Aviation safety analysis

April 1984Includes bibliographical referencesIntroduction: Just as the aviation system is complex and interrelated, so is aviation safety. Aviation safety involves design of aircraft and airports, training of ground personnel and flight crew members' maintenance of aircraft, airfields, en route and terminal area navigation and communication facilities definition and implementation of Federal Aviation Regulations (FARs)l air traffic control procedures and much more. Ultimately, every part of aviation has a safety aspect. No other transportation mode has its safety record so rigorously scrutinized. In part this is due to the general societal (and media) fascination with infrequent large disasters in part because U.S. legislators have a personal interest in air safety, as they rely upon aircraft for their seasonal commutes to Washington, and in part because people in the industry are aware that their paychecks ultimately depend on their customers' perception that travel by air is as safe as possible. (Various airlines still conduct aircraft familiarity classes for travelers who have a fear of flying, although as the younger generation of Americans gains experience with airlines, this particular phobia should become less prevalent.) Aside from the industry's self-enforcement attempts, the Federal government tries to assure safety of the traveling public through regulation. The National Transportation Safety Board (NISB) investigates all major air carrier accidents and subsequently makes safety recommendations to the Federal Aviation Administration (FAA) - which the FAA may or may not choose to accept. One of the long lasting standoffs in aviation safety is between the NPSB (backed by Congressional committees), whose sole concern is safety,and the FAA, which must also take the economics of safety regulations into account-unless it wishes to run into a buzzsaw of industry reaction every time it changes (or issues) a FAR. On the international side, the International Civil Aviation Organization (ICAO) issues technical rules affecting aviation safety, although such decisions as its upcoming ruling on twinjet aircraft over-water flights may be tinged with economic considerations as well. But for safety regulations, whether external or internal to the aerospace industry, to make any sense, they must be grounded, to some degree, in reality, i.e. they must be backed up by some technical, statistical, or economic factors which people can address on their own merits. The more quantitative the supporting data are for rule justifications or changes, the greater the likelihood is that the regulations will be successfully promulgated and accepted by industry. Thus aviation safety analysis came into existence. Most broadly stated, the purpose of safety analysis is to improve safety. The spectrum of analysis ranges from the investigative to the predictive. At one end of the spectrum is the after-the-fact investigation of accidents and a search for causes at the other end is the attempt to seek out likely causes (or, more typically, combination of causes) of system failure before the system is put into operation. However, the great quandary of aviation system analysis is the lack of sufficient data to make probabilistic statements - even while the goal of this analysis is the elimination of the very accidents that provide the data. Practitioners of classical statistics, who have grown up considering probability as the likely outcome of an event based on a large number of repeated trials, face a mental hurdle when asked to accept the concept that an event which has never taken place can nevertheless be assigned a 0.95 probability of success. This is essentially the dichotomy between the investigative and the predictive ends of safety analysis - one is based on few accidents (but real accidents nonetheless), the other is based on more subjective probabilities of system (and subsystem) failures.(cont.) But safety analysts cannot throw up their hands and say that there is insufficient data after only one accident occurs and simply wait for the next one to happen. They must combine forces with their predictive brethren and attempt to head off the next accident. Only when this becomes the rule will aviation safety analysis rest on a sound base. Until this millennium, however, much remains to be done to improve safety analysis at each end of the analysis continuum, and also where the two occasionally intersect by chance. The investigative techniques depend on data: of incidents, accidents, near misses, and the like. The FAA, NASA, NSB, ICAO, aircraft manufacturers, airlines, etc., all maintain various types of data bases, most of which are incompatible (in the sense that they keep track of slightly different variables). A further complication is that some bases are computerized (different data base management systems are usually involved) and some are manual. The safety analyst, attempting to establish broad trends, is immediately faced with this incompatibility problem. Still, if the focus of the investigation is narrow enough (for example, a failure of a mechanical part on a specific aircraft), it may be possible to extract enough information from the various data bases to find a definitive cause. This is especially true when the cause of the incident is, in fact, mechanical - it is here that repeated failures should be noticed, isolated, and corrective action taken. Flight International (1984) provides a typical example that an alert safety analyst (or system) should have anticipated and caught: "Mis-rigging of the baggage door operating mechanism and the failure of the door warning arrangements to give adequate warning of door safety led to the fatal crash of a Dan-Air BAe 748-2A in June 1981, according to the official report. The baggage door at the rear end of the cabin, blew out and became fixed on the tailplane, thus making the aircraft uncontrollable. Subsequently, the wings were overstressed and suffered structural failure. The condition of the door operating mechanism, says the report, made it impossible to lock the door fully using the outside handle. But it was probably by the outside handle that the door had last been closed. Crew checks failed to discover the fault because of "a combination of shortcomings in the design, construction, and maintenance of the door warning systems and the appearance of the visual indications". The report notes that there have been 35 instances of the 748 baggage door malfunction reported in the past". Very rarely do accidents have such obvious design-induced crew error precursors. Most accidents result from interactive causes, rather than one specific factor, and one of the causes is, invariably, a human being - the pilot, the air traffic controller, or the maintenance worker. These acts of human beings do not fit readily into data banks, there to be identified by a specific parts number, and the safety analyst must now switch to the other end of the spectrum and try to isolate the sequence of events that lead to "pilot error". These accidents involving human performance usually turn out to be oneof- a-kind events - and it should be the aim of the safety analyst to ensure that they remain so. Data unavailability and incompleteness, however, are always present and it is up to the skill (and luck) of the analyst to uncover the sequence of events leading to the accident. If a procedural error is found, it can be immediately correctedy more difficult are those amorphous incidents where it is not at all clear why there was human error. (If it were possible to obtain quantitative estimates of human performance, such as human error rates per task, it would be a simple matter to incorporate them into operational reliability equations to determine system reliability.) Just as the role of analysis of incident and defect reporting systems should be to find mechanical failures before they become accidents, the human incident reporting systems should be designed to cause humans to "confess" their incidents so that the analyst can isolate potentially dangerous trends and practices before they too become accidents. (The Aviation Safety Reporting System (ASRS) managed by NASA is a step in the right direction.) It is the purpose of this report is to discuss various aspects of aviation safety analysis, ranging from general aviation to the public transportation system, and then to make some recommendations for improving the methodology of safety analysis.*Supported by Dept. of Transportation, Transportation Systems Cente

Analysis of the altitude tracking performance of aircraft-autopilot systems in the presence of atmospheric disturbances

Cover titleJanuary 1988Also issued as an M.S. thesis, Massachusetts Institute of Technology, Dept. of Aeronautics and Astronautics, 1988Includes bibliographical references (p. 99)The dynamic response of aircraft-autopilot systems to atmospheric disturbances was investigated by analyzing linearized models of aircraft dynamics and altitude hold autopilots. Four jet aircraft (Boeing 737-100, McDonald Douglas DC9-30, Lockheed L-10ll, and Cessna Citation III) were studied at three flight levels (FL290, FL330, and FL370). The models were analyzed to determine the extent to which pressure surface fluctuations, vertical gusts, and horizontal gusts cause assigned altitude deviations by coupling with the aircraft-autopilot dynamics. The results of this analysis were examined in light of meteorological data on disturbance magnitudes and wavelengths collected from observations of mountain wave activity. This examination revealed that atmospheric conditions do exist which can cause aircraft to exhibit assigned altitude deviations in excess of 1,000 ft. Pressure surface fluctuations were observed to be the dominant source of altitude errors in flights through extreme mountain wave activity. Based on the linear analysis the maximum tolerable pressure surface fluctuation amplitude was determined as a function of wavelength for an allowable altitude error margin of 300 ft. The results of this analysis provide guidance for the determination of vertical separation standards in the presence of atmospheric disturbances

An experimental and theoretical study of the ice accretion process during artificial and natural icing conditions

May 1986Also issued as an M.S. thesis, Massachusetts Institute of Technology. Dept. of Aeronautics and Astronautics, 1986Includes bibliographical references (p. 128-129)Real-time measurements of ice growth during artificial and natural icing conditions were conducted using an ultrasonic pulse-echo technique. This technique allows ice thickness to be measured with an accuracy of ł0.5 mm; in addition, the ultrasonic signal characteristics may be used to detect the presence of liquid on the ice surface and hence discern wet and dry ice growth behaviour. Ice growth was measured on the stagnation line of a cylinder exposed to artificial icing conditions in the NASA Lewis Icing Research Tunnel, and similarly for a cylinder exposed in flight to natural icing conditions. Ice thickness was observed to increase approximately linearly with exposure time during the initial icing period. The ice accretion rate was found to vary with cloud temperature during wet ice growth, and liquid runback from the stagnation region was inferred. A steady-state energy balance model for the icing surface was used to compare heat transfer characteristics for icing wind tunnel and natural icing conditions. Ultrasonic measurements of wet and dry ice growth observed in the Icing Research Tunnel and in flight were compared with icing regimes predicted by a series of heat transfer coefficients. The heat transfer magnitude was generally inferred to be higher for the icing wind tunnel tests than for the natural icing conditions encountered in flight. An apparent variation in the heat transfer magnitude was also observed for flights conducted through different natural icing cloud formationsSupported by the National Aeronautics and Space Administration Supported by the Federal Aviation Administratio

In-flight measurement of ice growth on an airfoil using an array of ultrasonic transducers

Results of preliminary tests to measure ice growth on an airfoil during flight icing conditions are presented. Ultrasonic pulse echo measurements of ice thickness are obtained from an array of eight ultrasonic transducers mounted flush with the leading edge of the airfoil. These thickness measurements are used to document the evolution of the ice shape during the encounter in the form of successive ice profiles. Results from 3 research flights are presented and discussed. The accuracy of the ultrasonic measurements is found to be within 0.5 mm of mechanical and stereo photograph measurements of the ice accretion

The interaction of radio frequency electromagnetic fields with atmospheric water droplets and application to aircraft ice prevention

June 1982Also issued as an Ph.D. thesis, Massachusetts Institute of Technology, Dept. of Physics, 1982Includes bibliographical references (p. 188-191)In this work the physics of advanced microwave anti-icing systems, which pre-heat impinging supercooled water droplets prior to impact, is studied by means of a computer simulation and is found to be feasible. In order to create a physically realistic simulation, theoretical and experimental work was necessary and the results are presented in this thesis. The behavior of the absorption cross-section for melting ice particles is measured by a resonant cavity technique and is found to agree with theoretical predictions. Values of the dielectric parameters of supercooled water are measured by a similar technique at X = 2.82 cm down to -17 0 C. The hydrodynamic behavior of accelerated water droplets is studied photographically in a wind tunnel. Droplets are found to initially deform as oblate spheroids and to eventually become unstable and break up in Bessel function modes for large values of acceleration or droplet size. This confirms the theory as to the maximum stable droplet size in the atmosphere. A computer code which predicts droplet trajectories in an arbitrary flow field is written and confirmed experimentally. Finally, the above results are consolidated into a simulation to study the heating by electromagnetic fields of droplets impinging onto an object such as an airfoil. Results indicate that there is sufficient time to heat droplets prior to impact for typical parameter values and design curves for such a system are presented in the study

Heat Transfer Variation on Protuberances and Surface Roughness Elements

In order to determine the effect of surface irregularities on local convective heat transfer, the variation in heat transfer coefficients on small (2-6 mm diam) hemispherical roughness elements on a flat plate has been studied in a wind funnel using IR techniques. Heat transfer enhancement was observed to vary over the roughness elements with the maximum heat transfer on the upstream face. This heat transfer enhancement increased strongly with roughness size and velocity when there was a laminar boundary layer on the plate. For a turbulent boundary layer, the heat transfer enhancement was relatively constant with velocity, but did increase with element size. When multiple roughness elements were studied, no influence of adjacent roughness elements on heat transfer was observed if the roughness separation was greater than approximately one roughness element radius. As roughness separation was reduced, less variation in heat transfer was observed on the downstream elements. Implications of the observed roughness enhanced heat transfer on ice accretion modeling are discussed

Flight tests of a digital data acquisition system for analysis of ultrasonic pulse-echo signals used to measure ice accretion

May 1986Also issued as an M.S. thesis, Massachusetts Institute of Technology. Dept. of Aeronautics and Astronautics, 1986Includes bibliographical references (p. 76)A number of signal processing algorithms were developed for analyzing ultrasonic signals used to measure aircraft ice accretion in flight. A high speed digital signal acquisition system was designed and constructed to acquire the signals. The ultrasonic signals were acquired during a series of flight tests in actual icing conditions. This digital data was used to evaluate various algorithms for determining the ice thickness. An analog data acquisition system provided data for comparison with the digital data. A gated peak detector, employing low signal to noise ratio filtering and derivative preprocessing, was developed. This algorithm correctly determined the ice thickness for all tested flight data. Icing rate algorithms were also developed. The measured icing rate correlated reasonable well with the liquid water content of the cloud.Supported by the National Aeronautics and Space Administration Supported by the Federal Aviation Administratio

Existing and Required Modeling Capabilities for Evaluating ATM Systems and Concepts

ATM systems throughout the world are entering a period of major transition and change. The combination of important technological developments and of the globalization of the air transportation industry has necessitated a reexamination of some of the fundamental premises of existing Air Traffic Management (ATM) concepts. New ATM concepts have to be examined, concepts that may place more emphasis on: strategic traffic management; planning and control; partial decentralization of decision-making; and added reliance on the aircraft to carry out strategic ATM plans, with ground controllers confined primarily to a monitoring and supervisory role. 'Free Flight' is a case in point. In order to study, evaluate and validate such new concepts, the ATM community will have to rely heavily on models and computer-based tools/utilities, covering a wide range of issues and metrics related to safety, capacity and efficiency. The state of the art in such modeling support is adequate in some respects, but clearly deficient in others. It is the objective of this study to assist in: (1) assessing the strengths and weaknesses of existing fast-time models and tools for the study of ATM systems and concepts and (2) identifying and prioritizing the requirements for the development of additional modeling capabilities in the near future. A three-stage process has been followed to this purpose: 1. Through the analysis of two case studies involving future ATM system scenarios, as well as through expert assessment, modeling capabilities and supporting tools needed for testing and validating future ATM systems and concepts were identified and described. 2. Existing fast-time ATM models and support tools were reviewed and assessed with regard to the degree to which they offer the capabilities identified under Step 1. 3 . The findings of 1 and 2 were combined to draw conclusions about (1) the best capabilities currently existing, (2) the types of concept testing and validation that can be carried out reliably with such existing capabilities and (3) the currently unavailable modeling capabilities that should receive high priority for near-term research and development. It should be emphasized that the study is concerned only with the class of 'fast time' analytical and simulation models. 'Real time' models, that typically involve humans-in-the-loop, comprise another extensive class which is not addressed in this report. However, the relationship between some of the fast-time models reviewed and a few well-known real-time models is identified in several parts of this report and the potential benefits from the combined use of these two classes of models-a very important subject-are discussed in chapters 4 and 7

Situational Awareness Issues in the Implementation of Datalink: Shared Situational Awareness in the Joint Flight Deck-ATC Aviation System

MIT has investigated Situational Awareness issues relating to the implementation of Datalink in the Air Traffic Control environment for a number of years under this grant activity. This work has investigated: 1) The Effect of "Party Line" Information. 2) The Effect of Datalink-Enabled Automated Flight Management Systems (FMS) on Flight Crew Situational Awareness. 3) The Effect of Cockpit Display of Traffic Information (CDTI) on Situational Awareness During Close Parallel Approaches. 4) Analysis of Flight Path Management Functions in Current and Future ATM Environments. 5) Human Performance Models in Advanced ATC Automation: Flight Crew and Air Traffic Controllers. 6) CDTI of Datalink-Based Intent Information in Advanced ATC Environments. 7) Shared Situational Awareness between the Flight Deck and ATC in Datalink-Enabled Environments. 8) Analysis of Pilot and Controller Shared SA Requirements & Issues. 9) Development of Robust Scenario Generation and Distributed Simulation Techniques for Flight Deck ATC Simulation. 10) Methods of Testing Situation Awareness Using Testable Response Techniques. The work is detailed in specific technical reports that are listed in the following bibliography, and are attached as an appendix to the master final technical report

Allocation of Airspace Cutouts to Enable Procedurally Separated Small Aircraft Operations in Terminal Areas

The current air traffic control (ATC) system is human-centric and voice-based. As a result, separation minima, controller workload, and radio frequency limitations may restrict the number of emerging unmanned aircraft system (UAS) or urban air mobility (UAM) operations that can occur within congested airspace. Limited ATC capacity will be especially impactful for UAS or UAM operations in proximity to large airports. One concept to reduce ATC limitations is to re-allocate airspace to develop procedurally separated corridors or regions where UAS and UAM aircraft may operate without receiving conventional ATC services. The creation of such “airspace cutouts” currently enables hundreds of daily small aircraft and helicopter operations in major U.S. cities without contributing to ATC workload. This paper develops an approach to analytically identify terminal airspace that is procedurally segregated from large aircraft operations and may be appropriate for new airspace cutouts. The magnitude of the benefit of allocating airspace in this manner is demonstrated at three major airports and in the 34 largest metropolitan areas of the United States.National Aeronautics and Space Administration (Contract NNL13AA08B