Department of Defense Aviation Safety Technologies Report. Citation of this work should appear as follows:

Transcription

1

2

3 Department of Defense Aviation Safety Technologies Report Citation of this work should appear as follows: Acquisition and Technology Programs Task Force (ATP TF) Department of Defense Aviation Safety Technologies Report. Washington, DC: Defense Safety Oversight Council, Office of the Under Secretary of Defense for Personnel and Readiness. Office of the Under Secretary of Defense for Personnel and Readiness 4000 Defense Pentagon Washington, DC 20301

4 CONTENTS EXECUTIVE SUMMARY INTRODUCTION Background Acquisition and Technology Programs Task Force Aviation Accidents Aviation Safety Technologies Study Boundaries Approach Evaluation Criteria About the Report TECHNOLOGIES General Data Collection and Analysis Fighter/Attack Aircraft Fighter/Attack Controlled Flight into Terrain Fighter/Attack Midair Collision Fighter/Attack Propulsion, Structure, and Subsystems Fighter/Attack Aircrew Protection and Survival Rotorcraft Rotorcraft Controlled Flight into Terrain Rotorcraft Midair Collision Rotorcraft Propulsion, Structure, and Subsystems Rotorcraft Aircrew Protection and Survival Large Aircraft Large Aircraft Technologies Unmanned Aircraft Systems Unmanned Aircraft System Technologies Summary of Analyses RECOMMENDATIONS Technology Recommendations Fighter Automatic Recovery-Controlled Flight into Terrain Fighter Risk Reduction Program-Automatic Airborne Collision Avoidance Fighter Automatic Airborne Collision Avoidance Manual Controlled Flight Into Terrain Avoidance for Large Aircraft and Rotorcraft Manual Midair Collision Avoidance for Large Aircraft and Rotorcraft Flight Data Analysis for All Aircraft Unmanned Aircraft System Technologies Rotorcraft Crash Survival Real-Time Satellite Weather for Rotorcraft Improved Gz Protection for Fighter/Attack Aircraft Policy Considerations...61 iii

5 CONTENTS General Fighter/Attack Aircraft Rotorcraft SUPPORTING STUDIES...71 ABBREVIATIONS AND ACRONYMS...74 REFERENCES...80 CONTRIBUTORS...84 TABLES Table 1-1 FY 2008 DoD Class A Aviation Accidents... 4 Table 2-1 Federal Aviation Administration Terrains Awareness Warning System Table 2-2 Unmanned Aircraft System Technology Value Assessment Table 2-3 Summary of Technology Analyses Table 3-1 Recommended Technologies in Order of Priority Table 3-2 Funding Required for Fighter Automatic Recovery-Controlled Flight into Terrain Table 3-3 Funding Required for Fighter Risk Reduction Program and Fighter Automatic Airborne Collision Avoidance Table 3-4 Funding Required for Manual CFIT Avoidance for Large Aircraft and Rotorcraft Table 3-5 Funding Required for Manual Midair Collision Avoidance for Large Aircraft and Rotorcraft Table 3-6 Funding Required for Flight Data Analysis for All Aircraft Table 3-7 Funding Required for Unmanned Aircraft System Technologies Table 3-8 Funding Required for Rotorcraft Crash Survival Table 3-9 Funding Required for Real-Time Satellite Weather for Rotorcraft Table 3-10 Funding Required for Improved Gz Protection for Fighter/Attack Aircraft FIGURES Figure 2-1 Links Between Active and Latent Failures and Associated Probabilities iv

6 Executive Summary This report recommends specific technologies that could eliminate military aircraft losses. In the past five years (FY FY 2008), the Department of Defense s aircraft operations sustained 276 military deaths and destroyed 247 military aircraft (not including unmanned aircraft systems). Although many of the deaths are attributed to "human error," inserting hardware and software safety technologies could greatly reduce these actual losses during the next five through twenty years. Preventing these crashes will increase readiness, reduce the need for replacement aircraft, and save the lives of our Soldiers, Sailors, Marines, and Airmen. These technologies assist the pilots when they are task-saturated. Several of these technologies already exist in commercial aircraft, in foreign military aircraft, or have been previously tested in Department of Defense military aircraft -- but not previously funded. The Deputy Secretary of Defense requested this report in the Program Budget Request 10-15, Program Decision Memorandum 1, to Evaluate the most effective hardware and software technologies to be implemented to reduce preventable aviation mishaps. Survey existing programs and provide an assessment of the viability and advisability of future resource investments. Identify potential joint solutions so as to minimize redundant development efforts. Recommend specific technologies to be integrated in future design and development efforts. The joint approach to evaluating aviation safety hardware and software was completed under the guidance of the Defense Safety Oversight Council (DSOC). The DSOC used the expertise of its Acquisition and Technology Programs Task Force to employ a data-driven approach to evaluate and recommend technology solutions to prevent aviation accidents. The task force assessed programs, aviation studies and the crash data from the past 20 years. Many subject matter experts from the Military Departments and Office of the Secretary of Defense s staff contributed to the assessment of the viability of future resource investments. The task force recommends specific technologies for investment by the Department. These investments will fund hardware and software technologies to prevent rotary wing, fixed wing, and unmanned aircraft system accidents. The major risks to the Department s aircraft are controlled flight into terrain, midair collisions, occupant survival of rotorcraft crashes, and the expansion of unmanned aircraft systems. Implementation of the report recommendations will foster Secretary Gates direction to achieve a 75 percent reduction in accidents. 1

7 1 INTRODUCTION 1.1 BACKGROUND Safety is a key part of mission readiness; that is, systems must be safe to operate in their intended environment and not cause preventable accidents or illnesses that erode or degrade mission capability and readiness. Because of the strong correlation between readiness and safety, the Secretary of Defense has established goals for accident reduction and continues to challenge the Department of Defense (DoD) to eliminate the loss of resources incurred as a result of preventable accidents. In executive memoranda, the Secretary of Defense has stated the Department s commitment to reducing preventable accidents, which cost the nation in lives and capability: We will fund as a first priority those technologies and devices that will save lives and equipment. We will retrofit existing systems, and consider these devices as a must fund priority for all new systems. (Rumsfeld 2006) Our goal is zero preventable accidents. The current focus of our Safety Council is increasing the accountability of individuals and leaders as well as pursuing safety technologies... We have no greater responsibility than to take care of those who volunteer to serve. (Gates 2007) In 2008, the Guidance for the Development of the Force , stated: DoD Components will pursue the following accident reduction and prevention initiatives: emphasizing safety in the workplace and hold leaders accountable for their safety programs; and achieving a 75 percent accident reduction target by 2012 from a 2002 baseline in military and civilian injuries, private motor vehicle fatalities, and aviation accidents. (Guidance for the Development of the Force , April 2008) Section 1043 of the National Defense Authorization Act (NDAA) 2009 stated, in part: The Secretary of Defense and the Chairman of the Joint Chiefs of Staff shall carry out a study on Department of Defense rotorcraft survivability. The study shall (1) with respect to actual losses of rotorcraft in combat (A) identify the rates of such losses from 1965 through 2008, measured in total annual losses by type of aircraft and by cause, with rates for loss per flight hour and loss per sortie provided; 2

8 (B) identify by category of hostile action (such as small arms, Man-Portable Air Defense Systems, and so on), the causal factors for the losses; and (C) propose candidate solutions for survivability (such as training, tactics, speed, counter measures, maneuverability, lethality, technology, and so on), in a prioritized list with explanations, to mitigate each such causal factor, along with recommended funding adequate to achieve rates at least equal to the experience in the Vietnam conflict; etc. (2) with respect to actual losses of rotorcraft in combat theater not related to hostile action (A) identify the causal factors of loss in a ranked list; and (B) propose candidate solutions for survivability (such as training, tactics, speed, countermeasures, maneuverability, lethality, technology, and so on), in a prioritized list, to mitigate each such causal factor, along with recommended funding adequate to achieve the Secretary s Mishap Reduction Initiative goal of not more than 0.5 mishaps per 100,000 flight hours; (3) with respect to losses of rotorcraft in training or other non-combat operations during peacetime or interwar years (A) identify by category (such as inadvertent instrument meteorological conditions, wire strike, and so on) the causal factors of loss in a ranked list; and (B) identify candidate solutions for survivability and performance (such as candidate solutions referred to in paragraph (2)(B) as well as maintenance, logistics, systems development, and so on) in a prioritized list, to mitigate each such causal factor, along with recommended funding adequate to achieve the goal of rotorcraft loss rates to non-combat causes being reduced to 1.0; (4) identify the key technical factors (causes of mishaps that are not related to human factors) negatively impacting the rotorcraft mishap rates and survivability trends, to include reliability, availability, maintainability, and other logistical considerations; Acquisition and Technology Programs Task Force The Acquisition and Technology Programs Task Force (ATP TF) is one of eight task forces under the Defense Safety Oversight Council (DSOC), which was established in response to the Secretary of Defense s May 2003 memo Reducing Preventable Accidents. The Under Secretary of Defense for Personnel and Readiness chairs the 3

9 DSOC and established the ATP TF in October The Deputy Director, Systems and Software Engineering/Human Capital and Specialty Engineering, chairs the ATP TF. The ATP TF is charged with investigating and recommending or implementing changes to policies, procedures, initiatives, education and training, and investments to ensure acquisition programs address safety throughout the program life cycle, including systems acquisition, operations and support, sustainment, demilitarization, and disposal. The task force includes 60 members from across the Services, the Office of the Secretary of Defense, and industry advisors. The goals of the ATP TF are to: Ensure acquisition policies and procedures for all systems address safety requirements. Review and modify, as necessary, relevant DoD standards with respect to safety. Recommend ways to ensure acquisition program office decisions consider system hazards. Recommend ways to ensure milestone decision reviews and interim progress reviews address safety Aviation Accidents Table 1-1 shows the occurrence of DoD Class A accidents in FY 2008 alone. Class A accidents are those that result in a destroyed aircraft, over $1M in damage, fatality, or permanent disability (Source: Defense Safety Enterprise System 2008.) Table 1-1 FY 2008 DoD Class A Aviation Accidents Aircraft Type Accidents Fatalities Destroyed Aircraft Helicopters Fighter/Attack Unmanned Aircraft System Trainer Bomber Tanker Airborne Early Warning Cargo 2-1 4

10 Air Anti-Submarine Warfare Special Air Mission Totals AVIATION SAFETY TECHNOLOGIES STUDY Program Budget Request (PBR) 10-15, Program Decision Memorandum (PDM) 1 designated the Under Secretary of Defense for Personnel and Readiness (USD (P&R)) as the lead to brief the Deputy Secretary of Defense in third quarter of FY 2009 concerning aviation technology investments to prevent death, injury, aircraft damage, and loss. The USD (P&R) enlisted the DSOC to complete this requirement. The PDM tasked the Services to support the effort. The ATP TF task was to evaluate and prioritize the most effective hardware and software technologies that could be implemented to prevent aviation accidents. The task force used the results of analyses and studies performed by numerous agencies, including the Services. The task force did not seek to develop new information but to collect, analyze, and present potential aviation technologies that were reviewed in previous reports and studies Boundaries Recent DoD and Service studies have sought to determine how many accidents are preventable and with what technology. This study capitalized on the existing studies and analyses of aviation safety and their associated data. The sources are referenced in the material presented for each category of aircraft platform. The ATP TF assumes the source data remain applicable to current operations and that the conclusions remain valid. No newly emerging technologies (hardware or software) not previously addressed by an agency or military department evaluation have been considered in this study for application on any of the platform categories. Approach The DoD employs a variety of aviation platforms, which operate in numerous environments and provide a broad range of capabilities and roles. Therefore, all DoD aviation platforms could not be analyzed as one large group. To fully understand the impact and feasibility of inserting safety technology into aviation platforms, the analysis must be conducted with logical categories. For this task, four broad categories of aviation platforms were developed to facilitate the analysis and understanding of the results: 1. Fighter/Attack Aircraft 2. Rotorcraft 5

11 3. Large Aircraft 4. Unmanned Aircraft Systems Each platform category was assigned a lead from within the ATP TF Aviation Safety Technology Working Group (AST WG). The platform category leads were directed to: (1) gather available data for each category and (2) assemble a team of Subject Matter Experts (SMEs) to rate the potential of these programs for viability in existing and future programs, with specific attention to joint solutions. The platform leads utilized SMEs from the Office of the Secretary of Defense (OSD) and the Services to gather and review existing studies, analysis, data, and potential technology solutions. These SME teams then evaluated each technology and provided final recommendations for that specific platform category. In addition, because of the maturity of Military Flight Operations Quality Assurance (MFOQA) as an ongoing safety initiative, the DSOC Executive Secretary directed that MFOQA technology status be briefed and assessed independent of the ATP TF working group. The results of this assessment (Smith 2009) are included in this report under the general headings of Data Collection and Analysis and Flight Data Analysis Evaluation Criteria The criteria used to quantitatively evaluate potential technologies are capability enhancement/risk reduction, cost, and technical maturity level. The explanations of the criteria follow: Capability Enhancement/Risk Reduction This criterion is used to depict the potential to reduce the number and severity of preventable accidents. This criterion indicates if a technology is proven to, or there are indications that it may, mitigate causal factors that have contributed to aviation accidents. The ratings used for this criterion evaluate the impact on mission capability to include reduction in loss of life, reduction in debilitating injuries and illnesses, and reduction in platform losses. Below is the qualitative rating scale that was used for this criterion: Green (G): Significant reduction in loss of life/platform and disabling injuries Yellow (Y): Moderate reduction in loss of life/platform and disabling injuries Red (R): Minimal reduction in loss of life/platform and disabling injuries Cost This criterion considered the life cycle cost of the safety technology including cost to develop, acquire, integrate, and sustain. Below is the relative rating scale used for this criterion: Green (G): Minimal cost Yellow (Y): Moderate cost 6

12 Red (R): Significant cost Technical Maturity Level Technology Readiness Levels (TRLs) were estimated by the AST WG SMEs applying the definitions in Table III-1 of the Deputy Under Secretary of Defense for Science and Technology (DUSD(S&T)) Technology Readiness Assessment Deskbook (2005). The criterion is intended to indicate to senior leaders which technologies are ready, or near ready, within the Program Objective Memorandum (POM). Numerous technologies are expected to be identified that are in the S&T and/or Research and Development (R&D) phases. Below is the quantitative rating scale that was used for this criterion and based on TRLs: Green (G): 7-9 TRL Yellow (Y): 5-6 TRL Red (R): 1-4 TRL To accomplish the survey/task, the ATP TF collected information on: Currently installed safety technologies, with their inventories and aircraft applications. Other candidate technologies, with their corresponding studies, evaluations, and analyses. 1.3 ABOUT THE REPORT Section 2 presents the subject technologies by platform area. It presents technologies that currently exist, are in development, or have been proposed, along with an assessment of their value and recommendations for progress. Section 3 presents the ATP TF s top 10 recommended technologies based on potential estimated Return On Investment (ROI). Section 4 presents a comparison of the recommendations of this study with those of recent related studies. 7

13 2 TECHNOLOGIES 2.1 GENERAL Data Collection and Analysis The information gathered as part of this effort was also included with the larger Data Collection and Analysis (DCA) effort associated with the DoD s response to NDAA 2009 Section 1043 language. Data Collection Following the death of Commerce Secretary Ron Brown in a CT-43 crash on April 3, 1996, the Secretary of Defense directed installation of Crash-Survivable Flight Data Recorders (CSFDR) on all passenger-carrying aircraft. The precedent of requiring crash recorders on Department aircraft was first established in 1973 when the Air Force required all aircraft entering production after July 1974 to install a CSFDR. This directive came after an in-depth study in 1969 proving CSFDR cost-effectiveness. There have been recent examples in which recorder capabilities or lack thereof directly affected Department readiness. Lack of crash-survivable recorder capabilities unnecessarily delays investigative causal findings and exacerbates associated costs. Fleets of advanced weapon systems have been grounded awaiting accident determination dependent on recorder information, most notably the F-22 and B-2 fleets. Investigators must analyze system and crew actions quickly to determine accident causal factors, identify mitigating actions, and return the fleet to operational status. In order to analyze these actions, aircraft information must be collected and recorded in crash-survivable media. Unfortunately, installation of this technology has not been fully accomplished, and many accidents still occur for which the cause is unknown or uncertain. Many of these accidents go undetermined or are expressed as multiple possible causes, making any mitigation efforts dubious in value. Improvements in technology have greatly increased the capability and capacity of recorders. Concurrent with these advances, the Maintenance, Operations, Safety, and Training (MOST) communities have discovered uses of this aircraft information that improve availability, lethality, and resource preservation. These coincident advances have proliferated recording devices and analysis systems both within and across Services. Aircraft often have multiple recorders consuming power, adding weight, and increasing logistical sustainment costs. The systemic evaluation and consolidation of all aircraft information uses and requirements provides significant savings and efficiencies. The integrated recorder can provide acoustic, parametric, and imagery records for mishap investigations, aircraft usage data (for aircraft structural, propulsion, and subsystem maintenance, and integrity programs); mission data recording for training, and 8

14 Military Flight Operations Quality Assurance (MFOQA) data for Operational Risk Management (ORM). Consolidation of recording requirements prevents redundant system installation while capturing the exponentially growing digital data on aircraft. Standardized recorder solutions can serve as a ready replacement for legacy recorders that go out of production, become obsolete/unsupportable, or require upgrade of operational capability. Industry has responded to the large civilian aviation market and is producing crash-survivable combined acoustic, parametric, and imagery recorders. Two hours of digital audio recording, limited imagery, and more than 25 hours of data recording are common. Military-capable recorders are produced by numerous industry sources. Some of these recorders even exceed the civilian crash impact requirement to accommodate the extreme conditions of high-speed, high-angle terrain impacts of fighter aircraft. Through systemic addressing of all recording requirements, the Department can leverage this industrial capability to reduce cost, weight, and power requirements while advancing investigative and analysis capabilities. Another consideration is CSFDR recovery following an accident. Modern crash recorders survive almost all impacts; however, experience has shown that although the recorders may survive a crash, they might not be recoverable due to the location of the crash. When an aircraft crashes in deep water, the cost of recovering the crash recorder averages $1M per occurrence and induces a lengthy investigation delay. Based on this expense, other technologies should be considered. The use of a deployable recorder or real-time off-board data collection should be considered as potential candidates to enable data from all incidents to be collected. While deployable solutions are available now, real-time off-board data collection appears challenging at best due to technological, logistic, and cost issues Analyses Flight data analyses fall into two general categories: analysis of singular flights or analysis of an aggregation of flights. Singular analyses include diagnosis of system failures or degraded performance, animated and graphical replay for operational performance feedback, and mishap investigation analyzing both system and crew performance. Aggregate analyses include ORM, structural life usage, Condition-Based Training (CBT), Condition-Based Maintenance (CBM), and optimization of training curriculum. All of these capabilities depend upon the recording of specific flight data. This information is required to be continuous time-history data as opposed to Built-In-Test failure codes or event-based recordings captured only when thresholds are exceeded. It is very important to recognize that quality of analyses is directly proportional to the quality and quantity of time-history data parameters. Minimum data correlates to minimum benefit. 9

15 Data transfer from the aircraft can be accomplished through various technical paths. Optical disks, solid state memory devices, support equipment download, and wireless transmissions have all been utilized. Each solution brings a corresponding maintenance or operational impact. The Services must carefully consider how this process will be accomplished in the context of their operations. While singular analyses provide for individualized feedback at the unit level, aggregated data facilitates risk management and optimized efficiencies throughout an organization. Time-history data should flow unmodified from the unit to the highest levels as expeditiously as possible. Units may choose to comment upon but not be capable of deleting or altering the data. Procedural and/or data access privileges will be required to ensure the data cannot be used punitively except in cases of willful disregard. A just culture should be adopted to safeguard the misuse of such information. Singular analysis tools must focus on facilitating a person s comprehension and manipulation of the data from a single flight. Animations should represent the actual environment of the flight as closely as possible. They should display pilot control inputs as well as aircraft configuration and flight path. Graphical data representations should allow manipulation in time scale, magnitude scale, color, and contrast while allowing simultaneous graphing of a parameter set for comparison purposes. Quality, accuracy, and operator qualifications are extremely important aspects, especially if the tools are used to formulate opinions in accident investigations. Aggregate analyses require development of algorithms that detect and accumulate flights displaying a particular area of interest. These could be either discrete events such as glide slope limit deviations on final, or routine operational measurements such as a distribution of airspeeds for all aircraft on final approach. These operational analyses provide the commander a quantitative tool with which to manage risk to only that required to accomplish the mission. Database software enables statistical observations and expert analyses of any trends detected. There are many Commercial-Off-The-Shelf (COTS) products on the market to accumulate and generate statistics from an event or measurement database. Poor-quality aircraft data makes it difficult for experts to reliably detect adverse events and make valid measurements. The Services should prioritize developing algorithms for minimal false positives over routine software development where industry has already excelled. Detailed cost-benefit analyses should be done comparing the purchase and sustainment costs of COTS software to the development and sustainment costs of governmentdeveloped software Aircraft Information Programs The Aircraft Information Program (AIP) is a systemic approach to determining and specifying aircraft data collection requirements for design integrity, maintenance, operations, safety, and training purposes. It is a comprehensive approach to addressing all 10

16 information requirements, thereby optimizing aircraft design or leveraging modification actions to achieve the broadest benefits. The AIP process reduces deployed equipment, overall costs, and aircraft weight and power requirements. It originated at the U.S. Air Force Safety Center (AFSC) in 1999 to determine a standard set of crash investigation parameters and institutionalize them across the Air Force. This goal necessitated a systems approach that was further defined by a policy directive, instruction, and handbook to guide implementation. The Army Aviation Data Exploitation Capability (ADEC) program and the Navy s MFOQA program are similar in scope and scale to the AIP whereby they also look more broadly at information uses than traditional recording systems. An AIP/ADEC/MFOQA program is an effective and efficient management and exploitation of aviation data to improve safety, maintenance, training, and operations. At the aircraft, within the unit, and at higher levels, users act upon, share, and disseminate information through a decisionsupport system. This provides greater situational awareness and the understanding to make more informed and timely decisions, which aids in the risk management process. The AIP/ADEC/MFOQA capability is necessary to reduce aviation mishaps attributed to human error, increase the responsiveness of fleet management and sustainment, and allow aviation units to more effectively train and deploy assets. This more broadly defined information requirement encompasses the more narrowly focused concepts of integrity programs, mission debrief and CBM. The AST WG (DSOC 2006) recommended that AIP/ADEC/MFOQA concept continue to be expanded to all aircraft within the Department and chose to collectively refer to these efforts as data collection and analysis MHz Emergency Locator Transmitters The capability to locate downed aircraft and aircrew is largely dependent upon the presence of a functional Emergency Locator Transmitter (ELT) at the site. The global capability to locate ELTs that broadcast on the emergency frequencies of and 243 MHz ended in February Both the COSPAS and SARSAT detection grids have moved to having only a capability to detect beacons transmitting on MHz. This means that any ELT broadcasting on the previously used frequencies will rely solely on the willingness of pilots and ground facilities to monitor the frequencies, and there will be no global, centralized detection capability. The new satellite detection capability for MHz is divided into two constellations of satellites. One set of satellites, in geosynchronous orbit, has the capability to receive MHz signals that contain data-burst information with specific position information taken from the last known aircraft position or, in the case of personal ELTs, from the position of a Global Positioning System (GPS) receiver paired into the same container as the ELT. The geosynchronous satellites have no Direction Finding (DF) capability. 11

17 The advantage of the geosynchronous constellation is that it provides continuous coverage of the earth from 60 degrees South latitude to 60 degrees North latitude. The second set of satellites is in Low Earth Orbit (LEO) and bears the traditional DF capability of COSPAS and SARSAT. This set is, by design, less accurate than the first constellation s capability and does not provide continuous global capability; but does, intermittently, cover the Polar Regions where the first constellation cannot see and also picks up signals that may be masked from the geosynchronous satellites due to their great distance from Earth. Data sent to the geosynchronous satellites may be encrypted. Failure to upgrade to this capability will leave our personnel and equipment without adequate protection. Commercial systems are available now that can meet our needs. Study data from Lt Col Rob Kent s work covering U.S. Army non-human factor mishaps (Kent 2007) found that the risk of fatality to personnel in mishaps without functioning ELTs was 7.5 times higher than the risk in mishaps where the ELT functioned properly. The Combat Survivor Evader Locator (CSEL) radio is an Air Force-led program that is currently being fielded to Air Force and Army aviators. This radio appears to provide a comprehensive solution to the changing communications requirements. This technology should be implemented DoD-wide as a personal location system for airmen who are downed. Aircraft also need ELTs, and these systems should also be upgraded as quickly as possible. With rotorcraft, similar to fixed wing aircraft, there will be no global, centralized detection capability of older ELT frequencies. Rotorcraft will be required to upgrade to the MHz frequency in the future Military Flight Operations Quality Assurance MFOQA is a multifaceted process that enables reduction of unnecessary risk through the trending of flight hazards while improving maintenance and training capabilities. It addresses a broad spectrum of mishap types but excels in the most prevalent mishap cause, human factors. Through the collection and aggregation of time-history data from multiple flights, expert system software applies operational rules to detect the incidence of hazards. Examples of such hazards could include unstable approaches, insufficient separation during air-to-air engagements, ground proximity warnings, or asymmetric G loading. Once hazards are detected and their rate of occurrence determined, leaders can then quantifiably manage operational risk to only the level required for mission accomplishment. This collection of time-history data also provides a data-rich environment for maintenance and training improvements. System performance analyses, advanced diagnostics, and prognostics development are enabled through the collection and aggregation of subsystem parametric data. Crews utilize automated flight data replay to improve performance through immediate feedback and reinforcement. MFOQA s elimination of unnecessary risk, advancement to maintenance capabilities, and 12

18 improvement of crew performance will advance mission readiness and effectiveness within the DoD. The installation of robust MFOQA systems has the highest potential to both reduce mishap risk and lower operational cost through the institution of CBM Deployable Flight Data Recorders and Cockpit Voice Recorders The DoD operates aircraft globally and occasionally suffers a mishap over deep water or in extremely isolated or hostile terrain that makes aircraft recovery impossible. In some cases, the Flight Data Recorder (FDR) or Cockpit Voice Recorder (CVR) are so badly damaged that the information on them is destroyed due to high-impact G-forces or post-crash fire. This issue is critical because knowing what happened during a mishap is key to being able to prevent the next mishap. The use of a deployable FDR/CVR or telemetry provides more assurance that the data from the last seconds of a mishap aircraft is available for analysis. If the mishap cause is an issue likely to recur, the failure to isolate it from lack of data places lives and aircraft at needless risk. All future DoD large aircraft should be required to have a deployable FDR/CVR aboard. Any current large aircraft without an FDR/CVR of some sort should be retrofitted with a deployable version capable of providing full MFOQA compliance. Every aircraft that the DoD flies should be able to be fully analyzed when it is subject to a mishap. The inability to accomplish this analysis prevents an unacceptable risk, and one solution, deployable FDR/CVR technology, is reasonably priced. The financial issue involved in gaining this capability centers on the sensor arrays required to capture the data on the aircraft. This is particularly true of older aircraft with analog and mechanical controls and data displays. The DoD should move toward the ability to capture real-time telemetry data through encrypted satellite relay. 2.2 FIGHTER/ATTACK AIRCRAFT The major data source for Fighter/Attack (F/A) aircraft analysis is the business case for automatic recovery conducted by the DSOC AST WG (DSOC 2006), updated by Mapes and colleagues (2008). Mishap prevention technologies for F/A aircraft are presented in the following categories: Controlled Flight into Terrain (CFIT); Midair Collision; Propulsion, Structure, and Subsystems; and Aircrew Protection and Survival Fighter/Attack Controlled Flight into Terrain Fighter/Attack Auto-Recovery The single most valuable technological improvement for F/A aircraft is the institution of automatic recovery technology designed to prevent impact with the ground. This technology is applicable to all aircraft with Digital Electronic Flight Controls (DEFC) such as the F-16 (Block 40+), F-22, F-35 and F/A-18. Because of the ability of the analog 13

19 flight computers in the F-16 Block 30 aircraft to accept digital cards, they may also be candidates for this technology. Auto-recovery is valuable in F/A aircraft because it prevents loss of life and aircraft for four major causes of mishaps including CFIT, Spatial Disorientation (SD), Loss Of Control In flight (LOCI) (except in the case of stall/spin mishaps), and physiological compromise, which includes Gz (vertical acceleration)-gravity-induced Loss Of Consciousness (G-LOC), hypoxia, and sudden onset medical illness. A portion of the mishaps classified as LOCI by the AFSC are Automatic Ground Collision Avoidance System (Auto-GCAS) recoverable. These recoverable LOCI mishaps are those in which the aircraft was not in a spin or deep stall and was still flying; the LOCI in these cases had to do with the pilot, not the aircraft. The mishap classes making up the auto-recovery preventable mishaps comprise the largest single cause of loss of life and the second largest cause of loss of F/A airframes. Only engine failures have caused more loss of airframes than the auto-recovery preventable classes of mishaps. Using the F-16 fleet lifetime mishap history, the AFSC conducted a complete review of casualty and airframe loss from the perspective of what the Auto-GCAS could mitigate (DSOC 2006). Of roughly 320 lost aircraft, only nine were lost in combat, and only one combat fatality occurred. The majority of the lost airframes were due to losses in mishaps during peacetime training. AFSC determined that 89 percent of the lost lives and 27 percent of the lost airframes could have been prevented by the use of the Auto-GCAS capability. Technical experts from the Air Force have testified that Auto-GCAS is 98 percent effective in mishap prevention. The Air Force Materiel Command announced that Auto-GCAS was technologically mature and ready for implementation in both FY2000 and FY The Air Force initiated the Fighter Risk Reduction Program (FRRP) with a goal of reducing integration risks and accelerating deployment to the fleet. The F-16 (Block 40+) and the F-22 are fully funded to deploy Auto-GCAS. The F-35 is not fully funded for this technology. The Air National Guard is currently investigating the potential to install Auto-GCAS on the F-16 Block 30 fleet. The Navy s embedded Terrain Avoidance Warning System (TAWS) is a manual recovery system, requiring the pilot to apply the flight control inputs to safely recover the aircraft (Whitley 2008). While the embedded TAWS has been highly successful in mitigating the CFIT hazard for the F/A-18, it cannot provide a similar reduction in mishaps where the pilot is physically incapable of recovering the aircraft as in physiological compromise or spatial disorientation. The Navy has determined that it is possible to automate embedded TAWS by driving the flight controls with the expected recovery profile; however, the success of embedded TAWS in reducing the F/A-18 nonphysiological CFIT rate to near zero has limited the potential ROI for an auto-recovery capability on the F/A-18. Manual TAWS appears to have prevented 23 percent of the mishaps that auto-recovery could have prevented. Because an automated TAWS solution 14

20 is estimated to be 75 percent effective, the automation could possibly prevent another 52 percent of the eligible mishaps. Auto-GCAS capability in F/A aircraft will save 6 percent to 9 percent of the aircraft produced considering the system is 98 percent effective and that many aircraft are lost in auto-recovery preventable mishaps. Manual TAWS would save 4.5 percent to 6.8 percent of the aircraft produced because it is 75 percent effective. Based on historical mishap rates, the ROI for Auto-GCAS is 62:1, and with full implementation, it saves six to seven aircraft and seven lives per year Fighter/Attack Manual Terrain Warning The most cost-effective manual technological improvement to prevent CFIT is a manual Ground Proximity Warning System (GPWS) or TAWS. Legacy GPWS provides look-down-only protection using the radar altimeter as the primary data source for height above terrain. TAWS is a fourth-generation GPWS and adds a Digital Terrain Elevation Database (DTED) and GPS data to provide forward-looking deconfliction of potential flight paths with the ground. GPWS and TAWS both provide voice and visual warnings to the pilot to aid in recovering situational awareness and avoiding ground impact. The commercially available GPWS and TAWS systems were designed for civil aircraft and may not be suitable for military tactical flight but bring the added advantage of being able to deconflict the flight path from towers and other obstructions in addition to the ground. The COTS systems have never been tried in F/A aircraft but are widely deployed on large military aircraft. In 1992, the Navy began developing an embedded software solution specifically designed for F/A aircraft to address the alarming CFIT rates in the F/A-18 community. In 1996, the Navy successfully fielded manual GPWS in all Navy and U.S. Marine Corps F/A-18 aircraft to mitigate the hazard of CFIT. An evolutionary update to GPWS, the Navy s embedded TAWS, was developed and patented by the Navy in 2002 and has been fielded on all F/A-18E/F aircraft since FY Retrofit of Navy TAWS into most F/A-18C/D and all AV-8B aircraft will be complete in FY The Navy s embedded TAWS solution is a generic algorithm easily tailored to multiple Type/Model/Series (T/M/S) via a separate configurable parameters file that defines the aircraft performance and mission characteristics. It can operate with DTED to provide the most protection against flight into rising, level, or descending terrain, as well as in the absence of a valid radar altimeter input. When DTED is not available, TAWS reverts to a GPWS mode, providing protection against level and descending terrain while relying on the radar altimeter for height above terrain information. The Navy s embedded GPWS and TAWS solutions provide directive voice and visual warnings to the pilot indicating the best maneuver to avoid ground impact. These warnings are issued 3 to 7 seconds before ground impact. The Navy GPWS and TAWS solutions fielded on the F/A-18 have been credited with saving at least three pilots and 15

21 aircraft. The last CFIT on a fleet F/A-18 with GPWS or TAWS installed was in March The low cost of integrating the Navy TAWS solution, coupled with an expected CFIT reduction of 75 percent, makes TAWS a cost-effective system for reducing CFIT mishaps. This technology is applicable to all F/A aircraft, with or without digital electronic flight controls, but it cannot prevent as many mishaps as Auto-GCAS prevents. The Air Force experience has been that manual terrain awareness systems are ineffective in F/A aircraft Fighter/Attack Midair Collision Automatic Airborne Collision Avoidance System The second-leading cause of death and the third-leading cause of airframe loss in F/A aircraft is midair collision. More than 90 percent of the time, midair collisions occur with other aircraft cooperating in a training objective. Midair collisions account for more than 12 percent of aircraft losses and 6 percent to 40 percent of lost lives. The Air Force Research Laboratory (AFRL) estimates that the Automatic Airborne Collision Avoidance System (Auto-ACAS), in its current configuration, can prevent 75 percent of midair collisions among participating aircraft. Among the other 25 percent, it is the low-aspect ratio and low-overtake mishaps that are hardest to prevent. Auto-ACAS technology is based on existing data link capabilities and software algorithms with no additional hardware required. However, Auto-ACAS is not technologically ready for deployment at this time. The investment required to ready Auto-ACAS for insertion into all DEFC fighter aircraft is $26M over 3 years. Prompt provision of this funding is essential because the infrastructure required to complete the research will be dismantled in FY 2009 if the money is not forthcoming to keep this research active. Manual Midair Collision Avoidance Warning Systems The Navy recently concluded a study for midair collision avoidance in Naval aircraft. The Navy reviewed all Naval midair collision mishaps (FY ), concluding that 67 percent of the midair collisions analyzed had moderate to high probability of being prevented by a solution as simple as a situational awareness display showing position and velocity of aircraft within five nautical miles. Another 16 percent of midair collisions could have been avoided with a moderate to high probability by a Conflict Awareness Advisory (CAA) or Collision Avoidance Warning (CAW). Interviews with pilots and a review of the near midair collision hazard reports (FY ) indicated that the highest threat areas were the terminal areas, areas of high-density air traffic, and during join/re-join activities (PMA209 CAS IPT 2009). Air Force researchers at the AFRL take a different view. They note that F/A aircraft present a different midair collision problem from all other aircraft because fighters are the only aircraft that are deliberately trying to position themselves for high-angle, high-speed overtakes. These situations can easily exceed a pilot s recognition and reaction times 16

22 resulting in a collision. Commercial software and hardware for manual collision warning was never designed to operate in the F/A environment, and some concern exists among knowledgeable researchers as to whether a manual solution would have much value in fighter aircraft. This viewpoint explains why the Air Force has undertaken development of Auto-ACAS. A number of currently available manual warning technologies exist and are ready to deploy in aircraft. One of the least expensive systems is a commercially available system called Traffic Collision and Detection (TCAD), which is certified by the Federal Aviation Administration (FAA) under Technical Standard Order (TSO) TSO-C147, Traffic Advisory System (TAS) Airborne Equipment. TCAD displays the location of other traffic and shows squawk and relative altitude. TCAD operates in one of two modes. In the passive mode, TCAD provides range, azimuth, and Mode C altitude when it sees another aircraft s Air Traffic Radar Control Beacon System (ATRCBS) based upon that beacon replying to a ground radar site. In the active mode, TCAD actively interrogates other aircraft in the vicinity and displays the bearing, range, and relative altitude on a cockpit display. In the active mode, TCAD is completely self-contained and will see all ATRCBS transponder-equipped traffic in the immediate area. Some limitations of TCAD are the maximum range limitations (6 to 21 miles depending upon the strength of the interrogation signal-there are several models), minimum Traffic Advisory limitations (for example, 15 seconds or 0.2 nm, and 600 ft altitude; but these can be adjusted and specified in the software setup of each installation), closure rates that exceed the capability of the system (1,200 knots), and the number of active systems within the airspace before interference (not usually a problem because there are seldom more than 50 fighters in one service area). Another TCAD issue is that it provides traffic position information well but does not provide resolution advisories. The advantages of TCAD are that it is lightweight (some less than 2 pounds), completely self-contained, inexpensive (less than $10K per ship set), low power (less than 2 amps at 28 VDC), small (the size of a small cigar box), IEEE 429 bus capable or able to use a small ½ API indicator instrument. The second manual traffic detection system is part of the Automatic Dependent Surveillance-Broadcast (ADS-B), Traffic Information Service (TIS) being promulgated in the United States by the FAA and available in Europe and other countries as well. This system operates in two modes. Aircraft with Mode Select (Mode S) transponders are able to pass data directly between aircraft and display Mode S-equipped conflict aircraft on their cockpit displays. To realize this capability, the Mode S transponders must be equipped with ADS-B in and ADS-B out options to make use of the full unused spectrum of the Mode S digital communication spectrum. Aircraft with Mode 3 equipment cannot be detected by ADS-B, TIS-equipped aircraft directly; but rely on position information about them to be data-linked from an ADS-B, 17

23 TIS-capable ground radar station. Currently, ground radar stations, by requirement and contract, can only data-link information for 50 aircraft, making it possible for a participating ADS-B, TIS-equipped aircraft to collide with a Mode 3-equipped aircraft without ever receiving any warning of its presence. ADS-B also suffers from a problem known as False Replies Unsynchronized In Time (FRUIT), which can overcome any safety ability of the Radio Frequency (RF) spectrum and tracking algorithms (FRUIT is primarily an ADS-B, TIS limitation and has not affected TCAD to any significant degree. It is the result of a congested radar environment with overlapping interrogators that create replies not initiated by the site actually tracking the aircraft. This has the potential to produce radar targets that do not actually exist. As a result, the contract limit of 50 aircraft is promptly exceeded.) The third manual traffic detection program is also compatible with Mode S technology and is called Traffic Collision Avoidance System (TCAS) technology. TCAS, or Airborne Collision Avoidance System (ACAS), as it is referred to internationally, is five to 10 times more expensive, heavier, and much larger than TCAD. TCAS-II provides flight vector information and resolution advisories to avoid midair collisions. The system is currently employed on all U.S. air carrier aircraft by direction of the FAA and the International Civil Aviation Organization (ICAO), and it is currently used on many DoD large aircraft. ACAS solutions are not suitable to F/A aircraft because they were not designed for the high closure rates and close formation flight possible with high-speed, highly maneuverable aircraft. The fourth class of F/A manual midair prevention technology is the Midair Collision Avoidance System (MCAS). MCAS is a Navy-proposed system that combines passive ADS-B, including 1090 MHz Extended Squitter (1090ES) Universal Access Transceiver 978 MHz (UAT), and Mode 5 Level 2 data with a collision avoidance algorithm to give aircrew the necessary situational awareness to de-conflict flights. The ADS-B and Mode 5 Level 2 position and velocity data information would be sufficient to provide a display of other aircraft in the vicinity, giving aircrew significantly improved situational awareness. When combined with a collision avoidance algorithm, additional protection can be provided in the form of CAA or CAW. Navy research hypothecates that a situational awareness display could mitigate 67 percent of midair collisions, and CAA/CAW could mitigate 83 percent of midair collisions. Current transponders in use on DoD aircraft do not have a 1090 MHz nor 978 MHz receiver capability, requiring a modification to add the receiver to enable the key data source for MCAS functionality. One benefit to MCAS is that it is an embedded hardware/software solution requiring no new boxes or antennas (weight, power, space) for aircraft that have little room to add hardware systems. The MCAS collision avoidance algorithm could be designed such that a common software solution would be tailored to multiple platforms, allowing a single MCAS solution to work across all DoD fixed wing and rotorcraft platforms. MCAS has the distinct advantage over many other collision 18