Risk Assessment of Civil Aircraft during Operation

Abstract

In this chapter, the risk assessment methods for aircraft system, structure, and aeroengine are investigated. For the aircraft system risk assessment, the probability level is divided into probable, improbable, and extremely improbable, and the hazard level of the failure condition is divided into minor, major, and catastrophic. Using Weibull analysis and Bayesian method to analyze the aircraft operation data, the risk level of aircraft system can be determined by combing methods provided in AC 25.1309-1A. For the aircraft structure risk assessment, the probability fracture mechanics approach can be used to determine the structure failure risk based on the data of material properties, environment, inspection, and so on. For the aeroengine risk assessment, the methods for classification of failure risk level, determination of hazard ratio, and calculation of the risk factor and risk per flight are given. The risk assessment process for aeroengine multi-failure modes based on the Monte Carlo simulation is presented to predict the occurrence of the failure and assess the failure risk.

1. Introduction

Although the civil aircraft has obtained type certificate (TC), due to unknown changes in standard formulation or standard compliance, or unpredictable comprehensive failure caused by design defects and manufacturing defects, as well as unexpected operating conditions or environmental conditions and other factors, it will encounter various failures or failure conditions during operation. The aviation operator shall report various faults and failures to the aviation agency and the aircraft manufacturers. The aviation agency and the manufacturers will analyze the collected failure conditions to determine whether the aircraft or the fleet is unsafe. If it exists, corrective measures must be taken within the specified time limit, so that the aircraft or the fleet can return to the proper airworthiness safety level.

Boeing, Airbus, and other civil aircraft manufacturers can timely analyze and study the unsafe conditions of the aircraft they produce, formulate corrective measures, notify users to complete within the specified scientific and reasonable time limit, and ensure that the airworthiness safety level of the aircraft is maintained within an acceptable range. When an aircraft fails, it is necessary to assess the risk that may be caused.

Risk assessment is to assess the expected loss of the system or subsystem and equipment and the effectiveness of measures from the possibility and consequences of the occurrence of a dangerous event. In the continuous airworthiness stage of civil aircraft, the failure, fault, or defect of aircraft or parts is actually observed in service before it becomes an event. Through risk assessment, one can determine the occurrence probability and consequence severity of the event, judge whether the impact of the event on the aircraft exceeds the specified airworthiness risk level, and provide decision support for risk mitigation measures and corrective measures. The higher the risk, the shorter the time needed to take corrective measures; the lower the risk, the longer the time allowed to take corrective measures.

Risk assessment is divided into three processes: risk identification, risk analysis, and risk assessment. The risk assessment method of events can be divided into qualitative risk assessment and quantitative risk assessment; the level of risk assessment can be divided into aircraft risk assessment and fleet risk assessment; and the category of events can be divided into aircraft system, aircraft structure, and aeroengine risk assessment. In this chapter, the risk assessment methods for aircraft system, aircraft structure, and aeroengine are given.

2. Aircraft system risk assessment

The airworthiness standard of transport aircraft, such as Article 1309 of Part 25 (FAR 25) of Federal Aviation Regulations of the United States [1] and Part 25 (CS 25) of European type certification specification, puts forward the top-level requirements for the safety of civil aircraft system. It is stipulated in 25.1309 (b) (1) and (2): the probability of any failure state impeding the continued safe flight and landing of the aircraft is extremely impossible; the probability of any other failure state reducing the ability of the aircraft or the crew to handle adverse operating conditions is impossible.

AC 25.1309-1A [2] is the Advisory Circular prepared by the Federal Aviation Administration (FAA) for FAR 25.1309. The Advisory Circular provides guidance and method description for airworthiness compliance verification and certification of FAR 25.1309.

The failure probability of an occurrence in AC 25.1309-1A is classified as probable, improbable, and extremely improbable, which are defined as:

1. Probable failure conditions are those having a probability greater than on the order of 1 × 10⁻⁵.

2. Improbable failure conditions are those having a probability on the order of 1 × 10⁻⁵ or less but greater than on the order of 1 × 10⁻⁹.

3. Extremely improbable failure conditions are those having a probability on the order of 1 × 10⁻⁹ or less.

The failure condition of an occurrence in AC 25.1309-1A is classified as minor, major, and catastrophic, which are defined as:

1. Minor: Failure condition which would not significantly reduce airplane safety and which involves crew actions that are well within their capabilities. Minor failure conditions may include, for example, a slight reduction in safety margins or functional capabilities, a slight increase in crew workload, such as routine flight plan changes, or some inconvenience to occupants.

2. Major: Failure conditions which would reduce the capability of the airplane or the ability of the crew to cope with adverse operating conditions to the extent that there would be. For example, a significant reduction in safety margins or functional capabilities, a significant increase in crew workload or conditions impairing crew efficiency, or some discomfort to occupants.

3. Catastrophic: Failure conditions which would prevent continued safe flight and landing.

Each failure state has a probability that is opposite to its severity. Figure 1 shows the relationship between probability and failure condition.

Figure 1.

The relationship between probability and failure condition.

The qualitative and quantitative assessment methods are suggested in AC 25.1309-1A, including, failure modes and effects analysis, fault tree, or reliability block diagram analysis.

Using Weibull analysis and Bayesian method to analyze the aircraft operation event data, the failure probability of accidental event, hidden event, aging component failure event, and multiple factor failure event can be determined by combining the methods provided in AC 25.1309-1A, and the failure risk can be determined to provide input for the formulation of corrective/improvement measures and compliance time.

3. Aircraft structure risk assessment

Fatigue and corrosion are the main causes of aircraft structural failure during operation. The initial defect, crack size, residual strength, load spectrum, and maximum load of aircraft structure change with operation time, service environment, and service stage. In the risk assessment of aircraft structure, it is necessary to consider the above factors to calculate the risk of structural failure. Fatigue cracks may originate from defects in the material, such as holes or inclusions, or from damage during manufacturing and processing, or from environmental corrosion during aircraft operation. The risk of aircraft structure failure can be reduced by inspection and maintenance. However, the inspection interval and maintenance measures will affect the number and size of cracks and then affect the risk of aircraft structure failure. At present, during the operation of civil aircraft, aircraft structural risk assessment and analysis methods have been widely concerned in the field of aircraft structural integrity design and aircraft fleet management. When the aircraft enters into operation, the actual service life of the fleet will no longer depend on its design life at the time of certification but on factors such as maintenance cost, reliability, safety, and risk of fleet operation.

In the 1980s, the U.S. Air Force put forward a probabilistic fracture mechanics method (PROF) to calculate the risk of structural failure in the service of aircraft [3, 4, 5] (Figure 2). The input of this method includes: the distribution parameters of probability distribution (such as normal distribution, lognormal distribution, or Gumbel distribution) that the initial defect size or the defect size at a specific time obeys; the normal distribution parameters of fracture toughness; the distribution parameters that describe the inspection probability; the distribution parameters that the maximum stress obeys the probability distribution during the flight of the aircraft; and the data related to the aircraft, for example, the position and number of each aircraft, the number of hours per flight, the time interval, times of flight inspection, etc. The probability fracture mechanics method can be used to calculate the relationship curve between the aircraft instantaneous risk and flight time, and the cumulative probability distribution curve of aircraft structure crack size, which can determine the effectiveness of the inspection method and the distribution of defect size in each inspection interval.

Figure 2.

The probability fracture mechanics approach.

Figure 3.

The risk assessment flow chart in DARWIN software.

FAA, together with aircraft manufacturers and aircraft operators, proposed a risk assessment method for wide-body aircraft, namely, SAIFE (Structure Area Inspection Frequency Evaluation, referred to as SAIFE) method [6], which is mainly to improve the structural integrity and inspection effectiveness of the operating aircraft. The SAIFE method considers the following factors: aircraft design analysis, aircraft full-scale fatigue test, manufacturing, service and corrosion defects, crack and corrosion inspection probability, aircraft modification economy, etc. Taking the above factors into account by Monte Carlo simulation method, SAIFE method obtains a safe and economic aircraft operation scheme. The main purpose of SAIFE method is to evaluate the inspection interval of aircraft. It is suitable for wide-body aircraft, such as Boeing 747 aircraft and aircraft components. It can analyze the number of defects caused by cracks, corrosion, manufacturing damage, and operation during the use of aircraft.

Southwest Research Institute of the United States proposed a Probabilistic Risk Assessment (PRA) method [7] for aircraft structure, which is used to assess the structural risk during the use of aircraft, determine the inspection and maintenance intervals, and establish a balance between aircraft safety and operating costs to provide opinions and suggestions for decision makers. Many analysis tools are used in this method, such as the Probability Fracture Mechanics (PROF) method of the U.S. Air Force, the aircraft engine probability risk assessment software DARWIN (Design Assessment of Reliability with Inspection, DARWIN), and Weibull analysis. The influence of load, material properties, fatigue and fracture, defect size, inspection interval and inspection method, as well as uncertainty on aircraft structure risk are analyzed. This method analyzes the risk assessment of T-38 aircraft wing surface crack damage tolerance, T-37 aircraft fatigue critical area risk assessment, A-10 aircraft risk assessment, etc. In addition to the above analysis methods and software, there are FEBREL software [8] of Boeing company, PROMISS software [9] of Martec company, PRISM software [10] of Bombardier company, etc., which are used for structural risk assessment of the aircraft operation stage.

4. Aeroengine risk assessment

The components whose primary failure can cause the harmful effect of aeroengine are defined as Engine Life Limited Part (ELLP). In the design of aeroengine, the main purpose is to improve the safety of the whole aeroengine by reducing the failure probability of ELLP. The U.S. aviation industry proposes to adopt the component life management method based on Probabilistic Risk Assessment (PRA) to further reduce the failure probability of ELLP [11, 12], and the Federal Aviation Administration (FAA) also puts forward relevant requirements in airworthiness regulations [13]; after the ELLP is determined through system safety analysis [14] in the joint definition stage of the engine, the risk assessment must be conducted to show that the failure probability risk of the ELLP within the expected service life is less than 10⁻⁸/flight hour so that the engine can obtain the final type certificate. Therefore, it is one of the key technologies and implementation steps to evaluate the probability risk of the failure of ELLP in the service life.

In view of the great advantages of Probabilistic Risk Assessment in improving engine safety, the aviation industry departments have actively researched and developed a batch of highly integrated software, some of which have passed the certification of FAA; for example, the Southwest Research Institute (SwRI) in combination with Honeywell, Roll-Royce, P & W (Pratt & Whitney), and GE General Electric (GE) company developed the Darwin software [11, 12], which are mainly used to deal with the problem of low-cycle fatigue failure probability caused by hard α defect of titanium alloy turbine disk [11] and with the problem of fracture failure caused by other material defects and processing-induced defects [12]. Using DARWIN software to evaluate component design is not to replace the traditional safety life method but to provide a probabilistic risk prediction and management tool for aeroengine manufacturers. The risk assessment process and method adopted in DARWIN software basically integrate the main research contents of the above risk assessment method. The DARWIN software integrated the defect characteristics and material properties of components provided by four major engine companies and certified by FAA (Figure 3).

The working group of the Aerospace Industries Association (AIA) proposed a research achievement for the Federal Aviation Administration (FAA), aiming to develop more effective methods to identify and solve unsafe events on civil aircraft engines. The working group is the research committee of the Continuous Airworthiness Assessment Methodology (CAAM). Its members are mainly composed of GE, P & W, Airbus, Boeing, Honeywell, Roll-Royce, and other companies. The study of Continuous Airworthiness Assessment Method covers all kinds of unsafe events related to the propulsion system and auxiliary power plant unit, gives the frequency and hazard level of aircraft level accidents caused by the above system faults in history, and establishes the risk level and risk criteria. The FAA engine propeller certification center uses this information to identify and prioritize the risk of failure for each engine, propeller, and APU. In September 2003, FAA issued Advisory Circular AC 39–8 [15] on the Continuous Airworthiness Assessment of power units and auxiliary power units of transport aircraft and gave the acceptable standard of flight risk level in the aviation industry. AC 39–8 points out that the risk analysis and evaluation of aeroengine failure is a management process of identifying, evaluating, controlling, or reducing risks and accepting risks. The potential damage of risks is measured by the probability of occurrence, exposure of risks, and the severity of consequences. At the same time, implementation decisions are made to minimize the negative effects and economic losses caused by risks. The basic steps are as follows:

1. Define the failure risk and find out the risk factors.

2. Identify the hazard level of the failure risk and obtain the risk coefficient to determine the priority of the failure risk.

3. Calculate the risk factor of each flight [when multiple failure risks exist at the same time, calculate the cumulative risk factors, that is, add the risk factors of risk events caused by various failure risk states; the risk of each flight of the flight crew is calculated by the failure risk factor and risk level coefficient obtained in (1) and (2)].

4. The risk of each flight is compared with the risk criteria to evaluate whether the risk of current aeroengine failure is acceptable. If the short-term risk exceeds the limit value of the risk criteria within 60 days, the risk reduction measures need to be taken immediately.

Figure 4 shows the division of flight risk area according to the risk standard. It can be found that the flight risk area is divided into high-risk area, multi-risk area, and acceptable risk area. When the flight risk is located in the high-risk area, measures need to be taken immediately to reduce the risk; when the flight risk is located in the multi-risk area, it is necessary to formulate and implement measures to reduce the risk within a certain period of time and make the residual risk after the implementation of the measures within the acceptable range; and when the flight risk is located in the acceptable risk area, it is not necessary to take measures.

Figure 4.

The division of flight risk area.

5. Conclusion

In this chapter, the risk assessment methods for the aircraft system, structure, and aeroengine are investigated. For the aircraft system risk assessment, the probability level is divided into probable, improbable, and extremely improbable, and the hazard level of the failure condition is divided into minor, major, and catastrophic. Using Weibull analysis and Bayesian method to analyze the aircraft operation data, the risk level of aircraft system can be determined by combing methods provided in AC 25.1309-1A. For the aircraft structure risk assessment, the probability fracture mechanics approach can be used to determine the structure failure risk based on the data of material properties, environment, inspection, and so on.

For the aeroengine risk assessment, the methods for classification of failure risk level, determination of hazard ratio, and calculation of the risk factor and risk per flight are given. The risk assessment process for aeroengine multi-failure modes based on the Monte Carlo simulation is presented to predict the occurrence of the failure and assess the failure risk.

Acknowledgments

The work reported here is supported by the Fundamental Research Funds for the Central Universities (Grant No. NS2019038).

Conflict of interest

The author declares that he has no known competing financial interests or personal relationships that could have appeared to influence the work reported in this chapter.