A Risk Management Architecture for Emergency Integrated Aircraft Control

Abstract

*† ‡ § Enhanced engine operation—operation that is beyond normal limits—has the potential to improve the adaptability and safety of aircraft in emergency situations. Intelligent use of enhanced engine operation to improve the handling qualities of the aircraft requires sophisticated risk estimation techniques and a risk management system that spans the flight and propulsion controllers. In this paper, an architecture that weighs the risks of the emergency and of possible engine performance enhancements to reduce overall risk to the aircraft is described. Two examples of emergency situations are presented to demonstrate the interaction between the flight and propulsion controllers to facilitate the enhanced operation. I. Introduction n emergency situations, aircraft engines can be used as actuators to improve the capability and controllability of the aircraft. There are several examples of pilots using this technique in an attempt to recover and land a severely impaired aircraft. In 1972, an American Airlines DC-10 landed safely in Detroit after suffering damage that resulted in a stuck, offset rudder as well as partial elevator loss; 1 the pilot used asymmetric thrust to maintain heading. 2 In the 1985 JAL 123 accident, the Boeing 747 lost all hydraulics as well as suffering severe vertical tail loss, which excited the dutch roll (coupled yaw and roll oscillations) and phugoid (long period pitch oscillations) modes. The pilots used asymmetric thrust to regain limited directional control but ultimately failed to recover and crashed with tremendous loss of life. 3 In the 1989 DC-10 accident in Sioux City, Iowa, the plane lost hydraulic power to all flight control surfaces, and there was some tail damage. Here, the phugoid was much more of a problem than the dutch roll, and the crew was able to maintain enough control through modulation of engine thrust to crash land the aircraft and save a majority of the passengers. 4 In 2003, a DHL cargo plane climbing out of Baghdad was hit by a missile, causing loss of all hydraulics and wing damage. The pilots were able to successfully return to the airport and land using only the throttles to control the aircraft. In the aftermath of the Sioux City accident, NASA began investigating the use of throttles-only flight control. Several airframe configurations were studied, and it was found that the severity of the dutch roll and phugoid modes depends on multiple factors, but in general the engine response is too sluggish to be used to damp out the dutch roll, and the administration of thrust pulses to damp dutch roll may actually exacerbate it. 5 As the above examples demonstrate, use of the engines to modulate the aircraft’s dynamic behavior can improve the chance of survival in an emergency; however, the engine response may need to be improved to fully realize this benefit. In this paper we consider two specific emergency scenarios: vertical tail damage and runway incursion. Damage to the vertical tail can be detrimental in two ways. First, a reduction in the area of the vertical tail will reduce the directional stability of the aircraft. Second, if the rudder is disabled, the main control surface used for active yaw damping is lost. In the event of vertical tail damage, the dutch roll mode, which involves coupled yaw and roll oscillations, becomes much harder to control and in the worst case may be unstable. The dutch roll is often the least stable lateral-directional mode, and many planes rely on an automatic yaw damper to keep it manageable. One way to help recover directional stability is to use differential engine thrust to produce yawing moments. However, flight