Table Of ContentIgor Schagaev · Brian Robinson Kirk
Active
System
Control
Design of System Resilience
Active System Control
Igor Schagaev (cid:129) Brian Robinson Kirk
Active System Control
Design of System Resilience
IgorSchagaev BrianRobinsonKirk
Director ResearchDirector
IT-ACSLtd RobinsonSystemsEngineeringLtd
StevenageSG11RR PainswickGL66QJ
Hertfordshire,UK Gloucestershire,UK
ISBN978-3-319-46812-9 ISBN978-3-319-46813-6 (eBook)
DOI10.1007/978-3-319-46813-6
LibraryofCongressControlNumber:2017945950
©SpringerInternationalPublishingAG2018
Thisworkissubjecttocopyright.AllrightsarereservedbythePublisher,whetherthewholeorpartof
the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations,
recitation, broadcasting, reproduction on microfilms or in any other physical way, and transmission
or information storage and retrieval, electronic adaptation, computer software, or by similar or
dissimilarmethodologynowknownorhereafterdeveloped.
The use of general descriptive names, registered names, trademarks, service marks, etc. in this
publicationdoesnotimply,evenintheabsenceofaspecificstatement,thatsuchnamesareexempt
fromtherelevantprotectivelawsandregulationsandthereforefreeforgeneraluse.
Thepublisher,theauthorsandtheeditorsaresafetoassumethattheadviceandinformationinthis
book are believed to be true and accurate at the date of publication. Neither the publisher nor the
authors or the editors give a warranty, express or implied, with respect to the material contained
hereinor for anyerrors oromissionsthat may havebeenmade. Thepublisher remainsneutralwith
regardtojurisdictionalclaimsinpublishedmapsandinstitutionalaffiliations.
Printedonacid-freepaper
ThisSpringerimprintispublishedbySpringerNature
TheregisteredcompanyisSpringerInternationalPublishingAG
Theregisteredcompanyaddressis:Gewerbestrasse11,6330Cham,Switzerland
Preface
We used the word active in the title of our book, Active System Control, because
we are actively trying to predict the future behaviour of the system, and react
accordinglyinordertomanagethesafetyandcontinuetheoperationofthesystem
beingcontrolled.
We used the word system because we create a model of a system, based on an
aggregateofmodelsofitselements.Itisusedtotrytopredicttheparametersofthe
system’sbehaviour.
We use the word control because we continually monitor the current situation
andadaptthecontrolofthesystemtomakethebestofthecircumstances.
Therefore,ActiveSystemControlistherighttitle,andtheabbreviationASCwill
beusedinthetext.
Inthisbookwebrieflyanalysewhatisrequiredfromon-boarddevicesinorder
tosupportactivesystemcontrol,thatis,whatmustbedonetosustaineverydaysafe
operationandsummarisetherequirementsforthisclassofdevices.
Wealsointroducethenewconceptofasafetydevice—the“activeblackbox”—
whichmightbeusedforaviation,transport,andnuclearandchemicalplants.Inthe
coming age of “driverless” transport, it is particularly relevant to the automotive
sectortomonitorthebehaviourofsemi-autonomousandfullyautonomousvehicles
carryingpassengers.
Separately, and briefly, we describe the regulations in transport segments rele-
vanttotheapplicationofexistingandproposeddevices.Westartwithananalysis
of air transport because this is a well-established and reasonably well-understood
domainwitharelativelymaturesafetyculture.
Stevenage,UK IgorSchagaev
Painswick,UK BrianRobinsonKirk
v
Acknowledgements
Thisbookincludeseffortsfromquiteanumberofpeople.Dr.FelixFriedrich,ETH
(Zurich),Dr.FlorianNegeleandDr.ThomasKaegiwereinvolvedinthedevelop-
ment of flight mode algorithms, as well as the system architecture and design
requiredtoimplementtheconceptofactivesystemcontrolinthegeneralaviation
aircraftapplicationdomain.
Engineer Alex Schagaev (IT-ACS LTD) developed and tested various flight
scenarios to detect conditions of flight mode changes, and verified fight mode
changes using two flight simulators—X-plane and Microsoft—in preparation for
field trials using general aviation aircraft. This enabled us to improve our under-
standingoftheconditionsforflightmodechanges,whichwerenotknownbefore,
andtorefinetheflightmodemodel.
Several consultants from the areas of aircraft design, testing and simulations
were invited and contributed in various chapters: Dr. S. Plyaskota was fully
involved in the development of the classification of aviation and analysis of the
market domains. His efforts are highly regarded and appreciated. Dr. V Bukov
consultedinthe“algebraic”descriptionofourgraphlogicmodel(GLM)represen-
tation.Alongwithhiscolleagues,hewasinvolvedinmodellingandsimulatingthe
trialaircraftairpressuresystem.
Dr. Kai Goebel (NASA) made contributions to the prognostic aspects of our
approach and the role of active system control in the whole book, especially in
Chap.10.
Wesincerelyappreciatehelpofourcolleaguesandfriendsandofferourheartfelt
thanks.
vii
Contents
1 Aviation:Landscape,Classification,RiskData. . . . . . . . . . . . . . . . 1
Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
SurveyoftheAviationApplicationDomain. . . . . . . . . . . . . . . . . . . . 4
Terminology. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
ClassificationofAviation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
TheAircraftMarket. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
SafetyandRiskofFlight.. . . .. . . . .. . . .. . . . .. . . .. . . . .. . . . .. 24
AviationSafetyinCommercialAviation. . . . . . . . . . . . . . . . . . . . . 24
MainRiskAgentsandTheirContribution. . . . . . . . . . . . . . . . . . . . 26
RiskFactorsandFlightPhases. . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
RiskandSafetyinGeneralAviation. . . . . . . . . . . . . . . . . . . . . . . . . 30
AccidentStatistics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
FlightRiskAnalysis. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
FirstOccurrencesandSequenceofEvents. . . . . . . . . . . . . . . . . . . . 35
CausesandFactorsofAccidents. . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Conclusion. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
SafetyManagementScheme. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
Insurance,RegulationandAviationSafety. . . . . . . . . . . . . . . . . . . . 39
FlightSafetyandSafetyControlCycles
inAviation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
ConstraintsandFailuresofSafetyManagement. . . . . . . . . . . . . . . . 41
Conclusions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
References. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
2 ActiveSystemControlandSafetyApproach,andRegulation
inOtherApplicationDomains. . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
ApproachtoSafetyinCriticalSystems. . . . . . . . . . . . . . . . . . . . . . . 45
SafetyApproachinIndustrialSystemsandMachinery. . . . . . . . . . . . 46
ApproachtoSafetyinProcessPlants. . . . . . . . . . . . . . . . . . . . . . . . 46
ApproachtoSafetyinSmallIndustrialSystems. . . . . . . . . . . . . . . . 47
ix
x Contents
SafetyApproachintheAutomotiveIndustry. . . . . . . . . . . . . . . . . . . 49
CurrentOn-BoardSafetySystems. . . . . . . . . . . . . . . . . . . . . . . . . . 49
PhysicalSafetySystems. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
RouteSafetySystems. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
DrivingSafetySystems. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
DriverSafetyAssurance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
SafetyImprovement. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
OperationalSafetyCycle. . . . . . . . . . . . . . . . . . . . . . . . . . . . .. . . . 51
FutureSafetySystemsintheAutomotiveIndustry. . . . . . . . . . . . . . 53
SafetyApproachintheRailIndustry. . . . . . . . . . . . . . . . . . . . . . . . . 54
CurrentOn-BoardSafetySystems. . . . . . . . . . . . . . . . . . . . . . . . . . 54
PhysicalSafetySystems. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
RouteSafetySystems. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
DrivingSafetySystems. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
DriverSafetyAssurance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
SafetyImprovement. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
OperationalSafetyCycle. . . . . . . . . . . . . . . . . . . . . . . . . . . . .. . . . 57
FutureSafetySystemsintheRailDomain. . . . . . . . . . . . . . . . . . . . 59
SafetyApproachintheSpaceDomain. . . . . . . . . . . . . . . . . . . . . . . . 60
ExistingStandardisation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
StandardsintheIndustrialDomain. . . . . . . . . . . . . . . . . . . . . . . . . 62
SafetyDefinitionsofIEC61508. . . . . . . . . . . . . . . . . . . . . . . . . . . 62
FunctionalSafetyAnalysis. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
StandardsintheRailDomain. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
TheSafetyCase. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
DevelopmentLife-CycleforSafety-RelatedSystems. . . . . . . . . . . . . 65
SafetyIntegrityLevels(SILs). . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
StandardsintheSpaceDomain. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
Conclusions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
FunctionalSafetyStandardsBasedUponIEC61508. . . . . . . . . . . . . 69
References. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
3 AircraftFlightReliabilityandtheSafetyLandscape
ofAircraftUse. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
AnOperationalReliabilityModelforAircraft. . . . . . . . . . . . . . . . . . 74
ReliabilityModelofaFlight. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
OperationalReliabilityModel:Equations. . . . . . . . . . . . . . . . . . . . . . 76
MeasuresofSystemReliability. . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
TheSafetyMaintenanceLandscape. . . . . . . . . . . . . . . . . . . . . . . . . . 80
DevelopmentsinModernAviationandSafety. . . . . . . . . . . . . . . . . 80
DevelopmentsinRisk. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
ChainModeFlights. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
LatencyofFaultandSafetyMonitoring. . . . . . . . . . . . . . . . . . . . . . 84
Contents xi
TheSafetyMaintenanceLandscape:Commercial
Aviation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
On-GroundManagementofSafety. . . .. . . . . . .. . . . . . .. . . . . . .. 87
TimingforSafetyManagementbetweenFlights. . . . . . . . . . . . . . . . 89
Social,PoliticalandCommercialAspects
ofAviationSafety. . .. . . . . . . . . . .. . . . . . . . . . .. . . . . . . . . . .. . 90
FlightSafetyVersusRiskandStatistics:
FlightDataParadox. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
RiskandStatistics. . .. . . . . . . . . . .. . . . . . . . . . .. . . . . . . . . . .. . 94
ExternalandInternalAspectsofAircraftSafety. . . . . . . . . . . . . . . . 94
Conclusion. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
References. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
4 ActiveSafetyRelativetoExistingDevices. . . . . . . . . . . . . . .. . . . . 99
ActiveSystemControlandSystemSafetyVersus
AircraftManagement. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
SafetyToolsandSupportiveDevices. . . . . . . . . . . . . . . . . . . . . . . . . 101
SafetyDevices:BriefHistoryandEvolution. . . . . . . . . . . . . . . . . . . 101
ExistingFlightDataRecordingDevices. . . . . . . . . . . . . . . . . . . . . . . 105
MilitaryFlightDataRecordingDevicesandTesting
Recorders. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106
RequirementsforNewFlightDataRecording
andProcessingSystem. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
FlightDataProcessingSystemPost-flightAnalysis. .. . . .. . . .. . . .. 110
Constraints. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
TheNatureofDevicesforFutureAircraft. . . . . . . . . . . . . . . . . . . . . 114
Conclusion. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117
References. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118
5 PrincipleofActiveSystemControl(Theory). . . . . . . . . . . . . . . . . 121
Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121
TheGoals,RoleandStructure
oftheChapter. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. . . . . . . . . . 121
ActiveSystemControlOverview.. . . . . . . . .. . . . . . . .. . . . . . . .. . 123
DefiningandImplementingthePASC. . . . . . . . . . . . . . . . . . . . . . . . 126
StructureofResearchofActiveSystemControl. . . . . . . . . . . . . . . . 128
PrincipleofActiveSystemControl. . . . . . . . . . . . . . . . . . . . . . . . . . 129
FactorstoTakeintoAccountMaking
ActiveSystemControlWork. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
DefinitionofthePASC. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131
PASCandElementsofRedundancyTheory. . . . . . . . . . . . . . . . . . . 134
ThePASCAlgorithminMoreDetail. . . . . . . . . . . . . . . . . . . . . . . . 137
PASC:DependabilityandFaultTolerance. . . . . . . . . . . . . . . . . . . . 139
