Browse Topic: Risk assessments

Items (153)
Find
An Update on The Regulatory Readiness Level (RRL): An Objective Measurement of Progress Toward Civil Type CertificationF-0081-2025-01955/20/2025
Aircraft Certification is a mature and complex bureaucracy that has successfully ensured a very high degree of safety of aircraft design, construction, operation and maintenance. Outside of a very few doing the work, there is a general lack of knowledge of certification details. For novel technologies such as electric power, and innovative configurations such as multi-rotors, the rules are far less mature and still emerging and so also poorly understood. Within the Advanced Air Mobility (AAM) initiative, many new aircraft developments are underway using novel configurations, and the public announcements of regulatory progress toward FAA or EASA Type Certification capitalize on this ignorance by being vague or even misleading. Honeywell conceived the Regulatory Readiness Level (RRL) indicator as an objective measure of certification status to serve the AAM industry and ecosystem, with applicability across aviation. The released RRL Version 1 now enables credible, objective assessment of new aircraft progress toward FAA Type Certification, and Operational Approval for Part 135 operations, to allow consistent apples-to-apples comparisons with other aircraft in development. An emerging complementary version of the rubric for EASA Type Certification is ready for publication to enable RRL determination against the European Union criteria. Future releases will consider other Nation's regulatory authorities, supplemental types certifications (STCs), and risk-based airworthiness assessments such as the Specific Operations Risk Assessments (SORA).
Agrawal, Pulkit, Newman, Daniel
Adding Digital Twin Concepts to Helicopter Component Structural Life AssessmentF-0080-2024-12325/7/2024
The airframe digital twin analysis framework developed at the National Research of Canada is being transposed to safe life applications for rotorcraft components. A probabilistic safe life prediction approach, consisting of uncertain material property data and uncertain load spectra is used to calculate risk assessment metrics, such as the cumulative probability of failure, the hazard rate, and the average hazard rate as a function of time. A demonstration of this approach is presented for a CH-146 Griffon component, for which the uncertain loads are estimated from a model developed through machine learning. This preliminary assessment shows the feasibility of using digital twin concepts as a viable alternative to traditional deterministic life predictions, with the potential to reduce maintenance costs and increase aircraft availability.
Renaud, Guillaume, Wooldridge, Jack, Cheung, Catherine, Asaee, Zohreh
Quantitative Risk Assessment of Component Retirement Time ReductionF-0079-2023-181575/16/2023
ABSTRACT
Pham, Loan, Hewitt, John
Test Preprint 20220628 By Madhukar DongariSAE-PP-025996/28/2022
Test Preprint 20220628 By Madhukar Dongari
Mutagaana, Festo
A Method to Reduce Rotorcraft Development Risk by Integrating Historical Quantitative Risk Assessment into Fault Tree ModelsF-0078-2022-176135/10/2022
ABSTRACT
Pham, Loan(Joan), Hewitt, John
Integration of System Reliability Theory into Quantitative Risk AssessmentF-0077-2021-168535/10/2021
ABSTRACT
Hewitt, John, Pham,  Loan
Leveraging Risk Tolerances and Simple Kinematics to Quantify Fault Tolerant Time Intervals for Commercial Trucks2021-01-00664/6/2021
The ISO 26262 series of standards for vehicle functional safety codify requirements to avoid unreasonable risk from the failure of electrical or electronic (E/E) systems. E/E failures may cause malfunctioning behavior that manifest as vehicle-level hazardous events. The ISO 26262 second edition includes commercial trucking, which employs significant variation from the passenger car development cycle. The highly distributed nature of E/E system development and integration in commercial trucks complicates forging unified safety concepts. For instance, the Fault Tolerant Time Interval (FTTI) quantifies the minimum time span from the occurrence of a fault to the possible occurrence of a hazardous event. Often, the subjectivity involved in defining unreasonable risk and hazardous event onset frustrates consensus among stakeholders. In order to provide some uniformity in the adoption of ISO 26262 across the commercial truck industry, this paper introduces the Risk Threshold (RT) Method to clarify the boundary between acceptable and unreasonable risk. RT is defined as the acceptable travel distance caused by a malfunctioning behavior. The RT Method includes: Selecting a malfunctioning behavior and a corresponding hazardous event from a Hazard Analysis and Risk Assessment (HARA) Designing a vehicle-level experiment that simulates the hazard Defining a RT that quantifies hazardous event onset Applying kinematic equations using the RT and experimental data to calculate FTTI This paper applies the RT Method to four key hazards: unintended acceleration, unintended motion, unintended direction, and increased stopping distance. For ease of illustration, all motion described in this paper aligns with a truck’s longitudinal axis. The RT Method correlates FTTI to hazardous event onset using objective and repeatable measurements. For commercial trucks, consistently predictable velocity during the FTTI facilitates this correlation. The simplicity of this approach enables stakeholder comparison of differing risk tolerances in terms of RT. Driving consensus on RT then yields a corresponding FTTI.
Jones, Darren K, Awowede, Collins, Ellinger, Michael, Kretz, Angelina, Krishnamoorthy, Jayalekshmi
Performance Deterioration of Rotorcraft Engines fitted with Particle SeparatorsF-0076-2020-1633510/5/2020
Military rotorcraft engines operating in harsh environments routinely ingest large quantities of mineral dust, which can degrade components and ultimately reduce operability. Time off-wing for unscheduled maintenance is a costly burden, both financially and operationally. Rapidly predicting engine deterioration rates as a function of the mission presents an opportunity to optimise flow of supplies, better manage fleets, and perform safety risk assessments when dust loading is expected to be particularly high. In the current contribution, we present our ongoing efforts in this field with a new methodology for assessing the effectiveness of inertial particle separators and quantifying the changes they impart to the inbound dust. We demonstrate that both the concentration reduction and the modification to the particle size distribution can be made on the basis of a single independent variable- a generalised Stokes number for inertial particle separators- and a single performance parameter- the corrected separation efficiency. To develop these parameters we conduct numerical simulations of the flow through a generic axi-symmetric inertial particle separator, over a range of five mass flow rates, three scavenge mass flow rates, and 16 particle diameters. In addition to this, a framework is presented to enable an estimation of the dust concentration at the engine intake. This is achieved by correlating the total wake strength to an existing dust landing trial dataset. A coupled rotorcraft-engine model is then used to combined the two methodologies to investigate the influence of engine mass flow rate on dust ingestion rate. A weak non-linear relationship is observed, which arises due to the simultaneous increase in wake strength with engine mass flow rate as rotor power requirements increase. The additional dust stirred up by the stronger wake leads causes this non-linearity. Finally, we show that an improvement in separation efficiency caused by higher engine mass flow rate is far outweighed by the associated increase in dust loading in this condition.
Bojdo, Nicholas, Appleton, Wesley, Ellis, Matthew, Filippone, Antonio, Hee, Jee-Loong
Appropriate Calculation of Risk per Flight Hour for Rotorcraft Safety Risk ManagementF-0076-2020-1634710/5/2020
Quantitative Risk Assessment has become essential in rotorcraft safety risk management. Measures of risk include Cumulative Fleet Risk (also called Risk Factor), Risk per Flight, and Risk per Flight Hour. Each measure applies to a different situation and can produce the same or different predictions of future risk. Risk for a large fleet of aircraft might be accurately predicted by Cumulative Fleet Risk, whereas Risk per Flight or Risk per Flight Hour might be best for a small fleet of rotorcraft, a flight test program, or a fleet with low flight hours. Calculating risk per flight hour seems as simple as dividing the number of previous occurrences by the flight hours for the total fleet, but this is appropriate only in the case of random distribution. Most failures that lead to hazards are not random because the failure mechanism has a specific cause. A more appropriate method is to develop the future event forecast using Quantitative Risk Assessment, then divide that by the future fleet hours. The simple division process requires only two numbers and can be completed quickly, but with a possibly inappropriate or misleading result for anything but a random distribution. The approach presented here results in a risk prediction that is appropriate for hazard rates that are increasing, decreasing, or constant, and for non-random distributions, which could prevent misleading or unconservative risk management decisions.
Hewitt, John, Loan, Dr.
Standard for Refrigerant Risk Analysis for Mobile Air Conditioning SystemsJ2773_202005 (Current)5/15/2020
This SAE Standard describes methods to understand the risks associated with vehicle mobile air conditioning (MAC) systems in all aspects of a vehicle’s lifecycle including design, production, assembly, operation, and end of life. Information for input to the risk assessment is provided in the appendices of this document. This information should not be considered to be complete, but only a reference of some of the data needed for a complete analysis of the risk associated with the use of refrigerants in MAC systems.
Interior Climate Control Vehicle OEM Committee
PTW Passive Safety: Numerical Study of Standard Impact Scenarios with Rider Injury Risk Assessment2020-01-09304/14/2020
Powered two-wheeler (PTW) riders and passengers are among the group of vulnerable road users (VRU). This group uses the road transportation system together with other better-protected users such as passenger cars and truck drivers. The main vulnerability of PTW rider lies in their unequal position during the crash, due to the inability of application of the crashworthiness concept during the PTW vehicle design. This inequality could be somehow mitigated by the design of personal protective equipment (PPE). Mostly the design of the PPE’s is led by the standards which often are obsolete and takes into account only simple drop-tests (ECE 22.05). Those tests did not take into account complicated kinematics of the motorcycle accidents and biomechanics of the human body (the assessment is based only on the linear acceleration of the headform center of gravity). The authors propose a virtual approach for the PTW rider injury risk assessment, which coupled with the pre-impact conditions, could be used for the new PPE protection standards preparation. In this paper, authors want to present a numerical study on the most common PTW impact scenarios, which are described in ISO 13232. The simulations of the accidents were conducted in the VPS numerical environment (PAM-Crash explicit solver). Accidents participants, namely opposite vehicle (OV) modeled by finite element method (FEM) approach, powered two-wheeler (PTW) modeled by multi-body system (MBS) approach, PTW driver represented by hybrid FE-MBS human body model Virthuman and a helmet (modeled by FE approach) were coupled to represent the 7 most common accident scenarios. The helmet is the only PPE enforced by the law, but not in all territories (Afghanistan, Dominica, Guyana, Mexico, Libya, Senegal, USA). Due to the complexity of the OV FE model, there was a necessity of model simplification and revalidation, which also was done in this work. The results of the simulations were examined with special emphasis on realistic representation of real accident kinematics. In each configuration, an injury risk assessment was done on the PTW rider model. The assessment was done based on injury criterion used by the NCAP, UNE 135900 and the LNL criterion. The paper shows that the virtual approach using the Virthuman human body model could be used for the simulation of PTW accidents. The results of this paper could be used for future PPE design.
Bonkowski, Tomasz, Hyncik, Ludek, Lv, Wenle
Preparing for MDR? Don’t Overlook the Analytical Evaluation ThresholdTBMG-360272/1/2020
Medical device manufacturers have a big challenge in preparing for their regulatory device submissions for 2020. In addition to the European Union’s new Medical Device Regulation (MDR) taking effect in May, the International Organization for Standardization (ISO) is expected published the latest version of ISO 10993-18 in January 2020. These updates will emphasize the criticality of chemical characterization studies and toxicological risk assessments, and a key concept in successful implementation of these activities is the analytical evaluation threshold (AET).
How to Protect Patients from Potential Electrical FailureTBMG-357771/1/2020
People and power don’t mix well, and this is particularly true when people are medical patients. Aside from the more usual environment of a medical facility, patients are also increasingly using medical devices at home. Medical equipment is therefore heavily regulated by standards-based requirements and subsequent product testing to ensure the safety of patients and healthcare professionals alike.
Collaborative Automation: It's More Than Just the CobotTBMG-3560812/1/2019
Collaborative robots, often called “cobots,” offer opportunities for companies of almost any size to cost-effectively automate processes that were previously out of reach. Cobots are available in a wide range of sizes, payloads, and capabilities but they all share attributes that define the term “collaborative.” The aspect that most people think of first is safety — the ability for cobots to work alongside human workers without bulky, expensive guarding. Cobots include a number of built-in safety mechanisms including rounded edges and softer materials as well as power-and force-limiting technologies that avoid injury and minimize discomfort in case of contact, and sensors that automatically slow or stop the robot arm if a human enters its workspace.
Study on Comprehensive Evaluation Index of Front Collision Hazard of Intelligent Vehicle2019-01-504411/4/2019
Collision avoidance technology is one of the key areas in the longitudinal safety research of intelligent vehicles. For the research of collision avoidance system, the existing methods usually use the evaluation index based on time interval or braking process to carry out risk assessment. In order to overcome the shortcomings of the formulas for describing the longitudinal hazard degree established in most studies, such as great differences, inconsistent standards and weak normalization, a comprehensive evaluation method for the longitudinal hazard in front-impact scenarios is established. This method takes into account both the analysis of time interval and braking process, and considers the non-linear variation of the longitudinal hazard degree with the real-time distance and speed of two vehicles. It can describe the longitudinal hazard degree of vehicles in dangerous traffic scenarios. Compared with the existing longitudinal hazard assessment methods, the effectiveness and universality of the pre-collision hazard assessment method proposed in this paper are demonstrated.
Jiaxiang, Qin, Zhang, Sumin, Weiwen, Deng, Rui, He
Guide to Package Integrity & Validation Testing under ISO 11607 and MDRTBMG-350859/1/2019
Updates to ISO 11607, Parts 1 and 2, have left many medical device manufacturers wondering about the future of their packaging designs. These changes come at a stressful time for OEMs, as Europe is also in the process of replacing the current Medical Device Directive (MDD) with the Medical Device Regulation (MDR) in 2020. The interplay between ISO 11607 and MDR is complex, and it’s difficult to predict regulators’ plans for enforcement.
Safety Assessment of General Aviation Airplanes and Rotorcraft in Commercial ServiceARP5151A (Current)8/20/2019
This document describes a process that may be used to perform the ongoing safety assessment for (1) GAR aircraft and components (hereafter, aircraft), and (2) commercial operators of GAR aircraft. The process described herein is intended to support an overall safety management program. It is to help a company establish and meet its own internal standards. The process described herein identifies a systematic means, but not the only means, to assess continuing airworthiness. Ongoing safety management is an activity dedicated to assuring that risk is identified and properly eliminated or controlled. The safety management process includes both safety assessment and economic decision-making. While economic decision-making (factors related to scheduling, parts, and cost) is an integral part of the safety management process, this document addresses only the ongoing safety assessment process. This ongoing safety assessment process includes safety problem identification and corrective action, tracking of problems, the application of “lessons learned” to improve the efficiency of the process, and reduction of the time to achieve corrective action in the field. ARP5150 is the recommended practice for the safety assessment of Transport Airplanes in Commercial Service. ARP5151 is the recommended practice for the safety assessment process for GAR aircraft in commercial services. While the processes are similar, their implementations are different due to operations, data availability, and sizes of individual operations.
S-18C ARP5150A and ARP5151A Working Group
Guarding of Starter System EnergizationJ1493_201908 (Current)8/8/2019
This SAE Standard describes guarding to help prevent hazardous machine movement caused by activation of the starter motor by bypassing the starter control system. This document is applicable to off-road, self-propelled work machines, as identified in SAE J1116, and agricultural tractors, as defined in ANSI/ASAE S390, which have the potential for hazardous machine movement as a result of bypassing the starter control system and powering of the starter motor.
OPTC1, Personnel Protection (General)
Scaling Evaluation of Ice-Crystal Icing on a Modern Turbofan Engine in PSL Using the COMDES-MELT Code2019-01-19206/10/2019
This paper presents preliminary ice-crystal icing (ICI) altitude scaling evaluation results of a Honeywell Uncertified Research Engine (HURE) that was tested in the NASA Glenn Research Center Propulsion Systems Laboratory (PSL) during January of 2018. This engine geometry features a hidden core design to keep the core less exposed. The engine was fitted with internal video cameras to observe various ice buildup processes at multiple selected locations within the engine core flow path covering the fan stator, the splitter-lip/shroud/strut, and the high pressure compressor (HPC) variable inlet guide vane (IGV) regions. The potential ice accretion risk was pre-determined to occur by using NASA’s in-house 1D Engine Icing Risk assessment code, COMDES-MELT. The code was successful in predicting the risk of ice accretion in adiabatic regions like the fan-stator of the HURE at specific engine operating points. However at several operating points during the test, liquid water was observed running along the shroud toward the variable IGV of the HPC regions with an air temperature well below freezing, thus no particle melting could have occurred due to heating from the air alone. It was reasoned that other sources of heat were present in that region. To account for these heat sources the inlet total temperature was adjusted to give a wet bulb temperature of 24 °F below the standard minimum wet bulb temperature of 492 °R to allow ice to accrete in the splitter-lip/shroud/strut region, which was determined from a reference case where hard ice was observed in that region. With that adjustment the COMDES-MELT code was successful in providing operating points where there was a risk of ice accretion during the test campaign. In addition to calculating possible conditions at different selected lower altitudes, simulations were run to determine potential inlet conditions that could lead to ice-crystal accretion along the prescribed stations where the cameras were available. From there, scaled test conditions were determined by best matching the following three icing related parameters of the reference condition: (1) the local air total wet bulb temperature, (2) the local ice crystal cloud melt ratio and (3) the engine fan face ice/water to air mass flux ratio of the ice crystal cloud. Instantaneous images taken from the time-lapsed movies of ice buildup were used along with the relevant thermodynamic data of air, water vapor and local icing condition to help evaluate how closely the proposed altitude scaling method could be used in ground based test facility to duplicate selected reference ICI features observed at specific location inside this engine at different scale altitudes. Discussions on observed limitation for engine icing scaling application from this test campaign and needed improvement are provided. A scaling test procedure to help identify potential ICI risk conditions and possible ice accretion locations of a new turbofan engine is evaluated in PSL.
Tsao, Jen-Ching
Application of Principles, Processes and Technologies to Design and Develop the SkyFlight Risk AssessmentF-0075-2019-147095/13/2019
The success of the flight mission is closely related to a wide set of factors that must be taken into consideration. Combining all these elements together, the risk associated to the flight can raise significantly, eventually resulting in a situation in which the flight should be cancelled, unless some mitigation of the risk factors are applied. The aim is the understanding of the expectable human abilities and limitations, in correlation with the aircraft status and all the external elements related to the flight. Following the guidance contained in Ref.1, this knowledge has being applied in the definition of a standardize approach for the design of the risk assessment procedures and software requirements. For the safety of the flight, it is essential that the pilot is able to discern in advance between a low and a high risk flight. With a Flight Risk Analysis Tool (FRAT) the pilot can proactively identify the hazard with a visual representation of the risk, applying an evaluation process and risk mitigation strategies, as described in Ref. 2. Moreover to better support this analysis the tool shall be enough complex to consider all aspects, but at the same time, easy to use and simply accessible (i.e. usable by an application installed on the portable device). SkyFlight has been developed to support the flight planning activities for the rotorcraft mission, being the optimal offaircraft mean to carry out the evaluation of the flight, ensuring a thorough Safety Assessment. Pilots have SkyFlight application installed on their portable devices to access the service. As presented in Ref.3, SkyFlight gives to the Pilot a deep understanding of the current situation and the involved dynamics, to anticipate changes and future developments, and to clearly understand the consequences related to the flight. The features are designed to positively increase the Pilot Situational Awareness and reduce mission risks. The Safety is spread within all functionalities, starting from simple and common concepts, to a finer level with a deep performance calculations and what-if analysis. To further increase the safety, the latest developed functionality is the Flight Risk Assessment, which has been developed following the EASA and FAA standards, discussed in Ref. 4 and 5, and embedding the EHEST pre-departure Risk Assessment Checklist, provided in Ref. 5. The predefined set of checklist is available to support different types of flight (Training, HEMS, passenger, etc.) and each list is based on the PAVE (Pilot, Aircraft, Environment, External pressure) areas. In addition to the pre-departure Checklists, also In-flight and Post-flight Checklists have been shaped, following the approach discussed in Ref. 6. Through SkyFlight the pilot is able to fill the Risk Assessment Checklist, inserting mitigations where applicable and view the total score. The filled checklist can be saved and shared. It is also possible to export them in a pdf format and to send automatically via email to one or more email addresses. In addition to this, which reflects the state of the art for FRAT, some other peculiar features have been designed. Indeed, to better support the different rotorcraft missions and to meet the process of each operator, the Risk Assessment Checklists will be completely customized by the company safety manager. The functionalities have then being further enhanced with software developments to add value to the tool with both small and big features. For example, the order of the multiple choice answers changes every time the pilot access to the checklist, to guide her/him to read carefully the answers before the selection. More complex functionalities have been inserted to connect the flight planned with SkyFlight to the hazard evaluation, showing the weather data and all the notifications associated to the flight (NOTAMs, Warning/restrictive Airspaces infringements ...). AW SkyFlight application can be installed on personal portable devices and the Flight Risk Assessment functionality can be used for free, to let every pilot from the general aviation to access to the safety enhancements above described. The FRAT capabilities, usability and utility have been then tested with the Leonardo Helicopters Division pilots as well as a set of specific customers pilots as representatives of the different types of operations (in the Executive and Private transport, Medical and Rescue services, Offshore operations, Security services and Utility).
Maria, Susanna
Filter-Based Detection of the Proximity to Loss of Tail Rotor Effectiveness within Helicopter Flight Data MonitoringF-0075-2019-147075/13/2019
Loss of Tail rotor Effectiveness (LTE) is a critical low-speed aerodynamic flight characteristic that causes an unanticipated rapid yaw rate that will not subside on its own. Multiple factors influence this aerodynamic condition, like environmental conditions, helicopter model specifications and phases of flight. However, predictions of which of those elements cause a higher risk for LTE has not been determined as of yet. Because of this knowledge gap, pilots are often not trained well enough to proactively recognize the proximity to LTE, leading to several accidents in which the pilot fails to maintain directional control. This study begins to characterize the factors that contribute to LTE and the importance of this to helicopter safety. An LTE bowtie diagram is proposed to support hazard risk assessment and mitigation. The diagram is built through accident reviews and aims to give pilots a schematic summary of all the scenarios that may lead to LTE. Further, a new systematic filter-based framework able to detect proximity to LTE events within Helicopter Flight Data Monitoring (HFDM) is proposed. Safety-events detection is the main method of analysis used within HFDM. This method compares flight data to a large safety-event database, which includes predefined hazardous flight conditions and different levels of proximity to events. Through this framework, participating operators will be able to easily analyze data from multiple flights, visualize the results, and provide feedback to the pilots. This will promote pilots' awareness on the proximity to LTE during flight and educate them on conducting proactive LTE risk evaluations.
Zanella, Paola, Johnson, Charles, Collins, Kyle, Mavris, Dimitri
Can Autonomous Vehicles Make the Right ‘Decision?’19AVEP05_115/1/2019
The famous “Trolley Problem” might not really be the problem automated-vehicle ethics have to solve. The impact of artificial intelligence (AI) on society is on the rise and many are beginning to question the “ethics” of these systems, leading companies to jump to action. Microsoft's president met with Pope Francis to discuss industry ethics, Amazon is helping to fund federal research into “algorithm fairness,” and Salesforce has hired an “architect' for ethical AI practice and a “chief ethical and human use officer.”
Dukarski, Jennifer
A Guide to Collaborative Robot SafetyTBMG-343855/1/2019
The ability of collaborative robots to share tasks with humans and flexibly adapt to new requirements can provide high returns on investment in a wide variety of industrial applications. Manufacturers employ these robots to reap the benefits of integrated safety features that allow them to work with or close by humans and boost productivity for a wide variety of repetitive tasks.
A Fault Tolerant Time Interval Process for Functional Safety Development2019-01-01104/2/2019
During development of complex automotive technologies, a significant engineering effort is often dedicated to ensuring the safe performance of these systems. An important aspect to consider when assessing the viability of different safety designs or strategies is the time period from the occurrence of a fault to the violation of a Safety Goal (SG). This time period is commonly referred to as the Fault Tolerant Time Interval (FTTI). In Automotive Safety, ISO 26262 [1] calls for the identification and appropriate partitioning of the FTTI, however very little guidance is provided on how to do this. This paper presents a process, covering the entire safety development lifecycle, for the identification of timing constraints and the development of associated requirements necessary to prevent Safety Goal violations.
Denomme, Daniel, Hooson, Sam, Winkelman, James
Determination of Validation Testing Scenarios for an ADAS Functionality: Case Study2019-01-01374/2/2019
As the engineering community continues working on automated driving (AD) functionalities, the topic of safety validation still provides fuel for discussions. Despite the vehicles equipped with higher level AD functionalities ready to enter service on public roads, there is still no state-of-the-art process created for safety validation procedures. In this situation, vehicles with similar functionalities may end up coming through fundamentally different validation procedure, and the public may be exposed to additional risks. This paper fist formulates requirements which safety validation process needs to fulfill. The requirements are based on ISO 26262, PAS 21448 (SOTIF), and the state of the art requirements typical for safety applications. Then, the process of implementation of those requirements is sketched.
Kirovskii, Oleg
Risk Analysis of Blockchain Application for Aerospace Records Management2019-01-13443/19/2019
Blockchain as a technology has been successfully deployed in the financial industry. As the technology continues to mature, there are opportunities to use this to solve operational challenges in Aerospace. One of the common use cases is replacing paper records as a proof of compliance with a blockchain enabled distributed ledger. Commonly available open source blockchain frameworks have security ingrained in the components. However, replacing paper records with a blockchain based distributed ledger will require investigation of potential risks involved in the end to end usage of this technology for records management. The objective of this paper is to elucidate potential risks in an aviation record management workflow environment enabled by blockchain and suggest requirements to mitigate the risks. In addition requirements for Blockchain based systems will be proposed, which will guarantee minimum functional requirements like Protection of confidential information Integrity of the information in a record Safeguards against unauthorized access The potential gaps are understood using an illustrative end to end blockchain based process along with their conceptual high level intermediate steps. For example: Authenticated trusted digital identities of the participants whose transactions are recorded in distributed ledgers Trusted source which distributes these identities and has a mechanism to update, revoke and safely secure these identities Trusted methods to ensure detection if the digital identities are compromised Trusted method to demonstrate controlled authorization process for digital identities as per access control rules Trusted methods to demonstrate the generation of accounting logs
Kar, Satyanarayan, Kasimsetty, Vinay, Barlow, Susan, Rao, Sujay
Ground Control- Using Fiber Optics to Reduce Electrical Ground Interaction2019-01-13813/19/2019
The increase in the use of composite structures and components is revealing some contiguous consequences for the design of electrical systems: a) reduced electrical shielding and its effects on EMI compatibility, and b) the absence of electrical capacity from global electrical grounds. The first consequence can be mitigated by carefully following best practices for EMI compatibility, allowing for the weight and cost for shielding and other necessary components. The second consequence has been discovered in other industries. Supply and ground circuits must now be carefully planned and risk-analyzed because the power delivery circuits interact. Supply circuits are now more subject to voltage drops across supply and ground lines. Regulated supply voltage levels may interact; an unexpected dropout in one of several supplies can potentially affect all others. This paper has three objectives: The first is an alert that the consequence of reducing the number of high capacity ground circuits will require more planning and risk analysis with respect to the interaction of electrical supply circuits. Systematic design practices and risk mitigation activities may be required in the future. The second is to present the capabilities of photonics and fiber optics to help with these issues. The transmission of light does not require a circuit with a ground, and is commonly useful for isolating electrical circuits. Using optical fiber, we have the capability to deliver data signals, light for illumination, and power for electrical circuits. The third is to communicate the work of the SAE AS-3 Fiber Optics and Applied Photonics Committee toward assisting engineers and designers with transmission of signals via optical fiber.
Mazurowski, John
Risk Assessment of Fuel Property Variability Using Quasi-Random Sampling/Design of Experiments Methodologies2019-01-13873/19/2019
Increases in on-board heat generation in modern military aircraft have led to a reliance on thermal management techniques using fuel as a primary heat sink. However, recent studies have found that fuel properties, such as specific heat, can vary greatly between batches, affecting the amount of heat delivered to the fuel. With modern aircraft systems utilizing the majority of available heat sink capacity, an improved understanding of the effects of fuel property variability on overall system response is important. One way to determine whether property variability inside a thermal system causes failure is to perform uncertainty analyses on fuel thermophysical properties and compare results to a risk assessment metric. A sensitivity analysis can be performed on any properties that cause inherent system variability to determine which properties contribute the most significant impact. For the current study, a quasi-random sampling based uncertainty analysis was combined with a surrogate model based sensitivity analysis. Combining sample based and surrogate-based methodologies provided statistical information from the sampling based approach and sensitivity information from the design of experiments from one test series. Using the two methods simultaneously combined the advantages of both methods, while reducing the number of trials required for a statistically significant sample. The methodologies were applied to fuel property variability by sampling deviating thermophysical properties and analyzing the system impact for a sample mission profile. The fuel property variabilities examined were fuel density, specific heat, viscosity, and thermal conductivity. The analysis utilized the architecture’s feed tank temperature as the failure metric and the probability of system failure was determined using a confidence interval. The determined point of failure was analyzed using a sensitivity analysis to determine dominant fuel properties. The sample sizes were compared using computation time and sample size effect on statistical variation to determine the optimal setting for risk analysis.
McCarthy, Kevin, Jackson, Galen R.
Got Your Game Plan? The OEM Playbook to Navigating Preclinical Device Testing Under MDR and ISO 10993-1TBMG-337352/1/2019
When the Medical Device Regulation (MDR) replaces the Medical Device Directive (MDD) in 2020, requirements for medical devices in Europe will present greater regulatory hurdles. In addition, ISO 10993-1, created by the International Organization for Standardization (ISO) Committee and mandated by both the FDA and MDR also introduce new requirements for pre-clinical safety device testing. Medical device manufacturers are feverishly working to navigate the changes and develop their preclinical device testing strategies to overcome what's not just a regulatory hurdle, but a business challenge.
Multi-level Modeling Methodology for Aircraft Thermal Architecture Design2018-01-191010/30/2018
This paper proposes a new methodology to conduct thermal analysis in the conceptual phase of the aircraft development process. Traditionally, thermal analysis is conducted after the system architecture has already been defined. The aircraft system thermal environment evaluation may lead to late design changes that can have a significant impact on the development process. To reduce the risk of late design changes, thermal requirements need to be defined and validated in the conceptual design phase. This research paper introduces a novel multi-level modeling strategy based on a bottom-up approach. It proposes an automatic geometrical simplification procedure for Computational Fluid Dynamic (CFD) analysis, a methodology for the generation of analytical correlations based on highly detailed methods, and a thermal risk assessment approach based on dimensionless numbers. This methodology generates models with the right level of fidelity to conceptual and preliminary design, offers the possibility to assess thermal risk, and defines thermal requirements for the selection of aircraft and systems architectures. A proof-of-concept of the methodology for a simplified test case is presented to highlight the benefits of such multi-level capability.
Sanchez, Florian, Liscouet-Hanke, Susan, Boutin, Yanik, Beaulac, Sebastien, Dufresne, Stephane
Standard Best Practices for System Safety Program Development and ExecutionGEIASTD0010A (Current)10/18/2018
This document outlines a standard practice for conducting system safety. In some cases, these principles may be captured in other standards that apply to specific commodities such as commercial aircraft and automobiles. For example, those manufacturers that produce commercial aircraft should use SAE ARP4754 or SAE ARP4761 (see Section 2 below) to meet FAA or other regulatory agency system safety-related requirements. The system safety practice as defined herein provides a consistent means of evaluating identified risks. Mishap risk should be identified, evaluated, and mitigated to a level as low as reasonably practicable. The mishap risk should be accepted by the appropriate authority and comply with federal (and state, where applicable) laws and regulations, executive orders, treaties, and agreements. Program trade studies associated with mitigating mishap risk should consider total life cycle cost in any decision. This document is intended for use as one of the elements of project solicitation for complex systems requiring a systematic evaluation of hazards and mitigating measures. The Managing Authority may identify, in the solicitation and system specification, specific system safety requirements to be met by the Developer. These may include risk assessment and acceptance criteria, unique classifications and certifications, or mishap reduction needs unique to their program. Additional information in meeting program specific requirements is located in the Appendixes.
G-48 System Safety
EMC for Medical Devices: EN/IEC 60601-1-2, 4th EditionTBMG-3306010/1/2018
The fourth edition IEC/EN 60601-1-2 (4th Edition) will become a mandatory standard covering safety for medical devices on December 31, 2018.1,2 As with any new standard edition, there are changes that necessitate additional evaluations of the product beyond those required by the previous edition. Although emission and immunity tests for medical products are very similar to those applied to other product types, such as radio equipment, networking equipment and multimedia equipment, IEC 60601-1-2 requires that basic safety and essential performance of the medical device be maintained as opposed to the EMC compliance for other type of products. This is reflected in the title of 4th edition.
Effect of Mesh Size in Numerical Simulation of Turbine Housing in Turbocharger2018-01-17159/10/2018
Numerical method is popular in analyzing turbine housing in turbocharger with an early and rapid risk assessment. However, complex casting and extreme thermal loading from exhaust gas temperature and flow variation under engine duty cycle lead to big thermal stress and this makes material serviced in the plastic zone. Previous numerical simulations show that a mesh size is insensitive to the elastic finite element analysis (FEA), but might not be proper for elastic-plastic FEA, even that other boundary conditions keep same, which indicating simulation results are changeable with mesh size and a simple numerical mesh size convergence might not be enough to guarantee accurate numerical results as well. Therefore, several different mesh sizes are used in elastic-plastic analysis of turbine housing to investigate the influence on numerical results. Based on the numerical results and their comparison, we conclude that theoretical results exist under smaller finite element size but it is impractical to reach under elastic-plastics analysis in engineering application because industrial resource is not enough to support. The reasonable mesh size is recommended to consider both accuracy of simulation results and industrial resource. The fatigue life model and Goodman diagram should be calibrated as well based on this mesh size to evaluate turbine housing design risk.
Guo, Henry, Long, Haiyang
Driver Risk Perception Model under Critical Cut-In Scenarios2018-01-16268/7/2018
In China Cut-in scenarios are quite common on both highway and urban road with heavy traffic. They have a potential risk of rear-end collision. When facing a cutting in vehicle, driver tends to brake in most case to reduce collision risk. The timing and dynamic characteristics of brake maneuver are indicators of driver subjective risk perception. Time to collision (TTC) and Time Headway (THW) demonstrate objective risk. This paper aims at building a model quantitatively revealing the relationship between drivers’ subjective risk perception and objective risk. A total of 66 valid critical Cut-in cases was extracted from China-FOT, which has a travel distance of about 130 thousand miles. It is found that under Cut-in scenarios, driver tended to brake when the cutting in vehicle right crossing line. This time point was defined as initial brake time. Brake strength and brake speed were taken to describe brake maneuver. Average brake pressure (ABP) and acceleration at initial brake time indicated brake strength. Brake pressure change rate (BPCR) and longitudinal jerk (derivative of acceleration) at initial brake time indicated brake speed. Analytic Hierarchy Process and Fuzzy Comprehensive Evaluation Method were adopted to obtain an integrated subjective risk perception indicator D. Critical cases were divided into 3 groups by distance of within 5 m, from 5 to 15 m and over 15 m. Within the distance of 5 m, D was linear with 1/THW. Within the distance of from 5 to 15 m, D was linear with 1/TTC. Within the distance of over 15 m, both 1/THW and 1/TTC have linear relationship with D.
Ma, Xuehan, Feng, Zhiwei, Zhu, Xichan, Ma, Zhixiong
Plastic Bearings Reduce Weight and Improve DurabilityTBMG-290026/1/2018
When engineer Mark Doyle started to put together plans for an exoskeleton to support surgeons in 2012, he wanted to develop a lightweight product that they could wear comfortably for extended periods of time. Doyle and his team at Levitate Technologies (San Diego, CA) had to carefully choose the products that would be included in the device because any additional ounces could have made the device uncomfortable and unwieldy, thus ending development before it entered production.
Automated Flight System SoftwareTBMG-289025/1/2018
Kittyhawk San Francisco, CA +1 415-598-7757
Value of Information for Comparing Dependent Repairable Assemblies and Systems2018-01-11034/3/2018
This article presents an approach for comparing alternative repairable systems and calculating the value of information obtained by testing a specified number of such systems. More specifically, an approach is presented to determine the value of information that comes from field testing a specified number of systems in order to appropriately estimate the reliability metric associated with each of the respective repairable systems. Here the reliability of a repairable system will be measured by its failure rate. In support of the decision-making effort, the failure rate is translated into an expected utility based on a utility curve that represents the risk tolerance of the decision-maker. The algorithm calculates the change of the expected value of the decision with the sample size. The change in the value of the decision represents the value of information obtained from testing. The approach uses a Bayesian probability model, which allows the decision-maker to incorporate subjective priors on the reliability performance of the design alternatives. The dependency is modeled using copulas to couple the marginal prior distributions of the alternatives to a single, joint prior. The procedure being presented in this article uses Markov chain Monte Carlo (MCMC) simulation to determine the posterior probability density and the resulting expected utility of the decision. The approach considers design alternatives based on failure rate metric, for example, the number of failures per unit (FPU) or the number of failures per unit time λ, and utilizes Archimedean copulas to couple the dependent marginals that describe the priors for each design alternative’s failure per unit behavior. This article is an extension of the paper “Assessing the Value of Information for Multiple, Correlated Design Alternatives” [6], which presented an approach for determining optimal sample sizes for assessing correlated non-repairable design alternatives based on the prior estimate of their joint failure probability.
Capser, Shawn P., Nikolaidis, Efstratios
Hazard Analysis and Risk Assessment beyond ISO 26262:Management of Complexity Via Parametrization2018-01-10674/3/2018
The automotive world is getting ready to embrace the automated driving (AD). It is necessary to guarantee system safety of the AD application, which includes both “classic” functional safety according to ISO 26262 and specific areas like Safety of the Intended Functionality (SotIF) and others. However, safety remains safety, that is, absence of unreasonable risk. All safety activities, therefore, need to have their source in a Hazard Analysis and Risk Assessment (HARA), encompassing all relevant aspects, including operational situations, description of functionality and other parameter, Already from the description it is clear that a HARA for an AD is going to be a complex task. However, automotive engineering is used to management of complexity via task breakdown, equivalence classes and impact analyses. Those well-trusted methods were applied to an AD HARA. A manageable HARA with clear understanding of parameters, relevant to safety, their safe boundaries and safety levels, was obtained.
Lurie, Oleg, Miller, Joseph
Cobots and Industrial Robots Choose the Right Robot for the JobTBMG-288094/1/2018
Automating manufacturing processes is a complex issue, with no one-size-fits-all solution. Robots range from insect-like microrobots to industrial robots powerful enough to move automotive chassis or airplanes. Toward the lower end of the spectrum is a class of robots referred to as collaborative robots (or cobots) because they are designed to share a workspace with human workers.
A Means of Assessing the Entire Functional Safety Hazard Space2017-01-20569/19/2017
The goal behind Functional Safety is to anticipate the potential hazard scenarios (a.k.a. harm sequences) that a system may produce and address those scenarios in such a way as to mitigate or even eliminate them. A major challenge in determining hazard scenarios is trying to assess an adequate amount of scenarios, considering the large size of a hazard space. Typically assessing the entire hazard space is difficult to achieve, resulting in the possibility of overlooking some critical scenarios that can result in harm to either system operators, system by-standers, or both. In this paper we will explore a rule-based approach for concisely describing hazard scenarios, which could potentially enable us to examine the entire hazard space in a short amount of time. Our approach, called Hazard Space Analysis, combines three key activates: determining hazard scenarios, assigning a risk factor to those scenarios, and mapping those hazard scenarios directly to safety rules. We will detail the approach, show how the approach could be automated, and present a simple aviation related example that demonstrates the approach's potential in enabling stakeholders to explore a large hazard space.
Aceituna, Daniel
Collaborative Robot Applications at GKN Aerospace’s Fokker Business2017-01-20919/19/2017
The use of Collaborative Robots (Cobots) is an emerging technology that is developing at a fast pace. Within GKN Aerospace’s Fokker business a project is initiated to accelerate knowledge of application of this technology. Goal of the project is to get familiar with the technology and possibilities of a Cobot. The primary difference between Cobotics and a conventional Robotics approach is that the technology can safely exist in a human operating environment without caging or other hard guarding. Both Fokker Aerostructures and Fokker Landing Gear wanted to gain experience with this technology and worked together in the preparation of 2 projects to be showcased in their companies. Fokker Aerostructures concentrated on the application of handling of an Automatic Drilling Unit (ADU) for the production of the A350 Outboard Flap. Task of the Cobot was to pick-up an ADU from a table and insert the ADU in a drill jig. Goal of the project was to free-up well trained workers for more difficult tasks and have the robot work on “simple” tasks. Fokker Landing Gear concentrated on the application to use a collaborating robot on the shopfloor as an assistant for the operator to apply an even and bubble free bead of sealant for a limited number of bushings. Goal of the application is to reduce operating time and to initiate a repeatable and improvable proces. The paper describes the results of the mentioned projects. Specific topic in the paper will be the safe operation between humans and robots ( HRC = Human Robot Collaboration).
Muijs, Leo, Snijders, Manuela
High Volume Automated Spar Assembly Line (SAL)2017-01-20739/19/2017
The decision to replace a successful automated production system at the heart of a high volume aircraft factory does not come easily. A point is reached when upgrades and retrofits are insufficient to meet increasing capacity demands and additional floor space is simply unavailable. The goals of this project were to increase production volume, reduce floor space usage, improve the build process, and smooth factory flow without disrupting today’s manufacturing. Two decades of lessons learned were leveraged along with advancements in the aircraft assembly industry, modern machine control technologies, and maturing safety standards to justify the risk and expense of a ground-up redesign. This paper will describe how an automated wing spar fastening system that has performed well for 20 years is analyzed and ultimately replaced without disturbing the high manufacturing rate of a single aisle commercial aircraft program.
Calawa, Rick, Smith, Gavin
EMC Requirements: Pending Changes for the Fourth Edition of IEC 60601-1-2TBMG-274839/1/2017
Probabilistic Structural Integrity Framework for Composite Damage ToleranceF-0073-2017-121785/9/2017
ABSTRACT Airframes in the future will include a significant amount of composite material components that need to be designed for both optimal structural efficiency and damage tolerance. Current composite design methodology relies on the establishment of worst-case scenarios for each of the factors that influence the structural capacity and life of airframe components. The layered application of these factors can result in excessive levels of conservatism and maintenance requirements that reduce aircraft availability. The combat aircraft of the future can be designed and maintained based on specific knowledge derived from data driven methodologies to define risk, threat impact, and measured structural response in order to maximize aircraft availability, while ensuring safety and reliability. This work describes an Advanced Structural Integrity Framework (ASIF) that probabilistically models composite residual strength. Full-scale damage tolerance tests of a UH-60M stabilator provided input data for various threat types and severities. Threat probabilities were derived from prior studies and recent fleet repair data. The model estimated the risk of failure in various structural zones to identify areas for reducing conservatism. Trend studies confirmed that the model appropriately responded to changes in composite material properties and threat exposures, thus showing its potential as a powerful structural risk assessment tool for design and fleet management.
Weintraub, Alexander, Gurvich, Mark, Bordick, Nathaniel, Furnes, Kenneth, Bates, Preston, Kiser, Jay
TH-1H Finite Element Model Validation and Flight Loads DevelopmentF-0073-2017-122265/9/2017
ABSTRACT This paper presents the testing and analysis methods used in estimation of TH-1H flight loads and validation of a finite element model using data gathered during a static crane lift and flight strain survey. Analysis methods and results are emphasized here as most testing methods and data have been shared in previous forums. This is followed by a discussion of the resulting computed load values and their verification through comparisons to operational parameters such as aircraft weight and vertical acceleration. It was found that computed loads and moments compare well to flight conditions. For example, main rotor lift force correlates well to the product of aircraft weight and vertical acceleration (Nz). Preliminary results also show that the computed static and dynamic loads lead to strain predictions that have a good overall trend when compared to measured values, but more work is needed to improved correlations with individual sensors. Further development of these loads will allow the H-1 program office to use them to better address structural repairs, flight severities, and risk analyses. Accurately predicted aircraft response at the sensors from both static and dynamic inputs will enable the development of stress spectra to be used for durability and damage tolerance analyses and service life development.
Brenna, Jeffrey, Schleider, Mary, Hatcher, Nick, McGinty, Robert, Wood, Gregory
Risk Assessment: Quantitative Versus QualitativeF-0073-2017-121595/9/2017
ABSTRACT This paper provides a detailed examination of Quantitative Risk Assessment and qualitative risk assessment, and it compares the advantages, disadvantages, and usefulness of each process. It describes why Quantitative Risk Assessment is becoming more commonly used in rotorcraft safety risk management; it concludes with an approach that would employ the best of both methods, and it provides resources for further study.
Hewitt, John, Pham, Loan
Cybersecurity Testing and Validation2017-01-16553/28/2017
An essential part of an effective cybersecurity engineering process is testing the implementation of a system for vulnerabilities and validating the effectiveness of countermeasures. The SAE J3061 Cybersecurity Guidebook for Cyber-Physical Vehicle Systems provides a recommended framework which organizations can use to implement a cybersecurity engineering process, which includes activities such as integration and testing, penetration testing and verification/validation of cybersecurity requirements at the hardware, software and system levels. This presentation explores the different kinds of testing that are appropriate at each of these process steps and discusses some important differences between cybersecurity testing and more familiar forms of testing. We also consider the necessary scope and depth of cybersecurity testing and suggest examples of how this can be related to cybersecurity requirements, goals and integrity levels, as determined by the threat analysis and risk assessment.
Wooderson, Paul, Ward, David
Examination of Hazard Analysis and Risk Assessment and Exposure Research in the Real Traffic Situation of ISO 26262 for Motorcycles2016-32-005811/8/2016
ISO 26262, an international functional safety standard of electrical and/or electronic systems (E/E systems) for motor vehicles, was published in November 2011 and it is expected that the scope will be extended to motorcycles in a second edition of ISO 26262 going to be published in 2018. In order to apply ISO 26262 to motorcycle, proper estimation of Exposure, Controllability, and Severity are key factors to determine Motorcycle Safety Integrity Level (MSIL). Exposure is a factor to indicate the probability of the state of an operational situation that can be hazardous with the E/E system malfunction. And it is not easy to estimate the motorcycle Exposure due to less availability of back ground data in actual operational situation compared to motor vehicle. Therefore real traffic situation should be investigated in order to provide rationales for MSIL determination. In this study, we examined Hazard Analysis and Risk Assessment (HARA) for motorcycle in accordance with ISO/PAS 19695 and identified motorcycle-specific operational situation. Then we executed field survey for the acquisition of actual operational situation data and estimated Exposure. This paper shows motorcycle-specific issues for HARA and example of motorcycle travelling data useful for Exposure estimation.
Hasegawa, Makoto, Kaneko, Takanobu
A Suitable Platform for Storm Penetration, Risk Analysis for the SPA-10 Aircraft Modification2016-01-20439/20/2016
The SPA-10 project, sponsored by U.S. National Science Foundation, is to acquire and qualify a replacement for the retired T-28 “storm penetration” aircraft previously used to acquire meteorological data to enable understanding and modelling of mid-continent thunderstorms. The National Science Foundation selected the Fairchild A-10 (bailed from the U.S. Air Force) as the platform to be adapted to perform the storm penetration mission to altitudes of eleven kilometers, and funded Naval Postgraduate School’s Center for Interdisciplinary Remotely-Piloted Aircraft Studies (CIRPAS) as prime contractor. An expert panel conducted a review of the SPA-10 project in 2014 and recommended a risk analysis addressing hazards to the aircraft and pilots, such as icing, hail, turbulence and lightning. This paper presents the results of the risk analysis performed in response to this need, including recommended mitigations. In general the A-10 aircraft systems and structure were shown to be robust and suitable, reinforced by an operational plan for incremental exposure to the full force of the storm. A key challenge was obtaining the necessary information to resolve the expert panel’s concerns for a military aircraft designed in the 1970’s, with significant upgrades since, for a radically different mission. The support and assistance of the USAF and the engine manufacturer, General Electric was critical to this endeavor. The participation of the operator of the previous storm penetration T-28 aircraft, the South Dakota School of Mines and Technology, was a crucial source for understanding the mission and operational environment.
Millar, Richard C., Mazzuchi, Thomas, Jonsson, Haflidi
Managing Cybersecurity Risks in Connected Medical DevicesTBMG-252108/1/2016
The landscape of the medical device industry is changing, driven by emerging technologies and the influx of smart devices, telemedicine, and new patient care models. This new frontier is not without risks; integrating connected capabilities into medical devices has raised the stakes. In addition to human error or device malfunction, developers and manufacturers must think about things like hacking, malware, breaches, and bugs, making strong cybersecurity checks and balances more relevant than ever.
Items per page:
1 – 50 of 153