COLLISION AVOIDANCE AND SAFETY

Transcription

1 COLLISION AVOIDANCE AND SAFETY Johan Pellebergs, Saab Aeronautics November 2016 This document and the information contained herein is the property of Saab AB and must not be used, disclosed or altered without Saab AB prior written consent.

2 2 CONTENT Flight safety Safety statistics Ground Collision Avoidance Mid-Air Collision Avoidance Requirements for collision avoidance systems Safety principles

3 COLLISIONS THEY DO HAPPEN! COMPANY RESTRICTED NOT EXPORT CONTROLLED NOT CLASSIFIED

4 4 FLIGHT SAFETY

5 5 MISHAPS / CRASHES Main categories for catastrophic mishaps in military aviation have historically been: Controlled flight into terrain (CFIT) Engine Mid-Air collision 40% 30% 20% Mishap statistics for a military fighter 10% 0%

6 6 FLIGHT SAFETY Flight safety significantly improved over the past decades Includes both military and civil aviation Main contributing factors are Strong safety attention Training Incident reporting Reliability of flight critical systems Introduction of safety enhancing systems and automation Auto-GCAS Auto-ACAS MIDCAS

7 7 GROUND COLLISION AVOIDANCE

8 8 AUTOMATIC GROUND COLLISION AVOIDANCE Terrain profile ahead of the aircraft trajectory generated from onboard terrain data base Recovery flight path continuously calculated Recovery flight path evaluated against terrain profile Automatic recovery initiated when margin from calculated recovery flight path to the terrain profile goes below a minimum value (7m) Flight Control System (Redundant, EFCS DAL A) Executed Recovery Flight Path at 5.5g AFU Auto recovery AFU automatic/manual deactivation: Landing gear extended AAR probe extended GPW manually OFF Pilot manual inhibation Control stick breakout Mission System (DAL SC D96 C) MMI Warning AFU-command ARM (GPW) (MKV) Flight path prediction Margins SCAN Ground profile NINS terrain data base Calculated Recovery Flight Path at 5g

9 9 AUTO-GCAS SAVES Auto-GCAS has saved 4 aircraft and pilots since its operational fielding 2 years ago Pilots reactions have gone from skeptical of having a system that can take control away from them to now not performing the most advanced training flights without the system available! Acceptance of the users (pilots) is crucial when introducing an automatic high authority system!

10 10 4 TH AUTO-GCAS SAVE HUD video from 4 th Auto-GCAS save when the pilot becomes unconscious due to high G s (GLOC) G-load Velocity vector Speed Mach GCAS warning Altitude (ft) Radar altitude

11 2 ND AUTO GCAS SAVE Air Combat training mission Target fascination leads one of the pilots to initiate a maneuver that would result in a non-recoverable ground collision Letter from one of the saved pilots expressing his gratitude of the Auto-GCAS system! My unexpected AGCAS recovery prompted me to aggressively recover my aircraft, directly saving both my life and the aircraft. AGCAS worked as advertised and allowed me the honor to write this letter. I will gladly shake the hands of the men and women who developed this life saving system if I ever meet them in person.

12 12 MID-AIR COLLISION AVOIDANCE

13 13 MID-AIR COLLISIONS A REAL THREAT

14 MAIN LAYERS OF PROTECTION AGAINS MID-AIR COLLISIONS Strategic Conflict Management Procedures and Regulations Airspace design Flight plans Distance / Time 2. Separation Provision Responsibility of ATC or the Pilot depending on airspace class and flight rules (IFR/VFR) Don't scare others! 3. Collision Avoidance This ultimate responsibility for avoiding collisions always remains with the pilot. Mainly performed by the pilots ability to See & Avoid, i.e. the pilots eyes and his/hers ability to perform the correct decision and correct action. Don't scrape paint Criticality

15 15 AIRSPACE CLASSES Airliners Operates in class A-C Fly according to Instrument Flight Rules (IFR) Equipped with Transponder/ADS-B, i.e. are Cooperative Equipped with TCAS collision avoidance system Separated from all other traffic by ATC Pilot responsible for Collision Avoidance (aided by TCAS) Small GA aircraft Operates mainly in the lower airspace classes incl uncontrolled Operates at lower altitudes below ft (max speed 250 kts) Large portion of flights according to Visual Flight Rules (VFR) Many without Transponders/ADS-B, i.e. Non-cooperative Limited or no ATC separation Pilot responsible for both Separation and Collision Avoidance

16 16 REMOTELY PILOTED AIRCRAFT Terminology Unmanned Aircraft System - UAS Remotely Piloted Aircraft System - RPAS Removing the pilot from the aircraft requires an equivalent system capability to detect and avoid other aircraft Detect & Avoid system (D&A) Main requirement is to not degrade safety when introducing RPAS into the airspace

17 17 TRAFFIC AVOIDANCE AND COLLISION AVOIDANCE Detect and Avoid (D&A) consists of two safety barriers Traffic Avoidance ( don t scare ) Collision Avoidance ( don t scrape paint ) D&A design objective D&A Design Objective to reach the overall TLS is a Risk Ratio of 0,01 (TBC), i.e. save 99 of 100 critical encounters Risk Ratio = P(NMAC with system) / P(NMAC without system) NMAC = Near Mid Air Collision

18 18 D&A SYSTEM OVERVIEW Detect & Avoid Sensors ADS-B RPA Intruder Xpdr EO IR Data Fusion Collision Avoidance Traffic Avoidance Radar The RPA pilot will get suggested maneuvers from the system C2 link TrA maneuver needs to be manually activated by the remote pilot CA maneuver can be manually activated but will activate automatically at last instance CA protection remains even if there is a C2 link loss Remote Pilot Station D&A HMI

19 19 D&A COLLISION AVOIDANCE CONCEPT Protected Volume CV + uncertanties CV Collision Volume Intruder When the manoeuvre prediction indicates last chance to resolve the situation without CV breach (incl margins) the manoeuvre is activated automatically A manoeuvre is continuously calculated and evaluated against the Collision Volume RPAS MIDCAS flight test HMI video (Radar + EO)

20 SENSOR PERFORMANCE Flight testing of D&A system in the MIDCAS project Typical Sensor tracking performance in flight ADS-B: over 15 NM Radar: around 5 NM ( m) EO: ranging from 8-5 NM ( m) EO video - intruder below EO video CA with intruder above EO video loitering against sun reflex

21 21 REQUIREMENTS AND SAFETY

22 MAIN REQUIREMENTS FOR A SAFETY ENHANCING SYSTEM COMPANY RESTRICTED NOT EXPORT CONTROLLED NOT CLASSIFIED 22 3 mother requirements: Do good Warn and/or engage automatic maneuver when a collision is imminent No nuisance No unnecessary warning or maneuver Do no harm Do not cause a catastrophic event when no danger was present in the first place The most important of these 3 is No nuisance

23 23 DEFINITIONS AND CLASSIFICATIONS Classification of failure conditions by severity of effect Catastrophic, Hazardous, Major, Minor, or No Safety Effect A Catastrophic Failure condition is one which would result in multiple fatalities usually with the loss of the aircraft Definition of Probability Terms Extremely Improbable, Extremely Remote, Remote, or Probable An Extremely Improbable failure condition is one so unlikely that it is not anticipated to occur during the entire operational life of all airplanes of one type. Quantitatively, these probability terms are defined as follows: Extremely Improbable 10 9 or less Extremely Remote 10 7 or less Remote: 10 5 or less Probable: more than 10 5

24 24 SAFETY OBJECTIVES Quantitative The acceptable safety level for equipment and systems as installed on the aircraft are established as an inverse relationship between Average Probability per Flight Hour and the severity of Failure Condition effects: Failure Conditions with No Safety Effect have no probability requirement. Minor Failure Conditions may be Probable(>10 5 ) Major Failure Conditions must be Remote (<10 5 ) Hazardous Failure Conditions must be Extremely Remote (<10 7 ) Catastrophic Failure Conditions must be Extremely Improbable (<10 9 ) The safety objectives associated with Catastrophic Failure Conditions may be satisfied by demonstrating that: No single failure will result in a Catastrophic Failure Condition; and Each Catastrophic Failure Condition is extremely improbable. Qualitative The failure conditions Catastrophic through No Safety Effect are assigned Functional and Item Design Assurance Levels A, B, C, D, E, respectively

25 POSSIBILITY TO RELAX FDAL WITH PROBABILITY OF THE EXTERNAL EVENT COMPANY RESTRICTED NOT EXPORT CONTROLLED NOT CLASSIFIED 25 Example: Fire onboard an aircraft is very critical and can cause a catastrophic crash The mitigation is to install a fire extinguishing system What design assurance level will be needed for this system? If the probability of a critical fire is sufficiently low it will be possible to relax the FDAL requirement Consequence of fire: CAT Probability is (example): 10 6 FDAL can be reduced from A to B for design of the Fire extinguishing system ARP 4754A

26 26 TARGET LEVEL OF SAFETY (TLS) Large aircraft (i.e. Airliners) Hundreds of people onboard Catastrophic event: % allowed for technical failures: 10 7 Large aircraft have ~100 potentially catastrophic failures: 10 9 each Thus the risk for a mid-air collision with an airliner can not be higher than 10 9 per flight hour Small aircraft (i.e. General Aviation) Typically 1-2 people onboard Hazardous event: % allowed for technical failures: 10 6 Small aircraft have ~10 potentially catastrophic failures: 10 7 each Thus the risk for a mid-air collision with a small aircraft cannot be higher than 10 7 per flight hour RPAS are considered as complex aircraft equivalent to airliners

27 27 SAFETY BARRIERS To achieve very high levels of safety it is necessary to distribute the safety target to several different layers or barriers There are several different kinds of barriers Inherent Rules Procedures Technical Each barrier typically contributes between 1 and 3 orders of magnitude Better to have 3 barriers with a factor of 10 each than 1 barrier with a factor of 1000 Important to have independence or known common mode failures between the barriers!

28 D&A SYSTEMS ARE RELEVANT ALSO FOR MANNED AVIATION If we have a Detect & Avoid system onboard? Why do you ask?

29 29