Loss of flight controls need not be a death sentence, as engine thrust can be used as a fallback means of bringing a stricken airplane to a reasonably safe landing.
More than 1,000 aircrew and passengers have been killed over the years when primary flight control systems failed, pilots were forced into throttle-only attempts to control their aircraft, and crashes resulted. However, through careful manipulation of engine thrust, sufficient control over the airplane can be maintained to complete an emergency descent to landing. While it is difficult for pilots to do so manually, software developed nearly a decade ago by the National Aeronautics and Space Administration (NASA) demonstrated that some automation assistance safe landings could be made with engine power alone. The concept of automating throttles-only control (TOC) was dubbed propulsion- controlled aircraft (PCA).
The Nov. 22, 2003, surface-to-air missile attack on a DHL A300 cargo jet has heightened interest in PCA as an alternate fallback flight-control system. The airplane was struck by an SA-14 shoulder launched missile on climb out of Baghdad. The heat-seeking missile missed the left engine but struck the wing, causing a complete loss of hydraulic power. In what is regarded as a phenomenal feat of airmanship, the two pilots resorted to throttles-only control of their aircraft to make turns, descend and land at Baghdad.
PCA software would have made their task easier. As one advocate of the concept said, PCA can make every pilot faced with complete loss of flight controls “a hero.”
PCA is not an automatic landing system. Rather, using its automation allows the pilot to more precisely control aircraft heading and rate of descent. As such, it enables controlled safe runway landings, as opposed to a controllable landing, not necessarily on a runway.
PCA supporters said the history of system failures, plus the added threat of ground-to-air attacks on airliners evidenced by the DHL event, add impetus for incorporating such an emergency flight control system into transport category aircraft.
“With just a few hundred lines of computer code, the system could be put in the airplane for less than the price of fueling the airplane,” said Capt. David Hayes, Director of Certification Programs for the Air Line Pilots Association (ALPA).
Gordon Fullerton, the senior NASA test pilot involved in the original PCA flight tests, suggested that developing a PCA system for a specific aircraft model “might cost a couple tanks, but it doesn’t add a single ounce to the aircraft weight.”
With 1,098 lives lost in cases of flight control failure in which engine throttles were or could have been used, PCA is seen as a valuable emergency backup. In a recent briefing, Hayes and Capt. Terry Lutz, ALPA Director of Aircraft Development and Evaluation Programs, noted that of 3,447 airplanes among U.S. carriers, 1,607 – or about 47 percent – “have no mechanical back-up flight controls.”
In August 25 testimony to the House Aviation Subcommittee, Capt. Duane Woerth, ALPA president, said PCA should be considered as a lower cost option to the installation of missile defense systems on airliners:
“The response to this [missile] threat must be very carefully considered, because airborne countermeasures are tremendously expensive to purchase, maintain, and operate … In addition to any other measures eventually taken, we believe that the government should look seriously now at developing, certifying and funding deployment of NASA’s propulsion controlled aircraft on airliners. This system, which would cost far less than an electronic [missile] countermeasures system, would allow flight crews to fly an aircraft to a safe landing in the event of hydraulic failure or damage to flight control components.”
The cost of missile defenses for commercial airliners was raised in a European Commission (EC) internal report produced earlier this year: “Mandating a �1-2 million (Euro) equipment per aircraft, only to find out three years later that new missiles have been developed for which the installed equipment is not capable to defend against, is not the suitable way forward.”
The EC report suggested that fuel tank protection and additional fire prevention “associated with the wing-engine assembly” should be considered “as viable research candidates able to save an aircraft in a post impact phase.”
The EC report also mentioned engine thrust as a backup in the event of damaged or lost flight control systems: “The vertical or horizontal movements can be substituted by either engine thrust or control of other available flight surfaces.”
Most airliners today feature engines slung under the wings. The placement means that adding thrust can raise the nose, while retarding power can lower the nose. Applying more thrust to one side can also change the direction of flight. For example, a 10� throttle split on the MD-11 produces about 20,000 pounds of differential engine thrust. TOC can also be applied on aircraft with tail mounted engines, although the effects can be less significant.
In the event of loss of control to the flight surfaces, pilots must cope with two aircraft motions. One is known as phugoid, the longitudinal pitch oscillation of the airplane. This up-and-down motion can occur over a cycle ranging from 30-40 seconds to 1-2 minutes, depending on the aircraft type, its center of gravity, its trim state and engine thrust setting. Trim state is that condition where an airplane is flying in a balanced condition.
The other problem is known as Dutch Roll, in which yaw induces a rolling motion. One experienced captain described the phenomenon as akin to wallowing through the sky in a horizontal figure eight pattern. Yaw dampers connected to the rudder suppress Dutch Roll.
Thus, with loss of flight controls, pilots are faced with two problems: restoring lateral/directional control and restoring pitch control. Differential thrust can be used to bring the wings level and control yaw.
Damping the phugoid motion can be tougher. As the nose falls, thrust can be added, or, as the nose rises, thrust can be reduced.
As Lutz said, once pitch and roll are under control, “Now you can think.” Good crew resource management (CRM) can be employed to divide up the tasks. Messages on the instrument displays can help determine the exact status of the airplane and what is available for flight control. One can begin to think about landing the airplane, mindful of making any changes slowly and incrementally.
Based on his flight test experiences validating the PCA concept, NASA’s Fullerton has outlined ten steps to a survivable landing. In a telephone interview, he said the 10 steps should be regarded as “a generic approach,” as airplanes can vary greatly.
Deploying the landing gear can aggravate the phugoid, as it changes the airplane’s trim state. As shown in the table of previous loss of flight control events, when the B-52 and C-5A crews deployed landing gear, they lost 5,000 ft. and 8,000 ft. of altitude respectively before restoring the aircraft to reasonably stable flight. It’s advisable to deploy the landing gear at an altitude of several thousand feet.
TOC is tricky
What sounds straightforward in the abstract can be extremely difficult in an actual emergency. The DHL crew successfully employed manual TOC to land their badly damaged airplane. However, a January 2004 NASA technical memorandum, based on numerous simulator trials and flights involving different aircraft and pilots, is laced with dark expressions about manual TOC:
“Exceedingly difficult.”
“Good phugoid damping is critical for TOC flight.”
“After much practice, some safe landings could be made.”
“Workload was very high.”
“Adding winds and turbulence made the task even harder.”
“Bounces were typical.”
“A ‘cold pilot’ might be able to make a survivable TOC landing on a large dry lakebed.”
“Of the four TOC approaches, one appeared suitable for a survivable landing.”
“The combined TOC task of controlling sink rate, touchdown position, and runway alignment is extremely difficult.”
In terms of controllability with manual TOC, the Airbus A300 was the best out of all the airplanes assessed. For the pilots flying out of Baghdad, they were in the best airplane for a TOC situation. However, while their success provides faith, the DHL pilots’ experience with raw TOC may represent an isolated success, not repeatable in other airplanes and other damage situations.
The message from the 2004 NASA report of simulator trials and flight tests is that manual TOC is always a two-pilot task and the likelihood of an average crew successfully recovering an otherwise undamaged aircraft to a runway via TOC would be low.
The PCA system is born
Automated TOC is another matter. The NASA-developed PCA was successfully demonstrated in a series of flight tests using an MD-11 in 1995. The proof-of-concept system consisted of about 300 lines of computer code, which could be activated with the flip of a switch. In the flight tests, the normal hydraulic flight controls were disconnected and the PCA was switched on to assess its ability to null out Dutch Roll and phugoid, and to enable crews to control the airplane to a safe landing. The PCA was controlled via the normal autopilot controls on the MD-11. The 1997 NASA test report said the system “performed almost as well as the normal autopilot.” It controlled the flight path to within a few tenths of a degree and, with a level flight path command, held altitude to within + or – 20 feet.
Fullerton recalled, “The PCA worked better than our dreams.”
“It was just like being on autopilot, so long as you did it smoothly” and avoided large changes, he said.
Based on the simulator trials of the PCA, the pilots thought its performance would degrade at higher altitude (the system having been designed for speeds of around 150 to 200 knots at altitudes below 15,000 feet). The system was flight tested under various conditions up to 30,000 feet and performed better than predicted by the computer simulations.
PCA operation coupled to an instrument landing system (ILS) approach was also tested, both in the simulator and in flight. Landings were at safe sink rates and bank angles, with a significant reduction in pilot workload.
The results with PCA were characterized by phrases virtually the opposite of the descriptions related to manual TOC. For PCA:
“In smooth air, a new pilot could make a successful PCA approach on the first try.”
“In smooth air, flight path was held to within less than 0.5� of the pilot’s command.”
“The instrument landing system-coupled approaches were successful in turbulence levels up to at least moderate.”
“The PCA system operation is so sufficiently straightforward that extensive training is not required.”
As a proof-of-concept effort, the PCA design tested in 1997 was not ready for installation on aircraft in revenue service. The throttle handles did not move on the MD-11 as the PCA applied its power adjustments. Fullerton said, “I’m not sure having the throttles move is necessary for an emergency use PCA system.”
Other features were not incorporated that would be desirable, if not necessary, in a production system. For instance, there was no way to display a PCA-engaged annunciation without expensive changes to a symbol-generating computer.
Moreover, the system was limited to aircraft with flight control computers (FCCs) and full authority digital electronic controls (FADEC) on the engines. Most modern airliners are so equipped.
There is another important limitation, said Bill Burcham. He was involved in the original software development of the PCA. In a telephone interview Burcham, now retired, said that even with PCA, “You need an airplane that is minimally controllable.”
The DHL pilots, he added, were hit in daylight and in clear weather, factors that helped in their successful landing.
For older airplanes without FCCs and FADEC, Burcham recalled that simplified versions of PCA were developed. One was dubbed “PCA-Light” and the other was known as “PCA- Ultralight.”
In the PCA-Light version, the software was coupled to the autothrottles, moving them at a slower rate than in the original PCA version. Nor was the PCA-Light modification capable of moving the throttles differentially beyond a few degrees.
In the PCA-Ultralight version, the software was used for pitch control and the pilot controlled lateral movement of the aircraft by manually jiggling the throttles for asymmetric thrust.
“All versions had major improvements over the pilots grabbing the throttles by hand,” Burcham recalled.
Why was the system never developed beyond proof of concept to a deployable system? Burcham said, “By the time we got around to flying the PCA in 1995, it was six years after the 1989 United Airlines accident at Sioux City.”
Some manufacturers, he added, felt that this was a one-off accident and “they’d never lose all the hydraulics again.”
Nonetheless, as a result of its investigation into the United crash, the National Transportation Safety Board (NTSB) recommended that back-up means of motive power to powered flight controls should be developed for all new widebody airplanes. Lutz said, “PCA provides the same degree of control while remaining completely independent of any hydraulic systems.”
“While the NTSB recommended alternate means to power the flight controls, this may be possible by new aircraft designs, such as the Boeing 7E7, but it is unlikely that retrofit would be possible for existing airplanes,” he added.
“Had the NTSB known about PCA at the time of its report on the United crash, the board likely would have seen the great potential for PCA to allow a low cost control system, independent of existing powered flight controls, and made it a part of its recommendations,” Lutz said. He suggested that the federal government could provide funding to advance PCA from the concept stage to the point where it could be made available for retrofit to all airplanes without back-up mechanical flight controls.
Burcham observed that the missile strike on the DHL jet, which lost all its hydraulics as a result, has “reignited interest in what could be done in the near term.“
>> Hayes, e-mail [email protected]; Lutz, e-mail [email protected]; Fullerton, e-mail [email protected]; Burcham, e-mail [email protected] <<
The Conundrum
- For all airplanes tested, using manual TOC [throttle only control], it is exceedingly difficult to make a safe runway landing. This is due to difficulty in controlling the oscillatory phugoid and Dutch Roll modes, weak control moments, and slow engine response.
- As of 2004, however, there are no airplanes equipped with a PCA [propulsion-controlled aircraft] system, so major flight control failures that may occur and require the use of thrust for flight control must be accommodated with manual TOC [throttle only control].
Source: Manual Manipulation of Engine Throttles for Emergency Flight Controls, National Aeronautics and Space Administration (NASA), TM-2004-212045, January 2004, p. 2
Backup Wanted
NTSB, Dec. 14, 1990, Recommendation A-90-168: “The NTSB recommends that the Federal Aviation Administration [FAA] encourage research and development of backup flight control systems for newly certificated wide body airplanes that utilize an alternative source of motive power separate from that source used for the conventional control system.
FAA, June 30, 1993, response:
“The FAA agrees [and] is sponsoring a research and development program to explore protection of the flight control system. The proposed research is limited to new technology systems where the potential for improved survivability is greatest.
NTSB, April 22, 1996:
“Based on this information, the board classifies A-90-168 ‘Closed – Acceptable Action.’ “
Source: NTSB
Ten Steps to a Survivable Landing Using Only Throttles
1. If a wing is low, push that wing’s throttle(s) up until the wings are level. Continue to use asymmetric thrust as required to control bank angle and heading.
2. If the pitch attitude and airspeed continually oscillate, determine the approximate steady state trim airspeed by averaging the high and low speeds seen and set a reference bug or mark at that speed.
3. Damp the pitch oscillation using aggressive throttle inputs to force the airspeed to a steady state trim airspeed as the nose approaches a level attitude.
4. Continue this process until all pitch oscillations are stopped. Constant, precise control of airspeed is key to prevent oscillations from beginning anew.
5. Gentle climbs and descents can be initiated with a thrust change and then repeating the damping process of step 4. The steady state trim airspeed may change slightly in climb or descent.
6. Select a suitable landing site: the widest, longest and smoothest landing area with good weather within reach. Emergency services and ILS [instrument landing system] are also desirable.
7. Well before a landing attempt, configure for landing. Expect a pitch upset and a corresponding trim airspeed change when landing gear is lowered. Flaps, if available, should be lowered in very small increments.
8. Make a very long, flat, straight-in approach with no configuration changes.
9. Hold a flat approach all the way to the ground; do not reduce thrust before touchdown unless floating just above the ground.
10. Last minute lineup corrections are very difficult, go-arounds are easy. Fuel permitting, a go-around should be accomplished if in doubt about the impending touchdown.
For further advice on the technique, contact NASA test pilot Gordon Fullerton, at tel. 661/276-3214 (ASW note: Perhaps as part of step 5, we would suggest adding: “Restrict all movement in the cabin, even to and from lavatories. All persons must remain seated except for perhaps a couple flight attendants, who could assist in gently moving the center of gravity, i.e., longitudinal trim state, by repositioning themselves in response to a pilot’s public address system announcement.” Fullerton said, “We did no experimenting with attempts at control by moving people or cargo.”) Source: NASA, TM-2004-212045, January 2004
| Accidents or Incidents Involving Loss of Flight Controls In Which Throttles Were or Could Have Been Used | |
|---|---|
| Event | Circumstances |
| June 1972, American Airlines DC-10 | Aft cargo door blew out, damaging control cables to the tail. Center engine went to idle. Rudder was jammed with an offset. Crew landed, using differential engine thrust to keep the airplane on the runway. |
| March 1974, Turkish Airlines DC-10 | Aft cargo door blew out, breaking or stretching control cables to the tail. All 346 passengers and crew killed. It is possible that adding thrust to the wing engines would have pulled the airplane out of its terminal dive. |
| May 1974, U.S. Air Force (USAF) B-52H | All hydraulics in tail lost. For pitch control, the crew used throttles and airbrakes. One crewman manipulated the throttles to the eight engines while another handled the airbrakes. When they lowered the gear, they lost 8,000 ft. altitude before regaining control. With an inadequately damped phugoid motion, the aircraft landed hard on the downswing of the phugoid, breaking off the nose section. The eight crewmen in the nose section survived; the remainder of the airplane was destroyed by fire. |
| April 1975, USAF C-5A, “Operation Babylift”, | C-5A four-engine transport was evacuating 314 orphans from Vietnam. Rear pressure door failed during climb; all hydraulic controls to tail lost. Crew used throttles for pitch control, but lost 5,000 ft. altitude when landing gear was deployed, which excited a divergent long period phugoid pitching motion. Airplane crashed 1.5 miles short of the runway, killing 138. |
| April 1977, Delta Air Lines, L-1011 | One elevator jammed full up, causing a large nose up pitching and rolling moment. The captain, using amazing insight, retarded the wing engines and firewalled the center engine, regaining enough control to maintain flight. Crew moved passengers forward to reduce pitch-up tendency and completed a safe landing using throttles to supplement remaining flight controls. |
| 1981, USAF B-52G | Failure similar to B-52 event in 1974. Crew used techniques developed after the 1974 incident to land. Fuselage was cracked during hard touchdown, but there were no injuries and the airplane was repaired. |
| August 1985, Japan Air Lines B747 | Rear pressure bulkhead failed. Total hydraulic systems loss. Pilots achieved marginal TOC for about 30 minutes before crashing into a mountain. Of the 524 aboard, 520 were killed. |
| July 1989, United Airlines, DC-10 | Uncontained #2 (tail) engine failure caused loss of all hydraulics. Crew taught themselves TOC. To maintain heading, the right engine thrust had to be about twice that of the left engine. Phugoid not well damped, wing dropped just before touchdown at Sioux City, Iowa. In the controlled crash landing, 181 lives were saved of the 296 persons aboard. |
| November 2001, American Airlines A300-600 | The tail was lost after wake vortex encounter and large pilot rudder inputs. Without yaw stability, the airplane rolled out of control and crashed into Belle Harbor, N.Y., killing all 260 aboard and 5 on the ground. A PCA system could have provided yaw control and possibly saved the airplane, depending on how rapidly it was engaged after the failure. (ASW note: Although an adroit and responsive PCA might be able to keep things within bounds in smooth air, realistically the pilots of this aircraft likely did not fully realize what was happening to them – and they didn’t know that they’d lost their vertical fin.) |
| October 2002, Northwest Airlines B747 | Lower half of the split rudder deflected full left. Crew used upper rudder and aileron to compensate, but found it necessary to use differential engine thrust as they slowed for a safe landing at Anchorage, Alaska. |
| November 2003, DHL A300B4 cargo jet | Left wing damaged by missile attack. All hydraulics were lost. Crew remembered the United Airlines crash at Sioux City, achieved full TOC, lowered the landing gear and made a 20-mile straight in approach to Baghdad, veering off the runway and coming to a stop. |
| Source: Manual Manipulation of Engine Throttles for Emergency Flight Controls, National Aeronautics and Space Administration (NASA), TM-2004-212045, January 2004, App. A | |