Yuan Liu

N&R Engineering and Management Services, Parma Heights, Ohio

Jonathan S. Litt and Ten-Huei Guo

Glenn Research Center, Cleveland, Ohio

Design and Demonstration of Emergency Control 

Modes for Enhanced Engine Performance

NASA/TM—2013-216552

September 2013
NASA STI Program . . . in Profi le

Since its founding, NASA has been dedicated to the 

advancement of aeronautics and space science. The 

NASA Scientifi c and Technical Information (STI) 

program plays a key part in helping NASA maintain 

this important role.

The NASA STI Program operates under the auspices 

of the Agency Chief Information Offi cer. It collects, 

organizes, provides for archiving, and disseminates 

NASA’s STI. The NASA STI program provides access 

to the NASA Aeronautics and Space Database and 

its public interface, the NASA Technical Reports 

Server, thus providing one of the largest collections 

of aeronautical and space science STI in the world. 

Results are published in both non-NASA channels 

and by NASA in the NASA STI Report Series, which 

includes the following report types:

• TECHNICAL PUBLICATION. Reports of 

completed research or a major signifi cant phase 

of research that present the results of NASA 

programs and include extensive data or theoretical 

analysis. Includes compilations of signifi cant 

scientifi c and technical data and information 

deemed to be of continuing reference value. 

NASA counterpart of peer-reviewed formal 

professional papers but has less stringent 

limitations on manuscript length and extent of 

graphic presentations.

• TECHNICAL MEMORANDUM. Scientifi c 

and technical fi ndings that are preliminary or 

of specialized interest, e.g., quick release 

reports, working papers, and bibliographies that 

contain minimal annotation. Does not contain 

extensive analysis.

• CONTRACTOR REPORT. Scientifi c and 

technical fi ndings by NASA-sponsored 

contractors and grantees.

• CONFERENCE PUBLICATION. Collected 

papers from scientifi c and technical 

conferences, symposia, seminars, or other 

meetings sponsored or cosponsored by NASA.

• SPECIAL PUBLICATION. Scientifi c, 

technical, or historical information from 

NASA programs, projects, and missions, often 

concerned with subjects having substantial 

public interest.

• TECHNICAL TRANSLATION. Englishlanguage translations of foreign scientifi c and 

technical material pertinent to NASA’s mission.

Specialized services also include creating custom 

thesauri, building customized databases, organizing 

and publishing research results.

For more information about the NASA STI 

program, see the following:

• Access the NASA STI program home page at 

http://www.sti.nasa.gov

• E-mail your question to help@sti.nasa.gov

• Fax your question to the NASA STI 

Information Desk at 443–757–5803

• Phone the NASA STI Information Desk at

 443–757–5802

• Write to:

 STI Information Desk

NASA Center for AeroSpace Information

 7115 Standard Drive

 Hanover, MD 21076–1320
Yuan Liu

N&R Engineering and Management Services, Parma Heights, Ohio

Jonathan S. Litt and Ten-Huei Guo

Glenn Research Center, Cleveland, Ohio

Design and Demonstration of Emergency Control 

Modes for Enhanced Engine Performance

NASA/TM—2013-216552

September 2013

National Aeronautics and

Space Administration

Glenn Research Center

Cleveland, Ohio 44135

Prepared for the

49th Joint Propulsion Conference and Exhibit

cosponsored by AIAA, ASME, SAE, and ASEE

San Jose, California, July 14–17, 2013
Available from

NASA Center for Aerospace Information

7115 Standard Drive

Hanover, MD 21076–1320

National Technical Information Service

5301 Shawnee Road

Alexandria, VA 22312

Available electronically at http://www.sti.nasa.gov

Level of Review: This material has been technically reviewed by technical management. 

Acknowledgments

This work was sponsored by the Aviation Safety Program at the NASA Glenn Research Center.
NASA/TM—2013-216552 1 

Design and Demonstration of Emergency Control Modes for 

Enhanced Engine Performance 

Yuan Liu 

N&R Engineering and Management Services 

Parma Heights, Ohio 44130 

Jonathan S. Litt and Ten-Huei Guo 

National Aeronautics and Space Administration 

Glenn Research Center 

Cleveland, Ohio 44135 

Abstract 

A design concept is presented for developing control modes that enhance aircraft engine performance 

during emergency flight scenarios. The benefits of increased engine performance to overall vehicle 

survivability during these situations may outweigh the accompanied elevated risk of engine failure. The 

objective involves building control logic that can consistently increase engine performance beyond 

designed maximum levels based on an allowable heightened probability of failure. This concept is applied 

to two previously developed control modes: an overthrust mode that increases maximum engine thrust 

output and a faster response mode that improves thrust response to dynamic throttle commands. This 

paper describes the redesign of these control modes and presents simulation results demonstrating both 

enhanced engine performance and robust maintenance of the desired elevated risk level. 

Nomenclature 

C-MAPSS40k Commercial Modular Aero-Propulsion System Simulation 40k 

EPR Engine pressure ratio 

FAA Federal Aviation Administration 

HPC High-pressure compressor 

HPT High-pressure turbine 

LPC Low-pressure compressor 

LPT Low-pressure turbine 

max Maximum 

min Minimum 

Nc Core speed 

Nf Fan speed 

OT Overthrust 

PC Power code 

PLA Power lever angle 

PR Pressure ratio 

PRs Stall pressure ratio 

Ps30 Combustor inlet static pressure 

R Rankine 

R2

 Goodness of fit 

rpm Revolutions per minute 
NASA/TM—2013-216552 2 

RU Ratio unit (ratio of fuel flow rate to Ps30) 

SM Stall margin 

T40 HPT inlet total temperature 

T48 LPT inlet total temperature 

T50 LPT exit total temperature 

VBV Variable bleed valve 

VSV Variable stator vanes 

1.0 Introduction 

Commercial aircraft engines are designed to abide by strict safety standards. Enforced by regulatory 

bodies such as the Federal Aviation Administration (FAA), these requirements impose limits on the 

probability of various types of engine component failure. These limits are manifested as restrictions on 

engine operating variables such as rotational speeds, temperatures, pressures, and stall margins. However, 

in certain emergency flight scenarios, it may be more beneficial for overall vehicle survivability if certain 

safety parameters were relaxed to allow for non-standard usage of the propulsion systems. For example, a 

runway incursion event may cause a sudden reduction in available takeoff distance (Ref. 1). In such cases, 

it may be advantageous to have the option of temporarily increasing engine thrust output beyond the 

designed maximum level despite the accompanied elevated probability of powerplant failure. Moreover, 

there have been several instances of in-flight airframe malfunction or damage where flight crews resorted 

to engine throttle modulation to maintain aircraft control (Refs. 2 to 4). Such incidents have motivated 

research studies on throttle-only flight control, which identified the relatively slow dynamic response of 

gas turbine engines as one of the difficulties encountered (Refs. 5 and 6). Engine transient response is 

generally limited by conservative control algorithms designed to prevent compression system instabilities. 

However, in dire situations, a higher risk of compressor stall or surge may be an acceptable concession 

for increased thrust responsiveness. 

These considerations have motivated recent studies into intelligent risk management-based flight and 

propulsion control architectures (Ref. 7). Computer simulations of commercial-type turbofan engines 

were used to devise and assess methods of achieving additional engine performance (Refs. 8 and 9). 

Excess thrust output (overthrust) can be obtained by extending the control system target parameter 

(setpoint) beyond its default maximum value and relaxing spool speed and/or temperature limits. Engine 

transient response can be enhanced by modifying the controller bandwidth and acceleration schedule. 

Additionally, May et al. (Ref. 10) developed a novel control mode known as “high speed idle,” which 

improves transient performance by allowing the engine to operate at higher spool speeds while at idle 

thrust output levels. 

Complementary studies have been conducted to evaluate the risks of implementing the 

aforementioned control techniques. Litt et al. (Ref. 11) describe statistical methods that may be used to 

quantify the heightened likelihood of rotor disk/turbine blade failures and compressor instabilities due to 

overthrust and enhanced transient operation, respectively. Utilizing the underlying principles of these 

probabilistic methods, a somewhat qualitative risk assessment of the overthrust and faster response 

control modes was conducted at various engine operating conditions (Ref. 12) McGlynn et al. (Ref. 13) 

demonstrated through simulation the concept of a risk management architecture that combined this 

assessment of engine risk (due to enhanced performance) with one of situational risk (due to the specific 

nature of the emergency, e.g., vertical stabilizer damage). The two risk parameters were balanced to 

determine the conditions required for optimal (i.e., minimum) overall risk of an emergency scenario. 

Csank et al. (Ref. 14) documented a preliminary implementation of the overall control architecture, which 

integrated the enhanced performance control modes with the risk management logic. 

 
NASA/TM—2013-216552 3 

The objective of the previously developed control modes was to achieve enhanced engine 

performance based on the selection of a range of allowable risk. However, these risk levels were 

qualitatively designated (e.g., low risk, medium risk, etc.). Hence, although it was shown that usage of the 

control modes resulted in a higher probability of engine malfunction, the magnitude of this increased 

likelihood at each risk level relative to that of normal engine operation is quantitatively ambiguous. 

Moreover, it is unclear from the previous studies whether or not the control modes consistently provided 

enhanced performance within the selected risk range across various operating points within the flight 

envelope. This paper presents and demonstrates, through use of a detailed computer simulation of a 

generic turbofan engine, a simple philosophy for designing and implementing these emergency engine 

control modes. At the crux of this concept is an a priori design decision: specification of an elevated and 

quantitatively meaningful probability of engine failure that is above levels representative of typical engine 

operation yet deemed acceptable during emergency flight scenarios. Since the analysis required for this 

specification is situation-dependent and, hence, beyond the scope of this work, a notional elevated risk 

threshold was adopted for illustrative purposes. Subsequently, the objective of the control mode 

algorithms is to constrain engine operation near but within this threshold when activated. The resulting 

engine performance represents the maximum enhancement achievable while satisfying these elevated 

constraints. The aforementioned overthrust and faster response control algorithms were leveraged and 

(at times, heavily) modified to demonstrate these notions. 

2.0 Design Objective 

The design of emergency control modes is centralized around the notion of improving engine 

performance at the cost of elevating the probability of failure. The types of engine failure under 

consideration should be particularly relevant to the nature of the performance parameter to be enhanced. 

Namely, the failure mode should correspond to the “weakest link” of the engine when operating beyond 

design capacities (see Ref. 11 for more details on this concept). For instance, the risk of turbine blade 

failure due to continued exposure to higher-than-normal temperatures is more pertinent to an overthrust 

control mode than one for faster dynamic response. 

This concept is best illustrated through a generic example. Figure 1 shows a collection of fictional 

risk data for some particular engine failure type. The black squares represent the probability of failure 

occurrence while operating the engine at the maximum attainable baseline performance for various 

operating points. As illustrated by this example, the risk of engine failure is expected to vary with 

operating conditions (altitude, Mach number, etc.). However, a maximum allowable probability for 

various failure types is generally defined by a regulatory body and cannot be exceeded. In this example, 

suppose the guidelines dictate that the probability of failure may not exceed 10–5 (blue dashed line). 

Figure 1.—Notional illustration of emergency control mode performance. 

1.E08

1.E07

1.E06

1.E05

1.E04

1.E03

1.E02

1.E01

1.E+00

0 20 40 60 80 100

FailureProbability

OperatingPoint

Current

Elevated

Baseline

Enhanced
NASA/TM—2013-216552 4 

For the emergency control modes, the designer must decide on an acceptable elevated failure rate. This 

increased threshold should be chosen such that overall vehicle survivability (for the emergency scenarios 

relevant to the control mode under consideration) is improved despite the higher risk of engine failure. The 

details of this balance between vehicle and engine risk is beyond the scope of this paper. However, 

McGlynn et al. (Ref. 13) provide examples of similar analyses. The elevated risk level depicted in Figure 1 

is 10–3 (orange dashed line). The control mode should then be designed such that engine performance is 

increased until the elevated failure probability level is met. The red circles in Figure 1 represent the 

performance of a nearly ideal implementation of the hypothetical emergency control mode featured in this 

example. The risk of failure is consistently raised to approximately 10–3 at every operating point. 

3.0 Engine Simulation 

The demonstrations of the control modes developed according to this objective are conducted using a 

turbofan engine simulation called the Commercial Modular Aero-Propulsion System Simulation 40k 

(C-MAPSS40k) (Ref. 15). C-MAPSS40k is a zero-dimensional, nonlinear, dynamic model of a generic 

commercial aircraft engine implemented in the MATLAB/Simulink environment. The modeled 

powerplant is a 40,000-lb thrust class, high-bypass, dual-spool, turbofan engine. Figure 2 summarizes the 

layout of the major engine components. The fan and low-pressure compressor (LPC) are powered by the 

low-pressure turbine (LPT) through a low-speed shaft, and the high-pressure compressor (HPC) by the 

high-pressure turbine (HPT) via a high-speed shaft. The combustor model consists of a slight total 

pressure loss and an enthalpy rise based on the lower heating value of the fuel. The rotating components 

are modeled using unique performance maps (e.g., pressure ratio as a function of mass flow rate and 

corrected speed). Scaling factors, known as “health parameters,” for several map variables are available 

for each rotating component to simulate component faults or degradation. An overall engine deterioration 

level (ranging from 0 to 1) is available to automatically adjust these health parameters to model 

performance changes throughout the life of the engine (0 represents 50-hr engine; 1 represents end-of-life 

engine). The effects of variable stator vane (VSV) positions are accounted for by the HPC performance 

maps. There are two sources of compressor bleed air: a variable bleed valve (VBV) controls flow from 

the LPC to the bypass duct; HPC flow is used for turbine blade cooling and customer bleed. The 

rotational speeds of the two shafts are the state variables of the system, allowing for simulation of 

transient engine operation. 

Figure 2.—Layout of major turbofan engine components 

modeled by C-MAPSS40k simulation. 

 
NASA/TM—2013-216552 5 

Figure 3.—Control system for C-MAPSS40k engine simulation. 

With the exception of ambient temperature and pressure, which are determined by flight conditions 

(altitude and Mach number), inputs to the engine model (fuel flow rate, VSV position, VBV position) are 

computed by a comprehensive control system. VSV and VBV commands are scheduled on sensed engine 

parameters such as spool speeds and inlet conditions. The control architecture for determining fuel flow 

(Figure 3) is more involved. The throttle command from the pilot, in degrees of power lever angle (PLA), 

is converted into a demanded value, or “setpoint,” of engine pressure ratio (EPR), which is the ratio of 

LPT exit to fan inlet total pressure. A scheduled-gain, proportional-integral, feedback controller calculates 

the fuel flow rate required by the engine to attain this demanded EPR level. The fuel flow signal is then 

passed through a series of limit regulators, which impose maximum and minimum restrictions on its 

value. This protection logic maintains the required nominal performance and corresponding risk of failure 

below the defined threshold, preventing engine malfunction due to issues such as combustor blowout, 

overspeed, and compressor stall. The resultant fuel flow signal is sent to an actuator model (not shown) 

that meters the appropriate flow rate to the engine. 

4.0 Overthrust Control Mode Design 

This section presents the design of an overthrust control mode according to the process described 

previously. The objective of the overthrust control mode is to operate the engine at thrust levels beyond 

the designed maximum level while conforming to a predefined acceptable probability of engine failure. 

Since the engine would be operating beyond normal thresholds, this failure risk would necessarily be 

higher than that for typical usage. Furthermore, this elevated failure probability determines the amount of 

additional performance the control mode can achieve. A brief overview is given of the legacy overthrust 

control algorithm that is used as the starting point for this work. For more detailed descriptions, the reader 

is referred to documentation of the control mode’s original development (Refs. 9, 12, and 14). 

4.1 Risk Function 

In order to build the overthrust control mode, it is necessary to characterize the probability of engine 

failure as a function of operating conditions. For simplicity, in this demonstration, we will consider only 

failures of compressor and turbine disks and turbine blades. The failure model, or “risk function,” used 

for this work is documented in Litt et al. (Ref. 11). It is important to note that although the risk function is 

based on published data, the values generated should be considered representative. The model calculates 

the probability of disk failure as a function of operation time and the size and rotational speed of the disk. 

The metric used throughout this work is failure probability per flight hour; hence, operation time is set to 

1 hr for all risk calculations in this study. Using the output values of fan speed (Nf) and core speed (Nc) 

from C-MAPSS40k, the failure rate can be calculated for each disk corresponding to a row of compressor 

or turbine blades. The failure rates are then combined into a single risk value using basic probability 

theory (i.e., probability of at least one disk failing). Probability of turbine blade failure is determined by 

Accel Sched

EPR Setpoint

Fuel Flow

PLA

MIN

MAX

Nc max

Ps30 max

Nf max

Controller Ps30 min

RU min
NASA/TM—2013-216552 6 

applying relationships between material life and stresses from exposure to high centrifugal force and 

temperature. C-MAPSS40k does not model blade row performance. Instead, a linearly progressive 

extraction of enthalpy that empirically accounts for blade cooling flow is assumed, along with the 

component inlet and exit temperatures, to approximate the temperature at each blade row. Thus, the 

availability of shaft speeds (Nf, Nc) and temperatures at the HPT inlet (T40), LPT inlet (T48), and LPT 

exit (T50) is sufficient to estimate the failure rates of all turbine blades. Again, the failure rates are 

combined into a single blade failure risk value (i.e., probability of at least one turbine blade failing). The 

disk and blade failure probabilities can be further combined into an overall failure risk (i.e., probability of 

failure of at least one disk or one turbine blade). This parameter is used to guide the overthrust control 

mode design. 

To ensure the risk function produces reasonable results, failure rates were calculated for the engine 

operating at maximum power (80.5° PLA) across both its flight envelope and operational life range. The 

risk function was applied at the altitude/Mach number combinations shown in Figure 4. For each point in 

Figure 4, variations were applied to the standard ambient temperature (0, +20 °R, and +40 °R from 

standard day) and the engine deterioration level (0, 0.5, and 1), for a grand total of 1,251 test points. The 

results, shown in Figure 5, are within FAA regulations, which allow a rate of occurrence of 10–7 to 10–5

per flight hour for such failure types assuming they are contained (i.e., debris does not rupture through the 

nacelle) (Ref. 16). 

Figure 4.—Rotor disk/blade risk function tested at operating 

points across the flight envelope. Situations requiring 

overthrust are expected to occur at low-altitude/low-Mach 

number conditions. 

5000

0

5000

10000

15000

20000

25000

30000

35000

40000

0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8

Altitude,ft

MachNumber

FlightEnv.

OTEnv.

OperatingPts.

Figure 5.—Rotor disk/blade failure rates as calculated by risk 

function across flight envelope and operating life range of engine. 
NASA/TM—2013-216552 7 

For overthrust mode design, we defined the acceptable elevated failure level as 10–3 per flight hour. 

Namely, an ideal overthrust control mode would provide thrust levels that would result in a shift of each 

operating point shown in Figure 5 to a failure risk of 10–3. In practice, however, situations requiring 

enhanced engine performance are expected to occur at low-altitude and low-Mach number conditions 

(Figure 4). Hence, the control modes described in this work are, when applicable, tailored to this portion 

of the flight envelope. It follows that the results presented henceforth in this paper are primarily focused 

on this smaller operating regime as well. 

4.2 Modified Legacy Implementation 

This section describes the attempt to modify the legacy overthrust control algorithms (Refs. 9 and 12) 

to conform to the design objective prescribed in this work. The primary appeal of both the original and 

this modified approach is that they require minimal modifications to the baseline control architecture 

(Figure 3). The previous implementations of overthrust involved extending the EPR setpoint tables 

beyond the default maximum levels corresponding to 80.5° PLA. The EPR setpoint tables are used to 

convert PLA to EPR demand by interpolating between the setpoint flight conditions. The extended EPR 

setpoints corresponded to approximately 120 percent design maximum thrust output. The maximum fan 

and core speed limiters were disabled to allow this additional performance. 

The objective of this modified implementation is to provide overthrust while maintaining a consistent 

level of failure risk for a variety of operating conditions. Therefore, the risk function was used to reselect 

the elevated EPR setpoints. A set of 36 operating points at low altitude and Mach number (altitudes of 0, 

2000, and 4000 ft; Mach numbers of 0, 0.15, and 0.3; ambient temperature deviations of 0 °R and +40 °R; 

deterioration levels of 0 and 1)1

 was chosen as extended setpoints for this approach. At each point, the 

engine was run with all maximum limiters deactivated except those for spool acceleration and combustor 

static pressure (Ps30). EPR was then incremented until either the risk function indicated a failure 

probability of 10–3 or Ps30 reached its maximum allowable value (the Ps30 maximum limit prevents 

combustor failure, which is unaccounted for by the risk function). The resulting EPR values are saved as 

the elevated setpoints for overthrust operation. 

This approach was tested at 180 different flight conditions within the range of the extended EPR 

setpoints (altitudes of 0 to 4000 ft in 1000-ft increments; Mach numbers of 0 to 0.3 in 0.1 increments; 

ambient temperature deviations of 0 °R, +20 °R, and +40 °R; deterioration levels of 0, 0.5, and 1). 

Figure 6 compares the probability of failure for operating the engine at maximum power with and without 

 1

It is assumed that engine deterioration level is known from sources such as maintenance logs detailing number 

of hours since overhaul or health estimation/management techniques.

Figure 6.—Modified legacy overthrust implementation: failure probabilities. 
NASA/TM—2013-216552 8 

overthrust at each of those flight conditions. Figure 7 shows the percentage increase in net thrust at each 

operating point.2

 As expected, the level of additional thrust varies greatly with the flight condition—from 

approximately 4 percent to over 20 percent of baseline maximum thrust output. However, the overthrust 

mode designed using this modified method still performs poorly in terms of consistently delivering 

performance at the desired elevated failure risk of 10–3. Analysis of the data revealed that the primary 

contributor to the lack of consistency is the fact that the maximum Ps30 limit was reached before a failure 

rate of 10–3 could be achieved for several of the extended EPR setpoints. This essentially invalidates the 

basic premise of using setpoint interpolation for a large portion of the operating envelope covered by 

these points. Furthermore, even for portions of the flight envelope where the Ps30 limit was not reached, 

the uncertainties introduced by interpolation manifested as relatively large deviations in failure rates. This 

issue was attributed to the high sensitivity of the failure model to certain engine parameters—an 

important observation to be elaborated upon in subsequent sections. A denser set of extended setpoints 

may alleviate this latter limitation but would not address the primary problem of Ps30 limit activation at 

some of the setpoints. 

4.3 Risk Boundary 

In an effort to obtain more consistent risk levels during enhanced performance operation, a new 

approach to overthrust was developed. This design places more emphasis on the disk and blade failure 

model. The premise is to calculate a boundary that represents a constant level of failure probability (in 

this case, 10–3). This boundary can be visualized as a surface in the multi-dimensional space defined by 

the input variables of the failure model. For instance, since the risk function used in this work requires 

five inputs (Nf, Nc, T40, T48, T50), the boundary would ideally be a five-dimensional surface on which 

the failure probability remains constant at 10–3. The overthrust mode would then manipulate the control 

system to maintain the operating point of the engine on this boundary. 

In order to simplify the definition and visualization of this failure boundary, the dimensions of the 

input space were reduced. To do so, the risk function was analyzed to identify the inputs it is most 

sensitive to. Furthermore, disk failure and blade failure were investigated separately. Recall from 

 2

 For the presentations of engine performance and risk at multiple operating conditions in these and subsequent 

figures, the operating points are not ordered in a physically meaningful fashion (unless explicitly stated otherwise). 

Therefore, observations will focus on the overall consistency of the performance and risk delivered by the control 

mode. No conclusions will be drawn about how engine performance—baseline or enhanced—trends with flight 

conditions. 

Figure 7.—Modified legacy overthrust implementation: net thrust improvements. 
NASA/TM—2013-216552 9 

Figure 8.—Probability of disk failure as a function of core speed 

(neglecting fan speed). 

TABLE 1.—QUALITY OF LINEAR LEAST-SQUARES 

FIT BETWEEN TURBINE TEMPERATURE PAIRS 

Correlation Goodness of fit, 

(R2

) 

T40 and T48 0.9955 

T40 and T50 0.9598 

T48 and T50 0.9739 

Section 4.1 that the disk failure model requires spool speed inputs (Nf, Nc) whereas the blade failure 

model requires spool speeds and turbine temperatures (T40, T48, T50). Not surprisingly, even in the 

neighborhood of maximum engine power operation, both functions were particularly sensitive to Nc and 

relatively unreactive to Nf due to the large difference in rotational speeds between the fan and core shafts. 

The analysis concluded that neglecting Nf would not have a significant impact for this work. For the disk 

failure calculation, this simplification reduces the model to a single-variable function (Figure 8). Hence, 

imposing a particular maximum allowable disk failure probability involves simply restricting Nc to the 

corresponding value. For example, a 10–3 probability of at least one disk failure corresponds to core spool 

operation at over 13,200 rpm. 

The situation is more complicated with the blade failure model due to the turbine temperatures. 

Although the function is expectedly more reactive to the temperatures closely related to the hotter 

segments of the engine (in order of most to least sensitive: T40, T48, T50), it is sufficiently sensitive to all 

three variables such that none could be neglected. Thus, in an attempt to reduce the three temperatures to 

a single input value, a correlation study was conducted on steady-state turbine temperatures across the 

entire operating regime of the engine (at the 1,251 operating points described previously). It was found 

that the temperatures were highly linearly correlated; Table 1 summarizes the quality of the linear leastsquares fits (R2

) between different temperature pairs. Hence, knowledge of one temperature value can 

provide approximations of the other two. By using these correlations and neglecting fan speed, the input 

dimension of the blade failure risk function can be reduced to two (core speed and a turbine temperature). 

As an example, Figure 9 shows a failure boundary of 10–3 calculated in terms of core speed and T50. If 

the temperature correlations were perfect, operation on that threshold would result in a 10–3 probability of 

at least one turbine blade failing. The regions to the left and right of the boundary correspond to lower and 

higher risk levels, respectively. 

For this work, the elevated allowable probabilities for disk and blade failure were both set to 10–3. 

Although this may theoretically result in a maximum probability of approximately 2×10–3 for overall 

failure (i.e., failure of at least one disk or blade), in practice, the two probabilities were orders of 

magnitude apart when operating at design maximum (or beyond) thrust levels. Spool speeds and turbine 

temperatures are interdependent parameters obtained by balancing a multitude of aerothermodynamic 

1.E06

1.E05

1.E04

1.E03

1.E02

12200 12400 12600 12800 13000 13200

DiskFailureProbability

CoreSpeed,RPM
NASA/TM—2013-216552 10 

relationships. Simultaneous maximization of disk and blade failure probabilities (to 10–3) would require 

the contradictory scenario of operating at high core speeds (defined by Figure 8) and low turbine 

temperatures (to abide by the relationship in Figure 9). In other words, only a segment of the temperature/ 

speed boundary depicted in Figure 9 is realistically attainable. Hence, the elevated limit for overall 

disk/blade failure risk is still effectively 10–3. 

It is important to note that, ideally, LPT exit temperature (T50) should be used as the temperature 

input to determine the risk boundary since, of the three, it represents the most hospitable environment 

for sensor placement. Temperature measurements at the LPT inlet (T48) are available for certain aircraft 

engines (Ref. 17). 

However, HPT inlet temperature (T40) is not typically measurable and would require performance 

estimation techniques. Nevertheless, we will analyze examples of overthrust using each of the three 

temperatures. As the results will illustrate, despite the highly correlated temperature relationships, the 

differences in R2

 values—albeit small—coupled with the high sensitivity of the failure model to the hotter 

turbine temperatures noticeably impact overthrust mode performance. 

4.4 Implementation With Risk Boundary 

Before examining the new overthrust control architecture, the transition process between normal and 

overthrust operation is briefly considered. Recall that in the C-MAPSS40k simulation, PLA is mapped to 

a set of target EPR values. PLA may also be interpreted as the physical position of the throttle component 

in the aircraft cockpit. Thus, extending the allowable range of PLA values for the purpose of overthrust is 

not practical. Instead, it is envisioned that the overthrust mode would be controlled via a dedicated button 

or switch. However, since this new overthrust mode is based on failure risk as opposed to EPR, a redefinition of the PLA-to-EPR mapping would be ambiguous. As a result, an intermediary power level indicator, 

known as power code (PC), is introduced. The PLA-to-EPR mapping within C-MAPSS40k is reformatted 

into a PC-to-EPR mapping. The relationship between PLA and PC is shown in Figure 10. During normal 

operation, the full range of PLA (40° to 80.5°) is mapped to PC values of 0 to 100. However, upon 

activation of the overthrust mode, PLA is matched to PC values of 0 to 110. The correspondence between 

the EPR setpoints and PC values from 0 to 100 is consistent for both normal and overthrust operation. PC 

values greater than 100 activate the overthrust mode, with a PC of 110 representing the thrust output at 

the maximum allowable elevated risk level of 10–3. 

Figure 9.—Simplified boundary representing 10–3 probability of 

blade failure in terms of core speed and T50 (neglecting fan 

speed and using linear correlations for T48 and T40). 
NASA/TM—2013-216552 11 

Figure 10.—Definition of mapping from PLA to power code to 

facilitate transitions between normal and overthrust operation. 

Figure 11.—Control mode architecture of overthrust implementation with risk boundary. 

The architecture of the risk boundary-based overthrust control mode is shown in Figure 11. Blocks 

outlined in black represent the baseline control system components whereas those in red indicate new 

components for implementing overthrust. The purpose of the overthrust mode is to calculate the fuel flow 

rate required to drive the engine operating point to the designated risk boundary. The control mode consists 

of three primary components: a core speed limiter, the risk boundary data, and a temperature limiter. The 

core speed limiter ensures that, even during overthrust, an absolute maximum value on core speed is not 

exceeded. This limit is defined by the disk failure risk of 10–3. Concurrently, the pre-calculated risk 

boundary data (Figure 9, for example) is used to determine the maximum allowable turbine temperature for 

a given core speed. This temperature limit is recalculated as core speed varies. The temperature limiter 

determines the fuel flow required to drive the engine to that limit value. The minimum of the two limiter 

outputs is taken to ensure neither the disk nor blade failure threshold is violated. 

The remaining components introduced facilitate the transition process between normal and overthrust 

operation as described at the beginning of this section. The mapping from PLA to PC is dependent upon 

the mode of operation. For PC up to 100, the fuel flow rate is determined entirely by the baseline EPR 

controller (and the fan and core speed limiters). Between 100 and 110, the fuel flow signal sent to the 

remainder of the control system is a linear combination of the contributions from the EPR controller and 

the overthrust mode, weighted on PC. At maximum overthrust, or a PC of 110, the baseline fan and core 

speed limiters are essentially neglected and fuel flow rate is solely calculated by the overthrust mode. 

However, similar to the legacy overthrust implementation, the Ps30 limiter and acceleration schedule 

remain in the loop since the risk function does not account for their associated failure modes. The 

minimum limiters are preserved as well since they are not relevant to overthrust operation. 

0

10

20

30

40

50

60

70

80

90

100

110

40 45 50 55 60 65 70 75 80

PowerCode

PowerLeverAngle,deg

Normal

Overthrust
NASA/TM—2013-216552 12 

Figure 12.—Overthrust implementation with Nc-T50 risk boundary: 

operating points relative to risk boundary. 

The question remaining is which of the three turbine temperatures to use with the overthrust control 

mode. The subsequent subsections present the results and issues associated with each case. 

4.4.1 T50 

This subsection presents the results of using T50 with the overthrust control architecture. As 

previously noted, this selection is the most practical since LPT exhaust gas temperatures are typically low 

enough to be readily measurable. This implementation is tested on the same 180 low altitude/low Mach 

number operating points described previously. Figure 12 shows the location of each operating point, with 

full overthrust, relative to the risk threshold by plotting T50 against Nc. As the results indicate, there are 

several flight conditions where the maximum Ps30 limit was activated before the risk boundary was 

reached. These points represent flight conditions where a failure probability, as calculated by the risk 

function, of 10–3 is not achievable due to the hard Ps30 limit; for these points, maximum overthrust is 

determined by the Ps30 limiter and usually corresponds to risk levels noticeably lower than the desired 

10–3 value. Most of the test cases (approximately 70 percent), however, fall onto the risk boundary as 

expected (note that the boundary shown in these results is a small section of the boundary depicted in 

Figure 9). Figure 13 shows the changes in net thrust from the design maximum output due to the 

overthrust mode. (For clarity, in these and subsequent figures illustrating overthrust mode performance, 

the operating points are ordered such that those with an active Ps30 limiter are plotted first.) The control 

mode achieved an increase in net thrust of 10 to 25 percent at nearly all 180 operating conditions 

regardless of the Ps30 limiter status. 

Despite the apparent success of this implementation suggested by the results in Figure 12, the actual 

failure probability levels for the test points are not necessarily close to 10–3. Figure 14 shows the risk level 

for each run (before and after overthrust activation). These results confirm that the failure probabilities for 

most of the cases with an active maximum Ps30 limit remain well below 10–3. However, the failure 

probabilities for the operating points on the risk boundary are inconsistent, varying by approximately an 

order of magnitude in both directions. This scatter is a result of the uncertainty created by collapsing the 

risk boundary into two dimensions. Recall that, in this case, the boundary was simplified by approximating T40 and T48 using the linear least-square fits. Unfortunately, the high R2

 values of these fits are 

overshadowed by the sensitivity of the failure model to the hotter turbine temperatures—T40, in 

particular. Figure 15 shows failure probability plotted against T40 error (difference between the actual 

T40 value and the T40 value calculated by applying the linear fit equation on T50) for only the points 

situated on the risk boundary. The test cases with small T40 discrepancies indeed exhibit failure rates 

close to the desired 10–3 level. However, a 20 °R error in T40 corresponds to approximately an order of 

magnitude change in probability of failure. 

1400

1420

1440

1460

1480

1500

1520

1540

1560

1580

1600

11500 11700 11900 12100 12300 12500

T50,R

CoreSpeed,RPM

Threshold

Ps30LimitActive

Ps30LimitInactive
NASA/TM—2013-216552 13 

These results suggest that a risk boundary of lower failure probability should be used with the control 

mode if only T50 data are available. A more conservative boundary may be able to contain failure risk 

below the required level but will result in less-than-maximum performance in most cases. Alternatively, 

measurements or estimates of T48 or T40 could be utilized, which will be discussed in the subsequent 

section.

Figure 13.—Overthrust implementation with Nc-T50 risk boundary: 

net thrust improvements. 

0

5

10

15

20

25

30

0 20 40 60 80 100 120 140 160 180

NetThrustChange,%

OperatingPoint

Ps30LimitActive

Ps30LimitInactive

Figure 14.—Overthrust implementation with Nc-T50 risk boundary: 

failure probabilities. 

Figure 15.—Overthrust implementation with Nc-T50 risk boundary: 

sensitivity of failure probability to T40 error. 
NASA/TM—2013-216552 14 

4.4.2 T48 and T40 

Although the implementation with T50 data performed noticeably better than the modified legacy 

method in maintaining the desired elevated risk level (Figure 14 and Figure 6, respectively), there is 

ample room for improvement in terms of consistency. To address this issue, usage of the hotter turbine 

temperatures (T48 and T40) with this overthrust mode design was investigated. Because these 

temperatures represent harsher operating environments, they are not readily obtainable in all aircraft 

engine applications. Reference 17 suggests T48 is measurable for certain powerplants. However, T40 is 

generally unobtainable using conventional sensing devices. The implementations and results presented in 

this section assume either the availability of a T48 sensor or an accurate onboard estimation technique for 

T40 data. Measurement/estimation uncertainty was not analyzed, though, as shown by the results obtained 

using the T50 implementation, it would likely affect control mode performance. 

Figure 16, Figure 17, and Figure 18 show the results of applying the overthrust control mode using 

T48 data for the 180 test points. Figure 16 shows the 10–3 failure rate boundary presented in terms of Nc

and T48. Similar to the implementation with T50, for each run, the control mode increased thrust output 

until the engine was limited by either the maximum allowable Ps30 value or the risk boundary. Figure 17 

summarizes the percentage increase in net thrust over the design maximum output levels. However, in 

this case, as shown in Figure 18, the actual failure probabilities of the runs situated on the risk boundary 

are distributed more closely around the 10–3 level (standard deviation of approximately 0.34×10–3). 

Figure 16.—Overthrust implementation with Nc-T48 risk boundary: 

operating points relative to risk boundary. 

Figure 17.—Overthrust implementation with Nc-T48 risk boundary: 

net thrust improvements. 
NASA/TM—2013-216552 15 

The primary cause for this deviation, albeit reduced, is the same as before: high sensitivity of the 

failure model to T40. Therefore, it follows that the failure probability consistency was further improved 

by utilizing T40 data with the overthrust control mode (Figure 19, Figure 20, and Figure 21). For this 

case, the standard deviation of the failure probabilities for those points located on the risk boundary was 

reduced to 0.066×10–3. This tighter distribution indicates that the Nc-T40 boundary is a more accurate 

approximation of the true (i.e., five-dimensional) constant failure rate threshold than the others. It is 

interesting to note that there are no significant differences among the three implementations with respect 

to thrust output enhancement. The primary advantage of the availability of the hotter turbine temperatures 

is more fine-tuned authority by the control mode over the failure probability. 

Although more complex than the legacy overthrust control mode architecture, this novel 

implementation is robust to flight conditions since its design is primarily based on the risk function. To 

demonstrate this (disregarding whether or not overthrust functionality would be useful at all such 

conditions), the control mode using T40 data was applied at the aforementioned 1,251 test points across 

the entire flight and engine health range of operation. Increases in net thrust output range from 2.5 to 

36 percent (Figure 22). Figure 23 shows that, with the exception of the cases with an active Ps30 limit, 

the desired elevated risk level is consistently maintained at all test points. 

Figure 18.—Overthrust implementation with Nc-T48 risk boundary: 

failure probabilities. 

Figure 19.—Overthrust implementation with Nc-T40 risk boundary: 

operating points relative to risk boundary. 
NASA/TM—2013-216552 16 

Figure 20.—Overthrust implementation with Nc-T40 risk boundary: 

net thrust improvements. 

Figure 21.—Overthrust implementation with Nc-T40 risk boundary: 

failure probabilities. 

Figure 22.—Overthrust implementation with Nc-T40 risk boundary 

(full envelope): net thrust improvements. 
NASA/TM—2013-216552 17 

5.0 Faster Response Control Mode Design 

Application of the design method presented in this work to a faster engine response control mode 

requires identifying the type of malfunction to focus on and characterizing the probability of it occurring. 

This demonstration will concentrate on the risk of high-pressure compressor (HPC) rotating stall/surge 

(henceforth collectively referred to as “stall”) since the primary function of the faster response mode is to 

shorten engine acceleration times. Stall likelihood is captured by stall margin (SM), which is generally 

defined as the proximity of the operating pressure ratio (PR) of the compressor to its stall pressure ratio 

(PRs) for the same operating mass flow rate: 

1100% 

 



 
 	 PR

PR SM s (1) 

In C-MAPSS40k, the compressor maps and their corresponding surge lines are definitive quantities. 

Thus, it is usually assumed that stall does not occur if the stall margin is positive. However, in practice, 

there are uncertainties affecting both the operating and stall lines of a compressor that cannot be 

deterministically captured. If these random factors are accounted for, then the risk of stall exists even if 

the engine model reports a positive stall margin. The risk parameter used for the faster response control 

mode is this probability of HPC stall. 

5.1 Risk Function 

A statistical stability assessment is used to capture stall probability. The specific procedure and 

examples described in the “SAE AIR1419 Rev. A” guidelines document (Ref. 18) are leveraged for this 

work. Table 2 reproduces the data from the sample stability assessment provided by the document. The 

table enumerates factors that affect the operating and surge lines and provides approximations of how 

much stall margin is required to account for each. The sum of the non-random stall margin effects is an 

indication of the minimum design stall margin of the compressor. These factors are assumed to be 

accounted for in the design of the C-MAPSS40k engine model. Only the random effects are of interest for 

determining stall probability. 

Figure 23.—Overthrust implementation with Nc-T40 risk boundary 

(full envelope): failure probabilities. 
NASA/TM—2013-216552 18 

TABLE 2.—STATISTICAL COMPRESSOR STABILITY ASSESSMENT (Ref. 18) 

Operating line 

Destabilizing effects Non-random, 

percent 

Random, 

percent

Inlet distortion 0.7 ------- 

PLA transient 6.0 ------- 

Fuel control tolerance ------- ±1.15 

Engine-to-engine variation ------- ±1.25 

Surge line 

Reynolds number 0.36 ------- 

Inlet distortion 7.5 ------- 

Engine-to-Engine variation ------- ±1.35 

Total 14.56 2.17 

The premise of the risk function is that the deterministic engine model, C-MAPSS40k, represents the 

mean performance of a large operating fleet of such engines. Deviations from this mean performance are 

approximated by a normal distribution function. The risk function calculates the stall probability by 

applying this assumption to stall margin. The offset and shape of the probability density function is 

defined by the deterministic and random stall margin effects. Specifically, the HPC stall margin output 

from C-MAPSS40k is set as the mean of the normal distribution. The random stall margin effects are 

combined using a root-sum-square calculation, resulting in the overall 2.17 percent value shown in the 

last line of Table 2. This root-sum-square is assumed to equal three standard deviations, thus defining the 

shape of the normal distribution curve. For instance, Figure 24 shows the stall margin distribution for a 

mean stall margin of 1 percent. The probability of stall at this particular operating condition is then 

obtained by calculating the area under the density function from 0 to negative infinity. These calculations 

are repeated for various values of mean stall margin to generate the risk function, visualized in Figure 25. 

For consistency with the overthrust control mode, a risk threshold of 10–3 was selected for the design 

of the faster response control mode. This risk level corresponds to a stall margin of approximately 

2.4 percent. As Figure 25 shows, the risk of stall is negligibly small for stall margins above 5 percent. 

Since the baseline engine consistently operates (during transients and at steady-state) at HPC stall margins 

well above 5 percent, the performance of the faster response control mode will be presented in terms of 

stall margin as opposed to stall probability. 

Figure 24.—Stall margins of a large fleet of engines modeled as 

normal distribution. Stall margin reported by C-MAPSS40k 

(1 percent in this illustration) represents mean performance. Area 

under curve from negative infinity to 0 equals probability of stall. 
NASA/TM—2013-216552 19 

Figure 25.—Probability of stall due to random destabilizing effects 

as a function of mean stall margin (reported by engine model). 

5.2 Implementation 

The legacy control mode implementation improved transient response by introducing three primary 

modifications to the engine control system (Ref. 10). First, the bandwidth of the EPR controller was 

increased to provide faster response for small PLA transients. Second, a novel high-speed idling 

technique manipulated customer bleed and stator vane schedules to attain higher spool speeds at low 

thrust levels. This operating state reduces the time required for the engine to reach higher power levels. 

Finally, the acceleration schedule was shifted to increase the limit on maximum allowable core 

acceleration, improving large transient performance at the cost of increased stall margin usage. 

For the present implementation, the controller bandwidth modifications and the high-speed idle 

algorithms were largely preserved. However, since the acceleration schedule plays a major role in 

regulating the stall margin usage during a large power transient, the offset logic was tuned using the stall 

risk function. A simple search algorithm was created to determine the offset amount that yielded a 

minimum stall margin of 2.4 percent during a 0.1-sec flight idle-to-full power throttle change. This search 

was conducted at 60 operating points covering a low-altitude/Mach number flight regime (altitudes of 0 to 

4000 ft in 1000-ft increments; Mach numbers of 0, 0.1, and 0.2; 0 °R and +40 °R deviation from standard 

day ambient temperature; deterioration level of 0 and 1). Control mode usage within this envelope 

involved four-dimensional interpolation between these operating points to determine the appropriate 

offset value.3

To test the control mode, the same throttle transient was run at 540 operating points (altitudes of 0 to 

4000 ft in 500-ft increments; Mach numbers of 0 to 0.2 in 0.05 increments; standard day temperature 

deviations of 0 °R, +20 °R, and +40 °R; deterioration levels of 0, 0.3, 0.7, and 1) evenly distributed across 

the flight envelope defined by the 60 interpolation points. Figure 26 shows the minimum HPC stall 

margin observed during each run for the baseline control system and the faster response mode. The 

baseline cases exhibit a wide range of minimum stall margin values, indicating that the dynamic response 

is highly sensitive to ambient and engine health conditions. Nevertheless, the acceleration schedule 

performs its intended function, maintaining an often sizeable stall margin for all cases. With the faster 

response mode activated, this excess stall margin is consumed to improve transient performance. The 

control mode is relatively consistent in maintaining the desired minimum stall margin. 

 3

A more direct method—analogous to the risk boundary overthrust implementation—would be a minimum 

limiter on HPC stall margin. Such an approach would require stall margin estimation (e.g., Kalman filter, model 

prediction, etc.) and, hence, is beyond the scope of this paper. However, the design philosophy presented in this 

paper is well-suited for this approach and implementation of such a configuration is a possible avenue of future 

work. 

1.E12

1.E10

1.E08

1.E06

1.E04

1.E02

1.E+00

0.5 1.5 2.5 3.5 4.5 5.5

StallProbability

MeanStallMargin,%
NASA/TM—2013-216552 20 

Figure 27.—Faster engine response implementation: rise time 

improvements. 

The decrease in repeatability for the cases in the 180 to 360 range is due to interpolation of offset 

values across standard day temperature deviations. The 540 points in Figure 26 are grouped in order of 

increasing ambient temperature: the first third represents standard day ambient temperature; the second 

third is +20 °R deviation; the last third is +40 °R deviation. Since the interpolation points only consisted 

of conditions at 0 °R and +40 °R deviation, these results imply a nonlinear variation with standard 

temperature that is not being adequately captured by linear interpolation. It is expected that additional 

interpolation points at more temperature values would alleviate this issue. On the other hand, control 

mode performance across variations in altitude, Mach number, and engine health appears to be sufficient. 

Figure 27 shows the improvements in dynamic thrust response by using the control mode in terms of 

percentage reduction in rise time. For this application, rise time is defined as the time the engine takes to 

traverse from 10 to 90 percent of the difference between the initial and final thrust output levels. The faster 

response control mode achieves a 5 to 20 percent reduction in rise time for the majority of the test cases. 

25

20

15

10

5

0

0 100 200 300 400 500

RiseTimeChange,%

OperatingPoint

Figure 26.—Faster engine response implementation: minimum 

stall margin attained during transient. 
NASA/TM—2013-216552 21 

6.0 Joint Implementation 

The overthrust and faster response control modes operate on different components of the engine 

control system. As Figure 11 illustrated, the overthrust mode manipulates the limit protection (min/max) 

logic to incorporate the elevated risk boundary. On the other hand, the faster response mode modifies 

parameters within the EPR setpoint controller and acceleration schedule subsystems. Thus, the effort 

required to combine the two performance enhancing modes is minimal: the modifications introduced by 

each mode are superimposed without conflict. 

Likewise, engine performance when utilizing both emergency control modes is essentially a 

superposition of the results already presented for each control mode individually. This is because the two 

control modes seek to modify fundamentally separate portions of the engine response. To elucidate, 

Figure 28 shows the net thrust and HPC stall margin time responses to an idle-to-full-power throttle 

command for a particular operating condition (1000-ft altitude, Mach 0.2, +20 °R deviation from standard 

ambient temperature, 0.7 deterioration level). Four cases are presented: (1) both control modes 

deactivated (i.e., baseline); (2) overthrust mode only (using T40 data); (3) faster response mode only; (4) 

both control modes activated (with overthrust mode using T40 data). For the baseline and faster responseonly cases, throttle was increased from flight idle to full power in 0.1 sec at the 15-sec mark; for the 

overthrust-only and combined implementation cases, throttle was increased from flight idle to full 

overthrust in 0.1 sec at the 15-sec mark. As shown by the results, the overthrust mode primarily affects 

the conditions at which the engine settles. The transient portions of the baseline and overthrust only cases 

are similar until the overthrust mode commands a higher thrust. On the other hand, the faster response 

mode significantly alters the dynamic response of the engine in the form of a shorter rise time and 

increased stall margin usage. However, the faster response and baseline cases settle to identical 

conditions. The joint implementation exhibits the characteristics of both control modes. The dynamic 

portion of the response resembles the faster response time history since the combined implementation 

drops to a similar minimum HPC stall margin. The response then settles to the same thrust level as the 

overthrust case. 

The results shown in Figure 28 are representative of the enhanced performance obtained throughout 

the low-altitude/low-Mach number operating regime described in the previous section. Figure 29 shows 

the minimum stall margins attained during a 0.1-sec transient from flight idle to maximum overthrust at 

the same 540 operating points used to test the faster engine response mode. In this case, the joint 

implementation is compared with an overthrust-only configuration. Figure 30 summarizes the rise time 

improvements at those operating points. The results are similar to the comparisons between the baseline 

control system and the faster response control mode. Plots of steady-state net thrust improvements and 

increased disk/blade risk levels using the joint implementation are identical to the overthrust-only 

configuration (Figure 20 and Figure 21). 
NASA/TM—2013-216552 22 

Figure 28.—Engine performance using combined implementation 

exhibits characteristics of both overthrust and faster response 

control modes. 

Figure 29.—Combined implementation: minimum stall 

margin attained during transient. 

Figure 30.—Combined implementation: rise time improvements. 

14 15 16 17 18 19 20

0

1

2

3

4

x 104

Net Thrust, lbf

Baseline

OT

Fast

OT + Fast

14 15 16 17 18 19 20

0

10

20

30

40

Stall Margin, %

Time, s

0

2

4

6

8

10

12

14

0 100 200 300 400 500

MinimumStallMargin,%

OperatingPoint

OT

OT+Fast

30

25

20

15

10

5

0

0 100 200 300 400 500

RiseTimeChange,%

OperatingPoint
NASA/TM—2013-216552 23 

7.0 Summary and Future Work 

This paper described and demonstrated a design philosophy for developing engine performanceenhancing control modes for use during emergency flight scenarios. Performance improvements are 

defined and limited by a predetermined elevated risk of engine failure that is deemed acceptable for such 

situations where overall vehicle survivability must be maximized. This concept was demonstrated on two 

previously studied enhanced engine performance modes: overthrust and faster response. The overthrust 

control mode must be able to consistently provide increased maximum engine thrust output at a 

predefined elevated probability of rotor disk/blade failure for a variety of flight conditions. It was shown 

that minor modifications to the legacy overthrust implementation were not sufficient to achieve this goal. 

Instead, a significant redesign of the control mode logic that more explicitly accounts for disk/blade 

failure was required. The performance of the redesigned control mode is robust to flight conditions but 

dependent upon availability of measurements or estimates of the conditions within the high-temperature 

regimes of the engine (e.g., high-pressure turbine inlet/exit). The design objective was applied to the 

faster response control mode by requiring a consistent level of compressor stall probability while 

improving engine dynamic response. Probability of stall was characterized by applying a normal 

distribution-based statistical stall margin assessment. It was found that, with some tuning based on this 

statistical assessment procedure, the legacy fast response control architecture performed satisfactorily 

across various flight conditions. Since overthrust and faster response control modes modify 

fundamentally separate aspects of engine performance, the modes could be combined without conflict. 

Engine performance using the joint implementation reflected characteristics of both control modes. 

This work alluded to several relevant topics worthy of further discussion and investigation. It is 

important to note that although the design process presented is relatively generic, the control modes 

demonstrated are specific to both the elevated risk level selected and the risk models utilized. The risk 

level of 10–3 was arbitrarily selected for demonstrative purposes. The determination of a realistic elevated 

risk level must be based on analyses of vehicle survivability for a range of emergency flight scenarios. 

The control mode architectures described in this paper can readily accommodate other risk levels, albeit 

with a recalculation of the relevant parameters (e.g., risk boundary, minimum stall margin). However, the 

architectures are specific to the risk models utilized. Using significantly different risk models would 

almost certainly require a redesign of the control mode logic in order to preserve consistent enhanced 

performance. A possible area of future study is the usage of engine performance estimation techniques in 

conjunction with the performance-enhancing control modes. The results presented in this paper showed 

that knowledge of high-pressure turbine temperatures, especially at HPT inlet, is essential to consistent 

overthrust performance. Similarly, availability of stall margin data would allow a more direct 

implementation of the faster response mode. A redesign of the control mode that is analogous to that done 

for overthrust would eliminate the interpolation routines and increase robustness to flight conditions. 

Performance estimation algorithms such as Kalman filtering may be able to provide the data required for 

such implementations. However, the uncertainties associated with estimation techniques must be 

accounted for in the risk models. Another issue to consider is the human factors impact, if any, of 

consistent risk elevation (as opposed to consistent performance enhancement). As evidenced by the 

results, a consistent elevated risk level results in varying percentage increases in maximum thrust. Since 

these control modes are designed for emergency situations, it is essential to evaluate whether or not this 

variation affects a pilot's ability to fly the aircraft. 
NASA/TM—2013-216552 24 

References 

1. National Transportation Safety Board, “NW Airlines, Inc., Flights 1482 and 299 Runway Incursion 

and Collision Detroit Metropolitan/Wayne County Airport Romulus, Michigan, December 3, 1990,” 

NTSB/AAR-91-05. 

2. National Transportation Safety Board, “Aircraft Accident Report: American Airlines, Inc. 

McDonnell Douglas DC-10-10, N103AA. Near Windsor, Ontario, Canada, June 12, 1972,” 

PB-219 370, 1973. 

3. National Transportation Safety Board, “Aircraft Accident Report, United Airlines Flight 232, 

McDonnell Douglas DC-1040, Sioux Gateway Airport, Sioux City, Iowa, July 19, 1989,” 

PBSO-910406, NTSB/AARSO/06, 1990. 

4. Lemaignan, B., “Flying With No Flight Controls: Handling Qualities Analyses of the Baghdad 

Event,” AIAA Atmospheric Flight Mechanics Conference and Exhibit, San Francisco, California, 

15-18 August 2005. 

5. Burcham, F.W., Jr., and Fullerton, C.G., “Controlling Crippled Aircraft—With Throttles,” NASA 

Technical Memorandum, NASA TM-104238, 1991. 

6. Burcham, F.W., Jr., Fullerton, C.G., and Maine, T.A., “Manual Manipulation of Engine Throttles for 

Emergency Flight Control,” NASA Technical Memorandum, NASA/TM—2004-212045, January 

2004. 

7. Guo, T. and Litt, J.S., “Risk Management for Intelligent Fast Engine Response Control,” AIAA 

Infotech@Aerospace Conference, Seattle, Washington, 6–9 April 2009. 

8. Litt, J.S., Frederick, D.K., and Guo, T., “The Case for Intelligent Propulsion Control for Fast Engine 

Response,” AIAA Infotech@Aerospace Conference, Seattle, Washington, 6–9 April 2009. 

9. Csank, J.T., May, R.D., Litt, J.S., and Guo, T., “A Sensitivity Study of Commercial Aircraft Engine 

Response for Emergency Situations,” NASA Technical Memorandum, NASA/TM—2011-217004. 

10. May, R.D., Csank, J.T., Guo, T., and Litt, J.S., “Improving Engine Responsiveness during Approach 

through High Speed Idle Control,” 47th AIAA/ASME/SAE/ASEE Joint Propulsion Conference and 

Exhibit, San Diego, California, 31 July-3 August 2011. 

11. Litt, J.S., Sharp, L.M., and Guo, T., “A Risk Assessment Architecture for Enhanced Engine 

Operation,” AIAA Infotech@Aerospace Conference, Atlanta, Georgia, 20–22 April 2010. 

12. Csank, J.T., May, R.D., Guo, T., and Litt, J.S., “The Effect of Modified Control Limits on the 

Performance of a Generic Commercial Aircraft Engine,” 47th AIAA/ASME/SAE/ASEE Joint 

Propulsion Conference and Exhibit, San Diego, California, 31 July-3 August 2011. 

13. McGlynn, G.E., Litt, J.S., Lemon, K.A., and Csank, J.T., “A Risk Management Architecture for 

Emergency Integrated Aircraft Control,” AIAA Infotech@Aerospace Conference, St. Louis, 

Missouri, 29–31 March 2011. 

14. Csank, J.T., Chin, J.C., May, R.D., Litt, J.S., and Guo, T., “Implementation of Enhanced Propulsion 

Control Modes for Emergency Flight Operation,” AIAA Infotech@Aerospace Conference, 

St. Louis, Missouri, 29–31 March 2011. 

15. May, R.D., Csank, J., Lavelle, T.M., Litt, J.S., and Guo, T., “A High-Fidelity Simulation of a 

Generic Commercial Aircraft Engine and Controller,” 46th AIAA/ASME/SAE/ASEE Joint 

Propulsion Conference and Exhibit, Nashville, Tennessee, 25–28 July 2010. 

16. Aeronautics and Space, 14 C.F.R. pt. 33.75 (2012). 

17. “Engine Type Certificate Data Sheet EASA.IM.E.002,” European Aviation Safety Agency, 

16 March 2004. 

18. “Inlet Total-Pressure-Distortion Considerations for Gas-Turbine Engines,” SAE AIR1419 Rev. A, 

1999. 


American Institute of Aeronautics and Astronautics 

1

Design and Demonstration of Emergency Control Modes for 

Enhanced Engine Performance 

Yuan Liu*

N&R Engineering and Management Services, Parma Heights, Ohio 44130 

Jonathan S. Litt†

 and Ten-Huei Guo‡

NASA Glenn Research Center, Cleveland, Ohio 44135 

A design concept is presented for developing control modes that enhance aircraft engine 

performance during emergency flight scenarios. The benefits of increased engine 

performance to overall vehicle survivability during these situations may outweigh the 

accompanied elevated risk of engine failure. The objective involves building control logic 

that can consistently increase engine performance beyond designed maximum levels based 

on an allowable heightened probability of failure. This concept is applied to two previously 

developed control modes: an overthrust mode that increases maximum engine thrust output 

and a faster response mode that improves thrust response to dynamic throttle commands. 

This paper describes the redesign of these control modes and presents simulation results 

demonstrating both enhanced engine performance and robust maintenance of the desired 

elevated risk level. 

Nomenclature 

C-MAPSS40k = Commercial Modular Aero-Propulsion System Simulation 40k 

EPR = engine pressure ratio 

FAA = Federal Aviation Administration 

HPC = high-pressure compressor 

HPT = high-pressure turbine 

LPC = low-pressure compressor 

LPT = low-pressure turbine 

max = maximum 

min = minimum 

Nc = core speed 

Nf = fan speed 

OT = overthrust 

PC = power code 

PLA = power lever angle 

PR = pressure ratio 

PRs = stall pressure ratio 

Ps30 = combustor inlet static pressure 

R = Rankine 

R2

 = goodness of fit 

RPM = revolutions per minute 

RU = ratio unit (ratio of fuel flow rate to Ps30) 

SM = stall margin 

T40 = HPT inlet total temperature 

T48 = LPT inlet total temperature 

T50 = LPT exit total temperature 

 

*

 Senior Controls Engineer, AIAA Member. 

†

 Research Engineer, AIAA Senior Member. 

‡

 Research Engineer, AIAA Senior Member. 
American Institute of Aeronautics and Astronautics 

2

VBV = variable bleed valve 

VSV = variable stator vanes 

I. Introduction 

OMMERCIAL aircraft engines are designed to abide by strict safety standards. Enforced by regulatory bodies 

such as the Federal Aviation Administration (FAA), these requirements impose limits on the probability of 

various types of engine component failure. These limits are manifested as restrictions on engine operating variables 

such as rotational speeds, temperatures, pressures, and stall margins. However, in certain emergency flight 

scenarios, it may be more beneficial for overall vehicle survivability if certain safety parameters were relaxed to 

allow for non-standard usage of the propulsion systems. For example, a runway incursion event may cause a sudden 

reduction in available takeoff distance.1

 In such cases, it may be advantageous to have the option of temporarily 

increasing engine thrust output beyond the designed maximum level despite the accompanied elevated probability of 

powerplant failure. Moreover, there have been several instances of in-flight airframe malfunction or damage where 

flight crews resorted to engine throttle modulation to maintain aircraft control.2,3,4 Such incidents have motivated 

research studies on throttle-only flight control, which identified the relatively slow dynamic response of gas turbine 

engines as one of the difficulties encountered.5,6 Engine transient response is generally limited by conservative 

control algorithms designed to prevent compression system instabilities. However, in dire situations, a higher risk of 

compressor stall or surge may be an acceptable concession for increased thrust responsiveness. 

 These considerations have motivated recent studies into intelligent risk management-based flight and propulsion 

control architectures.7

 Computer simulations of commercial-type turbofan engines were used to devise and assess 

methods of achieving additional engine performance.8,9 Excess thrust output (overthrust) can be obtained by 

extending the control system target parameter (setpoint) beyond its default maximum value and relaxing spool speed 

and/or temperature limits. Engine transient response can be enhanced by modifying the controller bandwidth and 

acceleration schedule. Additionally, May et al.10 developed a novel control mode known as “high speed idle,” which 

improves transient performance by allowing the engine to operate at higher spool speeds while at idle thrust output 

levels. 

 Complementary studies have been conducted to evaluate the risks of implementing the aforementioned control 

techniques. Litt et al.11 describe statistical methods that may be used to quantify the heightened likelihood of rotor 

disk/turbine blade failures and compressor instabilities due to overthrust and enhanced transient operation, 

respectively. Utilizing the underlying principles of these probabilistic methods, a somewhat qualitative risk 

assessment of the overthrust and faster response control modes was conducted at various engine operating 

conditions.12 McGlynn et al.13 demonstrated through simulation the concept of a risk management architecture that 

combined this assessment of engine risk (due to enhanced performance) with one of situational risk (due to the 

specific nature of the emergency, e.g., vertical stabilizer damage). The two risk parameters were balanced to 

determine the conditions required for optimal (i.e., minimum) overall risk of an emergency scenario. Csank et al.14

documented a preliminary implementation of the overall control architecture, which integrated the enhanced 

performance control modes with the risk management logic. 

 The objective of the previously developed control modes was to achieve enhanced engine performance based on 

the selection of a range of allowable risk. However, these risk levels were qualitatively designated (e.g., low risk, 

medium risk, etc.). Hence, although it was shown that usage of the control modes resulted in a higher probability of 

engine malfunction, the magnitude of this increased likelihood at each risk level relative to that of normal engine 

operation is quantitatively ambiguous. Moreover, it is unclear from the previous studies whether or not the control 

modes consistently provided enhanced performance within the selected risk range across various operating points 

within the flight envelope. This paper presents and demonstrates, through use of a detailed computer simulation of a 

generic turbofan engine, a simple philosophy for designing and implementing these emergency engine control 

modes. At the crux of this concept is an a priori design decision: specification of an elevated and quantitatively 

meaningful probability of engine failure that is above levels representative of typical engine operation yet deemed 

acceptable during emergency flight scenarios. Since the analysis required for this specification is situationdependent and, hence, beyond the scope of this work, a notional elevated risk threshold was adopted for illustrative 

purposes. Subsequently, the objective of the control mode algorithms is to constrain engine operation near but 

within this threshold when activated. The resulting engine performance represents the maximum enhancement 

achievable while satisfying these elevated constraints. The aforementioned overthrust and faster response control 

algorithms were leveraged and (at times, heavily) modified to demonstrate these notions. 

C
American Institute of Aeronautics and Astronautics 

3

II. Design Objective 

 The design of emergency control modes is centralized around the notion of improving engine performance at the 

cost of elevating the probability of failure. The types of engine failure under consideration should be particularly 

relevant to the nature of the performance parameter to be enhanced. Namely, the failure mode should correspond to 

the “weakest link” of the engine when operating beyond design capacities (see Ref. 11 for more details on this 

concept). For instance, the risk of turbine blade failure due to continued exposure to higher-than-normal 

temperatures is more pertinent to an overthrust control mode than one for faster dynamic response. 

This concept is best illustrated through a generic example. Figure 1 shows a collection of fictional risk data for 

some particular engine failure type. The black squares represent the probability of failure occurrence while operating 

the engine at the maximum attainable baseline performance for various operating points. As illustrated by this 

example, the risk of engine failure is expected to vary with operating conditions (altitude, Mach number, etc.). 

However, a maximum allowable probability for various failure types is generally defined by a regulatory body and 

cannot be exceeded. In this example, suppose the guidelines dictate that the probability of failure may not exceed 

10-5 (blue dashed line). 

For the emergency control modes, the designer must decide on an acceptable elevated failure rate. This increased 

threshold should be chosen such that overall vehicle survivability (for the emergency scenarios relevant to the 

control mode under consideration) is improved despite the higher risk of engine failure. The details of this balance 

between vehicle and engine risk is beyond the scope of this paper. However, McGlynn et al.13 provide examples of 

similar analyses. The elevated risk level depicted in Figure 1 is 10-3 (orange dashed line). The control mode should 

then be designed such that engine performance is increased until the elevated failure probability level is met. The red 

circles in Figure 1 represent the performance of a nearly ideal implementation of the hypothetical emergency control 

mode featured in this example. The risk of failure is consistently raised to approximately 10-3 at every operating 

point. 

III. Engine Simulation 

The demonstrations of the control modes developed 

according to this objective are conducted using a turbofan 

engine simulation called the Commercial Modular AeroPropulsion System Simulation 40k (C-MAPSS40k).15

C-MAPSS40k is a zero-dimensional, nonlinear, dynamic 

model of a generic commercial aircraft engine implemented 

in the MATLAB/Simulink environment. The modeled 

powerplant is a 40,000-pound thrust class, high-bypass, 

dual-spool, turbofan engine. Figure 2 summarizes the layout 

of the major engine components. The fan and low-pressure 

compressor (LPC) are powered by the low-pressure turbine 

(LPT) through a low-speed shaft, and the high-pressure 

compressor (HPC) by the high-pressure turbine (HPT) via a 

high-speed shaft. The combustor model consists of a slight 

Figure 1. Notional illustration of emergency control mode performance. 

Figure 2. Layout of major turbofan engine 

components modeled by C-MAPSS40k simulation.
American Institute of Aeronautics and Astronautics 

4

total pressure loss and an enthalpy rise based on the lower heating value of the fuel. The rotating components are 

modeled using unique performance maps (e.g., pressure ratio as a function of mass flow rate and corrected speed). 

Scaling factors, known as “health parameters,” for several map variables are available for each rotating component 

to simulate component faults or degradation. An overall engine deterioration level (ranging from 0 to 1) is available 

to automatically adjust these health parameters to model performance changes throughout the life of the engine (0 

represents 50-hr engine; 1 represents end-of-life engine). The effects of variable stator vane (VSV) positions are 

accounted for by the HPC performance maps. There are two sources of compressor bleed air: a variable bleed valve 

(VBV) controls flow from the LPC to the bypass duct; HPC flow is used for turbine blade cooling and customer 

bleed. The rotational speeds of the two shafts are the state variables of the system, allowing for simulation of 

transient engine operation. 

With the exception of ambient temperature and pressure, which are determined by flight conditions (altitude and 

Mach number), inputs to the engine model (fuel flow rate, VSV position, VBV position) are computed by a 

comprehensive control system. VSV and VBV commands are scheduled on sensed engine parameters such as spool 

speeds and inlet conditions. The control architecture for determining fuel flow (Figure 3) is more involved. The 

throttle command from the pilot, in degrees of power lever angle (PLA), is converted into a demanded value, or 

“setpoint,” of engine pressure ratio (EPR), which is the ratio of LPT exit to fan inlet total pressure. A scheduledgain, proportional-integral, feedback controller calculates the fuel flow rate required by the engine to attain this 

demanded EPR level. The fuel flow signal is then passed through a series of limit regulators, which impose 

maximum and minimum restrictions on its value. This protection logic maintains the required nominal performance 

and corresponding risk of failure below the defined threshold, preventing engine malfunction due to issues such as 

combustor blowout, overspeed, and compressor stall. The resultant fuel flow signal is sent to an actuator model (not 

shown) that meters the appropriate flow rate to the engine. 

IV. Overthrust Control Mode Design 

This section presents the design of an overthrust control mode according to the process described previously. 

The objective of the overthrust control mode is to operate the engine at thrust levels beyond the designed maximum 

level while conforming to a predefined acceptable probability of engine failure. Since the engine would be operating 

beyond normal thresholds, this failure risk would necessarily be higher than that for typical usage. Furthermore, this 

elevated failure probability determines the amount of additional performance the control mode can achieve. A brief 

overview is given of the legacy overthrust control algorithm that is used as the starting point for this work. For more 

detailed descriptions, the reader is referred to documentation of the control mode’s original development.9,12,14

A. Risk Function 

In order to build the overthrust control mode, it is necessary to characterize the probability of engine failure as a 

function of operating conditions. For simplicity, in this demonstration, we will consider only failures of compressor 

and turbine disks and turbine blades. The failure model, or “risk function,” used for this work is documented in Litt 

et al.11 It is important to note that although the risk function is based on published data, the values generated should 

be considered representative. The model calculates the probability of disk failure as a function of operation time and 

the size and rotational speed of the disk. The metric used throughout this work is failure probability per flight hour; 

hence, operation time is set to one hour for all risk calculations in this study. Using the output values of fan speed 

Figure 3. Control system for C-MAPSS40k engine simulation. 
American Institute of Aeronautics and Astronautics 

5

(Nf) and core speed (Nc) from C-MAPSS40k, the failure rate can be calculated for each disk corresponding to a row 

of compressor or turbine blades. The failure rates are then combined into a single risk value using basic probability 

theory (i.e., probability of at least one disk failing). Probability of turbine blade failure is determined by applying 

relationships between material life and stresses from exposure to high centrifugal force and temperature. 

C-MAPSS40k does not model blade row performance. Instead, a linearly progressive extraction of enthalpy that 

empirically accounts for blade cooling flow is assumed, along with the component inlet and exit temperatures, to 

approximate the temperature at each blade row. Thus, the availability of shaft speeds (Nf, Nc) and temperatures at 

the HPT inlet (T40), LPT inlet (T48), and LPT exit (T50) is sufficient to estimate the failure rates of all turbine 

blades. Again, the failure rates are combined into a single blade failure risk value (i.e., probability of at least one 

turbine blade failing). The disk and blade failure probabilities can be further combined into an overall failure risk 

(i.e., probability of failure of at least one disk or one turbine blade). This parameter is used to guide the overthrust 

control mode design. 

To ensure the risk function produces reasonable results, failure rates were calculated for the engine operating at 

maximum power (80.5° PLA) across both its flight envelope and operational life range. The risk function was 

applied at the altitude/Mach number combinations shown in Figure 4. For each point in Figure 4, variations were 

applied to the standard ambient temperature (0, +20°R, and +40°R from standard day) and the engine deterioration 

level (0, 0.5, and 1), for a grand total of 1,251 test points. The results, shown in Figure 5, are within FAA 

regulations, which allow a rate of occurrence of 10-7 to 10-5 per flight hour for such failure types assuming they are 

contained (i.e., debris does not rupture through the nacelle).16 

For overthrust mode design, we defined the acceptable elevated failure level as 10-3 per flight hour. Namely, an 

ideal overthrust control mode would provide thrust levels that would result in a shift of each operating point shown 

Figure 4. Rotor disk/blade risk function tested at operating points across the flight envelope. 

Situations requiring overthrust are expected to occur at low-altitude/low-Mach number conditions.

Figure 5. Rotor disk/blade failure rates as calculated by risk function across flight 

envelope and operating life range of engine. 
American Institute of Aeronautics and Astronautics 

6

in Figure 5 to 10-3. In practice, however, situations requiring enhanced engine performance are expected to occur at 

low-altitude and low-Mach number conditions (Figure 4). Hence, the control modes described in this work are, 

when applicable, tailored to this portion of the flight envelope. It follows that the results presented henceforth in this 

paper are primarily focused on this smaller operating regime as well. 

B. Modified Legacy Implementation 

This section describes the attempt to modify the legacy overthrust control algorithms9,12 to conform to the design 

objective prescribed in this work. The primary appeal of both the original and this modified approach is that they 

require minimal modifications to the baseline control architecture (Figure 3). The previous implementations of 

overthrust involved extending the EPR setpoint tables beyond the default maximum levels corresponding to 80.5° 

PLA. The EPR setpoint tables are used to convert PLA to EPR demand by interpolating between the setpoint flight 

conditions. The extended EPR setpoints corresponded to approximately 120% design maximum thrust output. The 

maximum fan and core speed limiters were disabled to allow this additional performance. 

The objective of this modified implementation is to provide overthrust while maintaining a consistent level of 

failure risk for a variety of operating conditions. Therefore, the risk function was used to reselect the elevated EPR 

setpoints. A set of 36 operating points at low altitude and Mach number (altitudes of 0, 2000, and 4000 feet; Mach 

numbers of 0, 0.15, and 0.3; ambient temperature deviations of 0°R and +40°R; deterioration levels of 0 and 1*

) was 

chosen as extended setpoints for this approach. At each point, the engine was run with all maximum limiters 

deactivated except those for spool acceleration and combustor static pressure (Ps30). EPR was then incremented 

until either the risk function indicated a failure probability of 10-3 or Ps30 reached its maximum allowable value (the 

Ps30 maximum limit prevents combustor failure, which is unaccounted for by the risk function). The resulting EPR 

values are saved as the elevated setpoints for overthrust operation. 

 

*

 It is assumed that engine deterioration level is known from sources such as maintenance logs detailing number of 

hours since overhaul or health estimation/management techniques. 

Figure 6. Modified legacy overthrust implementation: failure probabilities. 
American Institute of Aeronautics and Astronautics 

7

This approach was tested at 180 different flight conditions within the range of the extended EPR setpoints 

(altitudes of 0 to 4000 feet in 1000-foot increments; Mach numbers of 0 to 0.3 in 0.1 increments; ambient 

temperature deviations of 0°R, +20°R, and +40°R; deterioration levels of 0, 0.5, and 1). Figure 6 compares the 

probability of failure for operating the engine at maximum power with and without overthrust at each of those flight 

conditions. Figure 7 shows the percentage increase in net thrust at each operating point.*

 As expected, the level of 

additional thrust varies greatly with the flight condition—from approximately 4% to over 20% of baseline maximum 

thrust output. However, the overthrust mode designed using this modified method still performs poorly in terms of 

consistently delivering performance at the desired elevated failure risk of 10-3. Analysis of the data revealed that the 

primary contributor to the lack of consistency is the fact that the maximum Ps30 limit was reached before a failure 

rate of 10-3 could be achieved for several of the extended EPR setpoints. This essentially invalidates the basic 

premise of using setpoint interpolation for a large portion of the operating envelope covered by these points. 

Furthermore, even for portions of the flight envelope where the Ps30 limit was not reached, the uncertainties 

introduced by interpolation manifested as relatively large deviations in failure rates. This issue was attributed to the 

high sensitivity of the failure model to certain engine parameters—an important observation to be elaborated upon in 

subsequent sections. A denser set of extended setpoints may alleviate this latter limitation but would not address the 

primary problem of Ps30 limit activation at some of the setpoints. 

C. Risk Boundary 

In an effort to obtain more consistent risk levels during enhanced performance operation, a new approach to 

overthrust was developed. This design places more emphasis on the disk and blade failure model. The premise is to 

calculate a boundary that represents a constant level of failure probability (in this case, 10-3). This boundary can be 

visualized as a surface in the multi-dimensional space defined by the input variables of the failure model. For 

instance, since the risk function used in this work requires five inputs (Nf, Nc, T40, T48, T50), the boundary would 

ideally be a five-dimensional surface on which the failure probability remains constant at 10-3. The overthrust mode 

would then manipulate the control system to maintain the operating point of the engine on this boundary. 

In order to simplify the definition and visualization of this failure boundary, the dimensions of the input space 

were reduced. To do so, the risk function was analyzed to identify the inputs it is most sensitive to. Furthermore, 

disk failure and blade failure were investigated separately. Recall from Section IV-A that the disk failure model 

requires spool speed inputs (Nf, Nc) whereas the blade failure model requires spool speeds and turbine temperatures 

(T40, T48, T50). Not surprisingly, even in the neighborhood of maximum engine power operation, both functions 

were particularly sensitive to Nc and relatively unreactive to Nf due to the large difference in rotational speeds 

between the fan and core shafts. The analysis concluded that neglecting Nf would not have a significant impact for 

this work. For the disk failure calculation, this simplification reduces the model to a single-variable function (Figure 

8). Hence, imposing a particular maximum allowable disk failure probability involves simply restricting Nc to the 

 

*

 For the presentations of engine performance and risk at multiple operating conditions in these and subsequent 

figures, the operating points are not ordered in a physically meaningful fashion (unless explicitly stated otherwise). 

Therefore, observations will focus on the overall consistency of the performance and risk delivered by the control 

mode. No conclusions will be drawn about how engine performance—baseline or enhanced—trends with flight 

conditions. 

Figure 7. Modified legacy overthrust implementation: net thrust improvements. 
American Institute of Aeronautics and Astronautics 

8

corresponding value. For example, a 10-3 probability of at least one disk failure corresponds to core spool operation 

at over 13,200 RPM. 

The situation is more complicated with the blade failure model due to the turbine temperatures. Although the 

function is expectedly more reactive to the temperatures closely related to the hotter segments of the engine (in order 

of most to least sensitive: T40, T48, T50), it is sufficiently sensitive to all three variables such that none could be 

neglected. Thus, in an attempt to reduce the three temperatures to a single input value, a correlation study was 

conducted on steady-state turbine temperatures across the entire operating regime of the engine (at the 1,251 

operating points described previously). It was found that the temperatures were highly linearly correlated; Table 1 

summarizes the quality of the linear least-squares fits (R2

) between different temperature pairs. Hence, knowledge of 

one temperature value can provide approximations of the other two. By using these correlations and neglecting fan 

speed, the input dimension of the blade failure risk function can be reduced to two (core speed and a turbine 

temperature). As an example, Figure 9 shows a failure boundary of 10-3 calculated in terms of core speed and T50. If 

the temperature correlations were perfect, operation on that threshold would result in a 10-3 probability of at least 

one turbine blade failing. The regions to the left and right of the boundary correspond to lower and higher risk 

levels, respectively. 

Figure 8. Probability of disk failure as a function of core speed (neglecting fan speed). 

Figure 9. Simplified boundary representing 10-3 probability of blade failure in terms of 

core speed and T50 (neglecting fan speed and using linear correlations for T48 and T40).

Table 1. Quality of linear least-squares fit between turbine 

temperature pairs. 

Correlation Goodness of Fit (R2)

T40 & T48 0.9955

T40 & T50 0.9598

T48 & T50 0.9739
American Institute of Aeronautics and Astronautics 

9

For this work, the elevated allowable probabilities for disk and blade failure were both set to 10-3. Although this 

may theoretically result in a maximum probability of approximately 2×10-3 for overall failure (i.e., failure of at least 

one disk or blade), in practice, the two probabilities were orders of magnitude apart when operating at design 

maximum (or beyond) thrust levels. Spool speeds and turbine temperatures are interdependent parameters obtained 

by balancing a multitude of aerothermodynamic relationships. Simultaneous maximization of disk and blade failure 

probabilities (to 10-3) would require the contradictory scenario of operating at high core speeds (defined by Figure 8) 

and low turbine temperatures (to abide by the relationship in Figure 9). In other words, only a segment of the 

temperature/speed boundary depicted in Figure 9 is realistically attainable. Hence, the elevated limit for overall 

disk/blade failure risk is still effectively 10-3. 

It is important to note that, ideally, LPT exit temperature (T50) should be used as the temperature input to 

determine the risk boundary since, of the three, it represents the most hospitable environment for sensor placement. 

Temperature measurements at the LPT inlet (T48) are available for certain aircraft engines.17 However, HPT inlet 

temperature (T40) is not typically measurable and would require performance estimation techniques. Nevertheless, 

we will analyze examples of overthrust using each of the three temperatures. As the results will illustrate, despite the 

highly correlated temperature relationships, the differences in R2

 values—albeit small—coupled with the high 

sensitivity of the failure model to the hotter turbine temperatures noticeably impact overthrust mode performance. 

D. Implementation with Risk Boundary 

Before examining the new overthrust control architecture, the transition process between normal and overthrust 

operation is briefly considered. Recall that in the C-MAPSS40k simulation, PLA is mapped to a set of target EPR 

values. PLA may also be interpreted as the physical position of the throttle component in the aircraft cockpit. Thus, 

extending the allowable range of PLA values for the purpose of overthrust is not practical. Instead, it is envisioned 

that the overthrust mode would be controlled via a dedicated button or switch. However, since this new overthrust 

mode is based on failure risk as opposed to EPR, a redefinition of the PLA-to-EPR mapping would be ambiguous. 

As a result, an intermediary power level indicator, known as power code (PC), is introduced. The PLA-to-EPR 

mapping within C-MAPSS40k is reformatted into a PC-to-EPR mapping. The relationship between PLA and PC is 

shown in Figure 10. During normal operation, the full range of PLA (40° to 80.5°) is mapped to PC values of 0 to 

100. However, upon activation of the overthrust mode, PLA is matched to PC values of 0 to 110. The 

correspondence between the EPR setpoints and PC values from 0 to 100 is consistent for both normal and overthrust 

operation. PC values greater than 100 activate the overthrust mode, with a PC of 110 representing the thrust output 

at the maximum allowable elevated risk level of 10-3. 

The architecture of the risk boundary-based overthrust control mode is shown in Figure 11. Blocks outlined in 

black represent the baseline control system components whereas those in red indicate new components for 

implementing overthrust. The purpose of the overthrust mode is to calculate the fuel flow rate required to drive the 

engine operating point to the designated risk boundary. The control mode consists of three primary components: a 

core speed limiter, the risk boundary data, and a temperature limiter. The core speed limiter ensures that, even 

during overthrust, an absolute maximum value on core speed is not exceeded. This limit is defined by the disk 

failure risk of 10-3. Concurrently, the pre-calculated risk boundary data (Figure 9, for example) is used to determine 

the maximum allowable turbine temperature for a given core speed. This temperature limit is recalculated as core 

Figure 10. Mappings from PLA to power code to facilitate transitions 

between normal and overthrust operation. 
American Institute of Aeronautics and Astronautics 

10

speed varies. The temperature limiter determines the fuel flow required to drive the engine to that limit value. The 

minimum of the two limiter outputs is taken to ensure neither the disk nor blade failure threshold is violated. 

The remaining components introduced facilitate the transition process between normal and overthrust operation 

as described at the beginning of this section. The mapping from PLA to PC is dependent upon the mode of 

operation. For PC up to 100, the fuel flow rate is determined entirely by the baseline EPR controller (and the fan and 

core speed limiters). Between 100 and 110, the fuel flow signal sent to the remainder of the control system is a linear 

combination of the contributions from the EPR controller and the overthrust mode, weighted on PC. At maximum 

overthrust, or a PC of 110, the baseline fan and core speed limiters are essentially neglected and fuel flow rate is 

solely calculated by the overthrust mode. However, similar to the legacy overthrust implementation, the Ps30 limiter 

and acceleration schedule remain in the loop since the risk function does not account for their associated failure 

modes. The minimum limiters are preserved as well since they are not relevant to overthrust operation. 

The question remaining is which of the three turbine temperatures to use with the overthrust control mode. The 

subsequent subsections present the results and issues associated with each case. 

1. T50 

This subsection presents the results of using T50 with the overthrust control architecture. As previously noted, 

this selection is the most practical since LPT exhaust gas temperatures are typically low enough to be readily 

measurable. This implementation is tested on the same 180 low altitude/low Mach number operating points 

described previously. Figure 12 shows the location of each operating point, with full overthrust, relative to the risk 

threshold by plotting T50 against Nc. As the results indicate, there are several flight conditions where the maximum 

Ps30 limit was activated before the risk boundary was reached. These points represent flight conditions where a 

failure probability, as calculated by the risk function, of 10-3 is not achievable due to the hard Ps30 limit; for these 

points, maximum overthrust is determined by the Ps30 limiter and usually corresponds to risk levels noticeably 

lower than the desired 10-3 value. Most of the test cases (approximately 70%), however, fall onto the risk boundary 

as expected (note that the boundary shown in these results is a small section of the boundary depicted in Figure 9). 

Figure 13 shows the changes in net thrust from the design maximum output due to the overthrust mode. (For clarity, 

in these and subsequent figures illustrating overthrust mode performance, the operating points are ordered such that 

those with an active Ps30 limiter are plotted first.) The control mode achieved an increase in net thrust of 10% to 

25% at nearly all 180 operating conditions regardless of the Ps30 limiter status. 

Figure 11. Control mode architecture of overthrust implementation with risk boundary. 
American Institute of Aeronautics and Astronautics 

11

Despite the apparent success of this implementation suggested by the results in Figure 12, the actual failure 

probability levels for the test points are not necessarily close to 10-3. Figure 14 shows the risk level for each run 

(before and after overthrust activation). These results confirm that the failure probabilities for most of the cases with 

an active maximum Ps30 limit remain well below 10-3. However, the failure probabilities for the operating points on 

the risk boundary are inconsistent, varying by approximately an order of magnitude in both directions. This scatter is 

a result of the uncertainty created by collapsing the risk boundary into two dimensions. Recall that, in this case, the 

boundary was simplified by approximating T40 and T48 using the linear least-square fits. Unfortunately, the high R2

values of these fits are overshadowed by the sensitivity of the failure model to the hotter turbine temperatures—T40, 

in particular. Figure 15 shows failure probability plotted against T40 error (difference between the actual T40 value 

and the T40 value calculated by applying the linear fit equation on T50) for only the points situated on the risk 

boundary. The test cases with small T40 discrepancies indeed exhibit failure rates close to the desired 10-3 level. 

However, a 20°R error in T40 corresponds to approximately an order of magnitude change in probability of failure. 

Figure 12. Overthrust implementation with Nc-T50 risk boundary: operating points 

relative to risk boundary. 

Figure 13. Overthrust implementation with Nc-T50 risk boundary: net thrust improvements.
American Institute of Aeronautics and Astronautics 

12

These results suggest that a risk boundary of lower failure probability should be used with the control mode if 

only T50 data are available. A more conservative boundary may be able to contain failure risk below the required 

level but will result in less-than-maximum performance in most cases. Alternatively, measurements or estimates of 

T48 or T40 could be utilized, which will be discussed in the subsequent section. 

2. T48 & T40 

Although the implementation with T50 data performed noticeably better than the modified legacy method in 

maintaining the desired elevated risk level (Figure 14 and Figure 6, respectively), there is ample room for 

improvement in terms of consistency. To address this issue, usage of the hotter turbine temperatures (T48 and T40) 

with this overthrust mode design was investigated. Because these temperatures represent harsher operating 

environments, they are not readily obtainable in all aircraft engine applications. Ref. 17 suggests T48 is measurable 

for certain powerplants. However, T40 is generally unobtainable using conventional sensing devices. The 

implementations and results presented in this section assume either the availability of a T48 sensor or an accurate 

onboard estimation technique for T40 data. Measurement/estimation uncertainty was not analyzed, though, as shown 

by the results obtained using the T50 implementation, it would likely affect control mode performance. 

Figure 16, Figure 17, and Figure 18 show the results of applying the overthrust control mode using T48 data for 

the 180 test points. Figure 16 shows the 10-3 failure rate boundary presented in terms of Nc and T48. Similar to the 

implementation with T50, for each run, the control mode increased thrust output until the engine was limited by 

either the maximum allowable Ps30 value or the risk boundary. Figure 17 summarizes the percentage increase in net 

thrust over the design maximum output levels. However, in this case, as shown in Figure 18, the actual failure 

probabilities of the runs situated on the risk boundary are distributed more closely around the 10-3 level (standard 

deviation of approximately 0.34×10-3). 

Figure 14. Overthrust implementation with Nc-T50 risk boundary: failure 

probabilities. 

Figure 15. Overthrust implementation with Nc-T50 risk boundary: sensitivity of failure 

probability to T40 error. 
American Institute of Aeronautics and Astronautics 

13

The primary cause for this deviation, albeit reduced, is the same as before: high sensitivity of the failure model to 

T40. Therefore, it follows that the failure probability consistency was further improved by utilizing T40 data with 

the overthrust control mode (Figure 19, Figure 20, and Figure 21). For this case, the standard deviation of the failure 

probabilities for those points located on the risk boundary was reduced to 0.066×10-3. This tighter distribution 

indicates that the Nc-T40 boundary is a more accurate approximation of the true (i.e., five-dimensional) constant 

failure rate threshold than the others. It is interesting to note that there are no significant differences among the three 

Figure 16. Overthrust implementation with Nc-T48 risk boundary: operating points 

relative to risk boundary. 

Figure 17. Overthrust implementation with Nc-T48 risk boundary: net thrust improvements. 

Figure 18. Overthrust implementation with Nc-T48 risk boundary: failure probabilities. 
American Institute of Aeronautics and Astronautics 

14

implementations with respect to thrust output enhancement. The primary advantage of the availability of the hotter 

turbine temperatures is more fine-tuned authority by the control mode over the failure probability. 

Although more complex than the legacy overthrust control mode architecture, this novel implementation is 

robust to flight conditions since its design is primarily based on the risk function. To demonstrate this (disregarding 

whether or not overthrust functionality would be useful at all such conditions), the control mode using T40 data was 

Figure 19. Overthrust implementation with Nc-T40 risk boundary: operating points 

relative to risk boundary. 

Figure 20. Overthrust implementation with Nc-T40 risk boundary: net thrust improvements. 

Figure 21. Overthrust implementation with Nc-T40 risk boundary: failure probabilities. 
American Institute of Aeronautics and Astronautics 

15

applied at the aforementioned 1,251 test points across the entire flight and engine health range of operation. 

Increases in net thrust output range from 2.5% to 36% (Figure 22). Figure 23 shows that, with the exception of the 

cases with an active Ps30 limit, the desired elevated risk level is consistently maintained at all test points. 

V. Faster Response Control Mode Design 

Application of the design method presented in this work to a faster engine response control mode requires 

identifying the type of malfunction to focus on and characterizing the probability of it occurring. This demonstration 

will concentrate on the risk of high-pressure compressor (HPC) rotating stall/surge (henceforth collectively referred 

to as “stall”) since the primary function of the faster response mode is to shorten engine acceleration times. Stall 

likelihood is captured by stall margin (SM), which is generally defined as the proximity of the operating pressure 

ratio (PR) of the compressor to its stall pressure ratio (PRs) for the same operating mass flow rate: 

 = 



 − 1 × 100%

In C-MAPSS40k, the compressor maps and their corresponding surge lines are definitive quantities. Thus, it is 

usually assumed that stall does not occur if the stall margin is positive. However, in practice, there are uncertainties 

affecting both the operating and stall lines of a compressor that cannot be deterministically captured. If these random 

factors are accounted for, then the risk of stall exists even if the engine model reports a positive stall margin. The 

risk parameter used for the faster response control mode is this probability of HPC stall. 

A. Risk Function 

A statistical stability assessment is used to capture stall probability. The specific procedure and examples 

described in the “SAE AIR1419 Rev. A” guidelines document18 are leveraged for this work. Table 2 reproduces the 

Figure 22. Overthrust implementation with Nc-T40 risk boundary (full envelope): net thrust 

improvements. 

Figure 23. Overthrust implementation with Nc-T40 risk boundary (full envelope): failure 

probabilities. 
American Institute of Aeronautics and Astronautics 

16

data from the sample stability assessment provided by the document. The table enumerates factors that affect the 

operating and surge lines and provides approximations of how much stall margin is required to account for each. 

The sum of the non-random stall margin effects is an indication of the minimum design stall margin of the 

compressor. These factors are assumed to be accounted for in the design of the C-MAPSS40k engine model. Only 

the random effects are of interest for determining stall probability. 

The premise of the risk function is that the deterministic engine model, C-MAPSS40k, represents the mean 

performance of a large operating fleet of such engines. Deviations from this mean performance are approximated by 

a normal distribution function. The risk function calculates the stall probability by applying this assumption to stall 

margin. The offset and shape of the probability density function is defined by the deterministic and random stall 

margin effects. Specifically, the HPC stall margin output from C-MAPSS40k is set as the mean of the normal 

distribution. The random stall margin effects are combined using a root-sum-square calculation, resulting in the 

overall 2.17% value shown in the last line of Table 2. This root-sum-square is assumed to equal three standard 

deviations, thus defining the shape of the normal distribution curve. For instance, Figure 24 shows the stall margin 

distribution for a mean stall margin of 1%. The probability of stall at this particular operating condition is then 

obtained by calculating the area under the density function from 0 to negative infinity. These calculations are 

repeated for various values of mean stall margin to generate the risk function, visualized in Figure 25. 

For consistency with the overthrust control mode, a risk threshold of 10-3 was selected for the design of the faster 

response control mode. This risk level corresponds to a stall margin of approximately 2.4%. As Figure 25 shows, the 

risk of stall is negligibly small for stall margins above 5%. Since the baseline engine consistently operates (during 

transients and at steady-state) at HPC stall margins well above 5%, the performance of the faster response control 

mode will be presented in terms of stall margin as opposed to stall probability. 

Table 2. Statistical compressor stability assessment.18

Destabilizing Effects Non-random Random

Operating Line Inlet Distortion 0.7% -

PLA Transient 6.0% -

Fuel Control Tolerance - ±1.15%

Engine-to-Engine Variation - ±1.25%

Surge Line Reynolds Number 0.36% -

Inlet Distortion 7.5% -

Engine-to-Engine Variation - ±1.35%

Total 14.56% 2.17%

Figure 24. Stall margins of a large fleet of engines modeled as normal distribution. Stall margin 

reported by C-MAPSS40k (1% in this illustration) represents mean performance. Area under curve 

from negative infinity to 0 equals probability of stall. 
American Institute of Aeronautics and Astronautics 

17

B. Implementation 

The legacy control mode implementation improved transient response by introducing three primary 

modifications to the engine control system.10 First, the bandwidth of the EPR controller was increased to provide 

faster response for small PLA transients. Second, a novel high-speed idling technique manipulated customer bleed 

and stator vane schedules to attain higher spool speeds at low thrust levels. This operating state reduces the time 

required for the engine to reach higher power levels. Finally, the acceleration schedule was shifted to increase the 

limit on maximum allowable core acceleration, improving large transient performance at the cost of increased stall 

margin usage. 

For the present implementation, the controller bandwidth modifications and the high-speed idle algorithms were 

largely preserved. However, since the acceleration schedule plays a major role in regulating the stall margin usage 

during a large power transient, the offset logic was tuned using the stall risk function. A simple search algorithm was 

created to determine the offset amount that yielded a minimum stall margin of 2.4% during a 0.1-second flight idleto-full power throttle change. This search was conducted at 60 operating points covering a low-altitude/Mach 

number flight regime (altitudes of 0 to 4000 feet in 1000-foot increments; Mach numbers of 0, 0.1, and 0.2; 0°R and 

+40°R deviation from standard day ambient temperature; deterioration level of 0 and 1). Control mode usage within 

this envelope involved four-dimensional interpolation between these operating points to determine the appropriate 

offset value.*

 

*

 A more direct method—analogous to the risk boundary overthrust implementation—would be a minimum limiter 

on HPC stall margin. Such an approach would require stall margin estimation (e.g. Kalman filter, model prediction, 

etc.) and, hence, is beyond the scope of this paper. However, the design philosophy presented in this paper is wellsuited for this approach and implementation of such a configuration is a possible avenue of future work. 

Figure 25. Probability of stall due to random destabilizing effects as a function of 

mean stall margin (reported by engine model). 

Figure 26. Faster engine response implementation: minimum stall margin attained during transient.
American Institute of Aeronautics and Astronautics 

18

To test the control mode, the same throttle transient was run at 540 operating points (altitudes of 0 to 4000 feet in 

500-foot increments; Mach numbers of 0 to 0.2 in 0.05 increments; standard day temperature deviations of 0°R, 

+20°R, and +40°R; deterioration levels of 0, 0.3, 0.7, and 1) evenly distributed across the flight envelope defined by 

the 60 interpolation points. Figure 26 shows the minimum HPC stall margin observed during each run for the 

baseline control system and the faster response mode. The baseline cases exhibit a wide range of minimum stall 

margin values, indicating that the dynamic response is highly sensitive to ambient and engine health conditions. 

Nevertheless, the acceleration schedule performs its intended function, maintaining an often sizeable stall margin for 

all cases. With the faster response mode activated, this excess stall margin is consumed to improve transient 

performance. The control mode is relatively consistent in maintaining the desired minimum stall margin. 

The decrease in repeatability for the cases in the 180-360 range is due to interpolation of offset values across 

standard day temperature deviations. The 540 points in Figure 26 are grouped in order of increasing ambient 

temperature: the first third represents standard day ambient temperature; the second third is +20°R deviation; the last 

third is +40°R deviation. Since the interpolation points only consisted of conditions at 0°R and +40°R deviation, 

these results imply a nonlinear variation with standard temperature that is not being adequately captured by linear 

interpolation. It is expected that additional interpolation points at more temperature values would alleviate this issue. 

On the other hand, control mode performance across variations in altitude, Mach number, and engine health appears 

to be sufficient. 

Figure 27 shows the improvements in dynamic thrust response by using the control mode in terms of percentage 

reduction in rise time. For this application, rise time is defined as the time the engine takes to traverse from 10% to 

90% of the difference between the initial and final thrust output levels. The faster response control mode achieves a 

5% to 20% reduction in rise time for the majority of the test cases. 

VI. Joint Implementation 

The overthrust and faster response control modes operate on different components of the engine control system. 

As Figure 11 illustrated, the overthrust mode manipulates the limit protection (min/max) logic to incorporate the 

elevated risk boundary. On the other hand, the faster response mode modifies parameters within the EPR setpoint 

controller and acceleration schedule subsystems. Thus, the effort required to combine the two performance 

enhancing modes is minimal: the modifications introduced by each mode are superimposed without conflict. 

Likewise, engine performance when utilizing both emergency control modes is essentially a superposition of the 

results already presented for each control mode individually. This is because the two control modes seek to modify 

fundamentally separate portions of the engine response. To elucidate, Figure 28 shows the net thrust and HPC stall 

margin time responses to an idle-to-full-power throttle command for a particular operating condition (1000-foot 

altitude, Mach 0.2, +20°R deviation from standard ambient temperature, 0.7 deterioration level). Four cases are 

presented: (1) both control modes deactivated (i.e., baseline); (2) overthrust mode only (using T40 data); (3) faster 

response mode only; (4) both control modes activated (with overthrust mode using T40 data). For the baseline and 

faster response-only cases, throttle was increased from flight idle to full power in 0.1 seconds at the 15-second mark; 

for the overthrust-only and combined implementation cases, throttle was increased from flight idle to full overthrust 

in 0.1 seconds at the 15-second mark. As shown by the results, the overthrust mode primarily affects the conditions 

at which the engine settles. The transient portions of the baseline and overthrust only cases are similar until the 

Figure 27. Faster engine response implementation: rise time improvements. 
American Institute of Aeronautics and Astronautics 

19

overthrust mode commands a higher thrust. On the other hand, the faster response mode significantly alters the 

dynamic response of the engine in the form of a shorter rise time and increased stall margin usage. However, the 

faster response and baseline cases settle to identical conditions. The joint implementation exhibits the characteristics 

of both control modes. The dynamic portion of the response resembles the faster response time history since the 

combined implementation drops to a similar minimum HPC stall margin. The response then settles to the same 

thrust level as the overthrust case. 

The results shown in Figure 28 are representative of the enhanced performance obtained throughout the lowaltitude/low-Mach number operating regime described in the previous section. Figure 29 shows the minimum stall 

margins attained during a 0.1-second transient from flight idle to maximum overthrust at the same 540 operating 

points used to test the faster engine response mode. In this case, the joint implementation is compared with an 

overthrust-only configuration. Figure 30 summarizes the rise time improvements at those operating points. The 

results are similar to the comparisons between the baseline control system and the faster response control mode. 

Plots of steady-state net thrust improvements and increased disk/blade risk levels using the joint implementation are 

identical to the overthrust-only configuration (Figure 20 and Figure 21). 

Figure 28. Engine performance using combined implementation exhibits characteristics of 

both overthrust and faster response control modes. 
American Institute of Aeronautics and Astronautics 

20

VII. Summary & Future Work 

This paper described and demonstrated a design philosophy for developing engine performance-enhancing 

control modes for use during emergency flight scenarios. Performance improvements are defined and limited by a 

predetermined elevated risk of engine failure that is deemed acceptable for such situations where overall vehicle 

survivability must be maximized. This concept was demonstrated on two previously studied enhanced engine 

performance modes: overthrust and faster response. The overthrust control mode must be able to consistently 

provide increased maximum engine thrust output at a predefined elevated probability of rotor disk/blade failure for a 

variety of flight conditions. It was shown that minor modifications to the legacy overthrust implementation were not 

sufficient to achieve this goal. Instead, a significant redesign of the control mode logic that more explicitly accounts 

for disk/blade failure was required. The performance of the redesigned control mode is robust to flight conditions 

but dependent upon availability of measurements or estimates of the conditions within the high-temperature regimes 

of the engine (e.g., high-pressure turbine inlet/exit). The design objective was applied to the faster response control 

mode by requiring a consistent level of compressor stall probability while improving engine dynamic response. 

Probability of stall was characterized by applying a normal distribution-based statistical stall margin assessment. It 

was found that, with some tuning based on this statistical assessment procedure, the legacy fast response control 

architecture performed satisfactorily across various flight conditions. Since overthrust and faster response control 

modes modify fundamentally separate aspects of engine performance, the modes could be combined without 

conflict. Engine performance using the joint implementation reflected characteristics of both control modes. 

This work alluded to several relevant topics worthy of further discussion and investigation. It is important to note 

that although the design process presented is relatively generic, the control modes demonstrated are specific to both 

the elevated risk level selected and the risk models utilized. The risk level of 10-3 was arbitrarily selected for 

demonstrative purposes. The determination of a realistic elevated risk level must be based on analyses of vehicle 

Figure 29. Combined implementation: minimum stall margin attained during transient. 

Figure 30. Combined implementation: rise time improvements. 
American Institute of Aeronautics and Astronautics 

21

survivability for a range of emergency flight scenarios. The control mode architectures described in this paper can 

readily accommodate other risk levels, albeit with a recalculation of the relevant parameters (e.g., risk boundary, 

minimum stall margin). However, the architectures are specific to the risk models utilized. Using significantly 

different risk models would almost certainly require a redesign of the control mode logic in order to preserve 

consistent enhanced performance. A possible area of future study is the usage of engine performance estimation 

techniques in conjunction with the performance-enhancing control modes. The results presented in this paper 

showed that knowledge of high-pressure turbine temperatures, especially at HPT inlet, is essential to consistent 

overthrust performance. Similarly, availability of stall margin data would allow a more direct implementation of the 

faster response mode. A redesign of the control mode that is analogous to that done for overthrust would eliminate 

the interpolation routines and increase robustness to flight conditions. Performance estimation algorithms such as 

Kalman filtering may be able to provide the data required for such implementations. However, the uncertainties 

associated with estimation techniques must be accounted for in the risk models. Another issue to consider is the 

human factors impact, if any, of consistent risk elevation (as opposed to consistent performance enhancement). As 

evidenced by the results, a consistent elevated risk level results in varying percentage increases in maximum thrust. 

Since these control modes are designed for emergency situations, it is essential to evaluate whether or not this 

variation affects a pilot's ability to fly the aircraft. 

References 

1

 National Transportation Safety Board, “NW Airlines, Inc., Flights 1482 and 299 Runway Incursion and Collision Detroit 

Metropolitan/Wayne County Airport Romulus, Michigan, December 3, 1990,” NTSB/AAR-91-05. 2

 National Transportation Safety Board, “Aircraft Accident Report: American Airlines, Inc. McDonnell Douglas DC-10-10, 

N103AA. Near Windsor, Ontario, Canada, June 12, 1972,” PB-219 370, 1973. 3

 National Transportation Safety Board, “Aircraft Accident Report, United Airlines Flight 232, McDonnell Douglas DC1040, Sioux Gateway Airport, Sioux City, Iowa, July 19, 1989,” PBSO-910406, NTSB/AARSO/06, 1990. 4

 Lemaignan, B., “Flying With No Flight Controls: Handling Qualities Analyses of the Baghdad Event,” AIAA Atmospheric 

Flight Mechanics Conference and Exhibit, San Francisco, California, 15-18 August 2005. 5

 Burcham, F.W., Jr. and Fullerton, C.G., “Controlling Crippled Aircraft—With Throttles,” NASA Technical Memorandum, 

NASA TM-104238, 1991. 6

 Burcham, F.W., Jr., Fullerton, C.G., and Maine, T.A., “Manual Manipulation of Engine Throttles for Emergency Flight 

Control,” NASA Technical Memorandum, NASA/TM-2004-212045, January 2004. 7

 Guo, T. and Litt, J.S., “Risk Management for Intelligent Fast Engine Response Control,” AIAA Infotech@Aerospace 

Conference, Seattle, Washington, 6-9 April 2009. 8

 Litt, J.S., Frederick, D.K., and Guo, T., “The Case for Intelligent Propulsion Control for Fast Engine Response,” AIAA 

Infotech@Aerospace Conference, Seattle, Washington, 6-9 April 2009. 9

 Csank, J.T., May, R.D., Litt, J.S., and Guo, T., “A Sensitivity Study of Commercial Aircraft Engine Response for 

Emergency Situations,” NASA Technical Memorandum, NASA/TM-2011-217004. 10 May, R.D., Csank, J.T., Guo, T., and Litt, J.S., “Improving Engine Responsiveness during Approach through High Speed 

Idle Control,” 47th AIAA/ASME/SAE/ASEE Joint Propulsion Conference and Exhibit, San Diego, California, 31 July-3 August 

2011. 11 Litt, J.S., Sharp, L.M., and Guo, T., “A Risk Assessment Architecture for Enhanced Engine Operation,” AIAA 

Infotech@Aerospace Conference, Atlanta, Georgia, 20-22 April 2010. 12 Csank, J.T., May, R.D., Guo, T., and Litt, J.S., “The Effect of Modified Control Limits on the Performance of a Generic 

Commercial Aircraft Engine,” 47th AIAA/ASME/SAE/ASEE Joint Propulsion Conference and Exhibit, San Diego, California, 31 

July-3 August 2011. 13 McGlynn, G.E., Litt, J.S., Lemon, K.A., and Csank, J.T., “A Risk Management Architecture for Emergency Integrated 

Aircraft Control,” AIAA Infotech@Aerospace Conference, St. Louis, Missouri, 29-31 March 2011. 14 Csank, J.T., Chin, J.C., May, R.D., Litt, J.S., and Guo, T., “Implementation of Enhanced Propulsion Control Modes for 

Emergency Flight Operation,” AIAA Infotech@Aerospace Conference, St. Louis, Missouri, 29-31 March 2011. 15May, R.D., Csank, J., Lavelle, T.M., Litt, J.S., and Guo, T., “A High-Fidelity Simulation of a Generic Commercial Aircraft 

Engine and Controller,” 46th AIAA/ASME/SAE/ASEE Joint Propulsion Conference and Exhibit, Nashville, Tennessee, 25-28 

July 2010. 16 Aeronautics and Space, 14 C.F.R. pt. 33.75 (2012). 

17 “Engine Type Certificate Data Sheet EASA.IM.E.002,” European Aviation Safety Agency, 16 March 2004. 

18 “Inlet Total-Pressure-Distortion Considerations for Gas-Turbine Engines,” SAE AIR1419 Rev. A, 1999.