Docstoc

Quantitative Approach to Risk Management

Document Sample
Quantitative Approach to Risk Management Powered By Docstoc
					Some references (including subsequent publications)
1. R. Clothier et al. A Casualty Risk Analysis For Unmanned Aerial System (UAS) Operations
   Over Inhabited Areas. 2007
2. K. Dalamagkidis, K. Valavanis, and L. Piegl. On Integrating Unmanned Aircraft Systems into
   the National Airspace System Issues, Challenges, Operational Restrictions, Certification, and
   Recommendations. Intelligent Systems, Control and Automation: Science and Engineering,
   Vol. 36. 2009
3. T. McGeer. Safety, economy, reliability, and regulatory policy for unmanned aircraft. Aerovel
   Corporation, March 2007. (9 pp)
4. T. McGeer. Aerosonde hazard estimation. The Insitu Group, 1994. (6 pp)
5. R. Weibel and J. Hansman. Safety Considerations for Operation of Unmanned Aerial Vehicles
   in the National Airspace System. MIT, 2006.




                                                1
The Insitu Group, Adroit Systems Inc., University of Washington               June 4, 1999
6. Quantitative Risk Management as a Regulatory Approach to Civil UAVs

                                         Tad McGeer, PhD
                                         The Insitu Group
                                        Bingen, Washington
                                               USA

                             Laurence R. Newcome, Lt. Col. Ret. USAF
                                       Adroit Systems, Inc
                                       Alexandria, Virginia
                                              USA

                                        Juris Vagners, PhD
                                      University of Washington
                                        Seattle, Washington
                                                USA


                                              Abstract
In this paper we argue for quantitative risk management as a regulatory approach to civil
Uninhabited Aerial Vehicles (UAVs). The current prescriptive approach to airspace regulation,
while appropriate to inhabited aircraft, does not realistically consider the issues of safely operating
all UAV’s in civil airspace. The wide range of missions for UAVs and the correspondingly diverse
physical vehicles to realize these missions makes the prescriptive “one size fits all” approach to
regulations inappropriate. Furthermore, there are significant differences between military UAVs
and civilian UAVs to warrant separate consideration

                                            Biographies
Tad McGeer – is president of The Insitu Group. He trained as an aeronautical engineer at Princeton
and Stanford, an then moved into academic research on walking robots in the 1980s, on the faculty
of Simon Fraser University in his native British Columbia. In 1990 he merged his robotic and
aeronautical interests for initial studies of the Perseus and Theseus unmanned research aircraft, as
Chief Scientist at Aurora Flight Sciences (Manassas, Virginia). He proposed the Aerosonde
concept in 1991 and has since managed its development at Insitu.

Laurence R. “Nuke” Newcome - is Director of UAV Activities at Adroit Systems, Inc. of
Alexandria, VA, where he is responsible for developing commercial reconnaissance markets for
unmanned vehicles. He has worked with Federal Aviation Administration regional offices to obtain
Certificates of Authorization for UAV flights in civil airspace on numerous occasions. Prior to
joining Adroit, he served in the U.S. Air Force and coordinated deployments of the Predator, Gnat,
and Pioneer UAVs into Europe, followed by a tour in the Defense Airborne Reconnaissance Office
overseeing development of the Global Hawk and DarkStar high altitude endurance UAVs.

Juris Vagners – is a Professor of Aeronautics and Astronautics and Adjoint Professor of Electrical
Engineering at the University of Washington (UW) in Seattle, WA. where he teaches control
systems engineering. Prior to joining the UW he worked at Lockheed Missiles and Space Division
in satellite guidance, control and navigation. He currently heads a research group at the UW
working in conjunction with The Insitu Group and Aerosonde Robotic Aircraft on the development
of second generation Aerosonde aircraft.
                                                2
The Insitu Group, Adroit Systems Inc., University of Washington                    June 4, 1999
1 Introduction                                     for European Airspace Coordination, which
                                                   we believe is addressing the issues of Air
The overarching goal of regulation of aerial       Traffic Control (ATC). In the United
vehicles is to ensure safe operation. To this      Kingdom, the 970 UAV-Sub-Committee is
end, regulation seeks to minimize the risks to     working on amendments of Def Stan 00-970
1) individuals in an aircraft, 2) individuals in   to frame a UAV requirements guide. In
other aircraft, and 3) individuals and property    addition to this group, a new specialist
over which aircraft fly. Minimization is           industrial association, the Unmanned Aerial
achieved by promulgating air worthiness, air       Vehicle Systems Association, has been
operation, and air traffic standards,              formed in the UK. This group is specifically
respectively.                                      looking at Civil Airworthiness requirements.
                                                   An      excellent    overview     of    safety
Air worthiness standards ensure aircraft are       considerations for Uninhabited Combat Air
constructed for safe and reliable operation, air   Vehicles (UCAVs) is given in Ref 2. In the
operation standards ensure that pilots and         reference, the safety relationships within the
mechanics are trained and remain proficient        UCAV environment are highlighted and a
to a common level, and air traffic standards       comprehensive chart detailing a comparison
ensure that aircraft are channeled in time,        of the safely issues for UCAVs and inhabited
altitude, and geography to reduce the risk of      aircraft presented. The chart compares these
midair collisions and to the risk to individuals   issues based on operational profiles and
on the ground.                                     common risk factors.

In the United States (as well as elsewhere in      A sense of the broad range of issues covered
the world), specific versions of these             under flight safety for UAV’s intended for
standards have been developed for air carriers     military applications can be gained from
(passenger and freight), general aviation,         presentations at the recent 14th Annual UAV
helicopters, homebuilt aircraft, gliders, and      Systems Conference held in April, 1999 at
lighter-than-air craft, but not for uninhabited    Bristol, United Kingdom. The civilian sector
aerial vehicles (UAVs), or in US FAA               has not been addressed with anywhere near
terminology, remotely operated aircraft            the same degree of specificity. While many of
(ROAs). An air traffic standard (7610.4) for       the issues are common to both military and
military (not civil) ROAs exists and Notice        civilian UAVs, there are significant
N7610.71 issued by the FAA 3/19/99 (Ref 1)         differences that should be accounted for in
makes this standard effective May 1, 1999.         the development of regulations for civil
The civil version of this standard awaits the      UAVs.
manifestation of a need (i.e., a commercial
market) for ROA traffic to bring it to life. An    Some risk issues simply do not exist for
air     operation     standard     for     ROA     civilian UAVs. For example, all hazards
pilots/operators is in the discussion phase in     associated with military stores do not apply,
the US; it reportedly will not restrict future     nor those associated with battlefield
ROA operations to the exclusive domain of          operations. Others are common to all UAVs,
pilots, even if the US Air Force elects to do      but are not all equally significant for all
so. Air worthiness standards for ROAs do           aircraft, for example, different mission
not exist, although their manned counterparts      profiles and physical characteristics of the
are being applied selectively by ROA               vehicles mitigate some hazards and
manufacturers to their products.                   emphasize others. Thus, a regulatory
                                                   approach that recognizes such factors should
In Europe, a comprehensive working group           be adopted. One proposed approach is to
has been set up under the NATO Committee           establish UAVs and UCAVs as a separate
                                                3
The Insitu Group, Adroit Systems Inc., University of Washington               June 4, 1999
class of vehicle much in the same way that            scope. Since the primary focus of this paper is
helicopters, balloons and gliders are. We             on civilian UAVs, we will be brief in this
argue that this is still too broad to realistically   discussion. The U.S. military operates some
encompass civilian vehicles, and in particular,       125 ROAs on a regular basis and, being
small civilian vehicles that are intended for         generous, U.S. manufacturer’s flight activities
use as remote sensing platforms. An approach          may raise this number to 200, of which
that recognizes these issues would be                 perhaps 10 percent, again being generous,
consistent with the historical evolution of the       may fly on any given day. If all 20 of these
air vehicle certification process which               ROAs were the largest ROA for which at
recognizes that there is an intimate                  least 20 flying examples exist, the RQ-
relationship between the context in which the         1/Predator, which has an area of 200 square
vehicle is used, the integrity of the vehicle         feet and a weight of 2300 lbs, the total area at
itself and the interactions of the operators of       risk below a fleet of 20 falling Predators is
the vehicle and the supporting ground                 some 4000 square feet. The density of the
systems such as ATC. In the following                 265 million U.S. citizens spread evenly over
sections we examine the implications of such          the 3.5 million square miles of the U.S. is
an approach.                                          some 76 people per square mile, or 368,000
                                                      square feet per individual, making the odds of
2. Hazard Estimation                                  an individual being hit by a falling UAV
                                                      0.000543, or 1 in 1840. Since its first flight
Principal sources of potential hazards to             in July 94, six Predators have crashed (not
individuals and property from UAVs arise              counting two that have been shot down), for
from 1) the flight integrity of the vehicle           an averaged loss rate of one every 9.3 months
itself, 2) midair collisions, and 3) collision        (as of Feb 99); this interval has actually
with persons or objects on the ground,                grown to 18 months for the most recent
whether by the entire aircraft or pieces of it        losses. (Similar mishap data rates are
following in-flight mishaps. The hazard               available for Navy RQ-2/Pioneer, Army RQ-
analysis for inhabited aircraft is driven by the      5/Hunter, and other large military UAVs).
fact that the probability of injury due to            Using the former interval means a falling
potential loss of aircraft is much higher than        Predator could be expected to hit a person on
that due to all other sources. Analysis thus          the ground once every 1431 years; for the
emphasizes probable loss of aircraft due to           latter, more recent interval, this rate becomes
functional failures, rather than the estimation       once every 2760 years. This is a conservative
of ground casualties. Experience has shown            estimate because the simplifying assumptions
that the in-aircraft injuries far outweigh            used in reaching it were obviously
injuries on the ground. Removal of the crew           conservative, such as the U.S. population
from the aircraft changes this scenario in that       being uniformly distributed instead of
now sources 2) and 3) become the drivers of           clumped together in metropolitan areas, to
hazard estimation. If airworthiness standards         name one. But whether the probability of
are now also meant to protect those on the            occurrence is once a millennium or once
ground from frequent falling debris, then the         every other millennium per fatality, the risk to
associated probability of occurrence must be          people on the ground from the current level of
examined.                                             UAV activity does not currently appear to
                                                      justify air worthiness standards for UAVs.
2.1 Military UAVs
                                                      Air operation standards holding “remote
Let us first discuss these issues for large           operators” to the same standards as general
UAVs in the military sector. We will address          aviation pilots would pose no hurdle to
the operations of civilian UAVs separately            present and future UAV expansion into the
since these have been much more limited in            national airspace. Then again, some of the
                                                4
The Insitu Group, Adroit Systems Inc., University of Washington                   June 4, 1999
medical and physical limitations placed on         scan the surrounding airspace for approaching
pilots would fail the reasonableness test if       aircraft and take action to avoid a midair.
applied to their UAV counterparts. Example:        Voice relay is built into, or being retrofitted
Sinus blocks should not be disqualifying for       on, all Predator-size and larger military
that day’s UAV flight when its pilot will see      UAVs, and, as technology reduces costs, will
no pressure change due to altitude. Indeed,        work its way down into the smaller, tactical
paraplegics could safely navigate all but the      UAVs.      What constitutes the undefined
few UAVs which replicate rudder pedals in          concept of “see & avoid” (there is no formal
their ground cockpits. The premise that a          FAA definition of it) is still being discussed
remotely located pilot would not have the          by UAV proponents and the FAA.
same vested interest in steering his or her
disabled aircraft away from populated areas        Today, regional offices of the FAA issue
that an onboard pilot would is fallacious on a     Certificates of Authorization (COAs) for
number of counts. First, the remote pilot is       ROAs to operate within specified areas for
free to focus on salvaging some kind of            periods of up to one year as long as they
landing without having to share his or her         conform to certain, manned aircraft-like
attention with thoughts of ejection or impact.     weather, safety, and operating limitations.
Second, short of a catastrophic failure, the       Although requests for COAs are required at
need to maintain line-of-sight communication       least 60 days prior to flight, FAA
with the UAV dictates turning the UAV              responsiveness experienced to date has been
toward base and/or the highest ground near it      from 1 to 10 days. For the near future,
in order to maintain control as long as            Traffic Conflict Alert Systems (TCAS)
possible. Third, there have already been           appear to be part of the answer, perhaps in
numerous instances in Bosnia in which the          combination with the reconnaissance UAV’s
pilot of a “non-returnable” UAV safely and         electro-optical or infrared mission sensors.
successfully steered the aircraft into             Of course, using these sensors for see &
controlled crashes in unpopulated areas. The       avoid detracts from the mission of the UAV
FAA seems to be adopting the general criteria      in the first place, scanning the ground vice the
of having “familiarity with operations in the      surrounding airspace. In the far future, the
national airspace” as its qualifying standard      Global Air Traffic Management (GATM)
for future UAV flyers.                             system is to migrate away from IFF-based,
                                                   ground-centralized, situational awareness to
Development of air traffic standards for           GPS-based, aircraft-localized situational
UAVs, however, unlike the two previous             awareness. In such an environment, the UAV
regulations, are crucial to their gaining          would, capability-wise, be an equal player
acceptance in the current civil airspace           with its manned counterparts. Bridging the
structure. These standards play a large part       airspace regulatory environment until that
in minimizing the risk to people and property      time is the challenge.
on the ground, as well as reducing the
chances of a midair, by providing aerial           2.2 Civilian UAVs
highways, altitude floors, and special use
bubbles of airspace.       Two capabilities,       To estimate hazards for civilian UAVs we
inherent in manned aircraft operations, must       need to rely on standard probability methods
be built into UAVs to allow them to operate        as comparatively little data exists on both
in this structure with an equivalent level of      numbers of aircraft and flight hours.
safety: These are: voice relay, so that the        Specifically, we need to estimate the
UAV pilot can hear, acknowledge, and               probability of hitting a manned aircraft in
respond to directions from air traffic control     flight or an individual or property on the
centers immediately as though he or she were       surface. The details of the analysis are given
onboard, and “see & avoid,” the ability to         in the appendix and the interested reader can
                                                5
The Insitu Group, Adroit Systems Inc., University of Washington                June 4, 1999
examine these probabilities for any vehicle of      eight flights with no lost aircraft.
interest using the formulae in the appendix or
modifying them to fit the scenario of interest.     Turning now to the results of our analysis, we
                                                    first consider the probability of a mid-air
Since it appears that the most likely civilian      collision of an Aerosonde with other traffic
UAV applications in the near future will            (appendix section A.1). Consider first the
involve small, low speed, low weight vehicles       case of encountering Boeing 747s as an
for remote sensing, we focus on this class of       example of large targets. In this case, the
vehicles. Of this class, the Aerosonde (see         applicable collision frequency is 10-9 per
web sites Ref 3,4) has reached the highest          flight-hour, this being the maximum rate of
level of maturity and accumulated the most          catastrophic failure considered acceptable by
flight hours to our knowledge. The                  the US FAA. Using 747 parameters of frontal
Aerosonde was developed by The Insitu               area t =2x10-4 km2, and average speed Vt =
Group and Environmental Systems and                 860 km/hr, the corresponding Aerosonde
Services of Australia (responsibility now with      density is s =10-8 per cubic kilometer.
Aerosonde Robotic Aircraft, Ltd of Australia)
under the sponsorship of the Australian             Next, consider the case of general aviation.
Bureau of Meteorology, US Office of Naval           Here we set the allowable collision frequency
Research, US Department of Energy,                  at 10-7 per flight-hour, which is closer to the
Environment Canada, US National Weather             historical rate achieved by the “see-and-
Service and the Taiwan Central Weather              avoid” paradigm. The average speed and
Bureau. This list of sponsors also serves to        frontal area parameters are Vt = 200 km/hr
support the expectation that the Aerosonde          and      t =10
                                                                    -5
                                                                       km2. In this case, the
will be the first civilian UAV in significant       corresponding Aerosonde density is s =10-4
numbers to enter service on a regular basis for     per cubic kilometer. The allowable
specific meteorological missions. All               Aerosonde density in this case is significantly
Aerosonde flights to date have been under           higher, but also significantly higher than
mission-specific Special Flight Operations          anything one would expect in practice, so the
Certificates issued by the appropriate agency       probability of collision would still be
in the country (or countries) in which the          negligible by current standards, even if
trials were conducted.                              nothing were done about avoidance or
                                                    appropriate Aerosonde distributions. For
We first wish to emphasize that the                 example, decreased Aerosonde distribution in
Aerosonde development is driven the                 areas of transiting aircraft such as oceanic
economics of the application to remote              tracks can be easily arranged since airways
meteorological sensing. This means that             and other busy airspace are well defined over
aircraft reliability and system complexity          regions of interest to the operators of
(hence cost) are in constant trade-off. This        Aerosondes. Aerosondes can be programmed
also means that the Aerosonde development           to avoid such areas both laterally and
has proceeded hand-in-hand with field trials,       vertically. Note that this entails no
thus sustaining higher aircraft losses than one     requirement for the avoidance strategy to be
would accept in routine service. In 1998, we        perfectly reliable – even if it worked only
lost 8 aircraft in about 400 flight hours, with 3   90% of the time, it would reduce Aerosonde
out of 4 aircraft lost in the ultimately            density tenfold in areas of concern.
successful, historic North Atlantic crossing
attempt (Ref 5,6). However, the responsible         Let’s next consider crash hazards (appendix
technical faults are well understood and are        section A.2). In this case we first consider the
being fixed. For example, in the most recent        hazard to ships since a highly likely scenario
field trials in Hawaii in May of 1999 two           of operations will be over the oceans. For
Aerosondes flew approximately 70hrs in              illustration, consider the hazard to ships
                                                6
The Insitu Group, Adroit Systems Inc., University of Washington                   June 4, 1999
arising      from       Aerosondes        doing    target cross track position yt = 3 y . With
meteorological reconnaissance over the high        these numbers the probability of a strike turns
seas, e.g. on a transatlantic or transpacific      out to be about 4x10-9. On average, one of
flight. Rough numbers are target density per       every 200 million such bystanders passed
unit area t = 4x10-4/km2 (assuming 105 ships       would be hit.
randomly distributed over the oceans), target
length lt = 0.1 km, averaged over all ship         This result might be questioned on the basis
sizes and orientations, target span bt = lt with   that some failures, such as that of the flight
all orientations being equally likely, and         computer, would cause loss of tracking
average crass frequency fi = 10-3 per flight-      performance. In that case a deadman’s switch
hour. Then average collision fc is about           would kill the engine, but the aircraft would
4x10-9 per flight-hour.                            then crash, with equal probability, anywhere
                                                   within gliding range.
Meteorological requirements ultimately may
entail about 106 annual Aerosonde hours in         Suppose we want to keep the average strike
oceanic reconnaissance. At this rate ships         rate below 10-7 per flight-hour, which seems a
would be hit on the average once every 250         reasonable guess at the present rate for
years. Actually, as a hazard estimate this is      inhabited aircraft. What restrictions must be
pessimistic: the probability of seriously          imposed on the areas overflown? We use the
damaging a ship with a 13 kg Aerosonde             same numbers as the last example, except
would be a good deal smaller. But 4x10-9 per       with a failure rate of 10-4 per flight-hour
flight-hour is already small enough to be          rather than 10-3 per flight-hour, because we
negligible.                                        are accounting only for events that cause
                                                   uncontrolled departure from track. The factor
Note that the hazard probability in this case is   of ten is a minimum requirement dictated by
very much less than the aircraft crash rate – a    economics of Aerosonde operations. In
situation obviously different from that in         estimating the costs of meteorological
manned aircraft as we noted earlier! The           reconnaissance by Aerosondes, we presume
hazard probability becomes comparable with         that most attrition will be caused by adverse
the crash rate only if the target density is       weather conditions. If systems failures were
high. Thus as the ship example illustrates,        to cause attrition at a comparable level, then
reliability requirements can be substantially      economics could be improved by making the
relaxed if operations are planned to avoid         design more reliable. Hence for minimum
high density areas.                                cost the systems failure rate must be made
                                                   small compared to the overall loss rate, i.e. no
Let’s consider then a flight-plan leg designed     worse than 10-4 per flight-hour. At this rate
to keep the aircraft over reasonably sparsely      the maximum allowable t turns out to be
populated terrain and estimate the probability     about 1 house per square kilometer.
of hitting a house. There will be some error in    Obviously this means that overland
tracking the leg and the aircraft may overfly a    operations must be conducted in remote
few bystanders. To illustrate, consider the        surroundings – but then economical access to
case for a typical Aerosonde and a typical         such areas is the whole purpose of the
house. The numbers are: Aerosonde speed Vs         Aerosonde project!
= 80 km/hr, standard tracking deviation y =
0.05 km (consistent with flight experience to      3 Conclusions
date), flight path angle = 1/20 (at best L/D,
hence conservative for most failures), width       In this paper we have highlighted some of the
of house bt = 0.03 km (typical, not Microsoft,     features of quantitative risk management as a
house), height of house ht = 0.006, average        regulatory approach to UAVs. This approach
crash frequency fi = 10-3 per flight-hour and      is most appropriate for civil UAVs in that

                                                7
The Insitu Group, Adroit Systems Inc., University of Washington                June 4, 1999
their operations will, at least in the near        Overall height: 0.6 m
future, be strongly mission oriented and the       Body depth: 0.19 m
characteristics of these missions are easily       Typical empty weight: 8.2 kg
defined. As shown by the results for the
Aerosonde, for small, light, low speed UAVs        Maximum launch weight: 13.4 kg
operated outside densely populated areas, the      Maximum fuel capacity: 5.0 kg (7 litres)
hazard probabilities are extremely low.            Powerplant: modified Enya R120
                                                   Type: single-cylinder, four-stroke, air-cooled
4 References                                       piston engine
1. “Department of Defense (DOD) Remotely           Manufacturer: ES&S, Melbourne, Australia
Operated Aircraft (ROA) Operations”, Notice
                                                   Rating: 0.75 kW
N 7610-71, US Dept of Transportation,
Federal Aviation Administration, March 19,         Fuel: Avgas 100LL
1999                                               Propellor: two-blade, fixed-pitch, 51cm
2. “Flight Safety Considerations for UCAV          diameter
Aircraft”, R.C. Wells, D.J. Hamlin, R.B.           Electrical power: 10 W typical
Smith, Proc. UAVs 14th Int. Conf., Bristol,        Ambient temperature range -10C to +40C
UK, April 12-14, 1999                              Max level speed: 56 kt
3. http://www.insitugroup.com                      Cruise Speed: 40 kt
4. http://www.aerosonde.com                        Loiter Speed: 40 kt
5. “Aerosonde Operations in 1998”. T.              Max S/L climb @ max TOW: 2 m/s
McGeer, G. Holland, G. Tyrrell, J. Becker, J.
Vagners, P. Ford, Proc. Third Symposium on         Service ceiling: 4500 m
Integrated Observing Systems: 60-63.               Still-air range: 1500 nm
American Meteorological Society, Dallas,           Max endurance: 32 hr in typical cruise profile
January 1999                                       Launch: From a car roof, using a cradle that
6. “Historic Crossing: An Unmanned                 fits most vehicles. Takeoff is normally flown
Aircraft’s Atlantic Flight”, T. McGeer, J.         manually by an outside pilot. Automatic
Vagners, GPS World 10 (2), Feb 1999                takeoff capability has been demonstrated.
                                                   Recovery: Belly landing. The aircraft has no
Appendix: Aerosonde Hazard Estimation              undercarriage. Landings are normally flown
                                                   manually but autoland has been
We are interested in estimating the
                                                   demonstrated.
probability of an Aerosonde hitting a manned
aircraft in flight, or an individual or property
                                                   A1. Midair collision
on the ground. In this appendix we work
through the analyses and example                   To formulate the problem, first consider
calculations for each case. We provide the         conflict in 2D. The extension to 3D follows
general specifications for the current             readily from the 2D case since aircraft fly at
generation Aerosonde used to illustrate the        shallow angles so the principal component of
calculations.                                      converging velocity will remain horizontal.
                                                   We assume that Aerosondes are operating
Aerosonde Mark I General Specification             randomly in a plane. You want to know the
Mission: Long-range meteorological                 probability of collision if you fly across the
reconnaissance and environmental monitoring        plane. A collision will occur if there is an
Wing span: 2.9 m                                   overlap of the areas swept out by your aircraft
Wing area: 0.55 sq m                               and that swept out by the Aerosonde in time
                                                   dt. In time dt you sweep through area dA
Overall length: 1.7 m

                                                8
The Insitu Group, Adroit Systems Inc., University of Washington               June 4, 1999
dA          bt Vt 2            Vs2       2Vt Vs cos dt              We can now evaluate collision frequencies
                                                                    for randomly distributed Aerosondes given
where Vt is your speed, bt is your wingspan,                        assumed densities. Conversely, we can solve
Vs is the Aerosondes’ speed and          is the                     this equation for the density of Aerosondes
crossing angle. In this equation we have                            leading to specified collision frequencies, as
neglected the Aerosondes’ wingspan (small in                        would be set by regulatory agencies.
comparison to anything else up there!). To
include it, just replace bt        by (bt+bs).                      Consider first the case of encountering
Assuming that traffic moves in random                               Boeing 747s as an example of large targets.
directions so that all values of are equally                        In this case, the applicable collision
likely, we average over all possible directions                     frequency is 10-9 per flight-hour, this being
to find                                                             the maximum rate of catastrophic failure
        1 2                                                         considered acceptable by the US FAA. Using
dA          dA d                                                    747 parameters of t =2x10-4 km2, Vt = 860
       2 0
                                                                    km/hr , the corresponding Aerosonde density
                          2                      2                  is s =10-8 per cubic kilometer.
                1                         Vs             Vs
dA     bt Vt dt                      1               2      cos d
                2          0
                                          Vt             Vt         Next, consider the case of general aviation.
From this we see that if the ratio of the                           Here we set the allowable collision frequency
Aerosonde speed to that of the encountered                          at 10-7 per flight-hour, which is closer to the
         V                                                          historical rate achieved by the “see-and-
traffic s increases from zero to 0.5 for                            avoid” paradigm. The average speed and
         Vt
                                                                    frontal area parameters are Vt = 200 km/hr
example, the bracketed coefficient increases                                        -5
                                                                    and      t =10     km2. In this case, the
from one to about 1.3. For order of magnitude
estimation this change is negligible, so one is                     corresponding Aerosonde density is s =10-4
justified in using the simpler formula                              per cubic kilometer. The allowable
                                                                    Aerosonde density in this case is significantly
dA     bt Vt dt                                                     higher, but also significantly higher than
                                                                    anything one would expect in practice, so the
                                                                    probability of collision would still be
The probability of collision during the time
                                                                    negligible by current standards, even if
interval dt for Aerosonde density per unit area
                                                                    nothing were done about avoidance or
of s is
                                                                    appropriate Aerosonde distributions. For
                        s bt Vt dt
                                                                    example, decreased Aerosonde distribution in
P dt
 c          1 e                           b V dt
                                         s t t                      areas of transiting aircraft such as oceanic
                                                                    tracks can be easily arranged since airways
with the approximation for sbtVt dt     1.                          and other busy airspace are well defined over
Hence the probability of collision per unit                         regions of interest to the operators of
time is                                                             Aerosondes. Aerosondes can be programmed
                                                                    to avoid such areas both laterally and
     dPc                                                            vertically. Note that this entails no
fc                b Vt
                  s t
     dt                                                             requirement for the avoidance strategy to be
                                                                    perfectly reliable – even if it worked only
To extend this relationship to the 3D case, we                      90% of the time, it would reduce Aerosonde
need to replace aerial density           s by                       density tenfold in areas of concern.
volumetric density s and target width bt by
target frontal area t . Thus fc becomes                             A.2 Crash Hazards

fc          V                                                       Aircraft crash from time to time and thus
        s   t t
                                                                    constitute a hazard to innocent bystanders on
                                                9
The Insitu Group, Adroit Systems Inc., University of Washington                                June 4, 1999
the surface. The fundamental principle that                   oceanic reconnaissance. At this rate ships
the general public must be protected from any                 would be hit on the average once every 250
form of flying machine has remained the                       years. Actually, as a hazard estimate this is
constant driver of safe operation. No matter                  pessimistic: the probability of seriously
what the design and purpose of the aircraft, it               damaging a ship with a 13 kg Aerosonde
must be certified and operated with this                      would be a good deal smaller. But 4x10-9 per
principle in mind and it is certain that                      flight-hour is already small enough to be
certification and operation of UAVs will                      negligible.
follow the same principle.
                                                              Note that the hazard probability in this case is
Suppose that the average frequency of crashes                 very much less than the aircraft crash rate – a
is fi. Then the probability of a crash in any                 situation obviously different from that in
interval of time dt is                                        manned aircraft! The hazard probability
                                                              becomes comparable with the crash rate only
                       fi dt
P dt
 i          1 e                  fidt where f idt         1   if the target density is high. Thus as the ship
                                                              example illustrates, reliability requirements
Thus the probability of crashing in the                       can be substantially relaxed if operations are
interval required to cross a “target” of length               planned to avoid high density areas.
lt would be
                                                              Let’s consider then a flight-plan leg designed
                 lt                                           to keep the aircraft over reasonably sparsely
P lt
 i          fi                                                populated terrain. There will be some error in
                 Vs
                                                              tracking the leg and the aircraft may overfly a
                                                              few bystanders. We can calculate the
Meanwhile, the probability of such a target
                                                              associated hazard as follows.
actually being in the flight path during this
interval is the product of the combined width
                                                              Take the tracking error to be Gaussian with
of the aircraft and the target (bs + bt ), length
along the track Vsdt , and the average density                standard deviation y. The probability of
                                                              crossing a bystander of width bt at a distance
of targets on the surface t. The overall
                                                              yt from the track centerline is
probability of a strike, per unit of flight time,
thus is                                                                         1          yt    bt b s / 2                 1/ 2 y /
                                                                                                                                           2

                                                              p yt                                                 e                   y
                                                                                                                                               dy
                                                                            y       2   yt       bt b s / 2
            lt
fc     fi             bs       bt Vs   t   filt bs   bt   t
            Vs
                                                              and for bt+bs<<           y       this becomes
For illustration, consider the hazard to ships                             bt       bs       1/ 2(y t /       )2
arising       from      Aerosondes        doing               p yt                     e                  y


                                                                            y       2
meteorological reconnaissance over the high
seas, e.g. on a transatlantic or transpacific
                                                              The probability of a strike is then
flight. Rough numbers are t = 4x10-4 per
km2 (assuming 105 ships randomly distributed                              lt bt bs               1 / 2(y t /           )2
over the oceans), lt = 0.1 km, averaged over                  Pc     fi            e                               y


all ship sizes and orientations, bt = lt with all                         Vs y 2
orientations being equally likely, bs << bt, and
fi = 10-3 per flight-hour. Then fc is about                   If the bystanders are high rather than long, so
4x10-9 per flight-hour.                                       as to be more likely to be hit from the side
                                                              rather than from above, we approximate lt by
Meteorological requirements ultimately may                    the ratio ht/ with      being the flight path
entail about 106 annual Aerosonde hours in                    angle.
                                                10
The Insitu Group, Adroit Systems Inc., University of Washington                                                    June 4, 1999
To illustrate, consider the case for a typical                    areal density t , the average strike
Aerosonde and a typical house. The numbers                        probability for all bystanders is
are: Vs = 80 km/hr, y = 0.05 km (consistent
with flight experience to date), = 1/20 (at                                    lt    bs bt       bs        1
                                                                                                               1
                                                                                                                    1 y2
best L/D, hence conservative for most                             Pc    2 fi                                               dy
                                                                                      Vs Ri                2        4 1 y2
failures), bt = 0.03 km (typical, not Microsoft,                                                               1

house), ht = 0.006, fi = 10-3 per flight-hour                                            bt bs
and yt = 3 y . With these numbers the                             Pc     0.24 fi
                                                                                          VsRi
probability of a strike turns out to be about
4x10-9. On average, one of every 200 million
                                                                  The average number of bystanders at risk per
such bystanders passed would be hit.
                                                                  unit time is
This result might be questioned on the basis                      dN
that some failures, such as that of the flight                            2Vs Ri     t
computer, would cause loss of tracking                             dt
performance. In that case a deadman’s switch
                                                                  and the average rate of bystander strikes is
would kill the engine, but the aircraft would
then crash, with equal probability, anywhere
within gliding range. Hence the crash radius                      fx    0.48 fi lt        bs bs       bt       t

is Ri = h/ . The bystander is at risk if the
failure occurs anywhere on a flight segment                       This is essentially the same result as we had
of length                                                         earlier. Note that the altitude doesn’t appear,
                                                                  except indirectly in the sense that the higher
                                 2                                the altitude, the wider the corridor over which
                           yt                                     the bystander density must be calculated.
li       2Ri 1
                           Ri
                                                                  Suppose we want to keep the average strike
The probability of failure on this segment is                     rate below 10-7 per light-hour, which seems a
                       l                                          reasonable guess at the present rate for
given by P li
            i       fi t . If the failure occurs,                 inhabited aircraft. What restrictions must be
                      Vs
then the bystander’s probability of being                         imposed on the areas overflown? We use the
struck is just his or her fraction of the affected                same numbers as the last example, except
area i.e.                                                         with a failure rate of 10-4 per flight-hour
                                                                  rather than 10-3 per flight-hour, because we
          lt     bs bt           bs                               are accounting only for events that cause
     t            2
                                                                  uncontrolled departure from track. The factor
               R i     2Rili                                      of ten is a minimum requirement dictated by
                                                                  economics of Aerosonde operations. In
Hence the overall probability of striking the                     estimating the costs of meteorological
bystander is                                                      reconnaissance by Aerosondes, we presume
                                                                  that most attrition will be caused by adverse
                                                    yt
                                                         2
                                                                  weather conditions. If systems failures were
                                              1                   to cause attrition at a comparable level, then
                      lt        bs bt    bs         Ri
Pc yt          2 fi                                               economics could be improved by making the
                                 Vs Ri                   yt
                                                              2
                                                                  design more reliable. Hence for minimum
                                              4 1                 cost the systems failure rate must be made
                                                         Ri
                                                                  small compared to the overall loss rate, i.e. no
                                                                  worse than 10-4 per flight-hour. At this rate
assuming then that bystanders are randomly                        the maximum allowable t turns out to be
distributed across the track, with average                        about 1 house per square kilometer.
                                                11
The Insitu Group, Adroit Systems Inc., University of Washington                                                June 4, 1999

				
DOCUMENT INFO
Shared By:
Categories:
Tags:
Stats:
views:22
posted:7/22/2011
language:English
pages:11
Description: Quantitative Approach to Risk Management document sample