SOFIA. Safe AutOmatic Flight Back and LandIng of Aircraft

Transcription

1 SOFIA Safe AutOmatic Flight Back and LandIng of Aircraft Seminar Date: 21/10/ By: Jorge Marga Seminar, Munich, 21_

2 SOFIA Overall Data Budget: 4,997,984 Duration: 36 months Start date: 1 st September, 2006 Web Site: SOFIA Consortium: 2

3 SOFIA s Operational Concept Enabling the safe and automatic return to ground of an airplane in the event of onboard hostile actions 3

4 Background SOFIA is a response to the challenge of developing concepts and techniques enabling the safe and automatic return to ground of an airplane in the event of hostile actions. SOFIA is proposed as a continuation of a part of the SAFEE project. SAFEE focused in the development and validation of a concept that detects and evaluates on-board threats using the Threats Assessment and Management System (TARMS) and enables the Emergency Avoidance System (EAS) to autonomously flight the aircraft to a secure point. SOFIA develops the system (FRF) that, from that secure point, takes control of the airplane and safely returns it to ground. Both projects are mainly related to the Research Domain 3.d aircraft security of the FP AERO-1, Research Area 3 Improving safety and security. 4

5 SOFIA Scope 1 EAS IDLE FRF IDLE THREAT EAS ACTIVE FRF ARMED 5 6 EAS ARMED FRF ACTIVE 2 4 EAS ACTIVE FRF IDLE EAS ARMED FRF IDLE Collision Course 3 ATC EAS AVOIDANCE FRF IDLE 5

6 SOFIA Core: the FRF The Flight Reconfiguration Function (FRF) is SOFIA s core. It creates and executes without any command from ground, a new flight plan towards a secure airport, taking the control of the aircraft and managing its safe landing at the selected airport. Three different solutions are proposed and developed: Solution 1: Flight Planning without negotiation: FLPN is generated by the FRF system. Solution 2: Flight Planning with negotiation: FLPN is generated on ground and up-linked to the airplane. FRF system checks its feasibility. Solution 3: Military A/C Relay: FLPN is transmitted from a a military aircraft. 6

7 SOFIA Core: the FRF (2/2) It means to create and execute without any control from ground, a new flight plan towards a secure airport and landing the airplane at it The flight plan can be created: 1. Integrally by the FRF system 2. By an Authority on Ground and negotiated with the FRF system 3. In a military airplane and transmitted to the aircraft The execution of the new flight plan is autonomously performed by FRF 7

8 SOFIA Solutions Three different solutions for the FRF are considered: Solution 1: Flight Planning without negotiation: FLPN is generated by the FRF system. Solution 2: Flight Planning with negotiation: FLPN is generated on ground and up-linked to the airplane. FRF system checks its feasibility. Solution 3: Military A/C Relay: FLPN is transmitted from a a military aircraft. 8

9 Trajectory Generation by FRF The Trajectory is generated by FRF considering: Destination airport according to the threat Jeppessen data Weather, terrain, obstacles, restricted areas and PSA (Prohibited Security Areas) Fuel Aircraft performances FRF enables Trajectory updates due to: ATC messages (e.g. change in destination airfield) Weather Traffic Obstacles, PSA 9

10 FRF Functions Decision Centre Function (DCF) Manages FRF capabilities and controls events Health Monitoring System Interface (HMS) Monitors for external systems failures critical to FRF Route Planning and Static Flight Monitoring (RPL) Generates a suitable flight path to a secure airfield Guidance Management and Leg Management (GLM) Performs flight guidance Route Re-planning (RRP) Performs re-routing due to a conflict Dynamic Flight Monitoring (DFM) Monitors aircraft performances and resolves conflicts External Communication (COM) Processes the information to be exchanged with the GSDS Display Management (DSM) Manages displays when FRF is active 10

11 Validation Process IoA Aircraft DAI Aircraft Flight Trials FRF Version 1 FRF Version 2 DFS ATC GAL ATENA DFS ATC Ground Simulations THA Airlab Preliminary Validation (Implementation) Final Validation 11

12 SOFIA Safety Issues 12

13 Why? 1. Assess how safe the FRF design is 2. Are we compromising current levels of safety? 3. Refine FRF specification and design 4. Mitigate potential SAFETY RISK early in the design 13

14 What? Safety Assessment at two levels Aircraft level Goal: Ensure that FRF design achieves acceptable levels of risk Requirements: EASA CS Methodology: SAE ARP 4761 Focus: Inside the aircraft (FRF System on-board equipment) Integration on airspace levels Goal: Ensure that the SOFIA operational concept achieves acceptable levels of risk Requirements: ESARR4 Methodology: EUROCONTROL EATMP Safety Assessment Methodology (SAM), Focus: Outside the aircraft (ATM operations) 14

15 Selected Approach Operational Issues Function allocation Initial FRF Design DBs Requirements FHA Airspace (ATM) FHA A/C Level FHA Aircraft FHA FRF Level FHA Aircraft PSSA FTA FMEA PSSA Airspace (ATM) PSSA Identify Causes Derive Safety Requirements First Criticality Assessment Preliminary System Safety Assessment Final FRF Architecture Final System Safety Assessment 15

16 ARP 4761 Approach Aircraft FHA FRF System FHA Id Function Phase Failure Condition Failure Effect Class. Id Function Phase Failure Condition Failure Effect Class. A/C 1.1. A/C 1.2 Reconfigure flight and land Reconfigure flight and land HP, DES, APP, LND HP, DES, APP, LND FRF Malfunction under the presence of sec. threat FRF Malfunction when no security threat is present. Hull Loss No effect on safety CAT NSE FRF 1.1. FRF 1.2 Manage FRF modes Reconfigur e flight and land HP HP, DES, APP, LND Failure to switch from ARMED to ACTIVE FRF Malfunction when no security threat is present. Hull Loss No effect on safety CAT NSE Aircraft FTAs PSSA FTAs Loss of A/C resulting from FRF failure No FPLN created Untimely switching ARMED MODE ACTIVE MODE Failure to switch from ARMED to ACTIVE Loss of Function 1 Loss of Function 2 Loss of function 3 Erroneous switching out of ARMED Failure to switch from ARMED to ACTIVE Basic Causal Events 16

17 Results Understand the logic that contributes to produce most severe failures Important contributors to failure Safety requirements on: On-board equipment: Conventional A/C Systems (e.g. Sources of information to generate a FPLN, FMS/AP Coupling) FRF System Security Systems (TARMS, EAS) Operations: Ground personnel (ATCOs) Procedures Ground equipment 17

18 Recomendations Need for better statistics on likeliness of occurrence for security scenarios Need to adjust safety criteria to account for security scenarios Redefine certain avionic functions design which count on the pilot as safety net (i.e. navigation, flight controls, etc) Identification of FRF functions that need to be developed to high safety assurance levels: Mode management Exchange of data with critical systems like FMS or TARMS. (e.g. Airfield and route verification) 18

19 Recomendations At least to information rounds are needed to create the flight plan: one once the A/C leaves the holding pattern, the second when approachin the airport FRF shall be informed about ATIS failures Having up to date information from ground is critical Weather at selected airport has to be part of the criteria for airport selection In solution 2 flight plan acceptance shall be confirmed 19

20 Recomendations Spurious activation of the FRF during normal operation does not present (a priori) a major risk for safety for two reasons: 1) The FRF is intended to automatically land an aircraft at a secured airport. In the absence of any critical failures this operation can be considered safe. 2) The FRF is not designed to remove control away from the flight crew. Once the flight crew detects the spurious activation (without a threat on-board), they are still capable of reverting the system back to normal. If there is a threat (security scenario), protection measures are considered within the scope of SAFEE project. 20

21 THAK YOU VERY MUCH FOR YOUR ATTENTION ANY QUESTION, PLEASE? 21