Controllability-involved Risk Assessment Model for Carrier-landing of Aircraft Jin Tian, Ph.D., Beihang University Tingdi Zhao, Ph.D., Beihang University Key Words: system safety, risk assessment, Time Margin, mishap, aircraft carrier-landing SUMMARY & CONCLUSIONS Are the risk levels of many mishaps (which include the carrier-landing mishap) directly related to the time available to correct the abnormal system state? In the case studies of past mishaps, it can be seen that the landing mishaps of carrier aircraft are often caused by the reason that the time available to control the aircraft or adjust its flight attitude is not sufficient. Moreover, engineering experience intuitively tells us that as the time available to take corrective action over a hazardous situation increases, the ability to exert controls and avoid mishap also increases. However, there is no evidence to prove this conclusion yet. We focused on risk controllability, and presented a certain variable “Time Margin”(Tm) which could characterize risk controllability as possible. Moreover, we established a conceptual model of risk, including the variable characterizing risk controllability, based on conventional risk assessment model which includes variables mishap probability and mishap severity. By using the carrier-landing process as a case, with the statistical data from real samples on carrier-landing performed aboard the USS Enterprise CVN-65, we implemented an empirical research program into the relationship between ability to correct landing attitude and mishap risk, to verify the rationality of the improved risk assessment model. The law of the relationship between Tm (the time available for the pilot to adjust the flight attitude and glide slope) and the risk reflected by the actual record data has been revealed. Statistical analysis shows that: Both the probability and the severity of landing mishaps are negatively correlated with Tm. In other words, it’s concluded that the risk is negatively correlated with the Tm. The sample size of aircraft landing is large, and the data are derived from actual record, therefore the conclusion is authentic and credible. It illustrates the argument that the more sufficient the time available to correct the hazardous situation is, the greater the chance of controlling or avoiding mishaps is. 1 INTRODUCTION The carrier-landing of aircraft has a high mishap risk. There is high possibility that mishaps happen within the last few seconds before a carrier-landing process ends. 1 According to the statistics, about 40 percent of all mishaps happened in this period, such as an aircraft hitting ramp (end

978-1-4577-1851-9/12/$26.00 ©2012 IEEE

of the flight deck) of the aircraft carrier, an aircraft crashing into the sea, an aircraft hitting other equipment or aircraft on the carrier when out of control after touching down, and so on. The damages of these mishaps are critically severe. Therefore, it is very important to assess the risk of carrierlanding of aircraft. However, when the aircraft is landing, the conditions are changing greatly. In addition, there are various complex factors, which will influence the landing. There are sharp changes with time in landing attitude. Moreover, many flight parameters need to be controlled, and high control precision is required. Accordingly, it is a challenge for safety analyst to build a reasonable assessment model of flight safety. The conventional definition to mishap risks 2~7 based on the probability and consequences plays an important role in the safety evaluation of various products including the aircraft. It is mature technically, and has been widely applied in various engineering projects around the world. However, it will conceal some important features of risks (such as the controllability and the variability), and the features of risks could not be fully reflected, if only the mishap probability and the mishap severity are used to describe and assess the mishap risks. Actually, in some cases, the controllability has a great influence on the risk level. On March 16, 1997, an F/A-18C collided with flight deck while landing aboard the KENNEDY CV-67 carrier, for its oversize flight obliquity 8. Following the conventional mishap risk assessment model and only considering the probability and final consequences of hitting the aircraft carrier (usually is a fatal crash), a high risk level should be obtained. While in this mishap, actually, the pilot had a relatively sufficient time margin for emergency operation. At last, the aircraft stopped after sliding for a distance on the deck. Except that the pilot was slightly injured, there was no other casualty. It can be seen that even for the same type of mishaps, for different Time Margin, the risk levels could be different. At present, Many researchers have studied and practiced the controllability of risks 9~11. Especially, Clifford 10 described a three-dimensional method, based on the traditional dimensions of probability (likelihood) and severity of risks, and added third dimension “level of control”. These achievements help to reveal the inherent features of risks. Based on them, the controllability of risks have be further studied and discussed in this paper. By engineering experiences and intuition, it is indicated

that the risk levels of many mishaps, including the carrierlanding mishap, are directly related to the time available to correct the abnormal system state since the abnormal state emerges (this available time shall be referred to as Time Margin). The meaning of “Time Margin” and its relationship with the mishap risk is described in this paper. A conceptual model of risk is built, including three variables: mishap probability, mishap severity and time margin. Taking the carrier-landing process as a case study, with the statistical data from real samples on carrier-landings performed aboard the USS Enterprise CVN-65, research into the relationship between the mishap risk and the carrier-landing time margin for control was performed. This research was performed to verify the reasonability of the three-variable risk model. 2 THE CONCEPT OF TIME MARGIN (TM) There is a time period from the emergence of an abnormal system state to the outbreak of a mishap, during which some measures could be taken to prevent or mitigate the mishap according to the observed or detected premonitory information of the mishap. The time available to hazard-mishap control is named “Time Margin” (Tm), which describes the interval from the emergence of a hazard to the emergence of the critical condition which determines whether the mishap trend can be reversed. Tm can be divided into the following four categories by different characters: 1) None: No time available. No control measures can be taken. 2) Very Limited: There is some time but it is not sufficient to take measures or to make the measures effective. 3) Limited but adequate: There is some time, limited but sufficient to take certain measures and also make the measures effective. 4) Long-duration and sufficient: Time margin is large and there is sufficient time to take measures.

Figure 1- The Relationship between “Time Required” (Tr) and Time Margin(Tm) The significance of Time Margin is whether it is enough

to ensure the implementation and effectiveness of risk control measures. It can be compared between the Time Margin with the minimum time required (“Time Required” or “Tr” is called for abbreviation) to correct deviations or to eliminate abnormalities. And the comparison result can be used to illustrate whether the Time Margin is enough (as shown in Figure 1). The comparison result between “Time Required” (Tr) and Time Margin (Tm) reflects the correctability of the hazardous state. In Figure 1, each curve represents the implementation of a specific activity (such as the landing of an aircraft). For a certain activity, Tm usually shortens as the activity is being carried out. The red shaded area means that the system state cannot be corrected and the trend towards a mishap cannot be reversed. For example, landing crash is inevitable, even if it has not happened yet at that moment; The blue shaded area means that the system state still can be corrected. So the appropriate control measures can be taken to terminate the transformation from a hazard to a mishap, so as to avoid mishaps. Assuming that there is a critical state in the engineering practice, when Tm = Tr, the safety state of the system would be in a critical condition (as the curve “a” in Figure 1); when Tm< Tr, the safety state of the system would exceed the critical condition (as the curve “b” in Figure 1), and it is too late to correct the hazardous state, so the mishap is inevitable in this activity; when Tm >Tr, the safety state of the system can be corrected promptly, and the transformation from a hazard to a mishap can be terminated, so the system can remain in a safety state (as the curve “c” in Figure 1). Time Margin is the direct reflection of the controllability of risks. It affects the risk level of a mishap directly as follows: 1） The Effect on the Mishap Probability Generally, Tm and Tr have nature of randomness. The mishap probability depends on both of them, namely: P (Tm ) = P (Tm < Tr ) . Where, P indicates the mishap probability approximation, in which aircraft or carrier hardware failures, aircraft software faults, pilot or deck crew error that went undetected and uncorrected, were omitted. 2） The Effect on the Mishap Severity Through engineering experiences, when Tm >Tr, the larger the difference between Tm and Tr is, the more completely the implementation of risk control measures is, and the more likely to be effective. In this case, even if the mishap happens, the consequences of the mishap would be relatively less severe. Therefore, the risk of accidents can be expressed as the following mathematical model: R = f [P(Tm ), C (Tm )] = P(Tm ) × C (Tm ) Where, R---The risk level P---The mishap probability C---The severity of the mishap consequences Tm ---Time margin It should be noted that the function properties of P(Tm )

may be different for different types of risk (or mishap), and the same as C (Tm ) . 3 CASE STUDY ON CARRIER-LANDING FOR AIRCRAFT During any carrier-landing, it will be regarded as normal flight if the flight profile and the attitude deviation can be adjusted constantly to match the requirement. In this case, the aircraft will land safely. However, if abnormal state, (the flight profile and attitude being out of required scope) occurs in any time, it is possible that the aircraft could try to fly off the deck successfully. In case the aircraft fails to continue its normal flight, there is high possibility of hazards. Especially if the arrester system has failed to secure the aircraft, and the aircraft on the deck is unable to initiate a go-around, it may be damaged and slewing on the deck, and it may be damaged to the extent that there are additional hazards such as fuel leaks and the high potential for further mechanical damage and crew injury. Taking the carrier-landing of aircraft as a case, the relationship between Time Margin and the probability and severity of carrier-landing mishaps is analyzed. The function properties of P (Tm ) and C (Tm ) are also quantitatively analyzed in this section. All the source data for analysis is selected from ref.12. The data is on 617 times of carrier day landing performed by aircraft TA-4 (for its sample size is larger than any other aircraft), aboard the USS Enterprise CVN-65 operating off the west coast of the United States. 3.1 The Analysis of the Relationship Between Landing Mishaps Probability and the Tm Before Touchdown Due to the limited length of the runway on the landing deck, the stage of the engagement between an aircraft and a carrier is the most critical and most dangerous stage for the whole landing process. In the stage, the higher the landing speed is, the shorter the reaction time left for the pilot or the landing control system. There are many disturbing factors at the end of the process of landing, which makes the mishap probability increase. Therefore, for a certain type of aircraft carrier, the distance from the ramp (end of the flight deck) to the appointed touching down point is a fixed value. By analyzing the relationship between the flying time through this distance and the frequency of hooking failure, the relationship between the Tm and the mishap probability will be obtained. The relative position of the aircraft and the carrier during landing is shown in Figure 2. The time spent from flying over the ramp to landing can be determined by the ratio of the vertical distance from the aircraft to the ramp and the average sinking velocity.

Figure 2- The Relative Position of the Aircraft and the Carrier during Landing It is assumed that the time taken flying from the ramp to the touching down point is described as H t≈ W , VVA

where, HW ——height of main wheels over the ramp, the average height of the aircraft main landing gear wheels as it flies over the aircraft carrier ramp. VVA ——the average sink speed of the aircraft main

landing gear, which is calculated just prior to touchdown of the first main landing gear wheel. Then, the sample on landing could be shown as T = t1 , t 2 , … , t N , where N is sample size. Assuming that the frequency of "hooking failure" could be denoted as variable F. F is the ratio of times of "hooking failure" to the sample size, which is obtained from statistic result. Each sample group is averagely divided into 2 parts (approximately). The data on the day landing of carrier aircraft TA-4 during the 6 seconds just before touching down was calculated, and the result is shown in Table 1. Table 1- Analysis Result of Relationship between Mishap Probability and Tm before Touchdown Sample Size

F

[0.727, 1.548]

309

0.298

[1.548, 3.417]

308

0.269

TM Phase 1 (sec) Phase 2 (sec)

F (t ) Character (Increasing or Decreasing)

Because the time is short (only several seconds) at the end of the process of landing, there is only a slight difference of the ability to respond and control between the short Tm (such as 1 second) and the long Tm (such as 5 seconds). The results are also vulnerable to be affected by data accuracy. So there is no need to divide the time into periods too densely. In this case, the data for each type of aircraft is divided into 2 time phases. From the calculation results, it can be seen that the frequency of hooking failure in phase2 is lower than that in phase1, so that it can be considered that the frequency of hooking failure of the aircraft is negatively correlated with Tm. This is consistent with the engineering practice.

3.2 Analysis of the Relationship between the Severity of Landing Mishaps and the Tm before Touchdown The analysis of the landing mishaps shows that in case the hooking failed and the aircraft can not succeed in flying off the deck again, it is very easily for the aircraft to rush out of the specified landing area on the deck. As a result, the aircraft will crash into the sea or hit other equipment or aircraft on the deck. Furthermore a fire or an explosion will occur. In short, the consequences will be very serious. By analysis it could be seen that hooking failures are often due to the fact that the flight attitude is beyond the scope of requirements when touching down or the deviation produced earlier has not be corrected promptly, which makes the flight path deviated from the centerline of the deck. Typically, the longer the distance between the actual touching down point and the appointed touching down point is, or the larger the angle between the flight path and the centerline of the deck is, the more serious the deviation of touchdown is, and the more likely that the aircraft rush out of the specified landing area is. Assuming that the consequences severity due to hooking failure is denoted as variable D, and D = Y ⋅ θ . Where, Y——the perpendicular distance between the aircraft centerline and the centerline of the flight deck, just prior to first main wheel touchdown. θ ——aircraft flight path angle between the aircraft flight path and the flight deck centerline at the point of touchdown.

Figure 3- Analysis Result of the Relationship between Mishap Severity and Tm before Touchdown Then C(Tm ) could be concluded approximately through analyzing the numerical regularity of variable D(t ) .The data on the hooking failure samples of carrier aircraft TA-4 is calculated respectively by statistical method, and the two-

dimensional coordinate is established as shown in Figure 3. The horizontal axis indicates the variable Tm (unit: second) and the vertical axis indicates the variable C (unit: m·degree). Each ring in Figure 3 represents a hooking failure sample. The linear fitting is a commonly applied fitting type in engineering. In addition, according to the scattergraph, in case with the increasing of independent variable, the influence of the unit change of the independent variable on the induced variable is descending, the logarithmic function can be selected 13. Although as the data scattergraph of aircraft samples show that there is no obvious logarithmic function features, considering the analysis attempt from different aspects, the data is fitted with linear and logarithmic model in this paper. The fitting follows the principle of Least Square Approximation. The result is shown in Figure 3 and Table 2. Table 2- Result Analysis of Curving Fitting Fitting Type

Regression Equation

R2

Linear

C=-9.442×TM+24.613

0.116

Logarithmic

C=-15.278×ln(TM)+16.32

0.122

rs between C and TM -.0365

The variable R2 is the coefficient of determination, which equals the ratio of the Sum of Squares for Regression to the Sum of Squares for Total. R2 is the relative index to measure the goodness of fittest of the regression curve with the samples observation values. The more R2 is close to 1, which shows that the most of the uncertainty of the induced variable could be explained by the regression equation, the better the fitting of the regression equation is. In the relevance analysis of variables, the Spearman Correlation Coefficient of rs,,which is commonly applied in engineering, is used to judge the relativity of variable C and Tm in this paper. The Spearman Correlation Coefficient of rs has an outstanding advantage that there is no requirement for the data allocation and sample size. If rs>0, it means that variable C and Tm has the positive correlation. If rs