JOURNAL OF AIRCRAFT Vol. 43, No. 4, July–August 2006 Emergency Flight Planning Applied to Total Loss of Thrust Downloaded by UNIVERSITY OF MICHIGAN on May 18, 2015 | http://arc.aiaa.org | DOI: 10.2514/1.18816 Ella M. Atkins,∗ Igor Alonso Portillo,† and Matthew J. Strube‡ University of Maryland, College Park, Maryland 20742 Autopilot systems are capable of reliably following flight plans under normal circumstances, but even the most advanced flight-management systems cannot provide robust response to most anomalous events including in-flight failures. This paper describes an emergency flight-management architecture that can be applied to piloted or autonomous aircraft, with focus on the design and implementation of an adaptive flight planner (AFP) that dynamically adjusts its model to compute feasible flight plans in response to events that degrade aircraft performance. A two-step landing-site selection/trajectory generation process defines safe emergency plans in real time for situations that require landing at an alternate airport. A constraint-based search algorithm selects and prioritizes feasible emergency landing sites, then the AFP synthesizes a segmented trajectory to the best site based on postfailure flight dynamics. The AFP architecture is general for any failure situation; however, operational success is guaranteed only with accurate postfailure performance characterization and a trajectory generation strategy that respects degraded flight envelope boundaries. A real-time segmented trajectory planning algorithm and case study results are presented for total loss of thrust failure scenarios. This emergency is surprisingly common and necessitates an immediate approach and landing without a go-around option. I. Introduction bility in data management and display previously unavailable. When flight performance degrades, the aircraft will become more difficult to control, and existing flight plans might no longer be feasible. In such situations, it is critical to make decisions with efficiency and accuracy to enable a safe landing, particularly when failures place hard limits on available time aloft. Researchers have begun to design flight-management architectures that will enable the avionics to assist the pilot during emergencies, such as the Emergency Flight Planner (EFP) proposed by Chen and Pritchett.7 Their EFP architecture includes an automatic plan generator, trajectory predictor, autopilot, pilot interface, and model identification tools. Limits on critical dynamic reference quantities such as roll and pitch rates are provided in a heads-up display format, and the trajectory predictor plots projected aircraft path, a task difficult for pilots without visual aids. Pilot studies suggest an EFP has the potential to reduce errors provided the presented data are correct. Analogous architectures are also under development for UAVs,8 assimilating a suite of flight planning and adaptive control modules required to enable fully autonomous fault management. To date, development within EFP-class architectural frameworks has primarily emphasized human factors7 (e.g., pilot’s situational awareness and automation aid impact on decision making) and/or adaptive control with system identification.8 Because of computational complexity issues, automatically generated maneuvers are typically precompiled and presume the nominal aircraft performance model.9 The focus of our research is automatic postfailure flight planning to enable safe emergency landings, a capability that fits between pilot interface and adaptive control components. Our adaptive flight planner (AFP), shown in the context of an emergency flight-management architecture in Fig. 1, is designed to enable robust response to situations in which aircraft performance is reduced. In the overall Fig. 1 architecture, a flight-plan monitor, acting as a trajectory predictor, propagates the executing flight plan through the current (potentially degraded) performance model, flagging any expected excursions outside the flight envelope. If the plan is determined to be infeasible, the pilot and AFP are notified, then the AFP builds a dynamically feasible flight plan to the top-ranked landing site. All emergency flight-planning algorithms must meet real-time deadlines imposed by performance limits because a disabled plane might not be able to remain aloft for an extended time. Note that this work assumes the aircraft can ignore other traffic because declaration of an emergency will enable priority handling by air traffic control (ATC). Although the AFP could be adopted as an ATC advisory tool, this work also presumes the AFP resides in the cockpit to facilitate integration with autopilot systems. M ODERN aviation is a safe and reliable form of transportation. Although rare, incidents do occur, and researchers are improving aircraft avionics and mechanical systems to reduce the likelihood of failures and improve the ability of pilots to manage emergencies when they arise. Consider total loss of thrust, a situation that converts a powered aircraft into a glider that cannot climb or maintain altitude. In this case, the pilot [or unmanned aerial vehicle (UAV) autopilot] must quickly select a landing site and follow a trajectory that places the aircraft on the ground at that site. Because thrust is no longer one of the flight controls, altitude management is critical, and go-around is not an option. Loss of thrust is a surprisingly common source of general-aviation accidents, as shown in the Table 1 statistics compiled from 2002 and 2003 Nall Reports.1,2 Mechanical failures and fuel mismanagement account for the majority of power-loss accidents, whereas power loss for unknown reasons, such as carburetor ice where “the evidence melts,” captures remaining cases. Note that the Table 1 statistics do not include power-loss cases, where the aircraft glided to a safe landing. Although less common, loss of thrust incidents also occur in commercial transport operations, with three fatal accidents caused on fuel exhaustion during the period 1994–2003.3 Other less predictable incidents have occurred, such as a 1991 MD-80 accident near Stockholm where improper de-icing resulted in chunks of ice being ingested into both engines and the 2002 Indonesia crash of a B737-300 after both engines flamed out in torrential rains. Proper response to engine failure is a recurring training theme,4 but pilots continue to be challenged with quickly identifying a reachable runway and accurately guiding their powerless aircraft to that runway. Any failure that reduces performance requires prompt action to enable a safe landing. Flight-management systems (FMS),5,6 and emerging general-aviation (GA) glass cockpits offer a level of flexiPresented as Paper 2002-1073 at the AIAA Aerospace Sciences Meeting, Reno, NV, 14–17 January 2002; received 14 July 2005; revision received c 28 August 2005; accepted for publication 31 August 2005. Copyright  2005 by the American Institute of Aeronautics and Astronautics, Inc. All rights reserved. Copies of this paper may be made for personal or internal use, on condition that the copier pay the $10.00 per-copy fee to the Copyright Clearance Center, Inc., 222 Rosewood Drive, Danvers, MA 01923; include the code 0021-8669/06 $10.00 in correspondence with the CCC. ∗ Assistant Professor, Aerospace Engineering Department, 3182 Martin Hall. Associate Fellow AIAA. † Graduate Research Assistant, Aerospace Engineering Department; currently Senior Test Engineer, Research Department, Construcciones y Auxilliar de Ferrocarriles (CAF), J.M. Iturrioz 20200 Beasain, Spain. ‡ Graduate Research Assistant, Aerospace Engineering Department. 1205 1206 ATKINS, PORTILLO, AND STRUBE Table 1 GA loss of propulsion accidents in 2001 and 2002 Failure type Downloaded by UNIVERSITY OF MICHIGAN on May 18, 2015 | http://arc.aiaa.org | DOI: 10.2514/1.18816 Mechanical failure (with power loss) Engine/propeller Fuel system Oil system Fuel mismanagement total Fuel exhaustion Fuel starvation Fuel contamination Power loss for “unknown reasons” Total GA power-loss accidents Total GA accidents Power loss % of all GA accidents 2001 total 2002 total 2001 fatal 2002 fatal 146 109 26 11 114 75 30 9 67 327 1494 21.9% 152 108 38 6 120 70 36 14 51 323 1472 21.9% 22 17 4 1 7 4 1 2 —— 29 298 9.7% 26 19 5 2 13 7 4 2 —— 39 312 12.5% Fig. 1 Emergency flight-management architecture. Given the overall directive to build a safe landing plan, the AFP performs two tasks: 1) selection of a feasible landing site and 2) synthesis of a landing trajectory that falls within the degraded flight performance envelope. Identification of a suitable landing site requires computation of the landing footprint and the runways within the footprint that will safely accommodate the aircraft given its reduced performance capabilities. [This work defines “landing site” as an airport runway, although this definition could straightforwardly be extended for the AFP because runways are defined for AFP algorithms by their latitude, longitude, altitude, dimensions (e.g., landing area length), and on-site equipment (presumed nonexistent with off-field landings).] Postfailure trajectory generation requires a reachable waypoint sequence to connect the current aircraft state to the landing site. This paper begins with a review of technologies that together will enable robust emergency flight management. The adaptive flight-planning architecture is described next, with focus on algorithms adapted to the loss of thrust emergency. Results are presented for a transport aircraft given loss of thrust over various continental U.S. regions. II. Related Work An emergency flight planner is one component in the overall management of an in-flight failure. It is essential that the controller, autopilot or manual, maintain stable flight at all times, avoiding conditions outside the potentially degraded flight envelope. Adaptive controllers have been designed to maintain stability for an extensive suite of failure situations such as control surface failures10−12 and airframe icing.13 Adaptive critics12,14 have been shown to improve piloting ability by adjusting dynamic reference model characteristics (e.g., maximum bank/pitch rates), provided the pilot specifies trajectories that are still within the performance envelope. Integration of a reference model into an intelligent flight controller15,16 has enabled pilots to maintain control of a damaged aircraft following an extensive suite of control surface and loss-of-thrust failure combinations. The flight envelope protection provided by this controller is an essential element of any autopilot or flight-management system expected to maintain stable flight during failure scenarios. The AFP described in this paper is being implemented as part of this intelligent flight controller,15,16 providing a “middleware” layer between pilot and reconfigurable autopilot that will assist with the definition, evaluation, and execution of postfailure flight plans. Unmanned-aerial-vehicle researchers have developed related flight-management tools more directed at fully autonomous operation. Boskovic et al.8 and Boskovic and Mehra17 define a hierarchical control architecture with layers for strategic decision making, tactical planning, and reconfigurable flight control somewhat analogous to a flight-management model that combines pilot, emergency flight planner, and reconfigurable flight controller. Boskovic and Mehra construct a set of alternative routes offline to respond to anomalous events, handling the set of most probable emergency situations that might otherwise require extensive deliberation to handle given a complex battle scenario. Similarly, Schouwenaars et al.,9 Mettler et al.,18 and Valenti et al.19 have applied a dynamic programming strategy with a minimal time-to-go cost function to dynamically define UAV flight plans from a database of trim conditions and maneuvers. Rescue paths, such as a loiter or holding pattern, are generated at each time step to buy planning time when unexpected events occur. This strategy is applicable to UAVs and piloted aircraft except for situations where the autopilot cannot track the rescue paths and can prove a valuable tool for situations requiring substantial strategic deliberation given unpredicted military or crowded airspace/adverse weather situations. We have, in fact, adopted an anytime version of the trim database approach to postfailure trajectory planning within our AFP for control surface jam scenarios.20 Downloaded by UNIVERSITY OF MICHIGAN on May 18, 2015 | http://arc.aiaa.org | DOI: 10.2514/1.18816 ATKINS, PORTILLO, AND STRUBE Trajectory generation algorithms are required to construct feasible postfailure flight plans. Much of the literature in automatic aircraft trajectory generation has focused on continuous state-space solutions that minimize fuel and time subject to airspace and airtraffic-control constraints. Betts21 presents a thorough review of twopoint boundary-value problems with direct and indirect solution techniques. Seywald et al.22 and Seywald23 and Schultz24 optimize trajectories for aircraft flying in the longitudinal plane using a point mass performance model. Slattery and Zhao25 and Wagner et al.26 describe the synthesis of three-dimensional point-mass-based lateral and longitudinal plane trajectories for air-traffic management. We also adopt three-dimensional point mass performance models for this paper and use segmented trajectories for both loss of thrust and trim database trajectory planners. As a complementary collisionavoidance tool, Tomlin et al.27 have devised a probably correct procedure and have evaluated it with pilot and ATC studies. Pilot-preferred commercial and GA flight plans are typically defined by a sequence of waypoints connected by constant-trim segments and transitions between these trim states. Such segmented routes28 enable intuitive comprehension by pilots and ATC, facilitate communication of the trajectory, and can reduce computational complexity relative to numerical optimization processes. A goal of this research is to provide a trajectory synthesis tool to use when a piloted or unmanned aircraft suffers a decrease in performance. A segmented trajectory can be more quickly computed and understood; the goal during an emergency is a safe landing that need not be elegant. We have implemented a waypoint generation algorithm (WGA) as the AFP trajectory generation tool that defines dynamically feasible postfailure trajectories as a sequence of waypoints connected by constant-trim states. The loss-of-thrust trajectory synthesis algorithm adopted for this work generates glide trajectories based on energy management.29 Such algorithms have more commonly been applied for spacecraft reentry.30−32 III. Adaptive Flight-Planning Architecture Following any failure, a pilot or UAV autopilot must perform three tasks: 1) maintain stable flight (fly the plane), 2) analyze the situation to determine the problem (or at least the effects of the problem), and 3) develop and execute a safe plan of action. Reconfigurable flight control handles (1) and a mature system identification capability will facilitate (2) in situations where performance is reduced. Emergency flight-planning architectures (Fig. 1 or Chen and Pritchett7 ) 1207 are designed to guide the pilot or direct the autonomous UAV to follow a safe postfailure flight plan (3). Shown in Fig. 1, the AFP has two components: landing-site search and postfailure trajectory planning. The landing-site search module selects a feasible and desirable final state (landing runway) that takes into account the post-failure aircraft performance envelope. The trajectory planner then defines a waypoint-based trajectory connecting initial aircraft state (latitude x, longitude y, altitude h, heading ψ, velocity V ) with the desired touchdown state at the landing runway’s approach end. Note that initial state is defined as the postfailure aircraft state projected along a trimmed flight state (e.g., constant heading best glide) for the expected planning time, currently a user-defined constant. The AFP architecture and landing-site search (LSS) components are general for any failure; however, the trajectory planner must efficiently meet the spectrum of reduced performance scenarios. We have adopted two trajectory planning approaches for the AFP: a highly efficient WGA (<1-s execution time) customized to loss-of-thrust emergencies (γmax < 0) and a trim database approach that builds a sequence of valid postfailure trim states connecting the aircraft with the designated landing runway.20 Although this paper focuses on the loss of thrust case (thus the WGA), the trim database approach has also been implemented within the AFP and is being extended to cover a suite of control surface jam and structural damage scenarios. Figure 2 shows the LSS algorithm. Inputs include a U.S. airport database, updated performance model, initial state, forecast winds over different flight levels, and airport weather conditions. The LSS outputs a list of viable landing runways ranked according to a safetyoriented utility function, after which a segmented landing trajectory is planned for the top-ranked runway. The AFP is implemented in C, and all AFP input except the airport database is currently generated from user-defined files. In an operational context, the updated dynamic model and initial state would be provided by the flight plan monitor/system ID modules (Fig. 1), whereas airport weather and winds aloft would be compiled via datalink. Each LSS component is described next. A. Footprint Generation The first LSS step is to compute the aircraft footprint, defined as the region in which the aircraft can safely land given postfailure performance characteristics. Previous work30,31 has utilized the calculus of variations to identify footprints for air and space vehicles during reentry glide. Adoption of such an exact footprint strategy Fig. 2 Landing-site search. Downloaded by UNIVERSITY OF MICHIGAN on May 18, 2015 | http://arc.aiaa.org | DOI: 10.2514/1.18816 1208 ATKINS, PORTILLO, AND STRUBE for the AFP would impose nontrivial computational overhead both to generate the footprint and to identify which runways are inside the footprint given its nonregular geometry. Regardless of its accuracy, a footprint represents range but can optimistically include airport runways that cannot actually be used given that the aircraft must be aligned with the runway at touchdown. As a real-time procedure adequate for identifying potential postfailure landing sites, the LSS computes a simple circular footprint that approximates the exact solution. Our approximate footprint is either defined by a maximumrange boundary in cases where the aircraft is unable to remain aloft long term, or an artificial boundary to constrain postfailure time aloft but with sufficient extent to enable identification of a safe landing site. The loss of thrust emergency places a hard constraint on time aloft; thus, a maximum-range footprint is utilized. Figure 3 illustrates the approximate footprint computation procedure. As shown, the aircraft begins at initial state∗ with an ENE heading. To generate the circular footprint, the LSS first computes three footprint boundary points, each depicted with an x in Fig. 3. The most distant boundary point is found by projecting the aircraft straight ahead along a best-glide path to the ground. The second and third footprint boundary points are computed by turning the aircraft 120 deg to the right and left, respectively, presuming best-glide, 30-deg bank turns, then projecting straight best-glide paths to the ground. The circle uniquely defined by these three footprint boundary points is defined as the loss-of-thrust approximate footprint, with radius rfoot and center coordinates (xfoot , yfoot ) as shown in Fig. 3. For comparison, Fig. 4 shows a series of more exact loss-of-thrust footprints for an aircraft flying North in which each boundary point was constructed with a turn-and-fly simulation. Figure 4a shows footprint contraction over time should the disabled aircraft continue a straight best-glide path (γmax = −3.23 deg = −0.056 rad), illustrating the urgency to compute and begin execution of the postfailure flight plan. Figure 4b shows the effects of a 30-kn wind on footprint, included during the computation of our three approximate footprint boundary stations by laterally displacing each waypoint based on time aloft and (constant) wind velocity. Figure 4 also illustrates the effect of the initial turn on footprint shape and extent relative to initial aircraft state, an effect that is more pronounced with low initial altitude because a greater percentage of the total altitude is lost during the turn. Because differences between approximate and exact footprints are minor, typically the set of runways they enclose match identically. If discrepancies exist, any extra runway included only in the approximate footprint will be eliminated by the WGA if sufficiently highly ranked to be chosen as the landing site. Any runway found only in the exact footprint will not appear in the LSS’ reachable list, but such a runway would have little chance of actually representing a valid landing site because the aircraft must align itself with the landing runway, requiring flight distance beyond that modeled in the maximum-range footprint. B. Landing-Site Identification and Constraint Satisfaction The set of reachable runways is defined as all airport runways within the approximate footprint region. Reachable landing sites are straightforwardly identified by matching airport database runway coordinates (lat, lon) with the footprint region. Other hard constraints must also be met to enable a safe landing. Minimum runway length and width, maximum crosswind component, surface type (no water landings), and reported visibility vs instrument approach minimum constraints are checked against published runway characteristics and wind/weather conditions to eliminate runways that cannot safely accommodate the disabled aircraft. The remaining reachable airport runways are then marked feasible. Note that with either a small footprint (e.g., low-altitude engine failure) or flight over a remote area, the default constraint set can eliminate all runways. In this case, the constraints must be relaxed, reducing safety margins until at least one feasible runway is identified. Landing on a short runway, for example, enables the aircraft to at least stabilize and decelerate safely, even though the aircraft might overrun the field. Incorporation of a terrain database will ultimately enable tradeoffs between marginally acceptable runways and off-field sites, but such analysis is beyond the scope of this work. C. Utility-Based Prioritization In situations with multiple feasible runways, the AFP ranks this list to identify the most desirable landing site(s). This safety-oriented utility function U includes airport and weather information and is defined as a weighted sum:  rl rw U= Ci · wi = C1 · + C2 · r r l,max w,max i + C3 · q I + C4 · Fig. 3 Approximate footprint. + C6 ·  d dmax  + C5 · wh wh,max (wc,max − wc ) + C7 · q S + C8 · q f (wc,max − wc,min ) (1) Eight parameters are included in our utility function: runway length rl , runway width rw , instrument approach quality q I , distance d from the footprint boundary, headwind velocity wh , crosswind velocity a) Glide footprint degeneration over time (h0 = 35,000 ft) b) Steady wind effects on footprint (h0 = 11,000 ft) Fig. 4 Example glide footprints. 1209 ATKINS, PORTILLO, AND STRUBE Table 2 Quality measures for runway utility computation Description (max value used) Value must be designed such that all parameters lie within the performance limits of the aircraft. Flight envelope limits are determined by aerodynamic, propulsion, and structural characteristics of the aircraft. Downloaded by UNIVERSITY OF MICHIGAN on May 18, 2015 | http://arc.aiaa.org | DOI: 10.2514/1.18816 Instrument approach (q I ) WAAS, ILS/MLS LOC with RWY designation LOC w/o RWY designation LDA w/RWY designation LDA w/o RWY designation GPS, LORAN, RNAV w/RWY VOR, NDB, SDF w/RWY GPS, LORAN, RNAV, VOR, NDB, SDF w/o RWY Runway surface (q S ) Asphalt Concrete Metal, brick, etc. (VTOL) Wood Turf/gravel/dirt Airport facilities (q f ) Fuel of required type (Jet-A) Airframe maintenance Major Minor Power plant maint. Major Minor Bulk oxygen 1.0 0.95 0.85 0.8 0.7 0.6 0.5 0.2 1.0 1.0 0.5 0.2 0.1 0.25 0.25 0.125 0.25 0.125 0.25 WAAS = wide area augmentation system, ILS = instrument landing system, MLS = microwave landing system, LOC = localizer, RWY = runway, LDA = localizer type directional aid, GPS = global positioning system, LORAN = long range navigation, RNAV = area navigation, VOR = very high frequency omni-directional range, NDB = nondirectional beacon, SDF = simplified directional facility, and VTOL = vertical takeoff and landing. wc , surface quality q S , and facility availability measure q f . Numerical costs rl , rw , d, wh , and wc are normalized by their extreme values over the set of feasible landing sites to guarantee individual cost values in the range [0.0 1.0]. An initial set of [0.0 1.0] values for our quality measures (q I , q S , q f ) is summarized in Table 2. The majority of the Eq. (1) parameters increase safety margins during landing, while facility quality q f is a convenience preference that favors landing where the aircraft can be repaired. Distance parameter d gives preference to runways away from footprint boundaries, which indicates they likely fall well within maximum range and/or time constraints. Weighting factors Ci are set to {C1 , C2 , . . . , C8 } = {0.15, 0.15, 0.15, 0.15, 0.1, 0.1, 0.1, 0.1} for our case studies. Exact quality measure values and utility weighting factors would ultimately be based on expert knowledge (pilot, airline, military strategist) and would be expected to vary by emergency type (e.g., a long runway is important without thrust reversers; a wide runway is important without robust directional control) and weather conditions (e.g., a precision approach is highly desirable with low ceilings). IV. Segmented Trajectory Generation for Total Loss of Thrust Once the top-ranked feasible landing runway is identified, the AFP must plan a trajectory to guide the aircraft down to the runway. For the loss of thrust case, aircraft dynamics are unchanged except that thrust is zero, enabling the AFP to adopt a typical pointmass performance model. The point-mass model balances the primary forces acting on the aircraft, namely, lift L, drag D, thrust T , and weight W = mg. A typical mathematical representation of this point-mass model33 is summarized in the following equations, and assumes a flat, norotating Earth, standard atmosphere, fully coordinated flight (no side forces; sideslip angle always zero) and that the aircraft is a “point,” thus dynamics of its movements around the center of gravity can be ignored. In this model, longitudinal and lateral aircraft dynamics are decoupled. The point-mass equations define the forces (L , D, W ) and velocities (ẋ, ẏ, ż, ψ̇) in terms of lift C L and drag C D coefficients, airspeed V , flight-path angle γ , bank angle X Y Z φ, heading ψ, and wind velocity vector Vwind , Vwind , Vwind , presumed constant over each trajectory segment in this work. The trajectory L =m·g· CL = cos γ , cos ϕ 2·L , ρ · V2 · S D = CD · 1 · ρ · V2 · S 2 C D = C D0 + K · C L2 y x , ẋ = V · cos γ · sin ψ + Vwind ẏ = V · cos γ · cos ψ + Vwind z ḣ = V · sin γ + Vwind V̇ = T−D −D · V − g · sin γ = · V − g · sin γ m m sin ϕ , ṁ glide = 0 ψ̇ = L · m · V · cos γ The trajectory planner constructs a valid postfailure waypoint sequence that can be safely followed to the landing runway. As just discussed, we generate segmented trajectories28 that are intuitive for pilots/ATC but need not be optimized at additional computational cost because the overriding goal is a safe landing. [The cost function for a loss-of-thrust trajectory is not intuitively defined because fuel use is necessarily zero, and it might be unwise to minimize or maximize time aloft because resulting trajectories might be close to flight envelope boundaries. Given current practices, airspace disruption will be minimized if the aircraft in distress indicates its intentions (flight plan) clearly and quickly.] Figure 5 describes our WGA aimed at a practical, real-time solution for the loss of thrust emergency. In this figure, the nominal execution steps are numbered. Three real-time waypoint generation procedures (Figs. 4a–4c) are available, the choice of which is dictated by postfailure flight-path constraints [γmin γmax ], where γmin is the steepest allowed descent angle and γmax is best-glide descent. As shown in Fig. 5, the top-ranked runway is initially selected as the landing site. After initializing initial and final states, a Dubins path34 of guaranteed minimum length (see Fig. 6a) is constructed to verify that the chosen runway is actually reachable. Given loss of thrust and our simplifying choice to maintain unaccelerated flight (V̇ = 0), airspeed V is a dependent variable computed from constant aircraft parameters, altitude h, and the prescribed flight-path angle γ (see preceding equations). Each turning segment radius, a function of atmospheric density ρ thus altitude h, is computed from  rturn (h) = {2m/[S · ρ(h)]} K /C D0 cos(γ )/ tan(ϕ) and is held constant through that segment at the value computed for φ = 30 deg at an altitude h halfway through the constant-γ descending turn. Lateral plane tangent connector segments are then identified, followed by longitudinal plane adjustment of flight-path angle to meet initial and final segment altitude constraints. If a Dubins path solution is found and does not exceed γmax , the runway is reachable, and the WGA proceeds nominally. In the next step Fig. 4a, Fig. 6b illustration) a stabilizing final approach segment of length |dfinal | is inserted, and a Dubins path is generated to this final approach waypoint. Given user-defined nominal values for turn flight-path angles (γ1 , γ3 ), final approach angle γ4 , and |dfinal |, tangent segment γ2 and its endpoints W1 , W2 are computed. If γ2 falls between [γmin γmax ] limits, waypoint sequence W = {W0 , W1 , W2 , W3 , W4 } is returned as the flight plan, where each Wi = {xi , yi , h i , ψi }, W0 = x0 , and W4 = x f . If γ2 is too shallow, |dfinal | is decreased, and nominal γ values are increased until a solution is found. (In the worst case the original Dubins path is returned with |dfinal | = 0 and best-glide flight segments.) If γ2 is too steep (i.e., γ2 < γmin ) and tangent segment |d2 | is sufficiently long, an intermediate turn is inserted (Fig. 6c) to facilitate altitude loss without unacceptably steep descent angle γ . This S-turn solution (Fig. 5, step 4b) introduces two new waypoints such that the returned solution W = {W0 , W1 , W2 , W3 , W4 , W5 , W6 }. Otherwise, if γ2 is too steep (γ2 < γmin ) but tangent segment length |d2 | is not sufficient for the intermediate turn, final approach |dfinal | is extended Downloaded by UNIVERSITY OF MICHIGAN on May 18, 2015 | http://arc.aiaa.org | DOI: 10.2514/1.18816 1210 ATKINS, PORTILLO, AND STRUBE Fig. 5 Waypoint generation algorithm. a) Worst-case trajectory b) Direct trajectory c) S-turn (high-altitude) trajectory Fig. 6 WGA lateral plane trajectory geometries. (Fig. 5, step 4c) until a solution W = {W0 , W1 , W2 , W3 , W4 } with all γ ∈ [γmin γmax ] is identified. Algorithms for the nominal WGA strategies (steps 4a, 4b, 4c) are provided in Fig. 7. Each algorithm typically generates solutions with γ sufficiently far from γmax to provide robustness to limited performance and wind perturbations. Note also that the extended final strategy (4c) can generate a viable solution for most s-turn cases, providing multiple options should terrain or pilot input be considered in future work. The nominal execution sequence successfully generates a solution unless the aircraft is either too low (i.e., the Fig. 5, step 3 Dubins path requires γ > γmax ) or a geometric exception is present. In cases where the aircraft is simply too low to align itself properly, the WGA is re-initialized with the next highest ranked runway, and the process continues until either a solution is found or no more reachable runways are available. Two geometric exceptions exist. When the aircraft is nearly above the runway, a pure Dubins path (step 3, Fig. 6a) might not be properly identified, in which case the WGA invokes the extended final algorithm (4c) to extend the final approach waypoint out to where an intercept path can be found. This exception handler is successful provided sufficient altitude exists for this “double-back” maneuver. The other exception occurs when the aircraft is nearly aligned with final approach at low altitude, as would be the case if thrust was lost on final approach. This special exception handler generates a single segment direct to the runway x f and is successful when this segment has γ ∈ [γmin γmax ]. The WGA achieves low computational overhead through the use of simple geometric constructs for its paths. Particularly for turning segments, incorporation of winds into the trajectory generation process increases computational complexity because values previously computed in a single step (e.g., tangent segments) require iteration to achieve nominal flight-path angles and account for changes in turn radius as the aircraft transitions through the spectrum of upwind, crosswind, and downwind conditions. Given an autopilot or pilot able to track an inertial trajectory despite winds, no-wind WGA flight plans can be followed so long as the aircraft has sufficient control authority. For the loss-of-thrust emergency, the primary concern is that the autopilot might need to exceed flight-path angle limits (especially best glide) given a no-wind flight plan. Before returning a solution, the WGA validates each no-wind flight plan W in a postprocessing step to compute a new sequence of effective flight-path angles that correct for forecast winds. If all corrected γi ∈ [γmin γmax ], the original trajectory is validated. Otherwise, a “wind warning” is returned along with W. This postprocessing procedure currently presumes constant wind magnitude/direction as 1211 ATKINS, PORTILLO, AND STRUBE Table 3 Loss-of-thrust test scenarios Case 1 2 3 4 5 6 7 Downloaded by UNIVERSITY OF MICHIGAN on May 18, 2015 | http://arc.aiaa.org | DOI: 10.2514/1.18816 8 x0 (lat, lon, h, ψ) {40.89◦ , −74.01◦ , 15000′ , 210◦ } {40.89◦ , −74.01◦ , 15000′ , 210◦ } (20 kt West wind) {39.2◦ , −77.0◦ , 30000′ , 0◦ } {36◦ , −112◦ , 25000′ , 90◦ } {36◦ , −112◦ , 26000′ , 90◦ } {36◦ , −112◦ , 48000′ , 90◦ } {35.95◦ , −112.15◦ , 48000′ , 90◦ } {35.95◦ , −112.15◦ , 15000′ , 90◦ } Footprint (xfoot , yfoot , rfoot ) {40.8632◦ , Reachable 104 −74.0255◦ , 41.8 nm} {40.8632◦ , −73.9774◦ , 41.8 nm} {39.2505◦ , −77.0000◦ , 83.9 nm} {36.0◦ , −111.957◦ , 70.3 nm (to sea level)} {36.0000◦ , −111.956◦ , 73.1 nm} {36.0000◦ , −111.906◦ , 134 nm} {35.95◦ , −112.056◦ , 134 nm} {39.95◦ , −112.119◦ , 41.8 nm} Feasible 36 Top runway xf (lat, lon, h) Trajectory JFK 31L {40.6269◦ , Direct −73.7636◦ , 13′ } {40.6269◦ , −73.7636◦ , 13′ } Direct 82 34 JFK 31L 654 70 BWI 10 18 2 GCN 03 22 4 GCN 03 138 12 GCN 03 136 12 GCN 03 8 2 GCN 21 {39.1779◦ , −76.6824◦ , 146′ } {35.9417◦ , −112.1531◦ , 6606′ } {35.9417◦ , −112.1531◦ , 6606′ } {35.9417◦ , −112.1531◦ , 6606′ } {35.9417◦ , −112.1531◦ , 6606′ } {35.9360◦ , −112.1408◦ , 6606′ } S-turn Direct S-turn S-turn Extended final Direct (short final) Fig. 7 Waypoint computation strategies. forecast at the segment midpoint altitude and has consistently validated WGA plans unless wind speeds are extremely high (e.g., gale-force+) or planned flight-path angles are already very close to their limits. V. Case Studies AFP operation is illustrated through a series of loss-of-thrust examples, summarized in Table 3. Cases were selected to provide urban and rural scenarios with low and high initial altitudes. The urban areas near New York City (cases 1 and 2) and Washington, D.C. (case 3) provide an extensive set of potential landing options, whereas the Grand Canyon region (cases 4–8) represents a rural area where terrain is high and runways are sparse. Each scenario is defined for the C-based AFP by its initial state x0 and winds aloft, nonzero for case 8. [For these tests, x0 was user defined. Operationally, x0 is a state (e.g., along a best-glide path) projected to the time at which the postfailure plan will be initiated. This delay must reflect worst-case AFP execution (∼1 s) plus time to accept/execute the plan.] LSS and WGA results are summarized next. A. Landing-Site Selection Consider case 1 with an initial state over Teaneck, New Jersey (a suburb of New York City) at h = 15,000 ft (FL150) and a southwesterly heading. To identify the set of reachable landing sites, an approximate circular footprint is computed (Table 3), and the LSS identifies 104 reachable runways within this footprint. To identify the feasible subset of these runways, the following constraints consistent with a commercial transport were imposed for all case studies presented in this paper: 5000-ft minimum runway length, 100-ft minimum runway width, 20-kn maximum crosswind, and a paved (asphalt/concrete) surface. For case 1, these constraints determined that 36 of the 104 reachable runways could support a safe landing. This feasible subset was then ranked with the Eq. (1) utility function. Table 4 lists the top 10 runways, with the LSS selecting as its top choice JFK 31L, the longest runway that scores nearly perfect in all respects except for its relative proximity to the footprint boundary d/dmax . Table 4 also lists utility values for case 2, identical to case 1 except with a 20-kn wind from the West. case 3, a high-altitude failure over Glenwood, Maryland, near Baltimore and Washington, D.C., provides an even more extensive set of landing-site choices because of the larger footprint area. Of the 654 reachable runways, 70 are deemed feasible, with BWI 10 ultimately selected as the top choice, as shown in the ranked Table 5 list, which excludes utility terms q I , wh , wc , and q S that were perfect (1.0) for all top 10 runways. Quantitatively, the LSS has made reasonable selections with JFK 31L and BWI 10. LSS decisions are made rapidly (<1-s execution time on a 2-GHz P-IV) and are immediately followed by the realtime generation of a landing trajectory (1–2-s execution time on a 1212 ATKINS, PORTILLO, AND STRUBE Table 4 Top 10 feasible landing sites for loss of thrust at FL150 over Teaneck, NJ (case 1/case 2a ) Rank Airport 1 (1) 2 (10) 3 4 (5) 5 6 (4) 7 8 (2) 9 10 (3) JFK TEB JFK JFK LGA LGA LGA LGA JFK JFK a Runway Total utility Length rl Width rw qI (d/dmax ) (wh /wh,max ) wc [Eq. (1)] qS qf 31L 06 04L 22R 04 22 13 31 13L 31R 0.928 (0.865) 0.912 (0.768) 0.895 0.895 (.8137) 0.891 0.891 (.8139) 0.891 0.883 (0.825) 0.881 0.881 (0.818) 14,572 6,013 11,351 11,351 7,000 7,000 7,000 7,000 10,000 10,000 150 150 150 150 150 150 150 150 150 150 1 1 1 1 1 1 1 0.95 1 1 0.55 (0.65) 1 (1) 0.55 0.55 (0.65) 0.79 0.79 (0.92) 0.79 0.79 (0.92) 0.55 0.55 (0.65) 1 (0.88) 1 (0.07) 1 1 (0.82) 1 1 (0.82) 1 1 (0.88) 1 1 (0.88) 1 (0.35) 1 (0.49) 1 1 (0.22) 1 1 (0.22) 1 1 (0.35) 1 1 (0.35) 1 1 1 1 1 1 1 1 1 1 0.95 1 0.95 0.95 1 1 1 1 0.95 0.95 With the 20-kt West wind, the case 2 top 10 also included (6) TEB 24, (7) JFK 22L, (8) EWR 22L, and (9) EWR 22R. Downloaded by UNIVERSITY OF MICHIGAN on May 18, 2015 | http://arc.aiaa.org | DOI: 10.2514/1.18816 Table 5 Top 10 feasible landing sites for loss of thrust at FL300 over Glenwood, MD (case 3) Rank Airport 1 2 3 4 5 6 7 8 9 10 BWI BWI BWI BWI IAD IAD IAD IAD IAD MTN Runway Utility U Length rl Width rw (d/dmax ) qf 10 28 15R 33L 01L 19R 01R 19L 12 33 0.9835 0.9835 0.9335 0.9335 0.9243 0.9243 0.9243 0.9243 0.9116 0.8886 10,502 10,502 9,519 9,519 11,501 11,501 11,500 11,500 10,501 6,996 200 200 150 150 150 150 150 150 150 180 1 1 1 1 0.804 0.804 0.804 0.804 0.804 0.765 1 1 1 1 0.95 0.95 0.95 0.95 0.95 1 a) Top view b) Three-dimensional view Fig. 8 Glide trajectory to JFK 31L from FL150 over Teaneck, New Jersey (cases 1 and 2). 2-GHz P-IV). However, near urban areas there are a host of landing alternatives, and Tables 4 and 5 are sure to stir debate, particularly among pilots, because other runways might actually be preferred as a result of unmodeled factors or because of weighting choices. BWI 10 and BWI 28 have equivalent utility (given no wind), and the LSS arbitrarily placed BWI 10 first. BWI 10 is not quite as long as Dulles (IAD) runways, but it is closer and wider and thus would likely be acceptable to pilots. Conversely, the LSS has chosen JFK 31L over much closer runways, electing an engine-out transit over Manhattan rather than landing at second ranked Teterboro (TEB) or Newark (EWK), feasible but not ranked in the top 10 because of rl and d. The BWI and JFK results illustrate both the use and the practical limitation of our utility-based ranking system. Although a valid flight plan to JFK 31L can certainly be developed, a pilot (or “intelligent” flight-management agent) would likely introduce factors such as population density into the final decision, using ranked runway lists (Tables 4 and 5) to rapidly identify viable landing options. B. WGA Once a landing runway is identified, the WGA builds a waypointbased trajectory to that runway as just described. The following per- formance parameters were presumed for our tests, with all angles in radians: γmax = 0.05644, γmax,turn = −0.06514, γnom =−0.10472, γfinal = −0.07854 (nominal γ for final approach), γmin = −0.17453, m = 300,000 kg, S = 512 m2 , ρ(0) = 1.225 kg/m3 , K = 0.045, and C D0 = 0.022. The Table 3 examples represent a broad range of WGA situations that might be encountered. Figure 8 shows the simplest case, where a direct trajectory (WGA algorithm 4a) is generated from Teaneck, NJ, at an initial heading of 210◦ to JFK 31L. For this trajectory, an initial turn with (γ1 = −0.10472, rturn,1 = 2.02 nm) is followed by a tangent segment at heading ψ2 =125◦ and γ2 = −0.0705, a turn (γ3 = −0.07854, rturn,1 = 1.42 nm), and then the 3-nm final approach at runway heading ψ4 = 310◦ and γ4 = γfinal = −0.07854. Although all γ are well within the flight envelope, the relatively shallow γ2 reflects the long transit to JFK. Figure 9 shows the s-turn trajectory from Glenwood, MD, to BWI 10 given an initial North heading, illustrating how the WGA splits the tangent segment to adjust path length so that a desired flightpath angle can be maintained. In this case, the sequence of flightpath angles is {−0.1047 −0.0874 −0.1047 −0.1056 −0.1047, −0.0785}, where all angles take nominal values except split segment values γ2 and γ4 , which are iterated within flight-path angle ATKINS, PORTILLO, AND STRUBE Downloaded by UNIVERSITY OF MICHIGAN on May 18, 2015 | http://arc.aiaa.org | DOI: 10.2514/1.18816 a) Top view 1213 b) Three-dimensional view Fig. 9 Glide trajectory to BWI 10 from FL300 over Glenwood, MD (MD46) (case 3). a) Top view b) Three-dimensional view Fig. 10 Glide trajectory to GCN 03 from FL250 over the Grand Canyon confluence (36◦ , −112◦ ) (case 4). constraints to provide the proper altitude drop. Figure 9 also illustrates the significant discrepancies in turn radii at high and low altitudes: (rturn,1 = 3.15 nm, rturn,3 = 1.95 nm, rturn,5 = 1.37 nm). Inclusion of steady winds has the potential to impact both LSS and WGA results. Winds “blow” the footprint center (Table 3), which in turn can impact reachable and feasible runway lists. In the Teaneck, NJ, case, the footprint migrates East (closer to the coast), eliminating western airports previously considered reachable. Utility values are also affected (Table 4), directly due to headwinds and crosswinds and indirectly due to footprint boundary relocation (d/dmax ). After no-wind waypoint generation, we postprocess the trajectory to assess its applicability given forecast winds. The straight segments of the original Fig. 8 solution from Teaneck to JFK 31L experience the largest effective change in γ , with the partial tailwind increasing γ2 from −0.0705 to −0.0773 and the partial headwind on final approach requiring a decrease in γ4 from −0.0785 to −0.0722. This solution still falls well within the original γ constraints and thus is returned by the WGA. Figures 10–14 illustrate a series of trajectories planned for loss of thrust sites in the Grand Canyon region. All occur with an initial East flight heading. Figures 10–12 represent cases in which initial state is at the Grand Canyon confluence (36◦ , −112◦ ) with altitudes (FL250, FL260, FL480), respectively. Figures 13 and 14 show cases in which the aircraft is nearly over GCN airport, exercising the exception handling algorithms provided within the WGA (Fig. 5). In all cases, the single Grand Canyon (GCN) runway is selected because of its proximity, length, and (most importantly) the fact that the GCN runway pair (3/21) is the only feasible choice at relatively low altitudes given the surface and runway size constraints. Note that at the (36◦ , −112◦ ) confluence, a runway landing is impossible at and below FL120 (h = 12,000 ft mean sea level), so that in such cases the AFP returns no solution (failure). Figures 10 and 11 illustrate the boundary between direct and s-turn solutions. At FL250, an acceptable but steep (γ2 = −0.1659) tangent segment is utilized to connect the aircraft with the runway on a direct trajectory. At FL260, this direct trajectory becomes unacceptably steep (γ > γmin ), and so the WGA switches to an s-turn solution and adjusts segment lengths to enable flight-path angles near their nominal values. The final highaltitude case (FL480) also utilizes an s-turn solution, but the path visually appears much smoother because of the extended length of each intermediate segment. Figures 13 and 14 illustrate solutions generated for two such cases near GCN with high and low initial altitudes, respectively. For the FL480 case, the tangent segment has insufficient length to generate an s-turn solution; thus, the WGA iteratively extends final approach (algorithm 4c) until a trajectory can be constructed with sufficiently shallow tangent segment flight-path angle. As shown, for FL480, an 18-mile final approach segment is developed, and the flight-path angle sequence is {−0.1047 −0.1743 −0.0785 −0.0785}, with γ2 just meeting the γmin constraint thereby terminating the iterative increase of |dfinal |. Figure 14, with initial state at FL150, illustrates a case in a minimum-length Dubins path exists, but the default 3-nm final approach |dfinal | cannot be followed without a γ2 that exceeds best glide γmax . In this case, default flight-path 1214 ATKINS, PORTILLO, AND STRUBE Downloaded by UNIVERSITY OF MICHIGAN on May 18, 2015 | http://arc.aiaa.org | DOI: 10.2514/1.18816 a) Top view b) Three-dimensional view Fig. 11 Glide trajectory to GCN 03 from FL260 over the Grand Canyon confluence (36◦ , −112◦ ) (case 5). a) Top view b) Three-dimensional view Fig. 12 Glide trajectory to GCN 03 from FL480 over the Grand Canyon confluence (36◦ , −112◦ ) (case 6). a) Top view b) Three-dimensional view Fig. 13 Glide trajectory to GCN 03 from (35.95, −112.15) near GCN at FL480 (case 7). angles iteratively increase up to γmax while |dfinal | is decreased. For the GCN case (Fig. 14), the WGA converges on a solution with flight-path angle sequence {−0.070 −0.059 −0.070 −0.061}, and |dfinal | = 1.1 nm, approaching but not exceeding worst-case constraints γmax = −0.0564 and |dfinal | = 0. As a final assessment of the AFP’s ability to function effectively despite its exclusive use of airport runways as emergency landing sites, we constructed a coverage map (Fig. 15) indicating the altitude (in 5000-ft increments) at and above which a runway of sufficient length (>5000 ft) can be reached by an aircraft operating at best glide. Because low-altitude loss of power requires a nearby landing site, at an initial altitude of 5000-ft above ground level (AGL) runways can generally be reached only near urban areas. Except for sparsely populated areas primarily over the Rockies, a feasible runway can be identified when power loss occurs at or above 15,000 ft AGL. Because typical commercial operations are conducted above ATKINS, PORTILLO, AND STRUBE Downloaded by UNIVERSITY OF MICHIGAN on May 18, 2015 | http://arc.aiaa.org | DOI: 10.2514/1.18816 a) Top view 1215 b) Three-dimensional view Fig. 14 Glide trajectory to GCN 21 from (35.95, −112.15) near GCN at FL150 (case 8). Fig. 15 U.S. landing-site availability. 15,000 ft AGL (∼FL300 over the highest U.S. terrain), it can be concluded that runway landings are in fact practical for high-altitude en route failures and lower-altitude failures near populous regions. Low-altitude loss-of-thrust failures during initial departure and final approach, in particular, will require future extension to off-field landing sites. VI. Conclusions Commercial transport aircraft have a single mission: to fly passengers or cargo between airports. Flight operations must be safe, efficient, and must comply with air-space restrictions and air-trafficcontrol directives. When a major aircraft system fails, safety becomes the overriding priority. The goal is to safely land the aircraft, generally not at the destination airport unless it is nearby. The adaptive flight planner (AFP) presented in this work performs the two main flight-planning tasks required to get a disabled aircraft safely on the ground: select a landing site, and construct a postfailure trajectory that can safely reach that landing site. To maximize plan simplicity and minimize computational complexity, flight plans are designed to fit within the current waypoint/trim-segment representation commonly used for both piloted and unmanned aircraft flight plans. Results illustrate AFP operation for a variety of scenarios, including an assessment of runway availability across the continental United States. Several future research directions must be pursued before the AFP can be implemented in practice. Certainly, inclusion of a terrain database is required to enable off-runway landing-site selection and, perhaps more fundamentally, to enable verification that postfailure trajectories do not impact terrain and buildings. The WGA can be extended without prohibitive complexity to account for forecast winds during waypoint computation and to plan for decelerating flight at least for the final approach segment. The loss of thrust emergency studied in this paper is relatively straightforward; more research is required to enable an aircraft to accurately and automatically generate postfailure performance models for the spectrum of actuator failures and structural damage cases. Although the landing-site search process beyond footprint generation is generally independent of the specific failure, the trajectory generation process is integrally tied to flight envelope constraints. Work is ongoing to systematically expand the set of failures handled by the AFP, beginning with an examination of control surface failures. As mentioned earlier, we have implemented a trim database approach to generate feasible landing trajectories in real time for control surface jam failures and are also working toward a similar strategy to handle airframe damage scenarios. We are collaborating with the NASA Ames Damage Adaptive Control14,15 group with the ultimate goal of achieving an end-to-end adaptive flight-management system applicable for both military and commercial aircraft. A fully autonomous UAV will enjoy increased robustness from an AFP, because the alternative is continued flight with an inaccurate performance model. However, the impact of an AFP system in the cockpit will require further pilot studies, given the potential to increase pilot workload and decrease overall situational awareness with additional advisory displays. Although the best user interface is unclear at this stage, we envision the AFP within a variable autonomy framework because pilots will likely prefer interaction with a flight planner to strict execution of its solution. As presented, the AFP most obviously operates in an autonomous mode, requiring only that a pilot inspect and execute its flight plan. Given sufficient planning time, a collaborative mode would allow the pilot to direct the AFP to an alternate landing site, using the sorted runway list as a guide. With even more time, the pilot could also compare AFP-generated trajectories to different reachable runways, or alter computed waypoint trajectories manually with AFP verification that performance constraints are still met. Affordable glass cockpit systems such as the Garmin G1000 are beginning to provide general-aviation (GA) pilots with user interfaces, data access, and computational resources comparable to those found in commercial FMS. With access to the sensor data required to generate GPS maps and heads-up displays, the AFP can be implemented as an advisory tool in such GA systems. Loss of thrust as a result of engine failure or fuel starvation is a leading cause of single-engine GA accidents, as already shown (Table 1). Pilots find forced landings challenging, often selecting undesirable landing sites or following a path that overshoots or undershoots the runway. Given a system such as the G1000 that can already mark the nearest airport as a fly-to waypoint, the AFP can quickly orient the pilot toward a feasible landing site and display intermediate waypoints on the same moving map. The advent of tunnel-in-the-sky displays can 1216 ATKINS, PORTILLO, AND STRUBE also help the pilot precisely follow a preplanned trajectory without a full autopilot system. Acknowledgments The authors would like to thank Rob Sanner, Kalmanje Krishnakumar, and graduate students at the University of Maryland Space Systems Lab for their invaluable feedback. This work was partially supported under NASA Ames Grant NCC21427. References Downloaded by UNIVERSITY OF MICHIGAN on May 18, 2015 | http://arc.aiaa.org | DOI: 10.2514/1.18816 1 Roy, K., and Wright, D. (eds.), “2002 Nall Report: Accident Trends and Factors for 2001,” AOPA Air Safety Foundation, Frederick, MD, 2003, URL: http://www.aopa.org/asf/publications/02nall.pdf. 2 Hummel, K., Murphy, K., and Wright, D. (eds.), “2003 Nall Report: Accident Trends and Factors for 2002,” AOPA Air Safety Foundation, Frederick, MD, 2004, URL: http://www.aopa.org/asf/publications/03nall.pdf. 3 “Statistical Summary of Commercial Jet Airplane Accidents: Worldwide Operations 1959–2003,” Airplane Safety, Boeing Commercial Airplanes, Seattle, WA, May 2004. 4 Collins, R. L., “What to Do When the Engine Quits,” Flying, Vol. 132, No. 5, 2005, pp. 54–57. 5 Liden, S., “The Evolution of Flight Management Systems,” Proceedings of the IEEE Digital Avionics Systems Conference, IEEE, ISBN #0780324250, Nov. 1994, pp. 157–169. 6 Fishbein, S. B., Flight Management Systems: The Evolution of Avionics and Navigation Technology, The Smithsonian Inst., Praeger, Connecticut, 1995. 7 Chen, T. L., and Pritchett, A. R., “Development and Evaluation of a Cockpit Decision Aid for Emergency Trajectory Generation,” Journal of Aircraft, Vol. 38, No. 5, 2001, pp. 935–943. 8 Boskovic, J. D., Prasanth, R., and Mehra, R. K., “A Multi-Layer Autonomous Intelligent Control Architecture for Unmanned Aerial Vehicles,” JACIC, Vol. 1, No. 12, 2004, pp. 605–628. 9 Schouwenaars, T., Mettler, B., Feron, E., and How, J., “Robust Motion Planning Using a Maneuver Automaton with Built-in Uncertainties,” Proceedings of the IEEE American Control Conference (ACC), IEEE, Vol. 3, Piscataway, NJ, June 2003, pp. 2211–2216. 10 Stewart, J., and Shuck, T., “Flight-Testing of the Self-Repairing Flight Control System Using the F-15 Highly Integrated Digital Electronic Control Flight Research Facility,” NASA Tech. Memorandum 101725, Aug. 1990. 11 Wagner, E. A., “Onboard Automatic Aid and Advisory for Pilots of Control-Impaired Aircraft,” Journal of Guidance, Control, and Dynamics, Vol. 14, No. 4, 1991, pp. 823–833. 12 Rysdyk, R., and Calise, A., “Nonlinear Adaptive Flight Control Using Neural Networks,” IEEE Control Systems Magazine, Vol. 18, No. 6, 1998, pp. 14–25. 13 Bragg, M. G., Basar, T., Perkins, W. R., Selig, M. S., Voulgaris, P. G., Melody, J. W., and Sarter, N. B., “Smart Icing Systems for Aircraft Icing Safety,” AIAA Paper 2002-0813, Jan. 2002. 14 KrishnaKumar, K., Limes, G., Gundy-Burlet, K., and Bryant, D., “An Adaptive Critic Approach to Reference Model Adaptation,” AIAA Paper 2003-5790, Aug. 2003. 15 Kaneshige, J., and Gundy-Burlet, K., “Integrated Neural Flight and Propulsion Control System,” AIAA Paper 2001-4386, Aug. 2001. 16 Gundy-Burlet, K., “Augmentation of an Intelligent Flight Control System for a Simulated C-17 Aircraft,” Journal of Aerospace Computing, Information, and Communication, Vol. 1, No. 12, 2004, pp. 526–542. 17 Boskovic, J. D., and Mehra, R. K., “An Integrated Fault Management System for Unmanned Aerial Vehicles,” AIAA Paper 2003-6642, Sept. 2003. 18 Mettler, B., Valenti, M., Schouwenaars, T., Kuwata, Y., and How, J., “Autonomous UAV Guidance Build-Up: Flight-Test Demonstration and Evaluation Plan,” AIAA Paper 2003-5744, Aug. 2003. 19 Valenti, M., Mettler, B., Schouwenaars, T., Feron, E., and Paduano, J., “Trajectory Reconfiguration for an Unmanned Aircraft,” AIAA Paper 2002-4674, Aug. 2002. 20 Strube, M., Sanner, R., and Atkins, E., “Dynamic Flight Guidance Recalibration after Actuator Failure,” AIAA Paper 2004-6255, Sept. 2004. 21 Betts, J. T., “Survey of Numerical Methods for Trajectory Optimization,” Journal of Guidance, Control, and Dynamics, Vol. 21, No. 2, 1998, pp. 193–207. 22 Seywald, H., Cliff, E. M., and Well, K. H., “Range Optimal Trajectories for an Aircraft Flying in the Vertical Plane,” Journal of Guidance, Control, and Dynamics, Vol. 17, No. 2, 1994, pp. 389–398. 23 Seywald, H., “Long Flight-Time Range-Optimal Aircraft Trajectories,” Journal of Guidance, Control, and Dynamics, Vol. 19, No. 1, 1994, pp. 242–244. 24 Schultz, R. L., “Three-Dimensional Trajectory Optimization for Aircraft,” Journal of Guidance, Control, and Dynamics, Vol. 13, No. 6, 1990, pp. 936–943. 25 Slattery, R., and Zhao, J., “Trajectory Synthesis for Air Traffic Automation,” Journal of Guidance, Control, and Dynamics, Vol. 20, No. 2, 1997, pp. 232–238. 26 Jackson, M., Zhao, Y., and Slattery, R., “Sensitivity of Trajectory Prediction in Air Traffic Management,” Journal of Guidance, Control, and Dynamics, Vol. 22, No. 2, 1999, pp. 219–228. 27 Tomlin, C., Mitchell, I., and Ghosh, R., “Safety Verification of Conflict Resolution Maneuvers,” IEEE Transactions on Intelligent Transportation Systems, Vol. 2, No. 2, June 2001, pp. 110–120. 28 Vormer, F., Mulder, M., van Paassen, M., and Mulder, J., “Design and Preliminary Evaluation of a Segment-Based Routing Methodology,” AIAA Paper 2002-4861, Aug. 2002. 29 Wu, S., and Guo, S., “Optimum Flight Trajectory Guidance Based on Total Energy Control of Aircraft,” Journal of Guidance, Control, and Dynamics, Vol. 17, No. 2, 1994, pp. 291–296. 30 Sheikh, S., and Schultz, R. L., “Optimal Guidance for Hypersonic Aircraft,” Honeywell, Inc., Report No. F0250-5, Minneapolis, MN, 1990. 31 Vinh, N. X., Optimal Trajectories in Atmospheric Flight, Elsevier, New York, 1981. 32 Burchett, B., “Fuzzy Logic Trajectory Design and Guidance for Terminal Area Energy Management,” AIAA Paper 2004-0700, Jan. 2004. 33 Hale, F. J., Introduction to Aircraft Performance, Selection and Design, Wiley, New York, 1984. 34 Dubins, L., “On Curves of Minimal Length with a Constraint on Average Curvature and with Prescribed Initial and Terminal Positions and Tangents,” American Journal of Mathematics, Vol. 79, No. 3, 1957, pp. 497–516.