." . INFORMATION AND DISPLAYREQUIREMENTS FOR INDEPENDENTLANDING MONITORS SYSTEMS"., CONTROL, INC. Palo Alto, Calif. 94306 for LaagZey Research Center NATIONALAERONAUTICS AND SPACEADMINISTRATION WASHINGTON, D. C. AUGUST 1976 - TECH LIBRARY KAFB, NM ~~ 0063475' 1. Report No. 2. Government Accession No. 3. Recipient's Catalog No. NASA CR-2687 ~~ ~ ~~ 4. Title and Subtitle 5. Rewrt Date August 1976 . Information. and Display Requirements for Independent I "" LandingMonitors I 6. PerformingOrganization Code 7. Author(s) 8. Performing Organization ReportNo., J.S. Karmarkar and J.A. Sorensen . 10. Work UnitNo. 9. Performing Organization Name and Address SYSTEMS CONTROL, INC. (Vt) 11. Contract orGrant No. 1801 Page Mill Road NAS1-13490 Palo A1 to, CA 94306 13. T pe ofRe rt andPeriod Covered ___ ".."I.~"" 12. SponsoringAgency Name and Address $1 nal Gport NationalAeronautics .and SpaceAdministration July 1974 - July 1975 14. Sponsoring'Agency Code . LangleyResearch Center Hampton,-!!Win.ia 15. Supplementary Notes Langley technical monitor: Patrick A. Gainer Final report. 16. Abstract The rising costs of air travel and the increased demand for consistent service has motivated providing avionicssystems which enableall-weather landing capability. All-weatherlanding can be at least partially accomplishedthrough provision of auto- maticlanding (autoland) systems andimproved landingaids such as the microwave land- ing system (MLS). The trend towardsincreased automation, together with increased equipment and maintenance costs, have motivated a rethinking of the potential role of the crew during automaticphases of flight. The problem,addressed in this study, con- cerns the waysan Independent Landing Monitor (ILM)may be used by the crew to comple- nent the autolandfunction. In particular, a systematicprocedure is devisedto es- tablishthe information and display requirements of an ILM during the landing phase of the flight. Functionally,the ILM system is designedto aid the crew in assessing whether the total system (e.g., avionics,aircraft, ground navigationaids, external disturb- ances)performance is acceptable,and, in case of anomaly, to provideadequate infor- mation to the crew toselect the leasturxafe of the availablealternatives. Economi- cally, this concept raises the possibility of reducing the primaryautoland system redundancy and associated equipment and maintenance costs. The requiredlevel of safety for the overall system would in these cases be maintained by upgrading the backupmanual system capability via the ILM. A safety buget analysis is used to establish the reliability requirements for the ILM.. These requirements are used asconstraints in devising the faultdetection scheme. Covariancepropagation methods are used with a linearized system model to establish the time required to correct manually perturbed states due to the faul't. -Time-to-detect and time-to-correct requirements are combined to devise appropriate 17. Key Words(Suggested by Author(s) j 18. DistributionStatement Independent Landing Monitors Human Pi lot Model Unclassified - Unlimited CovariancePropagation - I Category Subject 04 19. Security Classif. (of this report) 20. Security Classif. (of this page) 21. No.of Pages I 22. Prm' Unclassified Unclassified 169 $6.25 For sale by the National Technical InformationService. Springfield, Virginia 221 61 . TABLE OF CONTENTS PAGE I . INTRODUCTION ........................................... 1 Previous Developments ............................. 3 Objectives and Scope of Study ..................... 5 I1 . BACKGROUND ............................................. 13 Overview .......................................... 13 Terminal Area Environment and Crew Procedures ..... 16 Terminal area flight path .................... 17 Atmospheric Conditions ............................ 20 Crew Procedures ................................... 23 Autoland System Considerations .................... 26 Microwave Landing System Considerations ........... 30 ILM Application Areas ............................. 33 ILM Application Studied Under This Effort ......... 36 I11 . SYSTEM SAFETY ANALYSIS ................................. 39 Safety Analysis Overview .......................... 39 System Performance.Evaluation ..................... 42 System Safety Evaluation .......................... 43 Pilot decision strategies .................... 43 Event outcome tree ........................... 45 Effect of an ILM on pilot takeover ........... 49 Evaluation of System Requirements ................. 53 Summary ........................................... 60 IV . FAULT DETECTION AND DISCRIMINATION ..................... 61 Main Premises and Fault Models .................... 62 Fault Detection Algorithms ........................ 64 Fault Discrimination .............................. 73 V . FAULT RECOVERY PERFORMANCE ............................. 79 Fault Recovery Performance Assessment By Covariance Propagation ....................................... 80 Example Covariance Propagation Simulation Results . 85 iii . TABLE OF CONTENTS (CONTINUED) PAGE VI . TOTAL SYSTEM PERFORMANCE. ASSOCIATED STRATEGIES. AND DISPLAY REQUIREMENTS ................................... 91 Total System Performance .......................... 91 ILM Usage Strategy ................................ 98 Proposed Display Configurations ................... 103 System Hardware Implementation .................... 111 VI1 . SUMMARY. CONCLUSIONS. AND RECOMMENDATIONS .............. 113 Summary and Conclusions ........................... 114 Recommendations ................................... 122 APPENDIX A SAFETY BUDGET ANALYSIS .......................... 125 APPENDIX B COVARIANCE PROPAGATION ANALYSIS ................. 139 APPENDIX C STATISTICAL TESTS ............................... 161 REFERENCES .................................................. 165 iv - .- .. .. .. .. .. - ._" "_. .. .. .. .. ._ I-" INFORMATION AND DISPLAYREQUIREMENTS FOR INDEPENDENT LANDING MONITORS By J.S. Karmarkarand J.A. Sorensen SystemsControl, Inc. I. INTRODUCTION There are majoreconomic reasons for providing the capability ofall-weather operations to most National Airspace users. The fact that airports are frequentlyclosed or operating at reduced capacitybecause of low visibility is a primarysource of lost revenueand increased operating cost. Prolonged holding patterns and diversionsto alternate airports increase fuel usage, labor costs,and aircraft inefficiency. These delays also diminish user good will, andin some cases,cause the customer to seek alternate meansof transportation. These economic considerations have moti- vated a concentratedeffort on thepart of the appropriate govern- mentagencies--National Aeronautics and Space Administration, the FederalAviation Administration, and the Department of Defense-- tosponsor the development of all-weatherlanding capability [l-41. Increasingthe number of IFR operationsand improvements in IFR efficiency are beingaccomplished through the development of advancedonboard avionics (automatic landing system, Category I11 ILS).But using these advanced systems during low visibility im- plies that more precautionsmust be taken to ensure flight safety. Inorder for the pilot to accept fully the new equipmentcapability whichallows him to land in low visibility conditions, he must be reasonablysatisfied that his chances of safe landing are at least asgreat as under VFR conditions. The ability of different users to pay different amounts for all-weatheravionics equipment has resulted in varying degrees of IFR landingcapability in the respective aircraft fleets. These rangefrom Category I (wherethere must be at least a 61 m (200 feet)altitude visibility ceiling) to Category IIIc (wherethe landing is essentiallyblind). Aircraft avionicsmust be certi- fiedto be allowed to land under each of these categories, and the certificationprocedures ensure that the appropriate measures of systemsafety (probability of catastrophic accident) are adequate- ly met. ForCategory I conditions,the avionics must allow the pilot to get below 200 feetand be satisfactorily lined up with therunway for a manuallanding. For Category IIIa operation, presentlanding systems have utilized automatic landing to pass certificationrequirements. To meetthese requirements currently necessitatesthat the automatic landing (autoland) system have multiple componentredundancy toguard against failure. Avionicssystem improvements which have been suggested to improveall-weather landing capability include development of provisionsfor the following: (1) allow landing with lower visi- bility limits, and (2) usethe pilot's monitoring ability to reducethe necessary complexity of the automatic landing systems. Thesedesired improvements have produced the need for re-examina- tion ofthe potential role of the Independent Landing Monitor (ILM).Such a devicewould obtain independent information about thestate of theaircraft relative to the runway toallow the pilotto assess the performance of thelanding operation. 1. Allowlowering the visibility minimums whilemaintain- ingthe present-day levels of safety. 2 -- - .. " ". .. ._ . .. - . .. ___ - . ._. .. .. .. " I 2. Allowthe pilot to determine whether an anomaly has occur- redin the onboard guidance system or the ground-based ILS or MLS si,gnalduring the landing phase. This infor- mationincludes the decision of whether manual landing or manualgo-around should be attempted. 3.Guide the aircraft formanual landing or go-around in caseof takeover during flight. 4. Guide theaircraft in case of faultduring