Rachel A. Haga

Epidemiology of satellite anomalies and failures: A subsystem-centric approach

Epidemiology is the basic science of public health and it investigates the distribution, frequency, rates, and drivers of health-related states and illnesses in specific populations. 12We adopt in this article some of Epidemiologys concepts and approaches, and instead of human population and diseases, we focus on a satellite population and its on-orbit anomalies and failures. A total of 168 satellites were analyzed in this work, and they have logged 968.5 years on orbit. We analyze an extensive database of geosynchronous satellite anomalies and failures (retrospective cohort study) and develop for each spacecraft subsystem a health scorecard synthesizing its track record of on-orbit failure events. We include results on the severity of the failure events in each subsystems health scorecard (distribution and rates). We also provide for each subsystem its failure concentration ratio or the extent to which a single satellite in our population has experienced multiple failure events from the same subsystem. Next, having derived health scorecards for ten satellite subsystems identified in the database, we conduct a comparative analysis of the propensity and severity of failures between these subsystems. We identify for example several major subsystems driving on-orbit failure events, such as the Thruster/Fuel, the Solar Array, the Payload, and the Telemetry Tracking and Command (TTC) subsystems. In addition, we find that the Control Processor, the Mechanisms, and the Solar Array Deployment subsystems are sufficiently robust and contribute a minor share to the overall failure events on orbit. Furthermore, we find for example that while the attitude control subsystem and the Batteries exhibit roughly similar average failure rates, they have very different behaviors in terms of the severity of anomalies they experience: the former primarily failing “soft” (minor anomaly), whereas the latter, the batteries most often fail “hard” with major non-repairable degradations that affect operation of a satellite on a permanent basis. The results here provided should prove helpful to satellite manufacturers by allowing them to hone in on problematic subsystems that would benefit most from reliability improvements.

Toward meaningful human control of autonomous weapons systems through function allocation

One of the few convergent themes during the first two United Nations Meeting of Experts on autonomous weapons systems (AWS) was the requirement that there be meaningful human control (MHC) of AWS. What exactly constitutes MHC, however, is still ill-defined. While multiple sets of definitions and analyses have been published and discussed, this work seeks to address two key issues with the current definitions: (1) they are inconsistent in what authorities and responsibilities of human and automated agents need to be regulated, and (2) they lack the specificity that would be required for designers to systemically integrate these restrictions into AWS designs. Given that MHC centers on the interaction of human and autonomous agents, we leverage the models and metrics of function allocation - the allocation of work between human and autonomous agents - to analyze and compare definitions of MHC and the definitions of AWS proposed by the U.S. Department of Defense. Specifically, we transform the definitions into function allocation form to model and compare the definitions, and then show how a mismatch between authority and responsibility in an exemplar military scenario can still plague the human-AWS interactions. In summary, this paper provides a starting point for future research to investigate the application of function allocation to the questions of MHC and more generally, the development of rules and standards for incorporating AWS into the law of armed conflict.

Reexamining the titanic with current accident analysis tool: Multidisciplinary eduation and system safety primer for engineering students

We argue that the Titanic, being well known in pop culture, offers a unique opportunity to make learning about accident causation and system safety accessible and engaging. This work will walk the reader through the fundamental concepts of accident causation and system safety, using the Titanic as an illustrative example.

Pilot Designation and Dedesignation of Traffic Targets to the Autoflight System

This study examined flight crew designation and dedesignation of target aircraft, with the objective of assessing flight crews’ responses to errors in coupled operations: errors that may be caused by the flight crew, or that may originate outside the flight crew but then need to be detected and resolved by them. The study examined two potential air traffic operations selected to be representative of operations that couple traffic information to the autoflight system: advanced flight-deck interval management and closely spaced parallel operations. Both of these operations couple the autoflight to a traffic target designated by the flight crew, such that the autoflight system commands a flight path relative to this other aircraft. Twelve pilots each flew 12 scenarios in an integrated flight-deck/air traffic control simulation facility. Each scenario had a pitfall representing foreseeable conditions conducive to error by the flight crew or the air traffic controller, and requiring flight crew intervention. A...

Pilot responses to traffic events during NextGen high traffic density terminal operations

Implementation of NextGen operations into a high traffic density terminal area must be robust against traffic events, particularly where aircraft are coupled to other aircraft via ADS-B In information. For example, in a traffic flow in which arriving aircraft are carefully maintaining a specified time interval one behind another, an aircraft crossing the traffic flow could cause not only one aircraft to be commanded to follow a Traffic Alert and Collision Avoidance System (TCAS) Resolution Advisory (RA), but also then disrupt the aircraft following the maneuvering aircraft. This work evaluates pilot responses to TCAS RAs during NextGen operations, such as Advanced Flightdeck Interval Management (AFIM), which couple an aircrafts autoflight system to the flight path of another aircraft via ADS-B In information. Pilots compliance to RAs was as low in prior studies of compliance in current-day operations, and did not appear to vary with when the pilot chose to discontinue AFIM operations or with alerts about AFIM operation. Likewise, this paper examines the pilots ability to both maintain an interval and re-establish it after a TCAS resolution advisory (RA) involving either the pilots own aircraft or the lead aircraft. The error in spacing was found to grow through the traffic event, particularly in the case of corrective RAs requiring either the own aircraft or lead aircraft to maneuver, and pilots often were not able to re-engage the IM mode within 30 seconds after Clear of Conflict.

Automated conflict resolution for airport traffic using graduated intervention

Reducing the risk of aircraft collisions remains a primary airport safety issue. Evolution in air transportation brings new challenges including increased traffic levels, new information systems, and modified procedures, together with the requirement to maintain or improve safety. These challenges make it important to search for better ways to use automation to improve safety. Automation must go beyond single-level alerting to derive the greatest safety benefit from investments in surveillance and automation. At the same time, the automation must limit its demands made on flight crew attention, as unwanted outputs such as nuisance alerts can degrade performance and render such a system operationally unacceptable. A new concept for governing the behavior of an automated Conflict Detection and Resolution (CD&R) system called graduated intervention uses a control law that optimizes the time series of outputs (“interventions”) given to an operator in terms of costs and benefits. A non-alert indication might be provided first, while an alert is provided only later if the situation continues to worsen. The approach is more flexible than a single-level alerting system because less disruptive interventions, such as nonalert indications, may be provided earlier while uncertainty and nuisance alert constraints prevent the use of alerts. This approach requires the CD&R system to anticipate potential conflicts as early as possible, based on expected aircraft behavior. A technique for representing predicted aircraft activities in a CD&R system for the purpose of generating early indications will be described. Prior work in the field of cognitive engineering supports the argument that operator response times fluctuate depending on a variety of factors, and that care in the design of the alerting system is needed to maximize the chances of a successful response. That design must address the need to present critical information to the operator in time to speed the process of assessing the situation and successfully resolving it. Providing a progression of information beginning with indications to aid situation awareness and potentially culminating with resolution guidance can provide an additional safety barrier against delay or error in responding to the situation. This paper analyzes the importance of response time and accuracy using a probabilistic model of both the ensemble of potential conflict situations and the spectrum of pilot responses. The effectiveness of graduated intervention is contrasted with single-level alerting using this model, focusing on quantifying the potential to reduce the rate of late or insufficient responses to a hazardous situation. The model is applied to a representative runway safety scenario. By predicting the time at which early information can be provided under the graduated intervention algorithms, and conservatively predicting the effect of that information on conflict response time, the model quantifies the benefit in terms of conflict outcome, measured across an ensemble of potential conflict scenarios. Avenues for future research to validate the approach are suggested.