation is used to estimate the risk for marginal 

configurations. Denoting dutch roll damping ratio by ζ and natural frequency (in rad/s) by ω, the 

interpolation is defined piecewise in the ζ-ω plane. The risk interpolation function is defined piecewise on 

three regions, corresponding to the three minimum requirements. Risk is represented as a probability of 

mission failure between 0 and 1. The risk estimation function is given below.

The military requirements for Level 2 flying qualities are

ζ ≥ A and ω ≥ B and ζω ≥ C
NASA/TM—2011-217143 6

with the values A = 0.02, B = 0.4, C = 0.05 for a transport aircraft with sufficiently low dutch roll roll-tosideslip ratio in the landing phase of flight. In terms of these values, risk is estimated in various numbered 

regions of the ζ-ω plane (shown in Figure 3) as follows:

Region 1: For ζ ≥ A and ω ≥ B and ζω ≥ C risk = 0

Region 2: For ζ ≤ 0 risk = 1

and the interpolation between these regions, when neither of the above apply, is given by:

Region 3: For ζ ≥ C/B and ω < B, risk = 1 – ω/B

Region 4: For 0 < ζ < A and ω ≥ C/A risk = 1 – ζ/A

Region 5: For 0 < ζ < A and ω < B and ζω < C risk = 1 – ζω/C

This defines a linear interpolation between 0% risk and 100% risk. Defined in this way, risk is a 

continuous function of ζ and ω. The five regions in the ζ-ω plane defined above are depicted 

schematically in Figure 3, and a color plot of the risk function is shown in Figure 4.

Figure 3.—A schematic of the risk interpolation. The blue line 

marks the edge of the Level 2 (“acceptable”) region in the ζ-ω

plane. The numbers label different regions of the interpolation 

described in the text.
NASA/TM—2011-217143 7

Figure 4.—Risk as a function of dutch roll damping ratio and natural frequency. 

2.4.2 Runway Incursion

One way to potentially avoid disaster in a runway incursion is to reduce the takeoff distance, lifting 

the plane over the obstacle. The distance needed for takeoff can be calculated as a function of engine 

thrust as well as aircraft weight, ambient conditions, and other factors. In theory, if the distance and 

height of an obstacle on the runway is known (via a dedicated ranging sensor), the thrust needed to clear 

the obstacle can be computed. In reality, there will be uncertainty in the takeoff model and its parameters, 

so the probability of clearing the obstacle as a function of nominal thrust should be calculated. This gives 

the situational risk as a function of engine capability, which is what is needed to determine the optimal 

level of engine enhancement.

The risk estimator also needs to be aware of the uncertainty of its takeoff model and its sensor data. 

For example, if the takeoff model calculates that the plane should clear the obstacle by fifteen feet, the 

risk estimator must know whether that represents relative safety or a dangerous risk, perhaps as a function 

of the variance of the estimate, in order to decide how much engine risk to take on. A straightforward way 

to do this would be to experimentally determine the uncertainty in each input to the takeoff model, and in 

the model itself. Then, add up all the uncertainties statistically to determine the range of likely takeoff 

trajectories and thus determine the probability that the plane will clear the obstacle.

As an example of this idea, Figure 5 and Figure 6 show the output of a simple randomized takeoff 

simulation. Many trials were simulated in which engine thrust and takeoff weight were random variables 

with normal distributions, each with a standard deviation of 1%. An obstacle was located a certain 

distance down the runway, and the takeoff trajectory had to achieve a certain height at that distance in 

order to clear the obstacle. In this scenario, 3.2% of the takeoff trajectories would have failed to clear the 

obstacle as shown in Figure 6. This shows how risk can arise from uncertainties in model inputs.
NASA/TM—2011-217143 8

Figure 5.—Four sample takeoff trajectories from a randomized takeoff simulation.

Figure 6.—Histogram of the vertical clearance of the plane over an 

obstacle in 100,000 runs of a randomized takeoff simulation. Negative 

clearances, highlighted in red, represent trajectories that collide with 

the obstacle and constitute 3.2% of the overall distribution.

3.0 Proof of Concept

These examples of situational risk models were incorporated into a simulation of the proposed 

interaction between the flight controller and the propulsion controller. The Commercial Modular AeroPropulsion System Simulation 40k (C-MAPSS40k)16 turbofan engine simulation was used to represent 

the propulsion system. It was integrated with an estimator of the risk of implementing different levels of 

enhanced engine operation.17 This setup was used to evaluate the vertical tail damage and runway 

incursion scenarios within the proposed Risk Management Architecture.
NASA/TM—2011-217143 9

3.1 Vertical Tail Damage

In our proof of concept, a lateral-directional flight dynamics simulation, which takes into account 

vertical tail damage and the response characteristics of the engine, computes the aircraft dynamic 

response. The output of the simulations is the closed-loop dutch roll natural frequency and damping ratio 

achievable with differential thrust, given the natural frequency and damping ratio of the engine. In this 

way, the flight controller can estimate situational risk as a function of the capability of the engine. A 

sample engine risk model relates engine response time to engine risk. A simple flight controller then takes 

vertical tail damage as an input and uses the situational risk and engine risk models to determine the 

optimal level of engine risk. Figure 7 and Figure 8 show the results of a simulation in which 45% of the 

tail’s effective area is missing. The selected engine response is an input to the lateral-directional flight 

dynamics model, and the outputs of this are used to compute the situational and total risks at each level of 

engine risk. In this example, the optimal level of engine risk is found to be 15%.

Figure 7.—The risk measurements used to determine the optimal 

level of engine enhancements in a simulation run. Situational risk 

and total risk are shown at five possible levels of engine risk. 

Total or overall risk is minimized at 15% engine risk.

Figure 8.—The markers show the improvement in flying qualities at five 

levels of engine risk (left to right, 0%, 5%, 10%, 15%, 25%).
NASA/TM—2011-217143 10

3.2 Runway Incursion

The runway incursion risk estimation was integrated with the C-MAPSS40k overthrust engine risk 

estimator to produce an example of a complete risk management system for runway incursion. A 

maximum thrust level can be determined for C-MAPSS40k for a given engine risk level and flight 

condition, shown in Figure 9.

17 Figure 10 shows the process of risk minimization for a takeoff situation in 

which overthrust can help lift the plane over an obstacle. Situational risk is calculated for a sample 

runway incursion situation as described above (see Figure 6). Again, we assumed a standard deviation of 

1% in both thrust and takeoff weight. For this particular situation, 15% engine risk is calculated to give a 

greater than 95% chance of clearing the obstacle (situational risk) and minimizes the overall risk to the 

plane, as shown in Figure 10.

Figure 9.—Maximum thrust versus engine risk for the CMAPSS40k engine simulation at sea level, on a hot 

day, at a Mach number of 0.17.

Figure 10.—Situational risk and total risk at five levels of 

engine risk. Situational risk is calculated as in Figure 6. 

Total risk is minimized at 15% engine risk.
NASA/TM—2011-217143 11

4.0 Challenges in Risk Management

The situations described in the examples are extremely uncommon, and even when they do occur the 

circumstances are often unique. Thus the approaches taken in this research to mitigate these emergencies 

must be broad enough to encompass a variety of similar cases. This leads to the problem of properly 

determining the situational risk in a way that is valid and meaningful, as well as general enough to capture 

the range of events that would fall into the categories addressed by these propulsion control 

enhancements. These are whole areas of research themselves, and our work can only acknowledge the 

shortcomings of the available data for these purposes.

Preliminary risk estimators are presented here to illustrate the idea of the risk management system and 

are intended only as examples. More work is needed to improve the accuracy of automated risk 

estimation. For instance, military flying qualities specifications and the studies on which they are based 

are not ideal as a source for estimating the risk of landing with a given combination of flying qualities 

parameters; here they serve only as a basis for a first approximation. The purpose of these studies was

twofold: to find the combinations that give the best flying qualities and to determine the boundaries of 

what qualities are acceptable for routine flights. Previous studies have not spent much time investigating 

the regions of parameter space in which failure to land safely is at all probable. In contrast we consider 

more extreme and desperate situations, with a view to obtaining an estimate of the chance that a plane 

will be landed safely when the flying qualities are severely degraded from what is normally acceptable. In 

the absence of research dedicated to this topic, we have used the safety specifications determined from 

these studies to obtain an approximate boundary of the region of parameter space that carries very low 

risk.

The feasibility of implementing a system like the one described here would be determined by the 

ability to build a risk estimator that is accurate and fast enough to make the right tradeoffs between engine

risk and situational risk. Data for situational risk estimation from degraded flying qualities could likely be 

collected in simulator studies. Similar kinds of studies have been conducted in investigations of throttlesonly control and as part of NASA’s Propulsion Controlled Aircraft investigation, in which pilots 

attempted landings in simulation after all flight control surfaces were disabled and only the throttles could 

be used to steer.

6,18,19 To collect data for use in a risk estimator, pilots might attempt simulated landings

with various settings for flying qualities parameters, such as dutch roll frequency and damping, and 

observe the frequency of survivable landings. This would give more relevant data on which to base a risk 

estimator. It would also suggest a shape for the interpolation between the safe and unsafe regions of the 

flying qualities parameter space that might be quite different from our simple linear interpolation.

One difficult issue is that situational risk depends on many factors. For example, the risk from 

degraded flying qualities varies a great deal depending on the level of turbulence the plane experiences. In 

calm air, the aircraft may remain controllable even if stability parameters are severely degraded, because 

the oscillatory modes, though weakly damped, will not be excited. Other important factors include the 

experience of the pilots and the availability of automatic aids like instrument landing systems. 

A full risk management system will require sophisticated integration of many kinds of data. It might

also need to interact with the crew in order to incorporate human judgments into the assessment of risk. 

For example, an experienced pilot may be more confident in his ability to land the plane in turbulence. To 

a significant extent, then, the risk management system should be under pilot control. However, in 

situations where dangerous flying qualities could be improved with minimal engine risk, the system could 

automatically modify them without explicit pilot action; this would clearly require a highly reliable and 

intelligent risk estimation system. 

Situational risk assessment depends upon having an accurate and reliable model of the aircraft 

dynamics as they depend on engine capabilities. For simplicity, we have investigated only a rudimentary 

model of tail damage that disables the rudder. A full risk management system will require more general 

dynamics and risk models. Possibly, a sophisticated fault detection and diagnosis system would be able to 

assess damage to the plane and feed into an adaptive flight dynamics model that would be able to assess 

the risk of landing the damaged plane as a function of the capabilities of the engine.
NASA/TM—2011-217143 12

5.0 Conclusions

The proposed risk management architecture is a simple and general way of automatically managing 

risk for engine enhancement in an emergency. The complexity and intelligence of the system reside in the 

proposed risk estimators for engine and situational risk, which require detailed knowledge about the 

aircraft and its dynamics as well as important situational influences and how these affect risk. The 

proposed situational risk estimators for the two emergency conditions discussed suggest possible ways of 

implementing this intelligence. However, the situational risk functions themselves are very difficult to 

formulate and validate because each event is unique and the probability of any such event occurring is 

extremely small. It was proposed that simulation studies could be used to quantify risk for particular 

scenarios, but even that approach limits the validity to the cases evaluated. Additionally, the level of 

uncertainty in the pilot’s awareness of the situation, variation in pilot skill, and weather conditions, 

among other things, make the situational risk extremely hard to quantify. Other uncertainties such as 

aircraft weight, sensor measurement error, and thrust variations, can be modeled more easily, but 

determining realistic values may be a challenge. Finally, while the engine will have a predictable safe 

operating life under normal use, enhanced operation will increase risk of failure, creating uncertainty that 

may be difficult to validate. Building successful risk management systems will require dedicated studies 

to gather important data for use in risk models.

References

1 National Transportation Safety Board, “Aircraft Accident Report: American Airlines, Inc. McDonnell 

Douglas DC-10-10, N103AA. Near Windsor, Ontario, Canada, June 12, 1972,” PB—219 370, 1973. 2 Faith, N., “Black Box: Why Air Safety Is No Accident,” Zenith Press, 1997, pp. 157-158.

3 Job, M., and Swift, S., “JAL123, JAL123 ... uncontrollable,” Flight Safety Australia, July-August 2005, 

Vol. 9, No. 4, pp. 28-33.

4 National Transportation Safety Board, “Aircraft Accident Report, United Airlines Flight 232, 

McDonnell Douglas DC-1040, Sioux Gateway Airport, Sioux City, Iowa, July 19, 1989,” PBSO-910406, 

NTSB/AARSO/06, 1990.

5

Burcham, F.W., Jr., Fullerton, C.G., and Maine, T.A., “Manual Manipulation of Engine Throttles for 

Emergency Flight Control,” NASA/TM-2004-212045, January 2004.

6 Burcham, F. W., Jr., and Fullerton, C. G., “Controlling Crippled Aircraft—With Throttles,” NASA TM104238, 1991.

7 National Transportation Safety Board, “Aircraft Accident Report: Attempted Takeoff From Wrong 

Runway Comair Flight 5191 Bombardier CL-600-2B19, N431CA Lexington, Kentucky August 27, 

2006,” NTSB/AAR-07/05, PB2007-910406, 2007.

8 National Transportation Safety Board, “Runway Collision of USAIR Flight 1493, Boeing 737 and 

Skywest Flight 5569 Fairchild Metroliner, Los Angeles, California, February 1, 1991,” PB91-910409, 

NTSB/AAR-91-08, 1991.

9 Guo, T.-H, Litt, J.S., "Risk Management for Intelligent Fast Engine Response Control," AIAA-2009-

1873, AIAA Infotech@Aerospace Conference, Seattle, WA, April 6-9, 2009.

10 Litt, J.S., Sharp, L.M., and Guo, T.-H., “A Risk Assessment Architecture for Enhanced Engine 

Operation,” AIAA 2010-3469, AIAA Infotech@Aerospace 2010, Atlanta, Georgia, April 20-22, 2010. 11 Cooper, G.E. and Harper, R.P., “The Use of Pilot Rating in the Evaluation of Aircraft Handling 

Qualities,” NASA TN D-5153, April 1969.

12 Hall, G. W. and Boothe, E. M, “An In–Flight Investigation of Lateral–Directional Dynamics for the 

Landing Approach,” FAA-RD-71-26, October 1971. 13 Ellis, D. R,. and Seckel, E., “Flying Qualities of Small General Aviation Airplanes. Part I. The 

Influence of Dutch-roll Frequency, Dutch-roll Damping, and Dihedral Effect,” FAA DS-69-8 June 1969.
NASA/TM—2011-217143 13

14 Woodcock, R. J. and Drake, D. E., “Estimation of Flying Qualities of Piloted Airplanes,” AFFDL-TR65-218, April 1966. 15 Department of Defense, “MIL-HDBK-1797 – Flying Qualities of Piloted Aircraft,” 19 December 1997. 16 May, R. D., Csank, J., Lavelle, T. M., Litt, J. S., and Guo, T.-H, “A High-Fidelity Simulation of a 

Generic Commercial Aircraft Engine and Controller,” AIAA-2010-6630, 46th AIAA/ASME/SAE/ASEE 

Joint Propulsion Conference and Exhibit, Nashville, TN, July 25-28, 2010. 17 Csank, J., Chin, J. C., May, R. D., Litt, J. S., and Guo, T.-H., “Implementation of Enhanced Propulsion 

Control Modes for Emergency Flight Operation,” AIAA 2011-1590, AIAA Infotech@Aerospace 2011 

Conference, St. Louis, MO, March 29-31, 2011.

18 Burcham, F. Jr., Maine, T., and Wolf, T., “Flight Testing and Simulation of an F-15 Airplane Using 

Throttles for Flight Control,” NASA TM-104255, August 1992.

19 Burcham, F. Jr., Maine, T., Fullerton, C.G., and Webb, L., “Development and Flight Evaluation of an 

Emergency Digital Flight Control System Using Only Engine Thrust on an F-15 Airplane,” NASA 

Technical Paper 3627, September 1996.
REPORT DOCUMENTATION PAGE Form Approved 

OMB No. 0704-0188 

The public reporting burden for this collection of information is estimated to average 1 hour per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the 

data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this 

burden, to Department of Defense, Washington Headquarters Services, Directorate for Information Operations and Reports (0704-0188), 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA 22202-4302. 

Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB 

control number. 

PLEASE DO NOT RETURN YOUR FORM TO THE ABOVE ADDRESS. 

1. REPORT DATE (DD-MM-YYYY)

01-12-2011 

2. REPORT TYPE

Technical Memorandum 

3. DATES COVERED (From - To)

4. TITLE AND SUBTITLE

A Risk Management Architecture for Emergency Integrated Aircraft Control 

5a. CONTRACT NUMBER

5b. GRANT NUMBER

5c. PROGRAM ELEMENT NUMBER

6. AUTHOR(S)

McGlynn, Gregory, E.; Litt, Jonathan, S.; Lemon, Kimberly, A.; Csank, Jeffrey, T. 

5d. PROJECT NUMBER

5e. TASK NUMBER

5f. WORK UNIT NUMBER

WBS 457280.02.07.03.03 

7. PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES)

National Aeronautics and Space Administration 

John H. Glenn Research Center at Lewis Field 

Cleveland, Ohio 44135-3191 

8. PERFORMING ORGANIZATION

 REPORT NUMBER

E-17880 

9. SPONSORING/MONITORING AGENCY NAME(S) AND ADDRESS(ES)

National Aeronautics and Space Administration 

Washington, DC 20546-0001 

10. SPONSORING/MONITOR'S

 ACRONYM(S)

NASA 

11. SPONSORING/MONITORING

 REPORT NUMBER

NASA/TM-2011-217143 

12. DISTRIBUTION/AVAILABILITY STATEMENT

Unclassified-Unlimited 

Subject Categories: 7 and 63 

Available electronically at http://www.sti.nasa.gov 

This publication is available from the NASA Center for AeroSpace Information, 443-757-5802

13. SUPPLEMENTARY NOTES

14. ABSTRACT

Enhanced engine operation--operation that is beyond normal limits--has the potential to improve the adaptability and safety of aircraft in 

emergency situations. Intelligent use of enhanced engine operation to improve the handling qualities of the aircraft requires sophisticated 

risk estimation techniques and a risk management system that spans the flight and propulsion controllers. In this paper, an architecture that 

weighs the risks of the emergency and of possible engine performance enhancements to reduce overall risk to the aircraft is described. Two 

examples of emergency situations are presented to demonstrate the interaction between the flight and propulsion controllers to facilitate the 

enhanced operation. 

15. SUBJECT TERMS

Engine control; Thrust control 

16. SECURITY CLASSIFICATION OF: 17. LIMITATION OF

 ABSTRACT

UU 

18. NUMBER

 OF 

 PAGES

20 

19a. NAME OF RESPONSIBLE PERSON

STI Help Desk (email:help@sti.nasa.gov) 

a. REPORT

U 

b. ABSTRACT

U 

c. THIS 

PAGE

U 

19b. TELEPHONE NUMBER (include area code)

443-757-5802 

Standard Form 298 (Rev. 8-98)

Prescribed by ANSI Std. Z39-18