Ryan D. May

ASRC Aerospace Corporation, Cleveland, Ohio

Sanjay Garg

Glenn Research Center, Cleveland, Ohio

Reducing Conservatism in Aircraft Engine

Response Using Conditionally Active

Min-Max Limit Regulators

NASA/TM—2012-217814

December 2012

GT2012–70017
NASA STI Program . . . in Profi le

Since its founding, NASA has been dedicated to the 

advancement of aeronautics and space science. The 

NASA Scientifi c and Technical Information (STI) 

program plays a key part in helping NASA maintain 

this important role.

The NASA STI Program operates under the auspices 

of the Agency Chief Information Offi cer. It collects, 

organizes, provides for archiving, and disseminates 

NASA’s STI. The NASA STI program provides access 

to the NASA Aeronautics and Space Database and 

its public interface, the NASA Technical Reports 

Server, thus providing one of the largest collections 

of aeronautical and space science STI in the world. 

Results are published in both non-NASA channels 

and by NASA in the NASA STI Report Series, which 

includes the following report types:

• TECHNICAL PUBLICATION. Reports of 

completed research or a major signifi cant phase 

of research that present the results of NASA 

programs and include extensive data or theoretical 

analysis. Includes compilations of signifi cant 

scientifi c and technical data and information 

deemed to be of continuing reference value. 

NASA counterpart of peer-reviewed formal 

professional papers but has less stringent 

limitations on manuscript length and extent of 

graphic presentations.

• TECHNICAL MEMORANDUM. Scientifi c 

and technical fi ndings that are preliminary or 

of specialized interest, e.g., quick release 

reports, working papers, and bibliographies that 

contain minimal annotation. Does not contain 

extensive analysis.

• CONTRACTOR REPORT. Scientifi c and 

technical fi ndings by NASA-sponsored 

contractors and grantees.

• CONFERENCE PUBLICATION. Collected 

papers from scientifi c and technical 

conferences, symposia, seminars, or other 

meetings sponsored or cosponsored by NASA.

• SPECIAL PUBLICATION. Scientifi c, 

technical, or historical information from 

NASA programs, projects, and missions, often 

concerned with subjects having substantial 

public interest.

• TECHNICAL TRANSLATION. Englishlanguage translations of foreign scientifi c and 

technical material pertinent to NASA’s mission.

Specialized services also include creating custom 

thesauri, building customized databases, organizing 

and publishing research results.

For more information about the NASA STI 

program, see the following:

• Access the NASA STI program home page at 

http://www.sti.nasa.gov

• E-mail your question to help@sti.nasa.gov

• Fax your question to the NASA STI 

Information Desk at 443–757–5803

• Phone the NASA STI Information Desk at

 443–757–5802

• Write to:

 STI Information Desk

 NASA Center for AeroSpace Information

 7115 Standard Drive

 Hanover, MD 21076–1320
Ryan D. May

ASRC Aerospace Corporation, Cleveland, Ohio

Sanjay Garg

Glenn Research Center, Cleveland, Ohio

Reducing Conservatism in Aircraft Engine

Response Using Conditionally Active

Min-Max Limit Regulators

NASA/TM—2012-217814

December 2012

GT2012–70017

National Aeronautics and

Space Administration

Glenn Research Center

Cleveland, Ohio 44135

Prepared for the

Turbo Expo 2012

sponsored by the American Society of Mechanical Engineers (ASME)

Copenhagen, Denmark, June 11–15, 2012
Available from

NASA Center for Aerospace Information

7115 Standard Drive

Hanover, MD 21076–1320

National Technical Information Service

5301 Shawnee Road

Alexandria, VA 22312

Available electronically at http://www.sti.nasa.gov

Trade names and trademarks are used in this report for identifi cation 

only. Their usage does not constitute an offi cial endorsement, 

either expressed or implied, by the National Aeronautics and 

Space Administration.

Level of Review: This material has been technically reviewed by technical management. 
NASA/TM—2012-217814 1

Reducing Conservatism in Aircraft Engine Response Using

Conditionally Active Min-Max Limit Regulators

Ryan D. May

ASRC Aerospace Corporation

Cleveland, Ohio 44135

Sanjay Garg

National Aeronautics and Space Administration

Glenn Research Center

Cleveland, Ohio 44135

Abstract

Current aircraft engine control logic uses a Min-Max 

control selection structure to prevent the engine from 

exceeding any safety or operational limits during transients 

due to throttle commands. This structure is inherently 

conservative and produces transient responses that are slower 

than necessary. In order to utilize the existing safety margins 

more effectively, a modification to this architecture is 

proposed, referred to as a Conditionally Active (CA) limit 

regulator. This concept uses the existing Min-Max architecture 

with the modification that limit regulators are active only 

when the operating point is close to a particular limit. This 

paper explores the use of CA limit regulators using a publicly 

available commercial aircraft engine simulation. The 

improvement in thrust response while maintaining all 

necessary safety limits is demonstrated in a number of cases. 

Introduction

The control system in modern commercial aircraft engines 

is designed to operate the engine in a safe manner throughout 

its operating envelope during its on-wing life. This 

challenging objective is typically achieved through the use of 

a Min-Max architecture (Refs. 1 and 2) as shown in Figure 1.

Each of the physical and operational engine limits of concern 

has a unique regulator associated with it. Each of these 

regulators generates a desired fuel flow rate (Wf) that will 

maintain the limit. The throttle is used as input to either an 

engine pressure ratio (EPR) setpoint regulator or a fan speed 

(Nf) setpoint regulator. The desired fuel flow from the setpoint 

regulator and each of the maximum limit regulators are input 

to a minimum selector. The output of this Min selector and 

each of the minimum limit regulator outputs are input to a 

maximum selector. Thus, the output from the Min-Max 

selector is the fuel flow rate command that ensures that none 

of the operational and safety limits will be violated.

This architecture, which is typical for today’s commercial 

aircraft engine controllers, is inherently conservative. The 

engine limit regulators are typically designed as simple 

regulators (e.g., Proportional-Integral controllers) and they are 

each independently designed. The Min-Max architecture then 

ensures that the most conservative control input is chosen. A 

limit regulator can become active even when there is no 

immediate danger of reaching the limit. This results in a 

slower engine response than is actually necessary to maintain 

safe operation. Typically, this has not been a problem as this 

conservative design is still able to meet the FAA certification 

requirements for engine response time. However, in 

emergencies, such as the Sioux City crash of United flight 232

in 1989, this conservative design may prevent the engine from 

achieving the faster response times that might be needed to 

provide adequate flight control (Ref. 3).

Previous research (Ref. 4) on developing methods to 

enhance the engine response for emergency control has shown 

that this conservative limit protection approach prevents the 

engine from delivering the dynamic response that is actually 

achievable. The authors of Reference 4 were attempting to 

achieve faster engine response by increasing the bandwidth of 

the setpoint controller, using a 90,000 lbf engine simulation as 

the application. However, they found that the turbine 

temperature limit would activate and slow the engine 

response. It was discovered that the temperature limit 

regulator was becoming active even when the actual 

temperature was far from its limit. It is worth noting that while 

a turbine temperature limit is not typically found in 

commercial aircraft engine controller, it is possible that other 

limits become active prematurely and unnecessarily slow the 

engine response.

More recent research has studied means of avoiding this 

problem by the use of alternative limit protection 

architectures. One recent study investigates the use of Sliding 

Mode controllers as a means of preventing unnecessary limiter 

interventions while ensuring safe performance Reference 5.

Another recent study investigates the use of a reference 

governor on a linearized engine model Reference 6. However, 

the changes proposed in these studies necessitate a complete 

redesign of the engine controller which will impose challenges 

in terms of verification across the whole operating envelope 

and acceptance by engine control implementers.

In an effort to maintain the current control architecture 

while reducing this conservatism, a new scheme is proposed 

wherein the engine control limit regulators become active only 

when the variable to be limited is within a specified close 
NASA/TM—2012-217814 2

Figure 1.—Diagram of the C-MAPSS40k engine control system 

with throttle (PLA) input and Wf command output. The Power 

Management and Protection Logic subsystems are 

highlighted.

bound of the actual limit value. This paper first presents the 

formulation of this CA limit regulator protection scheme. 

Choosing appropriate bounds for when the limit regulator 

becomes active is then discussed in the context of application 

to an engine simulation. Various aspects of engine operation 

with the baseline Min-Max limit protection and the enhanced 

CA limit protection are evaluated and compared. Conclusions 

from this study and areas that need further investigation are 

then summarized.

Nomenclature

α Constant that defines the error bound for a 

conditionally active limiter

β Constant that defines the error derivative 

bound for a conditionally active limiter

CA Conditionally Active

C-MAPSS40k Commercial Modular Aero-Propulsion 

System Simulation 40,000 lbf

e limit regulator error

EPR Engine Pressure Ratio

Fnet Net engine thrust [lbf]

γ Constant that defines an override enable 

for a conditionally active limit regulator

ISA International Standard Atmosphere

HPC High Pressure Compressor

Nc Core Shaft Speed [rpm]

Nf Fan Shaft Speed [rpm]

PLA Power Lever Angle [deg]

Ps3 Combustor Entrance Static Pressure [psi]

RU Ratio Unit (Wf/Ps3) [lbm/s/psi]

SLS Sea-level static flight condition (0 ft altitude,

Mach 0.0, ISA+0 degrees)

SM Surge Margin [%]

ΔT Controller step size [s]

Wf Fuel Flow Rate [lbm/s]

y The measured value of a limited engine parameter

ymax The maximum limit of the engine parameter y

ymin The minimum limit of the engine parameter y

Conditionally Active Limit Regulation

Consider the generic form of a Min-Max control selection 

scheme as shown in Figure 2. Here, z is the regulated variable 

of interest to provide desired performance, i.e., fan speed or 

EPR in the case of an aircraft gas turbine engine. Output y1 is 

to be maintained below a certain maximum value (y1max) and 

output y2 is to be maintained above a certain minimum value 

(y2min). For simplicity, y1 and y2 are the only limits considered, 

however the premise extends to an arbitrary number of output 

variables.

In the above Min-Max selection scheme, the limit regulated 

outputs are constantly being used in the selection of the 

commanded input, u, to the plant. However, such an approach 

is inherently conservative in that the commanded input might 

be limited by one of the limit regulators even if the value of 

the output to be limited is far from its limit.

Since the purpose of the limit regulator is to ensure that the 

specified limit is not violated, it does not need to be active if 

there is no chance of the limit being reached. The idea behind 

CA limit regulators is to make the limit regulator active in the 

Min-Max selection scheme only when there is a reasonable 

chance that the limit will be reached if the input command 

generated by the setpoint regulator (or another limit regulator) 

is not modified.

An operational region for a limit regulator to be active in the 

Min-Max selection scheme can then be defined as: Condition 1:

the variable to be limited is “close” to its limit value, and 

Condition 2: its current rate is such that it will reach the limit 

within a certain period of time with no other changes. In order 

for the limit regulator to be active, both Conditions 1 and 2 must 

be true.

For the case of a maximum limit variable, y1, the objective 

will be to keep 1 1max y ≤ y . Condition 1 can then be stated as:

1 1 * 1max y ≥ (1 − α ) y (1)

where α1 is a design parameter that is non-negative.
NASA/TM—2012-217814 3

Set Point 

Regulator

Plant

Maximum 

Limit 

Regulator

Minimum 

Limit 

Regulator

Max

Min

Max Limited 

Variable

Regulated 

Variable

Min Limited 

Variable

u2

u1 umin

uz

z

y1

y2

u

-

-

-

zc

y1max

y2min

Figure 2.—A generic Min-Max scheme used to select the input 

to a plant such that the regulated variable, z, tracks zc with 

the constraints that y1 does not exceed y1max and y2 does 

not fall below y2min.

For condition 2, consider the controller update time to be 

ΔT with the objective to activate the limit regulator if the 

current rate of change of y1 is such that it will reach y1max in β1

time steps. The condition can be stated as

1 1 * 1 * 1max y T y dt

d

y + β ∆ ≥ (2)

where β1 is a design parameter that is non-negative.

An example maximum limited output variable trajectory is 

shown in Figure 3. The output, y1, is initially below the limit 

and both Equations (1) and (2) are false. At time tA, y1 crosses 

into the region for which Equation (1) is true—it is “close” to 

the limit. However, the slope at point A is too low to intersect 

y1max within β1 time steps (tA’ > tA+β1*ΔT). At all points 

between A and B the slope still does not exceed the necessary 

threshold. Visually, it does not appear that the trajectory will 

violate the limit. However at point B there is a sudden 

upswing and now Equation (2) is validated (tB’ < tB+β1*ΔT) 

thus the CA limit regulator would become active and act to 

restrict the input to prevent y1 from exceeding y1max.

For the case of a minimum limit variable, y2, the objective 

will be to keep 2 2min y ≥ y . Conditions 1 and 2 can be 

developed into equations analogous to Equations (1) and (2) 

with non-negative design parameters α2 and β2.

2 2 * 2 min y ≤ (1 + α ) y (3)

2 2 * 2 * 2 min y T y dt

d

y + β ∆ ≤ (4)

It is worth noting that when Condition 1 is met (the variable 

is “close” to the limit) that the construction of Condition 2 can 

Figure 3.—Plot showing an example y1(t) for which Equation (1) 

is satisfied starting at tA, but Equation (2) isn’t satisfied until 

tB. Therefore, the CA limit regulator would not become active 

until time tB.

cause the limit regulator to switch between active and inactive. This behavior could result in chatter in the fuel flow 

command. If this chatter is found to occur and negatively 

impact the performance, an additional condition could be 

imposed such as 1 1 * 1max y ≥ (1 − γ ) y where γ1 is a nonnegative number that is less than α1. This condition would be 

included into the CA activation logic through the following 

Boolean expression: (Conditions 1 and 2) or Condition 3. 

However, this condition is not implemented in this study.

Defining the maximum limit regulator error as 

1 1max 1 e = y − y , Equations (1) and (2) can be written as:

1 1 * 1max e ≤ α y (5)

T

e e dtd

β ∆

− ≤

1 *

1

1 (6)

With the minimum limit regulator error defined as 

2 2 min 2 e = y − y , Equations (3) and (4) can be stated as:

2 2 * 2 min e ≥ −α y (7)

T

e e dt

d

β ∆

− ≥

2 *

2

2 (8)

When implemented in the generic Min-Max selector block 

diagram of Figure 2, the above implementation of the CA limit 

regulator architecture is shown in Figure 4. The switches 

shown on the output of each limit regulator only connect to the 

Max and Min selector blocks when both bounding conditions 

are true—Equations (5) and (6) for the Max limit regulator 

and Equations (7) and (8) for the Min limit regulator. The rest 

of the system shown in Figure 2 remains unchanged.

y1

t

(1-α1

)y1max

y1max

A

B

t

A t

B

t

A

+β1

*ΔT

t

B

+β1 t *ΔT A

'

t

B

'
NASA/TM—2012-217814 4

Maximum 

Limit 

Regulator

Minimum 

Limit 

Regulator

Max

Min

umin

uz

u

-

- e1

e2

y1max

y2min

y1

y2

Eq. (5) 

Eq. (6)

Eq. (7) 

Eq. (8)

Figure 4.—The generic Min-Max selection scheme modified to 

include conditionally active limit regulators. When both of the 

necessary conditions are true, the regulator output is passed 

to the Min or Max selector block.

As most control laws are implemented in a digital 

processor, it is necessary to develop discrete-time versions of 

these equations. The discrete version of the maximum limit 

inequalities Equations (5) and (6) is listed below where e[k]

refers to the error at the current time index and e[k-1] to the 

error at the previous time step.

1 * 1max e [k] ≤ α y (9)

( ) T

e k e k e k

T β ∆

− − − ≤

∆ *

[ ] [ ] [ 1] 1

1

1

1 1 (10)

Also, the designer may find it desirable to use a filtered 

version of e[k] to reduce noise. For the case of a minimum 

limit, discrete time equations can be developed in a similar 

manner.

The designer is thus given two parameters which adjust the 

size of the region in which the limiter will be active. For 

parameters which change value quickly a large α and/or β may 

be needed to allow the limit regulator to become active early 

enough to arrest the behavior. 

Currently, the authors have not devised an analytical 

approach to determine α and β for an arbitrary limit regulator.

However, the next section contains an empirical study that 

was done to choose the CA parameters for a particular engine 

simulation. Until an analytical methodology is found, this 

empirical approach should allow for the implementation of 

CA limit regulators in other engines.

Empirical Method for Choosing 

Conditional Bounds

Empirically tuning the conditional bounds, α and β, will be 

done one at a time. The derivative term will be disabled and a 

suitable proportional gain chosen. The choice of α will be 

made by selecting a value as small as possible that produces a 

“safe” outcome in the worst-case situation. The derivative 

term will then be tested at various values and the smallest 

value that produces a safe transient will be selected.

The engine simulation used for the remainder of this work is 

the publicly-available Commercial Modular Aero-Propulsion 

System Simulation 40,000 lbf (C-MAPSS40k) developed by 

NASA Reference 7. This is a simulation of a generic highbypass, twin-spool, commercial aircraft engine in the

40,000 lbf thrust class. The simulation includes a realistic 

baseline engine controller Reference 1 against which to 

compare the performance with the CA limit regulators. The 

use of this realistic controller allows for any arbitrary throttle 

transient to be simulated. Additionally, it has realistic surge 

margin models that include the impact of engine deterioration, 

changes in compressor tip clearance, and heat transfer between 

the compressor and the casing. C-MAPSS40k also allows for 

studying the effects of engine degradation through 

implementation of a set of adjustable health parameters

representing performance deterioration within each of the 

major rotating engine components. The simulation is 

constructed to allow the user to choose EPR or fan speed (Nf) 

as the main regulated variable to command thrust changes 

through the throttle. For the purposes of this study, EPR will 

be used as the main regulated variable.

The Min-Max architecture used in C-MAPSS40k is shown in 

Figure 1. The maximum limit regulators used are: “Nf Max,” 

“Nc Max,” “Ps3 Max,” and “Accel Limit,” while the two 

minimum limit regulators are “Ps3 Min” and “RU Min.” Many 

of these are straightforward: the fan speed and core speed 

maximum limiters are to prevent over-speed conditions on the 

two shafts; the Ps3 maximum limit prevents combustor overpressurization; the ratio unit (RU), fuel flow rate divided by Ps3,

minimum limit is used to ensure that lean blow-out conditions do 

not occur and to prevent Low Pressure Compressor surge. The 

Ps3 minimum limit is used to set the idle operating limit. The 

maximum acceleration limit and the minimum ratio unit limit are 

designed to ensure safe engine operation during transients, 

specifically to preserve compressor surge margin. During engine 

acceleration, the High Pressure Compressor (HPC) is likely to 

surge, and the acceleration limit regulator is designed to prevent 

HPC surge. During engine deceleration, the Low Pressure 

Compressor (LPC) is more likely to surge and the RU limit 

regulator is designed to prevent LPC surge.

Currently, there is no feasible means of sensing the 

compressor surge margin on an operating engine. Thus the 

acceleration limiter must limit a sensed value that serves as a 

stand-in for surge margin. There are many different ways to do 

this Reference 8. In C-MAPSS40k, the acceleration limiter is

applied to maintain HPC surge margin. It is implemented by 

limiting the core shaft acceleration based on the current core 

shaft speed. The higher the shaft speed, the higher the allowed 

acceleration. For LPC surge margin, the ratio unit is used as a 

stand-in. Thus the RU limit regulator ensures that a minimum 

Wf/Ps3 is maintained at all time in order to preserve LPC surge 

margin.
NASA/TM—2012-217814 5

These particular limits were chosen for the C-MAPSS40k 

controller, but are by no means the only limits which are 

capable of ensuring safe engine operation. For a full 

discussion on the various limiter choices, see Reference 2.

The process for choosing the bounds for the CA limit 

regulators will be demonstrated for the acceleration limiter 

and then repeated for the rest of the limiters. The purpose of 

the acceleration limiter is to prevent HPC surge. The distance 

from surge is measured by surge margin (SM) where a value 

of zero means that a surge has occurred. In C-MAPSS40k, an 

HPC surge is most likely to occur on a fully deteriorated 

engine during a full throttle burst.

An initial look at the engine behavior using the baseline 

control law is useful for further understanding the need for 

conditionally active limit regulators. Plotted in Figure 5 are 

the EPR and net engine thrust (Fnet) for an idle to full throttle 

transient which starts at 15 s. The engine is fully degraded 

(i.e., the health parameters in the simulation are chosen to 

correspond to an engine at the end of its useful life—worstcase scenario) and operating at sea-level static (SLS) flight 

conditions. Figure 5 shows a long delay between the EPR 

command and the response of the engine with baseline 

control. This long delay manifests as a slow response in 

engine thrust.

In order to understand the reason for the long delay we look 

at the state of the acceleration limit regulator (as shown in

Fig. 6) during the transient. A value of one indicates that the 

limit regulator is active and overriding the EPR setpoint 

controller fuel flow rate command in order to preserve HPC 

surge margin. It can be seen that the limit regulator is active 

for more than 2 s almost immediately following the start of the 

transient.

The question is, does the acceleration limit regulator need to 

be active for this period of time? To answer that, the core shaft 

acceleration, which is limited by the acceleration limit, and 

HPC surge margin are plotted in Figure 7. The top plot shows 

the acceleration limit, which for C-MAPSS40k is a limit on 

dNc/dt based on the current core shaft speed, Nc, which is 

represented by the dotted line, as well as the actual dNc/dt

versus Nc is shown (solid line). The conservative nature of the 

baseline limit regulator can be seen from the significant 

difference between the limit and actual value of the core 

acceleration. Further, when the HPC surge margin is 

examined, there is a significant amount of transient surge 

margin (12 percent) available. Thus, the acceleration limit 

regulator does not need to be active for as long as it is, 

meaning that the transient thrust response is being slowed

because of unneeded activation of the acceleration limit 

regulator. To improve the response we can use an 

appropriately tuned conditionally active limit regulator.

Figure 5.—EPR and thrust responses to a full throttle change at 

15 s at SLS flight conditions with a fully deteriorated engine.

Figure 6.—Acceleration limit regulator state during a SLS fullthrottle burst at 15 s with a fully deteriorated engine.

Figure 7.—Impact of the acceleration limiter during a SLS fullthrottle burst at 15 s for a baseline controller.

14 15 16 17 18 19 20

1.1

1.2

1.3

1.4

1.5

EPR

14 15 16 17 18 19 20

0

1

2

3

4

x 104

time [s]

Fnet [lbf]

EPR Setpoint

Baseline

14 15 16 17 18 19 20

0

1

time [s]

Accel Limit Active

0.9 0.95 1 1.05 1.1 1.15 1.2

x 104

0

500

1000

1500

dNc/dt [rpm/s]

Nc [rpm]

14 15 16 17 18 19 20

0

10

20

30

40

HPC Surge Margin

time [s]

Baseline

Limit
NASA/TM—2012-217814 6

To determine an acceptable value of α for a specific limit 

regulator, the error rate limit condition is “ignored” and only 

Condition 1 is necessary for activation of the CA limit regulator. 

Thus, to determine an appropriate value of α, only the criterion 

associated with Equation (5) or Equation (7) is considered 

sufficient to activate that particular regulator. As an example, 

for the case of the acceleration limiter, various values of α are 

tested for the impact on being able to stay within the HPC surge 

limit. Note that “ignoring” the error rate limit condition is 

analogous to setting β to infinity in Equation (6) or

Equation (8). The HPC surge margin for various values of α 

with the fully deteriorated engine and the throttle command as 

before is plotted in Figure 8. Here all values of α less than 0.75 

result in the CA limit regulator not being able to prevent HPC 

surge. Note that while the remaining surge margin with α = 0.75 

is small (approximately 2 percent), it is considered sufficient as 

it is greater than zero. This is because the C-MAPSS40k 

simulation includes transient surge margin models that take into 

account engine deterioration, changes in compressor tip 

clearance, heating effects, and transient operation. In an actual 

engine design, the amount of remaining surge margin would 

need to be higher to account for engine-to-engine variation, inlet 

distortion effects, and modeling uncertainties Reference 9.

With the value of α fixed at 0.75, the effect of error rate on 

the limit regulator being active is considered as β is varied.

Based on how β is defined, the larger the value of β, the more 

sensitive the limiter activation will be to small deviations from 

Figure 8.—HPC surge margin for various choices of α on the 

acceleration limiter (β fixed at infinity). The test case used 

here is a full-throttle burst (at 15 s) at SLS conditions with a 

fully deteriorated engine. 

the limit. In Figure 9 the impact of changing β on the HPC 

surge margin is shown. Note that as β is increased the closer it

follows the β = ∞ curve. The choice of β = 30 produces a safe 

transient; increasing the value any further only serves to make 

the limiter too sensitive to noise or other disturbances.

Although performance can be improved by adjusting the 

acceleration schedule itself, doing so will increase the risk of 

surge under extreme conditions. The acceleration schedule is 

designed to ensure that adequate surge margin will be 

maintained under all allowable operating conditions as long as 

the core shaft acceleration limit is not exceeded. So the CA 

limit regulator provides the capability to achieve improved 

performance by allowing the engine to operate closer to the 

acceleration limit that guarantees adequate surge margin.

This process of determining the limit activation parameters α

and β is then repeated for each of the other engine limit

regulators. This results in the choice of parameter values as 

shown in Table 1.

Figure 9.—HPC surge margin for various choices of β on the 

acceleration limiter (α fixed at 0.75). The test case used here 

is a full-throttle burst (at 15 s) at SLS conditions with a fully 

deteriorated engine.

TABLE 1.—CONSTANTS CHOSEN FOR THE

FIVE CONDITIONALLY ACTIVE LIMITERS

IN C-MAPSS40K

Limiter α β

Accel 0.75 30

Nf max 0.10 20

Nc max 0.20 20

Ps3 max 0.20 20

Ps3 min 0.20 20

14 15 16 17 18 19 20

-10

-5

0

5

10

15

20

25

30

35

time [s]

HPC SM [%]

α=0.0

α=0.10

α=0.25

α=0.50

α=0.75

14 15 16 17 18 19 20

-10

-5

0

5

10

15

20

25

30

35

time [s]

HPC SM [%]

α=0.75, β=0

α=0.75, β=10

α=0.75, β=20

α=0.75, β=30

α=0.75, β=∞
NASA/TM—2012-217814 7

Engine Performance With Conditionally 

Active Limit Regulators

To determine the effectiveness of the conditionally active 

limit regulators on the engine response, three situations are 

evaluated: (1) a case where a transient limit regulator is 

necessary to ensure safe operation, (2) a case where a steadystate limit regulator is necessary to ensure safe operation, and 

(3) a case where a limit regulator becomes active 

unnecessarily during a transient.

During testing it was discovered that the C-MAPSS40k 

EPR setpoints are very conservative and, during normal 

operation, only the acceleration limiter is typically 

encountered. Future versions of the simulation will address 

this by developing a more aggressive EPR setpoint schedule in 

which the limiters act to bound the envelope of operation. For 

the purposes of this study, case 1 will evaluate the 

performance of the acceleration limiter while the core speed 

limiter will be used to evaluate both cases 2 and 3. 

To evaluate case 1, the previous study of a full throttle burst 

at sea-level static conditions is examined in more detail. A 

step throttle change is commanded at 15 s to an engine with 

the baseline control law and one in which the conditionally 

active limiters are installed. The engine is fully degraded to 

test a worst-case scenario.

The throttle change is commanded internally as an EPR

command as shown in Figure 10 for both the baseline control 

law and the controller utilizing CA limit regulators. The

90 percent rise time for the baseline case is 3.47 s compared to 

2.79 s for the case with the CA limit regulators—a reduction 

of nearly 20 percent. This corresponds with the finding in 

Figure 11 that the baseline acceleration limit regulator is 

active for 2.28 s, whereas the CA limit regulator is only active 

for a total of 0.54 s during two periods.

Examining the HPC surge margin (Fig. 12) for both cases 

highlights the fact that in the baseline case, the engine 

controller behaves in a conservative (surge margin is much 

greater than zero during the transient) manner. The use of the 

conditionally active limiters reduces this conservatism while 

maintaining a positive surge margin. Additionally, the core 

shaft acceleration versus core shaft speed is plotted in

Figure 12. Again, the inherent conservatism of the baseline 

limiter can be seen. This conservatism is removed when the 

CA limiter is used, resulting in much higher accelerations, and 

thus faster engine response.

In addition to studying the fully deteriorated engine, the 

same test was conducted with a new engine. The results are 

nearly identical to those shown in Figures 10 to 12 with the 

single exception that the HPC surge margin is approximately

3 percent higher for all cases when using a new engine. Due to 

the similar nature of the results, the plots are not included in 

this paper.

Case 2 studies the behavior of the engine when a steadystate limit, such as a core shaft speed limit, is encountered. For 

this case, a flight condition of 10,000 ft, Mach 0.8, and 

Figure 10.—EPR and thrust responses to a full throttle change at 

15 s at SLS flight conditions with a fully deteriorated engine.

Figure 11.—Acceleration limit regulator state during a SLS fullthrottle burst at 15 s with a fully deteriorated engine for both 

baseline and CA limiters.

Figure 12.—Impact of the acceleration limiter during a SLS fullthrottle burst at 15 s for a baseline controller and a controller 

with CA limiters.

14 15 16 17 18 19 20

1.1

1.2

1.3

1.4

1.5

EPR

14 15 16 17 18 19 20

0

1

2

3

4

x 104

time [s]

Fnet [lbf]

Command

Baseline

CA Accel

14 15 16 17 18 19 20

0

1

time [s]

Accel Limit Active

Nominal

CA Accel

0.9 0.95 1 1.05 1.1 1.15 1.2

x 104

0

500

1000

1500

dNc/dt [rpm/s]

Nc [rpm]

14 15 16 17 18 19 20

0

10

20

30

40

HPC Surge Margin

time [s]

Baseline

Limit

CA Accel
NASA/TM—2012-217814 8

Figure 13.—EPR and net thrust generated by engine during a 

full throttle transient at 15 s (10,000 ft, Mach 0.8, ISA+50 R) 

for a baseline controller and controller with CA limiters.

ISA+50 R is used. Again, an idle to full throttle transient is 

executed with the baseline control system and with the 

conditionally active limiters. For this case, the engine is 

considered to be new—that is all health parameter deviations 

are set to zero to indicate no deterioration.

The EPR and net thrust responses with the baseline control 

and the CA limit regulators are shown in Figure 13. The 

benefit of using the CA limit regulator is apparent from the 

results in Figure 13. In this case, the 90 percent rise time is 

reduced from 5.05 to 2.68 s. Also, it should be noted that there 

is a steady-state EPR error of 0.004 which cannot be seen in 

the plot at this scale. This error is due to the fact that the core 

speed limit regulator is active and preventing the EPR setpoint 

from being attained.

The fact that the core shaft speed hits the limit and remains 

there after the transient is shown in Figure 14. Shown are the 

core shaft speed responses as well as the core speed limit. It 

should be noted that the core speed limit is the same for both 

configurations. It can be seen that the CA limit regulator case 

reaches the limit much faster than the baseline case. For both 

cases, the core shaft speed limit is maintained and there are no 

oscillations.

To examine the impact of the CA limiter, the state of the Nc

max limiter and Accel limiter are plotted along with the state 

of the EPR setpoint controller (Fig. 15). Due to the nature of 

the Min-Max architecture, only one of these can be active at 

any given time. In the baseline case, the EPR setpoint 

controller drives the transient for approximately the first 1.2 s

and then the core speed limiter takes over. Note that at this 

point, the core speed is only 10,860 rpm while the limit is

12,200 rpm. By comparison, with the CA limiters, the Nc max 

limiter does not become active until 5 s after the transient 

when the core speed is approximately 4.0 rpm below the limit.

There is some chatter in the state of Nc max limit regulator as 

the changing control action results in the error rate criteria, 

Figure 14.—Core shaft speed and limit for a full throttle burst at 

15 s (10,000 ft, Mach 0.8, ISA+50 R).

Figure 15.—State of the core shaft speed limiter, acceleration 

limiter, and EPR setpoint controller during a full throttle burst 

at 15 s (10,000 ft, Mach 0.8, ISA+50 R).

Equation (6), becoming false, then true as the EPR setpoint 

regulator assumes control. While there are no observed 

negative effects of this chatter, some hysteresis can be added 

to the CA logic to smooth out the control action.

Case 3 is evaluated in which a steady-state limiter is 

unnecessarily active for the baseline controller. This is 

analogous to the temperature limit prematurely limiting the 

response in the initial NASA study Reference 4 discussed in the 

introduction. Here, the test is conducted at a flight condition of 

15,000 ft, Mach 0.8, and ISA+50 R with a new engine.

The EPR and net generated thrust are shown for the baseline 

controller and controller with CA limit regulators in Figure 16.

There is a small improvement in engine response: the

90 percent rise time decreases from 3.22 to 2.95 s

(an 8.4 percent reduction).

14 16 18 20 22 24

0.8

1

1.2

EPR

14 16 18 20 22 24

0

0.5

1

1.5

2

x 104

time [s]

Fnet [lbf]

Command

Baseline

CA

14 16 18 20 22 24

1

1.05

1.1

1.15

1.2

1.25

x 104

time [s]

Nc [rpm]

Baseline

Nc Limit

CA

14 16 18 20 22 24

0

1

0

1

0

1

time [s]

Limiter States

Baseline

CA

Nc max limiter

EPR Setpoint

Accel limiter
NASA/TM—2012-217814 9

Figure 16.—EPR and net thrust generated by engine during a 

full throttle transient at 15 s (15,000 ft, Mach 0.8, ISA+50 R) 

for a baseline controller and controller with CA limiters.

Figure 17.—Core shaft speed and limit for the baseline 

controller and controller with CA limiters for a full throttle 

burst at 15 s (15,000 ft, Mach 0.8, ISA+50 R).

The core shaft speeds for both controller configurations are 

plotted in Figure 17 along with the core speed limit. It is 

apparent that in both cases the physical limit is never 

encountered during the transient or at the new operating point.

Thus, the core speed limit regulator has no need to become 

active.

Figure 18 shows the state of the Nc max limiter, Accel 

limiter, and the state of the EPR setpoint controller for the two 

controller configurations. When using the baseline controller, 

the Nc max limiter is indeed active (for 0.66 s). When the CA 

limiters are used, the core speed limit regulator never becomes 

active. Additionally, the amount of time spent on the 

acceleration limiter is greatly reduced when using the CA 

limiters (0.19 s compared to 0.53 s for the baseline).

Figure 18.—State of the core shaft speed limiter, acceleration 

limiter, and EPR setpoint controller during a full throttle burst 

at 15 s (15,000 ft, Mach 0.8, ISA+50 R).

In the three cases evaluated, the engine controller using CA

limit regulators has been shown to result in faster engine 

response while ensuring engine safety. The improved 

performance is attained by eliminating unnecessary limit 

regulator activations and by utilizing more of the available 

safety margins. These cases were used to demonstrate the 

benefits of using CA limit regulators. While no negative 

impacts of the CA limit regulator were observed for these 

cases, a complete validation of the CA limit regulator 

architecture would be required just as was done for the 

baseline control design.

Conclusions

The concept of using CA limit regulators in the Min-Max 

architecture of typical engine control laws was introduced. The 

CA architecture in the Min-Max scheme only activates the limit 

regulators when the operating point is within a certain bound of 

the limit and approaching the limit at a faster than prescribed 

rate. This is unlike the typical approach where the limit 

regulators can become inadvertently activated, thereby limiting 

the system response time. The selection of the bounds for the 

CA limit regulator architecture was demonstrated using a 

publicly available detailed dynamic simulation of a commercial 

aircraft engine. The results presented in this paper showed that 

by properly choosing the parameters that activate the CA limit 

regulators, the engine response can be improved while 

preserving all necessary safety limits. It should be noted that the 

CA limiters require tuning and need to be fully evaluated under 

realistic situations (such as sensor noise and engine 

deterioration). While the bounds for the CA limit regulators 

were empirically determined in this study, research needs to be 

done to develop a more rigorous analytical approach to provide

guidelines for the selection of these bounds.

14 16 18 20 22 24

0.8

1

1.2

EPR

14 16 18 20 22 24

0

0.5

1

1.5

2

x 104

time [s]

Fnet [lbf]

Command

Baseline

CA

14 16 18 20 22 24

1

1.05

1.1

1.15

1.2

1.25

x 104

time [s]

Nc [rpm]

Baseline

Nc Limit

CA

14 16 18 20 22 24

0

1

0

1

0

1

time [s]

Limiter States

Baseline

CA

Accel limiter

Nc max limiter

EPR Setpoint
NASA/TM—2012-217814 10

References

1. Csank, J., May, R.D., Litt, J.S., and Guo, T.-H., “Control

Design for a Generic Commercial Aircraft Engine,” 

AIAA-2010-6629, 46th AIAA Joint Propulsion 

Conference & Exhibit, Nashville, TN, July 25-28, 2010.

2. Jaw, L., and Mattingly, J.D., Aircraft Engine Controls:

Design, System Analysis, and Health Monitoring, 

American Institute of Aeronautics and Astronautics, Inc., 

Virginia, 2009.

3. Burcham, F.W., Jr., Fullerton, C.G., and Maine, T.A., 

“Manual Manipulation of Engine Throttles for Emergency 

Flight Control,” NASA/TM—2004-212045, January 

2004.

4. Litt, J.S., Frederick, D.K., and Guo, T.-H, “The Case for 

Intelligent Propulsion Control for Fast Engine Response,” 

AIAA-2009-1876, AIAA Infotech@Aerospace Conference, 

Seattle WA, June 6-9, 2009.

5. Richter, Hanz, and Litt, Jonathan S., “A Novel Controller 

for Gas Turbine Engines with Aggressive Limit 

Management,” AIAA-2011-5857, 47th AIAA/ASME/

SAE/ASEE Joint Propulsion Conference & Exhibit, July 

31-August 3, 2011, San Diego, CA.

6. Weiss, A., Kolmanovsky, I., Merrill, W., “Incorporating 

Risk into Control Design for Emergency Operation of 

Turbo-Fan Engines,” AIAA-2011-1591, Infotech @ 

Aerospace 2011, St. Louis, MO, March, 2011.

7. May, R.D., Csank, J., Lavelle, T.M., Litt, J.S., and Guo, 

T.H., “A High-Fidelity Simulation of a Generic 

Commercial Aircraft Engine and Controller,” AIAA2010-6630, 46th AIAA Joint Propulsion Conference & 

Exhibit, Nashville, TN, July, 2010.

8. Spang III, A.H., and Brown, H., “Control of Jet Engines,” 

Control Engineering Practice, 8 March 1999, pp. 1043-

1059.

9. Walsh, P.P., Fletcher, P., “Gas Turbine Performance,”

2nd Edition, ASME Press, Blackwell Publishing,

New Jersey, 2004. 

REPORT DOCUMENTATION PAGE Form Approved 

OMB No. 0704-0188 

The public reporting burden for this collection of information is estimated to average 1 hour per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the 

data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this 

burden, to Department of Defense, Washington Headquarters Services, Directorate for Information Operations and Reports (0704-0188), 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA 22202-4302. 

Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB 

control number. 

PLEASE DO NOT RETURN YOUR FORM TO THE ABOVE ADDRESS. 

1. REPORT DATE (DD-MM-YYYY)

01-12-2012 

2. REPORT TYPE

Technical Memorandum 

3. DATES COVERED (From - To)

4. TITLE AND SUBTITLE

Reducing Conservatism in Aircraft Engine Response Using Conditionally Active Min-Max 

Limit Regulators 

5a. CONTRACT NUMBER

5b. GRANT NUMBER

5c. PROGRAM ELEMENT NUMBER

6. AUTHOR(S)

May, Ryan, D.; Garg, Sanjay 

5d. PROJECT NUMBER

5e. TASK NUMBER

5f. WORK UNIT NUMBER

WBS 284848.02.06.03.02 

7. PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES)

National Aeronautics and Space Administration 

John H. Glenn Research Center at Lewis Field 

Cleveland, Ohio 44135-3191 

8. PERFORMING ORGANIZATION

 REPORT NUMBER

E-18550 

9. SPONSORING/MONITORING AGENCY NAME(S) AND ADDRESS(ES)

National Aeronautics and Space Administration 

Washington, DC 20546-0001 

10. SPONSORING/MONITOR'S

 ACRONYM(S)

NASA 

11. SPONSORING/MONITORING

 REPORT NUMBER

NASA/TM-2012-217814 

12. DISTRIBUTION/AVAILABILITY STATEMENT

Unclassified-Unlimited 

Subject Category: 07 

Available electronically at http://www.sti.nasa.gov 

This publication is available from the NASA Center for AeroSpace Information, 443-757-5802

13. SUPPLEMENTARY NOTES

14. ABSTRACT

Current aircraft engine control logic uses a Min-Max control selection structure to prevent the engine from exceeding any safety or 

operational limits during transients due to throttle commands. This structure is inherently conservative and produces transient responses that 

are slower than necessary. In order to utilize the existing safety margins more effectively, a modification to this architecture is proposed, 

referred to as a Conditionally Active (CA) limit regulator. This concept uses the existing Min-Max architecture with the modification that 

limit regulators are active only when the operating point is close to a particular limit. This paper explores the use of CA limit regulators 

using a publicly available commercial aircraft engine simulation. The improvement in thrust response while maintaining all necessary safety 

limits is demonstrated in a number of cases. 

15. SUBJECT TERMS

Commercial aircraft; Propulsion system 

16. SECURITY CLASSIFICATION OF: 17. LIMITATION OF

 ABSTRACT

UU 

18. NUMBER

 OF 

 PAGES

18 

19a. NAME OF RESPONSIBLE PERSON

STI Help Desk (email:help@sti.nasa.gov) 

a. REPORT

U 

b. ABSTRACT

U 

c. THIS 

PAGE

U 

19b. TELEPHONE NUMBER (include area code)

443-757-5802 

Standard Form 298 (Rev. 8-98)

Prescribed by ANSI Std. Z39-18