Emergency Propulsion-Based Autoland System

EMERGENCY PROPULSION-BASED AUTOLAND SYSTEM

Nicolas Fezans∗ , Maxence Gamaleri∗ ∗DLR (German Aerospace Center) - Institute of Flight Systems [email protected]

Keywords: Autoland, Propulsion-Controlled Aircraft, Emergency System, Monte Carlo Simulations

Abstract still happen and has happened several times in the past (e.g. Japan Airlines flight 123 near Tokyo, In this paper, an emergency autoland system ca- United-Airlines flight 232 in Sioux-City or DHL pable of landing automatically with the ATTAS in Bagdad). As shown in the three aforemen- research aircraft only using engine thrust vari- tioned accidents it might still be possible to con- ations is presented. This autoland is intention- trol the aircraft by means of thrust variations. Of ally kept as simple as possible, but demonstrates course the maneuverability of the aircraft is then good performance even in the presence of uncer- very restricted, but this possibility has been in- tainties and external disturbances. The perfor- vestigated since the early 90’s when a research mance in the presence of wind shears is shown program on propulsion controlled aircraft (PCA) in the paper. It is based on a previously published took place at NASA. In this program, a pilot as- propulsion-based control law for the inner loops. sistance system was developed and demonstrated Implementing this simple emergency autoland in in simulator as well as in flight tests with several modern aircraft is not challenging. Aircraft al- aircraft types [1–3]. More recently developments ready in service could also be retrofitted. have been made on PCA technologies at the DLR and a propulsion-based control law was even suc- 1 Introduction cessfully demonstrated in flight test [4, 5]. The developed system was able to assist pilots and Jet airplanes are usually designed to be con- provide them good chances to land successfully. trolled by means of both engines (mainly act- During the first part of our simulator studies, pi- ing on speed/energy) and control surfaces which lots did not receive explanations on the way they are deflected to generate aerodynamic forces and should use the system. The goal was to check moments at several places on the airplane frame. experimentally the affordance of the developed These control surfaces are usually actuated by system and how fast pilots were able to figure means of hydraulic actuators. Quite recently, out how to use it. Results were very encourag- electrical actuators have also been introduced in ing but it appeared that some of the airline pi- the most modern jet airplanes. As these sys- lots taking part to the studies misunderstood the tems are crucial for the control of the aircraft, si- basic flight dynamics principles the control law multaneous failures affecting them must be pre- relies on, leading sometimes to dangerous reac- vented. Therefore, aircraft control surface actu- tions. After short explanations, all pilots were ation systems are implemented using highly re- able to land with acceptable touchdown condi- dundant architectures: multiple actuators, control tions in almost all following trials. signal transmission chains and power sources. In our opinion, this good result reproduces Even though aircraft are designed such that the results obtained by NASA in the 90’s but a complete failure of the primary control effec- still is not fully satisfying. Indeed, both airline tors is extremely improbable, this situation can

1 NICOLAS FEZANS, MAXENCE GAMALERI and military pilot trainings should not be used level obtained is sufficient, which validates this to train intensively for this very remote situation. initial choice. Without specific training and without making pi- The global structure can be represented by the lot aware of the way aircraft can be controlled block diagram in Fig. 1 in which the way the au- by means of thrust variations, the added value for topilot uses the already existing propulsion-based the system is clear but much lower as it seems it control law is explicitly shown. In this figure only could be. Apart from that, one of the results of the components of the autopilot that are activated the simulator tests was that the performance of during autoland operations are represented inside pilots seemed to be mainly limited by the men- the “autopilot” block. tal workload. This was not a surprise as the aircraft reaction is very slow and pilots must be ex- Glideslope γREF PLA L tremely attentive to predict the consequences of controller Control

t law Airplane

o Ground their actions (even with the the assistance of the l

i ΦREF from [5]

p track o

control law from [5]). This suggests a completely t controller PLA R u different solution: the design of an autopilot with A χREF an autoland function. This autoland permits to Localizer γ, Φ, p, q, r, nz, N1 L, N1 R get results independently of pilot understandings controller of the way the system is working internally. Ad- Inertial position and speed ditionally, this will permit to get a performance Fig. 1 Control structure for automatic landing level in the presence of disturbances that a human pilot would never obtain. The autoland function has to intercept the The autoland function of the autopilot will be runway centerline and the glidepath, to track presented in details in section 2. In section 3, the them up to the ground and to land possibly with behaviour of the autoland is demonstrated using a flare. In a previous version of this autoland [6], Monte Carlo simulations. Finally, conclusions the deviations with respect to the runway cen- and outlook are provided in section 4. terline and the glidepath were provided by the glideslope and localizer indicators. When the air- 2 Propulsion-based autoland craft is quite far from the localizer and glideslope emitters, these indicators can be interpreted as an For the design of the propulsion-based autopilot, angular measurement of the lateral and vertical two main options were considered: deviations. As shown in Fig. 1 and with the aim of giving more flexibility to the pilot to choose • the design of a standalone autopilot, the approach slope and later to ease the defini- which would directly command the en- tion and realisation of a flare maneuver, the clas- gines through the power lever angles, sical ILS measurements were replaced by the in- or: ertial position and speed. Internally the reference • the design of an autopilot as an outer loop system used is the WGS-84 system. Of course for the pre-existing propulsion-based con- a relative positioning cannot be replaced by an trol law (see. [5]). absolute one without some other changes: in the present case it must be additionally assumed that As it was estimated that the second option would the position and orientation of the runway are ease significantly the development of the autopi- known with precision and that the absolute po- lot, this option was chosen. Of course, when im- sitioning is also precise enough. Note that “ab- posing a structure to a controller the reachable solute positioning” does not mean GPS and only performance and robustness might be reduced GPS, but could be obtained by coupling inertial (compared to the unstructured case). It is later platforms with GPS and barometric+radar alti- shown by simulation results that the performance tude or any other useful source available.

2 Emergency Propulsion-based Autoland System

2.1 The underlying control law of [5] the flight path angle. Such a control law will basically consist of controlling the phugoid (accept- This autopilot is designed as an outer loop using able response time, good damping, and no static the control law of [5], which is already follow- error on the flight path) while avoiding unneces- ing the references on the flight path angle and on sary excitation of the short-period mode. the roll angle. In the current paper, this control Note that the flight path angle cannot be con- law, how it works and how to tune it will not be trolled independently from the speed. In order to re-explained in details but a short overview is pre- reach the runway the angle of descent (i.e. the sented hereafter. flight path angle) must be controlled. Once the flight path angle is determined, there is no degree 2.1.1 Control law requirements of freedom left to select the speed. In this section, the main requirements for suc- Lateral Control cessful approach and landing by means of a PCA system are discussed with focus on how desirable The lateral dynamics of an aircraft are com- they are, how difficult it will be to reach them, posed of: and which trade-off between the performance cri- • the Dutch roll mode exhibiting a pair of teria should be made. Obviously, classical han- complex conjugate and stable poles with dling qualities criteria are not applicable for an very low damping, aircraft having a propulsion-based control law. • the roll mode which is aperiodic and stable, Longitudinal Control • the spiral mode which is slow and quite of- The longitudinal motion is mainly composed ten slightly unstable. of the phugoid mode and the short-period mode. As for the short-period mode, the Dutch roll The period of the phugoid is generally between mode and the roll mode are generally too fast 30 and 60 seconds for transport airplanes. The to be significantly modified by means of the en- frequency of the short-period mode depends on gines, in particular in the low-thrust domain that the aircraft and its center of gravity location, but will generally be required for descent and ap- would typically lie between 1.5 and 3 rad/s. proach. However, a control law based on thrust Increasing the total thrust of the engines leads can easily modify the spiral mode in order to to an increase of the energy rate of the aircraft. To ease its control by a human pilot. For this, the really know the effect of this additional thrust on coupling between yaw and roll is used: the pi- the movement of the aircraft, the pitch equation lot controls only the roll motion and the con- as well as the aerodynamics and mass character- trol law generates a yaw motion by means of istics of the aircraft must be known. For typi- asymmetric thrust allowing to get the induced roll cal configurations, a simplified reasoning can be corresponding to the pilot’s commands. In pre- expressed as follows: a constant additional total vious studies PCA control laws were designed thrust ∆Tt = ∑i ∆Ti > 0 leads to a positive varia- to follow a reference bank angle ΦREF that was tion of the flight path angle γ and vice-versa, i.e. provided by the pilot. During the current re- ∆Ti > 0 ⇒ ∆γ(t → ∞) > 0 and ∆Ti < 0 ⇒ ∆γ(t → search activities several other possibilities have ∞) < 0. This makes it possible to control the tra- been investigated in the ATTAS ground simula- jectory of the aircraft in the vertical plane. tor. In particular a rate-command attitude-hold With the typical frequencies and damping ra- and a combination of roll rate and bank angle tios of the short-period mode and of the phugoid commands are being tested. They are both based as well as the typical dynamics of engines, no real on the control law presented hereafter: the differ- challenge is expected in designing and tuning a ence is the way pilots provide the references to control law assisting the pilots in the control of the system.

3 NICOLAS FEZANS, MAXENCE GAMALERI

n γ, z N1L N1sat N1Lref γREF PLA L Long. cont. Mixing EngL cont. Pilot N1cmd priorities PLAsat L PLAsat R Airplane inputs cmd & ΦREF ¢N1 Lat. cont. Protections EngR cont. PLA R ¢N1sat N1Rref N1R Φ,p,r

Fig. 2 Global architecture of the propulsion-based control law of [5]

Some reasonable goals for the lateral part of 2.2 Glideslope controller the control law are: to permit enough maneuverability, to reduce pilot workload by damping the lateral dynamics, and to ensure acceptable distur- The glideslope controller of the previous au- bance rejection without any action of the pilot. toland version was based on the geometrical principle presented in Fig. 3, assuming that the 2.1.2 Global architecture glideslope indicator measurements can be con- verted approximately to a deviation angle exz. The global architecture of this control law is pre- Contrary to what is shown in Fig. 3, with the sented in Fig. 2. It is based on a cascade control usual ILS system the reference point would be strategy with inner loops controlling the engines at the glideslope emitter, i.e. along the run- through commands in terms of Power Lever An- way shortly after the threshold. The position gle (PLA) and outer loops controlling the longitu- of the reference point shown in Fig. 3 is better dinal and lateral motions through symmetric and as it permits to use the same approximation and asymmetric thrust. The controllers in all these to keep small deviation angles until touchdown. loops are based on simple PI or PID structures Small angles lead to an almost linear relation- with feedforward terms and antiwindup. The in- ship between altitude error and deviation angle ner loops have a crossfeeding in case of satura- (exz ≈ 0 ⇒ tan(exz) ≈ exz), which later simplifies tion (see signals PLAsatL and PLAsatR for anti- slightly the tracking task. For practical reasons windup). A block labeled “Mixing priorities & the real glideslope emitter cannot be placed un- Protections” connects the outer loops to the inner der the runway as shown in this figure, but this is loops by allocating longitudinal (N1cmd) and lat- possible when defining a virtual reference point eral (∆N1cmd) control actions to the two engines for the autoland system. Consequently, this refer- while satifying the limits for each engine. This ence point and the touchdown point are parame- leads to the two references N1Lre f and N1Rre f ters which can be chosen by the pilot. The config- that are provided to the inner loops. Although uration shown in Fig. 3 with a reference point far this does not appear very explicitly in Fig. 2 the behind the touchdown point and therefore under “Mixing priorities & Protections” block also con- the runway is the one used later throughout the nects the two outer loops by means of the anti- paper. Note that this does not represent the usual windup feedback signals N1sat and ∆N1sat. glideslope signal (same remark applies also for Further details on all the elements of this con- the exy later) and is only introduced here to de- trol law as well as on its tuning were already pub- fined the variable used in the description of the lished in [5] and will not be reminded in the cur- autoland outer loops. For gain scheduling pur- rent paper. Results of both simulator and flight pose, the distance to the emitter or the runway is tests were included and illustrate that the control often used: if a virtual reference point far from law follow the references on the flight path angle the usual emitter position is chosen, the distance and on the roll angle well. The autoland system used for the gain scheduling must be corrected presented in this paper take the place of the pilot adequately. in the architecture of Fig. 2, as shown in Fig. 1. The tracking of the rectilinear glidepath with

4 Emergency Propulsion-based Autoland System

γNOM exy h γ RW REF e Reference x ex ΔχREF e point z z xy γNOM Runway Centerline D Runway x x lat RW Touchdown RW point y Reference RW zRW point Fig. 4 Localizer controller Fig. 3 Glideslope controller geometry deﬁnition deviation angle signal. Note that it would be pos- slope γNOM leading to the desired touchdown sible to use the exz signal previously deﬁned for point (green dashed line in Fig. 3) is realised by the glideslope controller and to use the real local- means of a simple PID controller on the deviation izer indicator signal in the localizer controller. angle exz: The reference χREF provided by the localizer controller to the ground track controller is di-

γREF = γNOM + Kp(Dlon) exz ... rectly the sum of the runway direction and a cor- Z (1) rection angle ∆χREF (see Fig. 4): + Ki(Dlon) exz + Kd(Dlon) e˙xz , χREF = ΨRW + ∆χREF , (3) where Dlon is the distance used for the gain scheduling (usually the distance between the air- with ∆χREF being the output of a gain scheduled craft and the reference point). To prevent un- controller, having a PI structure: desirable behaviour, this PID structure is com- Z pleted with saturations and antiwindup (not de- ∆χREF = Kp(Dlat,s) exy + Ki(Dlat) exy , (4) tailed here but similar to the saturations and antiwindup shown in [5] for the inner loops). The but with Kp(Dlat,s) a gain scheduled first order time derivativee ˙xz of the deviation angle exz can filter which is amplifying the high frequencies be replaced by the expression obtained by differ- more than the low frequencies (lead-lag form). entiating analytical with respect to time (no need A similar effect could have been obtained using a for numerical differentiation): derivative term based one ˙xy (also analytically dif- ferentiable) combined with a first-order low-pass x˙(h − h ) − h˙(x − x ) REF REF filter. In practice, there might be some reasons to e˙xz = 2 2 . (2) (x − xREF) + (h − hREF) use one or the other formulation: here the lead- 2.3 Localizer controller lag form was simply used but this choice was not imposed by any specific constraint. As shown in Fig. 4, the localizer controller uses As for the glideslope controller, the schedul- the same principle as the glideslope controller. In ing compensate the increase of sensitivity of the most cases, there is no need to perform lateral deviation angle while approaching of the refer- maneuvers during the final part of the approach. ence point. Only an approximated compensation The localizer emitter is usually placed behind the was made but it is not required to keep the closed end of the runway. This position permits to pro- loop gain exactly constant all along the approach vide a signal of good quality during the approach trajectory. The output of the localizer controller and on all positions on the runway. There is no is a reference on the ground track, which is pro- need for selecting any other position for the refer- vided to the ground track controller whose role is ence point, therefore this position was used. The to ensure that this ground track will be followed localizer controller works then exactly as the pre- by the aircraft. The ground track controller is previous version, but uses a geometrically computed sented in the next section.

5 NICOLAS FEZANS, MAXENCE GAMALERI

2.4 Ground track controller The transition between these two modes is made ◦ ◦ linearly for |eχ| ∈ [0.2 ,1.5 ], which lead to a The ground track controller generates a reference nonlinear gain of 0.25 in the interval [0.0◦,0.2◦], on the roll angle (which will be provided to the progressively increasing to about 1 around eχ = control law described in [5]) which permits to ±1.5◦. In the intervals ±[1.5◦,(almost)30◦] the make the aircraft turn and therefore change the controller behaves as a linear proportional con- orientation of its ground trajectory. The lateral troller of gain 1. part of the autoland must ensure that this trajec- This ground track controller is a simplified tory match the desired trajectory so that the air- version of the one directly accessible to the pilot craft will arrive at the chosen touchdown point. and with different gains. The pre-existing ground The localizer controller (see previous section) track controller could not be reused because a generates a ground track reference that should higher bandwidth was required in order to use it permit to follow or rejoin the desired trajectory. for centerline tracking in the presence of external The role of the ground track controller is then to disturbances. make sure that this ground track reference will be followed. 3 Autoland evaluation The ground track controller consists of two modes which are combined in a “fuzzy-control In this section the behaviour of the designed way” for the transition between them: emergency propulsion-based autoland system is • A mode used to perform small to large evaluated. Of course, with the same initial con- changes of ground track, which only conditions, in the nominal case, and without distur- sists in a highly nonlinear gain on the er- bance the system lands systematically at the same ror eχ between the reference and the cur- position, speed, and attitude. In order to eval- rent ground track. This part was kept un- uate the usability of the system under more re- changed between the regular ground track alistic conditions, the aircraft configuration must controller and this variation of it. In this be varied (including mass, position of the centre mode the reference ΦREF reads: of gravity, and possible structural damages). In- ◦ eχ[ ] fluence of initial conditions and external distur- Φ [◦] = 10 tanh . (5) REF 10 bances must be analysed as well. In this paper, The hyperbolic tangent introduce a strong the results shown will focus on the behaviour in nonlinearity leading to a smooth saturation the presence of low altitude wind shears. Although it is not shown in the paper, the the generated ΦREF. Extrema for ΦREF are ◦ ◦ influence of aircraft configuration as well as ±10 and are reached at eχ ≈ ±30 . This limitation to 10◦ commanded roll angle is possible structural damages have also been in- quite restrictive but prevents entering in en- vestigated and the system was able to control gaged turns without having the control au- the aircraft and land with all configurations and thority that is required to come back to hor- very strong damages. For instance the air- izontal flight. The best value for this limit craft landed successfully with damages generat- could be computed online, depending on ing a roll torque corresponding to a fourth of the the current damages of the aircraft. Here aileron roll authority at that speed. It is assumed for simplicity only this 10◦ constant value that aircraft configuration cannot be changed, was considered. which means that the aircraft might not be in a configuration permitting to satisfy the usual op- • A mode used for very small corrections, erational requirements for landing (speed cannot which after removing the integral term is be changed independently from the flight path basically a proportional controller (Kp = angle). However, reaching the runway in some 0.25 for eχ and ΦREF in the same unit). of the best conditions possible would still pro-

6 Emergency Propulsion-based Autoland System vide relatively good survival chances to people an aircraft with fully functioning primary control on board. Keeping the control of the aircraft and system, the performed simulations show that the reaching the runway permits also to prevent ad- deviations induced by lateral windshears is in- ditional deaths on ground. deed still relatively small. This is illustrated with the simulations shown in Fig. 5, where the air- 3.1 Considered wind shears craft reactions to wind shears of the same magnitude but different directions are compared. 3.1.1 Wind shear direction It should also be noticed that the lateral de- When controlling the aircraft only by means of viations caused by the purely longitudinal wind symmetric and asymmetric thrust variations the shear is higher than the lateral deviation caused maneuverability is far from being as good as in by a purely lateral wind shear of same magnitude. the normal case. Moreover the number of degrees With a perfectly symmetric aircraft, there will be of freedom that a pilot can control is reduced: no lateral deviation at all. However, no aircraft speed and flight path angle cannot be controlled is perfectly symmetric and therefore a deviation separately. The same applies for sideslip and roll. will be observed. Note that the effect that is ob- With an aircraft satisfying the usual handling served here does not correspond to strong asym- qualities criteria, the lateral component of wind metry: to fly along a straight line (i.e. χ˙ k = 0) ◦ shears presents a significantly lower risk than the with all control surfaces to 0 , both a roll an- ◦ longitudinal component of identical magnitude. gle and a sideslip around 0.3 is required (im- perfect lateral trim). These relatively small val-

Head wind shear ues are sufﬁcient to generate the coupling shown 40 in Fig. 5, where the head wind shear (blue line) generates the largest lateral deviations. Even 20 stronger couplings should be expected with dam- above the glideslope 0 aged aircraft.

Wind shear −20 from right Height error [m] 3.1.2 Wind shear parameterised based on alti-

−40 under the glideslope tude or on time? −14000 −11000 −8000 −5000

0° 15° 30° 45° 60° 75° 90° Physically, wind shears are differences of wind speeds and directions depending on the posi- 20 Head wind shear tion considered (in 3 d.o.f.). Weather conditions evolve with time, which introduces the time as a 10 fourth dimension in the description. When con-

left of the centerline sidering a specific landing on a specific runway at Wind shear 0 from right a specific time and with a specific approach path, all the wind possibilities in this 4-dimensional −10

Lateral error [m] space will not be encountered: only the wind

right of the centerline along the trajectory will affect the aircraft. Con- −14000 −11000 −8000 −5000 x [m] sequently, wind shears are often described in re- RW duced forms. A typical form used to describe a Fig. 5 Comparison between the deviations in- wind shear is to deﬁne a wind speed and orienta- duced by wind shears of same magnitude (∆W = tion depending only on the altitude. Note that in 10 m/s) but different directions general wind shear related to microbursts cannot be reduced to a single dimension without losing Although the lateral control of the aircraft is too much information: microburst-induced wind now signiﬁcantly slower and less precise than for shears are not considered in this paper.

7 NICOLAS FEZANS, MAXENCE GAMALERI

When describing wind shears as a function of The sign and naming convention used here- −→ the altitude, it might be observed that the posi- after is ∆W > 0 if the variation of wind ∆W goes −→ tive variation of winds in the direction of the air- in the direction of the flight (i.e. ∆W · −→x > 0). craft speed (i.e. that causes initially a reduction Therefore ∆W > 0 will be called a tail wind shear of aircraft air speed) lead to stronger reactions and the opposite a head wind shear. Note that the than wind shears in the opposite direction. The definition of the tail wind shear is based on the reason for that is well-known: when the aircraft sign of the wind variation and not on the wind encounters this type of wind shear, it loses lift direction itself! and begins to sink quicker, which lead to an even greater time-variation of the wind speed. Tail 3.2 Scenario and criteria wind shears are thus amplified by the aircraft motion they induce, whereas head wind shears are The considered scenario for all the Monte Carlo attenuated by the induced aircraft motion. simulation results presented hereafter is the ap- During design phases it might be useful to proach and landing at Hannover Airport (HAJ - consider time-based disturbances, but this rather EDDV) on runway 27R with the ATTAS (WFV- artificial decoupling between aircraft motion and 614) research aircraft. The simulation is always initialized with the aircraft at the coordinates disturbance should be used with extreme caution ◦ ◦ when doing a performance assessment. In the 52.4235 N / 10.2806 E and an ASL altitude of following only altitude-based wind shears will be 1000 metres. This initial position is located at considered. 40 km from the runway threshold, left from the centerline and still outside the localizer reception 3.1.3 Wind shear distribution used zone. The initial course was chosen the same as the runway direction and the autoland will have Due to the reasons given in the previous sections first to turn right and then left to capture and hold the following wind shear distribution was chosen: the centerline direction. Though not shown in the results that are pre- • all wind shears are in the direction of the sented later, this position as well as the flight runway, direction at initialization were varied to verify • all wind shears are single ramps based on no undesirable behaviour could be caused dur- altitude (see Fig. 6) with the parameters: ing switching from the regular autopilot modes to localizer capture and localizer hold. As these – ∆W: uniform on [−15 , +15] m/s, switches are working properly and the aircraft converge first to the given trajectory, this initial- – H low: uniform on [10 , 310] m, ization does not impact the results obtained when – ∆H: uniform on [10 , 210] m. encountering low-altitude wind shears. For this reason, the initialization conditions are not varied in the analyses presented hereafter.

s Four criteria are used to assess the autoland W e d

Δ u t performance i t l a

s • xRW (t = TD): x-position of the touchdown u o i r point in the runway reference system (see a v

H t

a red axes in Fig. 3 and 4) in x-direction, Δ s r o t

c • yRW (t = TD): y-position of the touchdown e v

d point in the runway reference system,

H n low i Ground W • Φ(t = TD): Roll angle at touchdown, Fig. 6 Longitudinal single ramp wind shear • h˙(t = TD): Sink rate at touchdown.

8 Emergency Propulsion-based Autoland System

The first two criteria permit to check that the soning do not take into account the effect of pos- aircraft landed on the runway and not too far be- sible disturbances on the result and in particular hind the runway threshold to permit to stop the it might be interesting to keep some margins and aircraft. Ideally the aircraft will land at the cho- therefore to choose an even more gentle slope. sen touchdown point. Landing outside the run- If this is the case, how large should these margins way or too far behind the runway threshold is be? In order to select the slope that offers the best of course unacceptable regarding these criteria. chances for successful landing a detailed analysis Note that the limit after the threshold may be sub- must be performed. ject to many discussions: in particular the safety The results obtained using the distribution level associated to any value will strongly vary described in section 3.1.3 for two different ap- with the runway length and the current braking proach slopes are shown in Fig. 7. In all these capabilities of the damaged aircraft. The value simulations the autoland was set to follow a rec- of 1250 metres behind the runway threshold was tilinear slope until touchdown, i.e. without per- chosen. forming a flare. The upper-left plot in this fig- The third criterion on the roll angle is a sim- ure represents the proportion of accepted land- plified version of a criteria aiming to prevent con- ings (using the criteria mentioned in section 3.2) tact between the ground and the wings or the for each of the simulated approach slopes. The engines. No large roll angles were observed on lower-left plot shows the respective proportions the simulations and no problem is expected here, of unaccepted landings caused by tail and head therefore there is no real need for a more ex- wind shears. In the upper-right plot of this fig- act computation. This criterion is kept to de- ure the maximum altitude at which a wind shear tect rapidly any deterioration: for instance a new leading to an unaccepted landing started is rep- tuning of the autoland gains could lead to exces- resented for each slope and wind shear direction sively aggressive maneuvers in ground proximity, (tail or head). Finally in the lower-right part of which is a behaviour which is dangerous, must be this figure the respective proportions between the prevented, and could remain undetected at first if causes for nonacceptance are represented. this criterion were not constantly monitored. As no flare was performed, the acceptance The last criterion permits to evaluate how of landings with the slope of −2.9◦ is very low, hard the landing was and to verify that the struc- which is logical as this slope leads to an exces- tural limits of the airplane and the landing gears sive nominal sink rate. This acceptance increases are not exceeded. The landing gears of the AT- significantly with the use of less steep slopes. TAS are certified for a vertical impact velocity As the nominal sink rate was already unaccept- up to 700 ft/min and therefore this limit is taken able for the −2.9◦ slope, the results were almost for the landing acceptance criterion. identical for head and tail wind shears: with the most gentle approach slopes differences can be 3.3 Results observed and tail wind shears are significantly more dangerous. At the same time, the risk of When using the autoland based on the absolute impacting the ground ahead of the runway thresh- position, the glidepath angle can be freely chosen old increases drastically when using more gentle and can thus be flat enough to avoid the necessity slopes. This is mainly due to the initial loss of of performing a flare (assuming that the terrain altitude that tail wind shears induce. Note that in around the chosen airport is flat enough). Con- the simulation environment “a perfectly flat air- sidering the current speed of the aircraft a flight- port neighbourhood” is assumed. path angle value that would lead to acceptable If the landscape around the airport permits to sink rate can be computed. This value is expected use a very gentle slope (between 0.4◦and 1.2◦) to be lower or equal to −1.5◦ with typical values and if weather conditions indicates that wind of transport airplanes. However, this simple rea- shear (especially tail wind shear) encounters are

9 NICOLAS FEZANS, MAXENCE GAMALERI

100

400 75

50 200 25 tail wind shears Maximum start

Proportion of head wind shears shear leading to an 0 altitude for a wind 0 −3 −2.5 −2 −1.5 −1 unacceptable landing [m] −3 −2.5 −2 −1.5 −1 acceptable landings [%] Approach slope [deg] Approach slope [deg]

100 100

75 75 with unacceptable xRW(touchdown) tail wind shears only unacceptable xRW(touchdown) 50 head wind shears 50 unacceptable sink rate

25 25 Distribution of x vs. dh/dt [%] distribution [%] 0 0 Unacceptable landings −3 −2.5 −2 −1.5 −1 unacceptable landings −3 −2.5 −2 −1.5 −1 tail / head wind shears Approach slope [deg] Approach slope [deg]

Fig. 7 Results obtained with various slopes unlikely, this should be done. Pilots have access with the 2.9◦ slope. In both cases a tail wind to the obstacles around the airports on the maps shear (∆W = 10 m/s) was always considered but and can thus assess the risk related to the use its position (and thus the encounter altitude) was of such a very gentle slope. This recommenda- varied. The results obtained are shown in Fig. 8. tion applies only to landings with the proposed In the upper part of this figure each point repre- autoland system: gentle slopes can lead to large sents the touchdown position in the runway co- variations of the touchdown position if the trajec- ordinates: the red dot-dashed line around −3400 tory is not tracked well enough. This is likely to m represents the position of the threshold (above happen if the same trajectory is tracked manually. is ahead of the threshold). The points that corre- If the weather is locally more uncertain, the spond to the same slope are connected with lines first question is of course whether the situation in order to show how the the touchdown position is less uncertain on a different airport or runway: varies with Hlow. The lower part uses the same just as for the initial choice that the pilot would representation for the sink rate H˙ at touchdown: have made, the runway length, the safety equip- the red dot-dashed line is the certified value for ments and expected hazard in case of runway ex- the landing gears of the ATTAS. cursion must be taken into account. If the runway In this figure, the curves for x at touchdown is particularly long the risk of landing before the oscillate with different periods. This is a con- runway due to a tail wind shear could be partly sequence of the excitation of the phugoid mode alleviated by selecting a desired touchdown point by the wind shear: the resulting oscillation is su- quite far from the runway threshold. If this would perimposed to the “ideal path” and leads to vari- not be the case, it seems at first better to make a ations of the touchdown positions depending on quite hard landing at an acceptable position than the altitude where it was initiated. These curves a “soft” landing outside the runway or too far be- are discontinuous because there are limit cases hind the threshold: most hard landings do not end leading to land at one oscillation if the wind shear up with deaths whereas quite a lot of runway ex- occurred at a given altitude, but at the previous cursions end tragically. one if the wind shear occurred at an only slightly In order to compare the results obtained for lower altitude. These discontinuities on the x po- various slopes, more specific simulations must sition correspond to peaks on the curves of H˙ that be looked at. To explain the differences in- go to 0 (or slightly lower as the limit case was not duced by varying the approach slope, two Monte perfectly found in the simulations made). Look- Carlo simulations with less parameters were per- ing at such curves, it is obvious that consolidated formed: one with the 1.6◦ slope and the other values (e.g. mean, standard deviations, quantiles,

10 Emergency Propulsion-based Autoland System

−4000 1.6° slope like to get. It should be kept in mind that the air- 2.9° slope craft is assumed to have lost control of its control surfaces which is rather unlikely to happen. −3400 This aircraft is controlled only by means of its en-

(t=TD) [m] gines thanks to an emergency assistance system. x In addition to this already very critical scenario, −2800 low altitude wind shears are encountered during the approach. Under these conditions the perfor- 0 mance reached is already very good. Beside, the implementation of this emergency system do not

−700 required speciﬁc hardware: it could run on the currently existing ﬂight computers and even be

(t=TD) [ft/min] integrated in a software update of the system al- ˙ H −1400 ready flying. Taking the airspeed measurement into ac- 100 200 300 400 count, the wind shear could be explicitly detected Hlow [m] Fig. 8 Variations of touchdown positions for the and precompensated. This would alleviate the same tail wind shear (10 m/s) depending on the initial reaction of the aircraft, but not completely encounter altitude. cancel it. Indeed, there is no possibility to dis- tribute the aircraft energy among kinetic and po- tential energy (usually possible through the hor- etc.) must be taken with precaution as their de- izontal trim and the elevators), which would be pendence to the input distributions used is very required to get an even more efficient alleviation strong. This applies of course also to the results of the wind shear. We only can compensate en- shown in Fig. 7. ergy deficits or excesses. In this figure the oscillations shown have dif- Though not desirable, hard landings are of- ferent periods. Reason for that is that the time ten not fatal. Landing before the runway seems required to reach the ground from the time the more critical, but if the weather is uncertain and wind shear is encountered is approximately the there was no derouting possible, the most prati- quotient of the encounter altitude by the sink rate: cable solution would be to choose a touchdown therefore for a given encounter altitude the more point further on the runway (here it was chosen gentle the slope is the more time is available to only 400 m behind the runway threshold) which restabilise the aircraft on the ideal slope. This ex- would significantly reduce this risk. plains why the oscillation vanishes “earlier” (i.e. at lower encounter altitudes) for the 1.6◦ sloper 4 Conclusions and outlook than for the 2.9◦ slope. The fact more gentle slopes leads to higher risk to reach the ground An emergency propulsion-based autoland system before the runway is also clearly visible in this for the ATTAS (VFW-614) research aircraft was figure. The mean x-touchdown value during the presented. It consist in a simple outer loop to a “first” two oscillations with the 1.6◦ slope devi- control law previously published by the authors ates clearly from the −3000 m value set for the [5]. The performances of the complete system ideal touchdown point, which is not the case for were shown in the paper with a focus on distur- the 2.9◦ slope. bance rejection capabilities. Various additional When looking at the proportion of acceptable developments have already been made and tested landings (Fig. 7), the values even for relatively in desktop simulation, which includes: curved flat approaches are around 80 - 90%, which still trajectory tracking, flare maneuvres, and a feed- seems quite far from the 100%−ε that one would forward that is activated only for strong distur-

11 NICOLAS FEZANS, MAXENCE GAMALERI bances. These systems are still being developed, tem using only engine thrust on an F-15 airplane. but already improve the good performance of the NASA/TP-3627, 1997. emergency propulsion-based autoland system. It [3] Bull, J., Mah, R., Hardy, G., Sullivan, B., Jones, is also planned to port this autoland (and under- J., Williams, D., Soukup, P., Winters, J., Piloted lying control law) for the DLR A320 ATRA re- simulation tests of propulsion control as backup search aircraft and at least to test it in a simulator. to loss of primary flight control for a B747-400 The proposed system provides very good sur- jet transport. NASA/TM-112191, 1997. vivability chances and in most cases no hull loss [4] de Almeida, F., Trajectory tracking with fault- should even be expected, though the failure con- tolerant flight control system: a model predictive dition leading to the use of this system is cur- approach. PhD thesis TU Braunschweig, ISBN: rently classified as “catastrophic”. A typical is- 978-3-8322-8546-3, 2009. sue encountered when introducing a new emer- [5] Fezans, N., Simple control law structure for the gency system in addition to the existing ones is control of airplanes by means of their engines. related to the possible activation of this system in Advances in Aerospace Guidance, Naviga- tion and Control, Ed. F. Holzapfel and S. Theil, when not required. In the case of the emergency Springer, ISBN 978-3-642-19816-8, 2011. propulsion-based autoland system proposed in [6] Fezans, N. and Kappenberger, C., Approaches this paper, this issue is easy to address as it is and vista on flight control systems reconfigura- very easy to know with certainty whether pri- tion - motivating example: aircraft control by mary control systems are still working or not. means of engine thrust. ONERA-DLR Aerospace Only if none of them is working the system can Symposium, Toulouse, France, 2011. be used. The readiness level of this technology [7] de Almeida, F., Waypoint navigation using con- is high enough to implement it in flight control strained infinite horizon model predictive con- systems and the associated costs are very low trol, AIAA-2008-6462. AIAA GNC, Honolulu, (basically a couple of additional modes in flight HI, USA, 2008. control softwares). To our mind, assuming that [8] de Almeida, F. and Leißling, D., Fault-tolerant the pursued flight safety strategy follows the “As model predictive control with flight test results, Low As Reasonably Practicable” (ALARP) pre- Journal of Guidance, Control, and Dynamics, cept: it seems there is no good reason for not 0731-5090, Vol. 33 No. 2, 2010. introducing this emergency system (or any suit- [9] Proctor, F. H., Hinton, D. A., Bowles, R. L., A able alternative) in transport aircraft. Besides, the windshear hazard index, Paper: 7.7, 9th Confer- costs assosiated with a single accident (investiga- ence on Aviation, Range and Aerospace Meteo- tion, legal procedures, possible responsabilities, rology, Orlando, FL, USA, 2000. image loss etc.) are expected to be significantly higher than the development costs of this addi- Copyright Statement tional and nonmandatory function for a complete The authors confirm that they, and/or their company or family of modern fly-by-wire airplanes. organization, hold copyright on all of the original material included in this paper. The authors also confirm References that they have obtained permission, from the copyright holder of any third party material included in this [1] Burcham, F. W. Jr., Burken, J. J., Maine, T. A. paper, to publish it as part of their paper. The authors and Fullerton, C. G., Development and flight test confirm that they give permission, or have obtained of an emergency flight control system using only permission from the copyright holder of this paper, for engine thrust on an MD-11 transport airplane . the publication and distribution of this paper as part of NASA/TP-97-206217, 1997. the ICAS2012 proceedings or as individual off-prints [2] Burcham, F. W. Jr., Maine, T. A., Fullerton, C. G. from the proceedings. and Webb, L. D., Development and flight evaluation of an emergency digital flight control sys-