Proceedings of the Twenty-First Innovative Applications of Artificial Intelligence Conference (2009) An Emergency Landing Planner for Damaged Aircraft Nicolas Meuleau∗ and Christian Plaunt and David E. Smith and Tristan Smith† Intelligent Systems Division NASA Ames Research Center Moffet Field, California 94035-1000 {nicolas.f.meuleau, christian.j.plaunt, david.smith, tristan.b.smith}@nasa.gov Abstract control surface movements in order to achieve the pilots in- tent. Testing of these controllers in full motion simulation Considerable progress has been made over the last 15 years and in test aircraft has been very successful so far (see for on building adaptive control systems to assist pilots in flying example (Burcham et al. 1996; Burken & Burcham 1997; damaged aircraft. Once a pilot has regained control of a dam- aged aircraft, the next problem is to determine the best site Gundy-Burlet et al. 2004)). As a result, such control sys- for an emergency landing. In general, the decision depends tems are being seriously considered for next generation mil- on many factors including the actual control envelope of the itary and civil transport aircraft. This capability, while quite aircraft, distance to the site, weather en route, characteristics remarkable, only addresses the first piece of the problem – of the approach path, characteristics of the runway or landing regaining control of the aircraft. Once this is achieved, the site, and emergency facilities at the site. All of these influence next problem is to determine the best site for an emergency the risk to the aircraft, to the passengers and crew, and to peo- landing. In general, the decision depends on many factors ple and property on the ground. We describe an emergency including the actual control envelope of the aircraft, distance landing planner that takes these various factors into consid- to the site, weather en route, characteristics of the approach eration, and proposes possible routes and landing sites to the path, characteristics of the runway or landing site, and emer- pilot, ordering them according to estimated risk. We give an overview of the system architecture and input data, describe gency facilities available at the site. All of these influence our modeling of risk, describe how we search the space of the risk to the aircraft, to the passengers and crew, and to landing sites and routes, and give a preliminary performance people and property on the ground. A purely secondary con- assessment for characteristic emergency scenarios using the sideration is airline and passenger convenience. current research prototype. Although pilots are highly trained in emergency proce- dures, structural damage and the consequent changes in 1. Introduction flight characteristics strain the limits of their intuition and ability to assess different possible options. It would there- On July 19, 1989, United flight 232, a DC-10 enroute from fore be very useful to have an automated system that could, Denver to Chicago, suffered an uncontained failure of the in seconds, generate and evaluate different possible emer- fan blades in the number two (rear) engine. The resulting de- gency landing plans, and present the best options to the pilot. bris severed hydraulic lines in the airplane’s tail resulting in Furthermore, as the flight progresses, it is necessary to con- loss of all hydraulic fluid and consequent loss of all aircraft tinually update and re-evaluate the set of options to take into control surfaces. Miraculously, a DC-10 flight instructor on account the changing location, altitude and velocity of the board the aircraft was able to regain some semblance of con- aircraft, subsequent degradation or failures that change the trol using differential thrust from the two remaining engines. predicted control envelope, and updated weather and airport An emergency landing was subsequently attempted at Sioux information. City, IA. Because of the high landing speed, high descent Fundamentally, this problem is a 3D path planning prob- rate, and limited control, the aircraft broke up on impact, lem involving dynamics (aircraft speed and direction), with but 10 of 11 crew members and 175 of the 285 passengers complex optimization criterion. It may, for example, be pos- survived the accident (NTSB 1990). sible for the aircraft to fly through a region of moderate tur- This accident, and others involving structural damage bulence, but because of the limited control authority there to aircraft, motivated research on adaptive control systems is increased risk of loss of control. It might also be easier aimed at allowing a pilot to continue to fly a damaged air- (as it was for United 232) for the aircraft to make right turns craft using stick inputs. The adaptive controller translates rather than left turns, or to handle a right crosswind rather those inputs into novel combinations of thrust vectoring and than a left crosswind. ∗Carnegie Mellon University Traditionally, difficult path planning problems have been †Mission Critical Technologies solved using either discretization of the space or by gener- Copyright c 2009, Association for the Advancement of Artificial ating probabilistic road maps. As we will explain in more Intelligence (www.aaai.org). All rights reserved. detail later, both of these approaches have proven problem- 114 ing: 1. The start state, consisting of the current position, speed, direction, and altitude of the aircraft. 2. The control envelope for the damaged aircraft, including airspeed range, allowable bank angles, descent range, and control responsiveness. 3. The potential landing sites within the estimated land- ing range of the aircraft, together with the characteristics of those landing sites, such as urban density, runway length and width, weather conditions, and emergency facilities. Figure 1: An overview of the IFPG Architecture in IRAC, 4. All of the “obstacles” that must be considered while flying including the Emergency Landing Planner. to any landing site. Some of these may be hard obstacles like terrain, but others may be regions with weather conditions that simply present increased risk. atic for this domain. Instead, we generate “roadmaps” by Within these constraints, the Emergency Landing Plan- starting with a 2D visibility graph, and augmenting the edge ner searches, based on explicit modeling preferences, for the set in the vertical dimension to allow paths above, below best solutions that can be found. These are then presented to or through obstacles where possible. This systematic ap- the pilot (see Figure 5) as possible landing sites. Alterna- proach to roadmap construction is proving to be reason- tive landing sites are regularly re-evaluated to account for ably effective because of the columnar nature of obstacles the evolution of the plane’s situation. in this domain. The planning search is then a hybrid dis- crete/continuous version of A* that searches for paths of low 3. Obstacles risk in this roadmap. To determine the best routes and landing sites, the planner In the sections that follow, we give an overview of the sys- has to consider a set of dynamic and static obstacles. These tem architecture, describe how obstacle information is ob- obstacles are derived from various on-line sources. There tained, describe how we assess risk, and describe the details are five rough categories of obstacle data: of our prototype path planning algorithm. • Terrain 2. Architecture • Urban development • The Emergency Landing Planner is one component of the Special Use Airspace (SUA) and Temporary Flight Re- Integrated Flight Planning and Guidance (IFPG) subsystem strictions (TFRs) of the Integrated Resilient Aircraft Control (IRAC) Project • Radar observations (rain, showers, thunderstorms) (see Figure 1). In the IFPG architecture, when some sort of • Icing and turbulence reports damage or failure occurs that impairs the aircraft in some significant way, several things happen. First, the Adap- Terrain, urban development, SUA, and TFRs are all rela- tive Flight Control subsystem helps the pilot retain or re- tively static, so the obstacles can be constructed on a daily gain control of the aircraft. While this is happening, the basis and cached. Radar observations and icing and turbu- IFPG subsystem dynamically gathers: airport and obstacle lence reports are much more dynamic, and must be con- data from the Integrated Intelligent Flight Deck (IIFD); air- structed in real time for the region in the vicinity of the craft health information from the Integrated Vehicle Health aircraft. Terrain represents hard obstacles that the aircraft Management (IVHM) subsystem; and aircraft control limi- cannot violate. The other areas are all soft obstacles that the tations from the Maneuvering Envelope subsystem. It then aircraft can violate, but with increased risk. In general, that uses this information to construct the 3D planning problem risk is a function of the controllability of the aircraft, and, in to be solved by the Emergency Landing Planner. the case of weather obstacles, of the severity of the weather. As the Emergency Landing Planner finds usable solutions All of these obstacles are columner in nature – that is, they that do not violate any of the obstacle or controllability con- have a 2D boundary, a floor, and a ceiling. We represent straints, it consults the Trajectory Planner to refine these so- them using convex polygons together with their floor and lutions into more detailed flight plans. (The trajectory plan- ceiling altitudes, and the associated risk. ner has a much more detailed but computationally more ex- pensive model of aircraft performance and dynamics.) The 4. Assessing Risk pilot then chooses from among the proposed flight plans. There is risk associated with various phases of an emergency This IFPG emergency planning architecture allows for landing – en route, approach, landing, and emergency re- flexibility in the amount of autonomy delivered by the IFPG sponse. We use expected loss of life as our measure of risk, subsystem. The pilot can choose any of the solutions pro- because it allows us to take into consideration casualties on posed by the IFPG subsystem based on experience, and the ground, as well as passengers and crew.