International Symposium on Transportation Recorders
May 3 - 5, 1999 Arlington, Virginia

A Case for Higher Data Rates

Ralph A'Harrah
NASA HQ

George Kaseote
FAA HQ

KEYWORDS

Aviation, Safety, Data-rate, Aircraft-Pilot Coupling.

INTRODUCTION

Flight data recorders required to support aviation accident investigations have benefited from numerous advances in recorder technology. These numerous technology advances for the most part have been directed at increasing the number of recorded parameters, improving the recording media, and improving reliability, maintainability, survivability and recovery characteristics. While these several aspects of the recorders have been improved, there has not been an associated increase in the once-per-second (1.0 Hz.) rate at which the flight data is recorded for accident analysis. This once-per-second rate has persisted in spite of the fact that technology advances could support much higher data rates, as demonstrated by rates of 20 to 100 data points per second (20 to 100 Hz) of current flight test data recordings. The need for a data rate above one data point per second evidently has not been conclusively established for accident analysis.

While the aviation accident rate is rewardingly low, the aviation accident rate has remained stubbornly unchanged for the past two decades in spite of the billions of dollars invested for safety improvement. The following review of the accident data for the most recent ten-year period for which data is available, may provide some insight as to a potential reason for our inability to further improve our aviation accident rate.

During the period from 1988 through 1997¹, the worldwide commercial jet fleet experienced 213 hull loss accidents. For 105 of these accidents, or 49% of the total accidents, the "flight crew" was listed as the primary causal factor. An additional 64 accidents, or 30%, listed "unknown" as the primary causal factor. These statistics indicate that nearly 80% of the hull loss accidents for the most recent ten year period are the results of causal factors for which there is incomplete understanding of exactly what problems need to be solved. Can there be a credible expectation for reducing the accident rate by 80% within ten years² when 80% of the causal factors aren't well understood.

The intent of this paper is to demonstrate the need, and argue for the establishment of data rate requirements at least an order of magnitude greater than today's requirements for selected parameters under particular conditions, and to describe the potential benefits that would be derived from the increased data rates.

THE NEED FOR HIGHER DATA RATES

The argument will be made as follows:

· A troubling, and often catastrophic phenomena causing temporary loss of control of the aircraft will be described,

· Recent experiences of this specific control-loss phenomena will be presented,

· A flight test program to expose seven FAA certification pilots to the loss of control phenomena will be described.

· An analysis of the flight test results taken at a data rate of 20, 10, 4, and 1 data points per second to illustrate the degradation of the information content as the data rate is decreased. Associated with the degradation is the shift in the primary causal factor from an aircraft problem (correct answer) to a pilot problem (wrong answer).

· The paper will conclude with a brief projection of the potential benefits of increased flight recorder data rates on aviation accident statistics, and to the aviation safety program.

AIRCRAFT-PILOT COUPLING (APC) - A LOSS OF CONTROL PHENOMENA

Discordant Aircraft-Pilot Coupling is a loss of control phenomena resulting from dynamic distortion of the pilot-aircraft control system. The dynamic distortion will occur in two areas:

· in the information upon which the pilot judges the aircraft's response to his control input (the feed back loop)

· in the actual response of the aircraft to the pilot's control inputs ( the feed forward loop)

The result of a small amount of dynamic distortion (for example, a delay of 0.1-0.2 second between the pilot's control input and the control surface output typical for today's aircraft) may cause a momentary loss of control during an aggressively flown recovery from an upset. The pilot's impression of this APC encounter will be that the incident may have been the result of an external disturbance, or pilot over control. From a hull loss perspective, such instances of momentary loss of control would be catastrophic only if there was contact with the ground or another aircraft, or the structural limits were exceeded. However, passenger discomfort/injury is likely, particularly if passengers are unbelted.

The results of substantial dynamic distortion (that is, a delay of greater than 0.2 of a second between the pilot's control input and the control surface output) can result in such discordant aircraft responses to the pilot's control input that the pilot becomes convinced that the control is broken. Substantial dynamic distortion is the result of the pilot "over driving" the cockpit control beyond the surface actuator (or software) rate limit and/or the control surface deflection (or software) limit. Such "over driving" might be expected during a flight saving recovery to counter a large upset in close proximity to the ground, or an impending mid air collision.

The tendency for pilots to experience the feeling that "the control system is broke" can be further exacerbated during moderate maneuvering by a degradation of the control surface actuator performance. This actuator performance available to the pilot will degrade from of the following:

1) reduced hydraulic pressure from a partial hydraulic system failure,

2) increased friction and flow restrictions caused by the actuator servo valve distortion,

3) depletion of the hydraulic pressure caused by the significant demands of other surfaces/systems.

RECENT APC EXPERIENCES

A partial listing³ of recent aircraft that have recognized and reported APC events during development flight-testing is provided in the following table:

Table 1. Recent APC Events

The above listed aircraft have several common factors:

· All employ a fly-by-wire control system,

· All used design guides derived from past experience to help design an aircraft with harmonious aircraft-pilot interaction,

· All extensively used ground-based flight simulation facilities as a tool to help design an aircraft with harmonious aircraft-pilot interaction, and several utilized in-flight simulation to complement the ground-based efforts,

· During the development process, all were specifically flight tested to discover any lingering APC tendencies,

· Yet every one of these aircraft did, after all of the above precautions, experience one or more APCs in subsequent flight testing,

· The identified design flaws contributing to the APC events, were satisfactorily corrected.

However, one of the more disturbing aspects of APC is that the chances of recognizing APC as a primary causal factor in an accident or incident are exceedingly low⁴ without the higher data rates currently only utilized during the development flight testing.

AN APC EXPOSURE/TRAINING INITIATIVE

For two weeks this past December (1988), seven FAA certification test pilots and five flight-test engineers were involved in a concentrated APC training session conducted at the Calspan Flight Research Facility in Buffalo, NY. The training included lectures; ground based simulation, and in-flight simulation on a variable stability Learjet incorporating both a control column and a side stick. On several occasions during the actual flights, APC encounters resulted in loss of control of the aircraft in situations that could well have resulted in a crash. The crash was avoided by the Calspan safety pilot taking control of the aircraft. Control is taken by the safety pilot hitting a paddle switch on his stick, which disengages both the visiting pilot's controls, and the variable stability system.

A typical APC exposure task was a precision landing commenced from an offset approach as depicted in Figure 1:

Figure 1. Offset Landing Task

An example data set for an offset approach is presented in Figure 2.

Figure 2. Time Histories of Offset Approach

APC DATA ANALYSIS

Data taken during the APC exposure and training flights are used to illustrate the critical importance of the higher data rates to establish the primary causal factor in accident investigations involving APC. The data are taken from one of the offset approaches for which control was lost. An accident was averted by the safety pilot taking control of the aircraft. Parameters were recorded at a data rate of 20 data points per second, or 20 times the usual data rate available to accident investigators. This 20 data points per second rate is on the low side of most of the data rates used during the development flight testing which recognized the APC experiences in the previous section. Over sixty flight parameters were recorded during the APC exposure. However, only two parameters are needed to address the dominant cause of the more currently recognized APC. Specifically, only an examination is required of the pilot's input at the cockpit controls, and the associated control surface response, which are shown in the Figure 3.

Figure 3. Pilot Input and Surface Output Time Histories

The time delays that can be determined from this Figure 3 flight data as a function of the recording rate are as follows:

Table 2. Time Delays Extracted from Figure 3 Time Histories

The identical data set from the same time history, plotted at data rates of 20, 10, 4 and 1 Hz are shown in Figure 3, with the associated time delays that would be read from those figures listed in Table 2. The ability to consistently discern the magnitude of the time-delay is shown in Figure 3 and the associated Table 2 listing of time delays to substantially degrade with the lower data rates. Note that there is no discernable/measurable time delay at the 1.0 Hz data rate currently exercised on most flight data recorders.

APC DATA SENSITIVITY

In an effort to put this 350 msec time delay in perspective, and to stress the implications of overlooking a 350 msec time delay, a review of the guidance given for the design of military aircraft is warranted. As early as 1980, military specifications stated⁵ that the response of the airplane motion to a pilot-initiated step control force input shall not exhibit a time delay longer than the following:

Table 3. From Paragraph 3.5.3 of Military Specification MIL-F-8785C

... where the Levels 1, 2 and 3 reflect "adequate for mission completion", "increased pilot workload/mission degradation", and "excessive pilot workload/inadequate mission effectiveness", respectively.

From the Figure 3 time history recorded at 20 Hz, the time delay between the pilot's input and the associated control surface output would be the 350 msec, as listed in Table 2. . This 350 msec time delay is well in excess of the 0.10 to 0.15 seconds delay that is generally accepted currently⁶,⁷ as the upper limit to prevent a time-delay induced APC. Further, 350 msec is greater than the maximum allowable time delay that the military would tolerate, as indicated by the Level 3 value of 0.25 seconds of Table 3, recognizing that "excessive pilot workload/inadequate mission effectiveness" would be the consequences.

Based on the time histories of Figure 3 and the associated apparent time delays of Table 2, all of the data rates above one Hz. flag the presence of a very significant time delay, i.e., equal to, or larger than, the maximum tolerable Level 3 value of Table 3. Whether this very significant time delay is 250, or 300, or 350 msec is relatively immaterial - what is important is that a large time delay has been identified. But what if the time delay is a smaller value? If the value of the time is to be measured with an accuracy 50 msec, so that investigators can discriminate between an arguably acceptable time delay value of 150 msec and a potentially dangerous value of 200 msec, then the case is made that a 20 Hz rate is required.

POTENTIAL AVIATION SAFETY BENNEFIT

Because APC continues to be unrecognized as a causal factor in operational accidents and incidents, there is little room for credibly projecting a specific reduction of aviation accident rates resulting from providing the capability of determining whether APC is, or is not a causal factor. However, the accident statistics indicating that 50% of the accidents involved "crew error" as the causal factor is a large target, as APC could be an unrecognized significant contributor, but the blame is being put on the crew. Likewise, the 30% of the accidents having the primary causal factor "unknown" could be harboring a substantial number of APC experiences. Further, the consistent inability of the current complement of analytical tools, design criteria, flight simulation testing, and dedicated flight testing to ferret out adverse APC characteristics to such an extent as to preclude a subsequent APC surprise, reinforces the wisdom of identifying a potential APC problem.

CONCLUSIONS

An order of magnitude increase in the data rates utilized for accident investigations is required to establish that APC is, or is not, a primary causal factor. Once APC is recognized as being a causal factor, there are available numerous solutions, as clearly indicated by the many aircraft, such as those listed in Table 1 that have been modified to correct APC difficulties recognized during development. Fixing the pilot is not one of the solutions, but that is the default thinking when a latent design problem goes unrecognized.

ACKNOWLEDGEMENTS

The authors thank Mike Parrag of Calspan for providing the flight data used in this paper, and Jeff Schroeder of the NASA Ames Research Center for processing and interpreting the flight data.

BIOGRAPHIES

Ralph A'Harrah is the Goal Manager for NASA's Aviation Safety Program at NASA Headquarters in Washington, DC, where he has been a member of technical staff since 1989. The previous 25 years with the Navy, serving in various capacities with the Naval Air Systems Command, the Naval Air Development Center, and the Office of Naval Research. The previous 15 years he served in various research and development roles at North American Aviation, in Columbus, Ohio, following his graduation from the Pennsylvania State University in 1955. Mr. A'Harrah has published 24 technical papers on the subjects of aircraft flying qualities, flight controls, flight simulation and Aircraft-Pilot Coupling; he has served as a technical consultant to the Advisory Group for Aerospace Research and Development (AGARD) of NATO, and to the US Air Force; he has served as Chairman of the Flight Mechanics Panel of AGARD; and is a member of the SAE Guidance and Control Committee.

George Kaseote is the Program Manager of digital flight Data Recorders and Cockpit Voice Recorders for the FAA Aircraft certification Service. He is a test pilot, chair of the Flight Test Technical Committee, member of the Flight Program Oversight Committee, course manager for the FAA Flight Test Pilot/Engineer courses taught by the National Pilot School at Mojave, CA. Prior to joining the FAA in 1990, he was one of three Navy test pilots that conducted the Navy Preliminary Evaluation and two Board of Inspection and Survey trials on the then North American RA-5C (Vigilante) aircraft. He flew that aircraft at twice the speed of sound in 1962, a mere 37 years ago. During his periods of furlough from Pan American World Airways, he was Chief Test Pilot at Lock Haven, PA where he made the fist flight in the PA-41 aircraft, Director of Flight Operations at the Falcon Jet Corporation where he conducted the first flight on the U.S. Coast Guard's HU-25A Falcon aircraft. George has experienced APC events in 4 different airplanes besides those in the Calspan Variable Stability Learjet-25.

1 Statistical Summary of Commercial Jet Airplane Accidents, Worldwide Operations, 1959 -1997, Boeing Commercial Airplane Group, June 1998

2 White House Commission on Aviation Safety and Security, Vice President Al Gore, Chairman, February 12, 1997

3 Aviation Safety and Pilot Control, Committee on the Effects of Aircraft-Pilot Coupling on Flight Safety, National Research Council, 1997, Table 1-2

4 Aviation Safety and Pilot Control, Committee on the Effects of Aircraft-Pilot Coupling on Flight Safety, National Research Council, 1997, Finding 3-2

5 Military Specification Flying Qualities of Piloted Aircraft, MIL -F-8785C, 5 N0vember 1980

6 Unified Criteria for Active Control Technology Aircraft Longitudinal Dynamics, Roger Hoh, AGARD AR 335, Paper #4, February 1995

7 Proposed Time Delay Limits for Digital Fly-By-Wire Transports in Precision Landings, David Klyde et al, STI TR-1284-1, May 1993