Hazard Analysis of NextGen Arrival Phase of Flight Concepts: Interval Management Spacing

Transcription

1 Hazard Analysis of NextGen Arrival Phase of Flight Concepts: Interval Management Spacing Cody Fleming March 26, 2014 SYSTEMS ENGINEERING RESEARCH LABORATORY

2 Agenda Background NextGen Example Analysis Future 1

3 Motivation Shuttle B787 [Wiki Commons 1986, WSJ 2013, Guardian 2013] 2

4 Systems Engineering Timeline [ARP ] 3

5 Systems Engineering Timeline [ARP ] 4

6 National Airspace Safety Current flight-critical systems remarkably safe due to: 5

7 National Airspace Effectiveness Conservative adoption of new technologies [Av News 2014] 6

8 National Airspace Safety Extensive decoupling of the system components [Ascent 2013] [IAC 2003] 7

9 National Airspace Safety Careful introduction of automation to augment human capabilities Reliance on experience and learning from the past 8

10 National Airspace Upgrades NextGen violates these assumptions -- more potential for component interaction accidents: [IHO 2013] 9

11 National Airspace Upgrades Use of new technologies with little prior experience in this environment Reliance on software increasing and allowing greater system complexity [IHO 2013] Human assuming more supervisory roles over automation, requiring more cognitively complex human decision making 10

12 National Airspace Upgrades Increased coupling and interconnectivity among airborne, ground, and satellite systems Control shifting from ground to aircraft and shared responsibilities [IHO 2013] 11

13 National Airspace Upgrades Attempts to re-engineer the NAS in the past have been not been terribly successful and have been very slow, partly due to inability to assure safety of the changes. Question: How can NAS be re-engineered incrementally without negatively impacting safety? Hypothesis: Rethinking of how to do safety assurance required to successfully introduce NextGen concepts Applying a new approach to safety based on systems theory can improve our ability to assure safety in these complex systems 12

14 Agenda Background NextGen Example Analysis Future 13

15 Interval Management Spacing Arrival Interval Management Spacing (IM-S) concept facilitates use of flow management constraints, while Enabling efficient descent patterns (OPDs) Reducing congestion in the arrival sector Increasing throughput 14

16 Interval Management Spacing Traditional Approach Approach using IM-S [FAA 2013] 15

17 2 Versions of IM-S Ground-based (GIM-S) Domain Center TFM En route ATC Terminal ATC Flight deck Capability Trajectory modeling CDT/FMT constraint assignment Speed advisory generation and validation without sector-level problem status Speed advisory Notification Indicators Responses Display control Tower Constraint List ADS-B Out (optional) Domain Flight crew Flight Deck-Based (FIM-S) Capability [FAA 2013] [RTCA 2011] determining if an IM Operation is desirable; determining the IM Aircraft, the Target Aircraft, the Assigned Spacing Goal and all other IM Clearance information; verifying that all initiation criteria are met communicating the IM Clearance to the IM Aircraft; ensuring separation between the IM Aircraft and all other aircraft, including the Target Aircraft; terminating the IM Operation if the ATM goal is no longer applicable or is not being met resuming non-im Operations whenever the IM Operation is terminated. 16

18 2 Versions of IM-S Ground-based (GIM-S) Domain Center TFM En route ATC Terminal ATC Flight deck [FAA 2013] Capability Trajectory modeling CDT/FMT constraint assignment Speed advisory generation and validation without sector-level problem status Speed advisory Notification Indicators Responses Display control Tower Constraint List ADS-B Out (optional) Domain Flight crew Flight Deck-Based (FIM-S) Capability determining whether to accept or reject the IM Clearance; making the IM Clearance information available to the FIM Equipment; confirming Target Aircraft Identification to the controller; determining if ownship (i.e., IM Aircraft) is capable of performing the instructed maneuvers informing the controller whether they accept or reject the IM Clearance; following the IM Speed and IM Turn Point provided; monitoring conformance with the IM Clearance; and informing the controller when the flight crew wishes to terminate the IM Operation. 17

19 Agenda Background NextGen Example Analysis Future 18

20 Analysis Process Identify accidents and hazards to be analyzed Systems-Theoretic Process Analysis (STPA) 1. Draw the control structure Identify major components and controllers Label the control/feedback arrows 2. Identify Unsafe Control Actions (UCAs) Derive corresponding safety constraints 3. Identify Causal Factors Create controller process models Analyze controller, control/feedback paths, process 19

21 Hazards Considered H-1: A pair of controlled aircraft violate minimum separation standards (LOS) H-2: Aircraft enters unsafe atmospheric region H-3: Aircraft enters uncontrolled state H-4: Aircraft enters unsafe attitude H-5: Aircraft enters a prohibited area 20

22 Analysis Process Identify accidents and hazards to be analyzed Systems-Theoretic Process Analysis (STPA) 1. Draw the control structure Identify major components and controllers Label the control/feedback arrows 2. Identify Unsafe Control Actions (UCAs) Derive corresponding safety constraints 3. Identify Causal Factors Create controller process models Analyze controller, control/feedback paths, process 21

23 Ground-based IM-S (GIM-S) Fused track reports CDM information to (and from) the Command Center Center TFM Capabilities Trajectory modeling Constraint assignment Speed advisory generation and validation TFM CDT constraint information Flight Deck Capabilities ADS-B Out (optional) Clearances Clearance responses Flight crew requests Speed advisory acceptance and cancellation Flight plans and amendments Fused radar track reports ADS-B reported position, altitude, velocity, and Time of Applicability - position TFM FMT constraint and speed advisory information En Route ATC Capabilities Speed Advisory Notification Indicators Responses Display control ADS-B Information Flight plans and amendments Terminal ATC Capabilities Tower Constraint list [IM-S ConOps] 22

24 GIM-S Control Structure ATC Flight Operations Center TFM Center Instructions & Clearances Requests & Acknowledgements En Route Air Traffic Controller TRACON Flight Crew Execute Maneuvers Aircraft status, Position, etc Flight Crew / Aircraft Aircraft Aircraft n Aircraft 1 Aircraft 3 Aircraft 2 RADAR GNSS 23

25 Analysis Process Identify accidents and hazards to be analyzed Systems-Theoretic Process Analysis (STPA) 1. Draw the control structure Identify major components and controllers Label the control/feedback arrows 2. Identify Unsafe Control Actions (UCAs) Derive corresponding safety constraints 3. Identify Causal Factors Create controller process models Analyze controller, control/feedback paths, process 24

26 Unsafe Control Actions Control Action Not Providing Causes Hazard Providing Causes Hazard Too soon, too late, out of sequence Stopped too soon, applied too long Modify Speed Not providing a speed modification is hazardous when the current speed leads to LOS Providing a speed modification is hazardous if it is the incorrect speed Providing a speed modification to aircraft i is hazardous if given after (before) a related clearance* was already provided to aircraft j Providing a speed modification is hazardous if it exceeds the aircraft capability (overspeed or stall) Providing speed modification too late after conditions (e.g. weather, aircraft speed, heading, etc) in TBFM trajectory model have changed [Not a full table. Full table shown in backup slides] 25

27 Analysis Process Identify accidents and hazards to be analyzed Systems-Theoretic Process Analysis (STPA) 1. Draw the control structure Identify major components and controllers Label the control/feedback arrows 2. Identify Unsafe Control Actions (UCAs) Derive corresponding safety constraints 3. Identify Causal Factors Create controller process models Analyze controller, control/feedback paths, process 26

28 Create Controller Process Models Contextual factors Inputs En Route ATC Process Model Aircraft / FC Model Airspace Model Clearance Decision making TFM Automation Model TFM Advisory Center TFM Flight Crew* Voice Comm, Datalink RADAR, ADS-B Control Process: Airspace Beacon System, GNSS 27

29 Controller Process Model Example OPDs are an increasingly important aspect of traffic mgmt En route interval management has different level of priority now than in the past Different downstream sectors might have different capacity constraints Own sector traffic demands vs up/down stream demands Contextual factors Inputs Procedures from FAA (?) Downstream capacity updates Upstream traffic constraints En Route ATC Process Model Aircraft / FC Model Aircraft type Aircraft capability (ascent/ descent rate, stall speed) Aircraft ID Current location Current airspeed, vertical speed, Current altitude Current advisory(ies) Airspace Model Separation requirement Current separation, own airspace Predicted separation, own airspace Current downstream sector (TRACON) capacity Predicted downstream sector (TRACON) capacity Environment (wind, convective weather) TFM Automation Model Sequence algorithm (how it decides which aircraft go first in flow) Trajectory model CDT / FMT constraint assignment, list User interface (how information is displayed, user options, modifications TFM Advisory Clearance decision making UCA1. Speed modification not given when current speed would result in imminent LOS Flight Crew Voice Comm Datalink (CPDLC) 28 RAD

30 Overall GIM-S Control Structure Flight Flight IF.TFM Operations Operations CDM Info Center IF.FOC Center IF.TFM IF.TFM FB.TFM3 FB.TFM3 Flight CDM Info TFM CDM Info TFM FB.TFM3 Fused track IF.FOCTFM Fused track Operations IF.FOC Center Center Fused track reports reports CDM Info Center CDM Info reports Center CDM Info CA.TFM CA.TFM CA.TFM FMT Constraint FMT Constraint FMT Constraint Speed Speed advisory advisory FB.TFM1 FB.TFM1 Speed advisory FB.TFM1 (long,vert) (long,vert) (long,vert) IF.TATC IF.TATC IF.TATC En Route En Route Flight Flight plans, plans, FB.TFM1 FB.TFM1 En Route Flight plans, FB.TFM1 Amendments Amendments Speed Speed advisory advisory Air Traffic Air Amendments Traffic TRACON Speed TRACON advisory Air Traffic IF.ERATC IF.ERATC TRACON acceptance & & Controller Controller IF.ERATC acceptance & cancellation Controller cancellation cancellation Flight plans and CA.ERATC FB.TFM3 Flight plans and Flight plans and CA.ERATC FB.TFM3 amendments CA.ERATC Clearance, FB.ERATC Clearance, FB.ERATC FB.TFM3 Flight plan amendments amendments Fused radar track reports Clearance, FB.ERATC Speed mod, Clearance response, Flight plan Speed mod, Clearance response, Flight plan Position Fused radar track reports Fused radar track reports ADS-B reported position, Speed mod, Clearance response, other FC request Position Heading alt, speed, and Time of IF.FOC other FC request Position ADS-B reported position, ADS-B reported position, Heading IF.FOC other FC request Heading Airspeed alt, speed, and Time alt, of speed, and Time of IF.FOC Applicability (position) IF.FC1 IF.FC1 Airspeed Airspeed Applicability (position) Applicability (position) IF.FC1 Flight IF.FC2 Flight Flight IF.FC2 IF.FC2 IF.FC2 Nav charts IF.FC2 Crew Crew / / IF.FC2 Nav charts Nav charts Crew / Op manual for a/c CA.FC1 Aircraft FB.FC2 Crew / Crew / Op manual for a/c CA.FC1 Crew / Op manual for a/c CA.FC1 Aircraft FB.FC1 Input flight Aircraft FB.FC2 Aircraft FB.FC1 Aircraft FB.FC1 Input flight Input flight Aircraft FB.FC1 EFB Ownship position plan FB.FC1 EFB FB.FC2FB.FC1 EFB Ownship position Ownship position plan plan Other a/c position Modify flight Other a/c position Other a/c position Modify flight Modify flight Weather plan Weather Weather plan CA.FC1 FB.FC1 plan CA.FC1 CA.FC1 FB.FC1 Aircraft n CA.FC1 FB.FC1 CA.FC1 CA.FC1 CDTI Aircraft 2 Aircraft 3 Heading CA.FC1 Modify Aircraft n CA.FC1 Aircraft n CA.FC1 Aircraft 2 CDTI Aircraft 3 Heading 2 Aircraft 3 Heading Modify Angle of attack Modify CDTI airspeed FMS Angle of attack Angle Airspeed of attack airspeed airspeed Modify FMS FMS EVS/SVS/ Airspeed Airspeed Modify Modify altitude EVS/SVS/ EVS/SVS/ HUD altitude altitude FCS Modify HUD FCS HUD Modify FCS Modify heading heading heading ADS- ADS- ADS- B B Aircraft 1 Aircraft B 1 Aircraft 1 RADAR RADAR RADAR GNSS GNSS GNSS 29

31 Analysis Process Identify accidents and hazards to be analyzed Systems-Theoretic Process Analysis (STPA) 1. Draw the control structure Identify major components and controllers Label the control/feedback arrows 2. Identify Unsafe Control Actions (UCAs) Derive corresponding safety constraints 3. Identify Causal Factors Create controller process models Analyze controller, control/feedback paths, process 30

32 Identifying Causal Factors Controller 1 Control input or external information wrong or missing Inappropriate, ineffective or missing control action Inadequate Control 2 Algorithm (Flaws in creation, Process changes, Incorrect modification or adaptation) 3 Process Model inconsistent, incomplete, or incorrect Inadequate or missing feedback Feedback delays Actuator Controller 2 4 Delayed operation Inadequate operation Conflicting control actions Controlled Process Process input missing or wrong Inappropriate, ineffective or missing control action 4 Component failures Changes over time Sensor 3 Inadequate operation Process output contributes to system hazard Incorrect or no Information provided Measurement inaccuracies Feedback delays 31

33 Checking for Missing Feedback Contextual factors Inputs En Route ATC Process Model Aircraft / FC Model Airspace Model TFM Automation Model TFM Advisory Center TFM Flight Crew* Clearance Decision making Are these loops closed? Voice Comm, Datalink RADAR, ADS-B Control Process: Airspace Beacon System, GNSS 32

34 Example from IM-S ConOps In some cases, operational conditions in the sector may not support the controller s acceptance of a speed advisory. For these cases, controllers can enter the advisory rejection into the automation, allow the advisory to time out, or choose a different speed (these responses are not sent to the TFM automation) [SBS IM-S ConOps, 2013] 33

35 Example from IM-S ConOps In some cases, operational conditions in the sector may not support the controller s acceptance of a speed advisory. For these cases, controllers can enter the advisory rejection into the automation, allow the advisory to time out, or choose a different speed (these responses are not sent to the TFM automation) [SBS IM-S ConOps, March 2013, emphasis added] Potential question about design: Is feedback missing for TFM automation? 34

36 factors Example Causal Factor Inputs En Route ATC Process Model Aircraft / FC Model Airspace Model Clearance Decision making TBFM Automation Model TBFM Advisory Center TFM Flight Crew* ATC process model flaw ATC believes that TFM automation is using same data as he/she sees Control Process: ATC believes TFM uses same Airspace algorithm (procedure) to determine advisories Voice RADAR, TFM process Comm, model flaw Datalink ADS-B Inaccurate information about airspace e.g. Amended flight plan not provided for trajectory modeling Beacon e.g. Aircraft 1 in scenario System, (following slides) not GNSS ADS-B equipped, or ADS-B not updated correctly 35

37 Scenario t 0 FMP 1 AC 1 AC k AC 2 AC 3 TFM generates advisory for AC 1 ATC gives different (faster) speed to AC 1 due to conflict with AC k ATC lets TFM advisory time out 36

38 Scenario t 0 FMP 1 t 1 AC 1 AC k AC 2 AC 3 TFM generates advisory for AC 1 ATC gives different (faster) speed to AC 1 due to conflict with AC k ATC lets TFM advisory time out FMP 1 AC 1 AC 2 AC 3 AC k TFM generates new advisory for AC 1 (using assumptions based on t 0 condition) ATC accepts advisory 37

39 Scenario t 0 FMP 1 t 1 AC 1 AC k AC 2 AC 3 TFM generates advisory for AC 1 ATC gives different (faster) speed to AC 1 due to conflict with AC k ATC lets TFM advisory time out FMP 1 t 2 AC 1 AC 2 AC 3 AC k TFM generates new advisory for AC 1 (using assumptions based on t 0 condition) ATC accepts advisory FMP 1 AC 1 AC 2 At t 1, TFM did not have updated model of aircraft position ATC did not update flight plan due to concentration on conflict 38

40 FIM Analysis Flight Crew Contextual factors Inputs Flight Crew Process Model Aircraft / FBW Model Aircraft capability (ascent/ descent rate, stall speed) Current location Current airspeed, vertical speed, heading Current altitude Current advisory(ies) Flight Plan FMS/autopilot mode Aircraft state (anomaly, degraded modes, etc) Airspace Model Separation requirement Current separation Predicted separation Environment (wind, convective weather) Sequencing or flow goals Restricted airspace or other restrictions FIM Automation Model Algorithm e.g. how it generates Turn Point How it generates aircraft speed, particularly when achieve-by is given as a range Trajectory model Constraint assignment, speed/alt/etc User interface (how information is displayed, user options, modifications Navigation & Control FMC, Yoke/Sidestick Control Process: Aircraft Heading Airspeed Altitude Other aircraft functions (landing gear, trim, etc) Weather Winds Convective weather 39

41 FIM Analysis ATC FIM incentivized during high workload environment (ATC workload) due to the fact that it puts more of an onus on flight crews and their avionics En Route ATC Process Model Aircraft / FC Model Aircraft type Aircraft capability (ascent/ descent rate, stall speed) Aircraft ID Current location Current airspeed, vertical speed, heading Current altitude Current advisory(ies) / Clearance types Airspace Model Contextual factors Inputs Separation requirement Current separation, own airspace Predicted separation, own airspace Current downstream sector (TRACON) capacity Predicted downstream sector (TRACON) capacity Environment (wind, convective weather) Sequencing or flow FIM Model Target Aircraft ID Assigned Spacing Goal IM Clearance Type Starting Event (as applicable) Achieve-by Point (as applicable) Intercept Point (as applicable) Planned Termination Point IM Tolerance Performance Level Target Aircraft Intended Flight Path Information IM DST** ** Analysts are unsure of what Decision Support Tools or automation will be required or available for FIM Clearance decision making Flight Crew* Flight Crew Voice Comm Datalink (CPDLC) RADAR ADS-B Control Process: Airspace Capacity Spacing, sequencing Aircraft trajectories Weather Winds Convective weather Beacon System GNSS 40

42 Scenario Time: t 0 TRACON i Merge point for TOD, STAR, or other route ARTCC j ARTCC k ARTCC j assigns IM interval to FM 1, relative to TG 1 of precisely 60s ARTCC k assigns IM interval to FM 2, relative to TG 2 of precisely 60s TG 1 TG 2 FM 1 FM 2 Sector Boundary 41

43 Scenario Time: t 1 TRACON i ARTCC j TRACON i assigns IM interval to TG 2, relative to TG 1 of precisely 60s ARTCC k TG 2 TG 1 FM 2 FM 1 Sector Boundary 42

44 Scenario Time: t 2 TG 1 TRACON i TG 2 ARTCC j FM 1 ARTCC k FM 2 Sector Boundary 43

45 Agenda Background NextGen Example Analysis Future 44

46 Current & Future Work Can we do the analysis even earlier? Analyze concepts with less maturity Assist decision-makers in design Actually develop concepts? 45

47 References 1. AO , In-flight uncontained engine failure Airbus A , VH-OQA, overhead Batam Island, Indonesia, Australian Transporation Safety Board, 4 November Rushe, D. Boeing 787 Dreamliner's failed battery was wired incorrectly, Japan says, 20 February, Gara, T. FAA Statement: Boeing 787 Dreamliner Grounded, For Now, Wall Street Journal Blog, 16 January Society of Automotive Engineers, SAE International. Guidelines for Development of Civil Aircraft and Systems, Aerospace Recommended Practice, ARP4754 REV. A, Issued , Revised Kapurch, Stephen J., ed. NASA Systems Engineering Handbook. DIANE Publishing, Surveillance and Broadcast Services (SBS) Concept of Operations Arrival Interval Management Spacing (IM-S), PMO-010, Revision 02, Final March 1, IHO blog, 11/6/2013, accessed 17 March FAA Surveillance and Broadcast Services (SBS) Concept of Operations. Arrival Interval Management Spacing (IM-S) Concept of Operations for the Mid-Term Timeframe, PMO-010, Revision 02 Final March 1, RTCA. Safety, Performance and Interoperability Requirements Document for Airborne Spacing Flight Deck Interval Management (ASPA-FIM), RTCA DO-328 Prepared by: SC-186, June 22, Interagency Airpsace Coordination, FAA and USDA, accessed 22 March Ascent Ground School, copyright 2013, accessed 22 March Aviation News, Copyright 2014, accessed 23 March