1. Small Airplane Approach for Enhancing Safety Through Technology1

2. Objectives Communicate Our Experiences
Managing Risk & Incremental Improvement
Discuss How Our Experience Might Benefit the Rotorcraft Community
Communicate Our Experiences
Fixed Wing Safety Improvements – 1990’s to Now
Focus on Incremental Improvements
Managed Risk Approach
How we identified & Addressed barriers
Planned Incremental Change for Safety
Discuss How Lessons Might Benefit the Rotorcraft Community

3. 90’s - Fixed Wing GA Fatal Accidents
1 Per Day, At Least……Flat For Years
Recurrent Root Causes
Better Information Would Benefit Safety
Needed a New Approach
First, it helps to look at how we got to where we are today by reviewing the situation in the mid 1990’s which led us to seek improvements in GA safety through technology:
We had at least one fatal GA accident per day. Fatal accident rate had been flat per years.
The root causes were weather, loss of control, and the majority attributed to “Pilot Error” of Human Error.
Studies by NASA under AGATE concluded advanced displays could benefit safety. We knew that if pilots had better weather information and better knowledge of their location relative to terrain, we could help the situation.
However, we were seeing few safety improvements in GA and realized we needed a new approach.

4. 90’s Attitudes Toward Change
Stagnation = situation unchanged for essentially 30+ years
Few examples of “new technology” - Little innovation or new product development
Companies & FAA entrenched in S-curve - Hindering technology potential
It also helped us to look at our attitudes towards change to see if we were actually achieving our safety goals, or if we were hindering safety and innovation by our attitudes.
By very nature, there is regulatory resistance to innovation. There is an attitude of “We’ve always done things this way”. This lead to stagnation in small airplanes, with few examples of safety improvements or new product development coming for essentially 30+ years.
Companies were entrenched in this S-curve mentality, so production/certification costs exceeded perception of the value of “new” products (what’s received vs. what it costs)

5. Technology Implementation
Typically follows an S-curve* for wide spread acceptance and use *Abernathy, W.J. and Utterback, J.M. – Patterns of Innovation in Technology, Technology Review 1978
S-curve mentality forced small airplanes to wait until older/used equipment was cheap
Technical Maturity &
Acceptance
Time .
Development
Mass Usage
Initial Use
Widespread
New & Novel
Commonplace
You are all probably aware of the typical technology S-curve. This typical implementation path for new technology was causing the small airplane industry to wait until used glass displays were cheap enough on the used market to be affordable for GA.
Also, we faced the expectation for any new idea to be technically mature and in widespread use before it was deemed acceptable for use in aviation.

6. 90’s Reality Check for Part 23
Typical “IFR” Panel
Single ADI Failure = Partial Panel
Typical, even on new Aircraft into 1990’s
Primary Attitude (Vacuum Driven)
Single source of attitude acceptable for 91 IFR Ops (Yet, failure in hundreds of hours, ie. 10E-2)
Ironically, waiting on systems to meet “acceptable level of safety for aviation products”, ie 10E-9
This caused us to do a reality check for the typical IFR panel where a single ADI failure put the pilot in a situation to use partial panel techniques even into the 1990’s.
We were allowing a single source of Attitude data to be approved for fixed wing use in IFR, when we were seeing failures in the 100’s of hours for typical vacuum driven instruments.
Yet, ironically, we were waiting on new systems emerging in the experimental market to reach a theoretical acceptable level of safety for aviation products at the same time studies showed the information and technology were potentially superior to the existing equipment.

7. 90’s Technology Potential
NASA studies showed display concepts could enhance safety
Wide format attitude displays
Moving GPS maps with weather, terrain, traffic
Could reduce accidents due to “pilot error”
We began looking at studies done by NASA, AOPA, GAMA, and the FAA that indicated glass displays with moving maps and wide format attitude indicators could improve safety, assist better pilot decision making, and reduce “pilot error accidents’

8. Response - Planned Evolution
Worked to improve GA safety through Purposeful Architectural Change
Goal to Maintain at least same level of safety, but implement incremental change
Had to address “Single Level Of Safety” Mentality
So we began a planned evolution.
We sought to improve GA safety and the technology in the panel through purposeful architechtural change, to the systems themselves, and how we certified them.
Our goal was to maintain at least the same level of safety we had in GA, but implement incremental change in the right direction.
We began looking at our expectations for enforcing one set of requirements for all aviation systems - Boeing 787 vs. Small Cessna
This led to a common-sense approach to managing risk that also recognized potential safety benefits of new technology & advocated the use of new displays, where we used a managed risk approach to focus on the chances of a fatal accident vs. our expectations for equipment design requirements.

9. Addressing Barriers
Natural Desire for 100% Safety Assurance & Zero Risk
Lack of Familiarity With Technology
Assumptions Regarding Pilot Skill & Response to Failures
Focus on Theoretical Design Targets Instead of Functional Performance & Failure Mitigation
Some of the barriers we had to overcome included:
The natural desire to have 100% safety assurance, or zero risk. We began to recognize that incremental change in the right direction allowed us to manage risk and safely implement new concepts.
We dealt with the lack of familiarity with the technology, and the potential unknowns for reliability by maintaining the original instruments as stand-by instruments. The panel was essentially the same, only with added features.
This allowed us to overcome several assumptions about pilot skill and their response to failures. They simply would fly the instruments they were used to flying before the glass was added.
Lastly, we focused heavily on where the 10E-9 Theoretical Design Target For Catastrophic Failure of “Aviation Systems” came from, and whether it made sense for GA instruments, particularly when we knew the existing systems were failing in the 100’s of hours

10. Where Did 10-9 Come From? Transport Category Airplanes
Fatal Accident Rate At Time Of Rule
Data Showed ~10% Caused By System Failures 10-1
Assume 100 Catastrophic Failure Conditions 10-2
Results In Probability
Small Single-engine Airplanes
Fatal Accident Rate At Time Of Rule (IN IMC) 10-4
~10% Caused By System Failures
Assume 10 Catastrophic Failure Conditions 10-1
Results In Probability
Goal: Rate Should NOT INCREASE
Looking into our system analysis expectations, we began to ask, “Where did 10E-9 come from?”
During the evolution of XX.1309 for system and equipment certification, the decision was made to move from a system where we had acceptable and unacceptable failures, to a system of multiple classification levels for failures based on their severity. out the different classifications of Highly Improbable, Improbable, Unlikely
To properly assign acceptable probabilities for occurrence of these failures, we started by looking at the actual transport and small airplane fatal accident rates, the majority of which were attributed to pilot error.
At the time this analysis was done, the Fatal Accident Rate at the time of the rule is based on approximately 80% human error. Our thought was to address this constant source of accidents by providing better information to the pilot to reduce human error.
By allowing 10E-6 in small aircraft, the systems would be affordable, yet the reduction in probability of failure does not increase the accident rate but by they nature of the equipment will improve safety by having an effect on 80% human error side of the fatal accident rate. 11 11 14

11. Analyzing Risk Exposure Factors
Aircraft/Ops
Passengers
Complex
Parts/Systems
Annual Hours Flown
Small Single
/Recreational
1’s
10’s
Large Twin /Business Use
100’s
Airliner
/Commercial
1000’s
In addition to being justified by reducing pilot error accidents, we also could justify a new approach by looking at basic risk exposure factors between large and small aircraft.
Our approach to use 10E-6 as a design target is also justified by the way our aircraft are flown, the complexity of their systems, and the number of passengers exposed on a typical flight.
This chart shows how the relative values for passengers, number of complex systems, and hours flown all tend to reduce the potential exposure in GA aircraft to a catastrophic outcome.
A Single Level of Safety for all Segments of Aviation Doesn’t Consider Specific Risk Exposure

12. Logical System Analysis Targets
Aircraft/Ops
Passengers
Complex
Parts/Systems
Annual Hours Flown
Theoretical Target
Small Single
/Recreational
1’s
10’s
10E-6
Large Twin /Business Use
100’s
10E-8
Airliner
/Commercial
1000’s
10E-9
So these relative values justify a logical tiered set of system analysis targets. We can justify different theoretical targets for the different segments of Part 23, based on how they are used and public perception.
This leads to a tiered approach to our system analysis requirements and safety expectations.
However, this does not represent a reduction in safety, but an actual classification of the ACCEPTABLE level of safety for each segment.
Created Tiered Approach to Theoretical Probability of Catastrophic Failure
Not a “reduction” in Safety, but Appropriate Safety

13. Actual Safety Data Shows Relative Trend Between Segments of Part 23
Indicates One Level of Safety Not A Realistic Goal
Some quick analysis using averages from AVP over the last decade or so, shows this relative tiered set of requirements is reflected in the actual safety levels based on the different segments of GA. It shows the actual operational safety between corporate operations, business use of singles and twins, personal single engine flight for recreation, LSA, and amateur built aircraft.

14. Safety efforts seek to move all to the left, not just one segment
Tiered Safety Targets
Part 23 Established Continuum of Safety
Relative Safety Expectation
Safety efforts seek to move all to the left, not just one segment
So the end result is to have safety targets, with the expectation to make all segments of aviation “safer” while maintaining different acceptable levels of safety based on the type of aircraft, operation, passengers, etc.

15. Result – Avionics Revolution
Kept what is still certifiable for IFR, and added glass
Mitigated the main risk of introducing glass – loss of function
Appropriate Design Targets Allowed Affordable Products

16. Success of New Technology
More glass in GA than in the Transport fleet!
New pilots training on glass
7000+ airplanes equipped with synthetic vision
Large % of GA has “latest technology”
We have glass in over 6000 GA airplanes. Considering that there are only about 8000 transports flying and many are still equipped with steam gauges, we easily surpass the transport world with our integrated cockpits.
Pilots are transitioning to glass from traditional panels with 3 hours ground instruction and a 1 hour flight checkout. We already have a significant number of pilots who have never flown an airplane that required “partial panel” techniques for IFR flying or that didn’t have a moving map.
AOPA reviewed the accidents from “glass” airplanes in 2007 and found that they had reduced the number of all types of accidents except weather accidents. We believe that this is because pilot are flying in more conditions that they would have historically not flown in. We also are concerned that pilots don’t have a clear understanding of the possible delays with uplinked weather verses weather radar. Uplinked weather is for strategic planning while onboard radar can be used tactually. 17

17. Take Away Items We manage risk, intent of SMS
Today’s “processes” involve risk
Tomorrow’s will also involve risk
Over time, intent is to reduce the overall risk and save lives = risk management in action
Focus on incremental change, not radical change – move one “yard” at a time
Can’t assume zero risk is the only acceptable option – does not exist
The key items to take away are:
Technology can hold the key to major safety improvements.
All change also involves risk. However, Incremental change should be our focus. Step functions are higher risk. Incremental change allows us to manage risk and the safe introduction of new technology.
The intent is to reduce the overall risk in actual operation one “yard” at a time
Cannot choose to stifle change. We can’t assume zero risk is the only acceptable option – does not exist

18. On The Horizon…
UAS technology used in Part 23: key sensors, control & navigation concepts
Auto-land systems already in place in UAS & “optionally piloted” vehicles
Point and click navigation & flight planning
Concepts to enhance GA safety
And now for a little marketing…
These are the features that we are looking to be integrated into our part 23 integrated cockpits. The features might include:
One-button aircraft recovery. If the pilot was incapacitated, any of the passengers could push the “auto recovery” button and the airplane would find the nearest airport, descend, and land regardless of visibility. This has already been demonstrated in a bonanza. All of the features needed to make this work are available today in our integrated cockpits with GPS navigators.
Point and click navigation using cursor or touch screen input allows the pilot to simply draw the “magenta line” for their flight plan instead of having a complex keyboard entry scheme. This also makes changes at critical times easier if the pilot can make the changes on screen using the moving map.
Envelope protection and fly-by-wire. These technologies will initially provide protection from departing from controlled flight or entering into a steep spiral during IMC. We expect to see these technologies before fly-by-wire, because all of the hardware is available today to simply use the autopilot for envelope protection. Fly-by-wire will eventually be incorporated into GA airplanes, perhaps more for manufacturing reasons than safety. We are promoting the development of fly-by-wire such that the pilot will control flight path and not the basic parameters. One of the difficulties that pilots have is using pitch, roll, and yaw to fly a desired flight path. With the average number of hours that a GA pilot flies dropping (its about 50 hours a year), staying proficient with basic aircraft control is difficult. Thankfully our autopilots are improving. But a better answer, one proposed in AGATE years ago, is to keep the pilot in the loop flying the airplane, but make that task easy. Anyone who has flown a research simulator or aircraft where they have direct flight path control knows that flying the airplane becomes very easy. This is basically putting a transport autoflight into the stick and throttle.
Fore and aft movements on the stick would control rate of climb or descent. Lateral movement controls rate of turn. The throttle would give the pilot direct speed control. Issues that have to be worked out are takeoff and flare commands. 19

19. Surveillance Team Lead
For More Information:
Wes Ryan, ACE-114
Phone:
Don Walker, AIR-130
Surveillance Team Lead
Phone:
Charles Sloane, AIR-130
Aerospace Engineer
Phone:

20. Supporting Information

21. Failure Condition  Failure  Failure Mode
Failure Condition: A condition with an effect on the aircraft and its occupants, both direct and consequential, caused or contributed to by one or more failures, considering relevant adverse operation or environmental conditions.
Result of the failure, not the failure itself
Result from one failure or combination of failures
Failure: The inability of an item to perform its intended function.
More component oriented.
Often viewed as single point cause
Failure Mode: The way in which the failure of an item occurs.

22. PROBABILITY VS. RELIABILITY
Probability is not the same as reliability
“RELIABILITY” and “PROBABILITY” are quite different
has nothing to do with “RELIABILITY”
regulates the probability of a particular event
does not regulate reliability
Term and concept of “RELIABILITY” is not appropriate in this context
Can and has caused huge misunderstandings

23. Failure  Error
Failure: The inability of an item to perform its intended function.
More component oriented.
Often viewed as single point cause
Error:
1. An occurrence arising as a result of an incorrect action or decision by personnel operating or maintaining a system.
2. A mistake in requirements design, or implementation.

24. Certification Complexity
Graphical Summary
Statistical
Analysis
Current
Civil Cert
Requirements
Integrated
Systems
Certification Complexity
Cost
&
Complexity
Digital
Systems
Electronics
Transport
Aircraft
This graphic illustrates the evolution and growth of our certification procedures and requirements, as technology has evolved. Cost and complexity have gone up as time and our safety expectations have grown. The problem is that every system tends to get caught up in the evolution of the requirements
The introduction of electronic systems, highly integrated systems, etc. has led to a continuous increase in cost and certification complexity.
At the point that statistical analysis came into play to deal with systems that could not be explicitly tested and evaluated, the cost and complexity began to rise even more, until we have reached our current expectation for ALL systems to meet this highly complex set of civil cert requirements.
Early
Aircraft
Time & Expectations 25

25. Certification Complexity
Graphical Summary
Statistical
Analysis
Current
Civil Cert
Requirements
Integrated
Systems
Cost
&
Complexity
Certification Complexity
Digital
Systems
Moving from
10E-9 for Small Aircraft
and Applying Appropriate, Clear Standards
Led to GA Glass Revolution
Electronics
Appropriate
Requirements
Transport
Aircraft
Our planned architectural change took a look at setting appropriate requirements for small aircraft systems, based on mitigating the potential loss of the new glass by retaining the stand-by instruments, etc.
This more appropriate set of requirements for GA systems has allowed us to maintain our expected safety levels, while reducing the cost of certification.
GA Glass
Early
Aircraft
Time & Safety Level 26

26. 2003 Relative Comparison

27. Potential for Rotorcraft
Compare current equipment failure rates to actual accident data
Chance of fatal accident – Similar to, but worse than Part 23 single engine aircraft
May justify adopting a similar managed risk approach to safety enhancing technology
Current chance of fatal accident around 10E-6
May not make sense to enforce a 10E-9 mentality on Rotorcraft Equipment

28. Future Challenges for GA
Future small jets / single-engine jets need different approach to certification and pilot training
Electric power coming
LSA developing standards
Cessna working on electric C-172
Autonomous operation from takeoff to landing
With the incorporation of “glass” or integrated cockpits into virtually all new part 23 airplanes, the directorate is moving on to the next step of the AGATE concept. We have all the sensor data available somewhere in the system to make better automation and envelope protection a reality. We expect this to start with simple features but ultimately to override the pilot when the pilot is doing something that will cause the airplane to crash.
The Small Directorate is funding research into using some of the low-cost equipment available in the industry, include the experimental equipment, to build envelope protection capability. We hope to ultimately end up with a system installed in a demonstrator airplane included the development of requirements for the installation. 29

29. Further Horizon…
Fused image on PFD – use synthetic until IR or radar image is strong enough to replace it. Real-time integrity validation
Enhanced or smart 4D guidance (Pathway or other scheme) is matched to RNP and NextGen operations – includes time element
With the incorporation of “glass” or integrated cockpits into virtually all new part 23 airplanes, the directorate is moving on to the next step of the AGATE concept. We have all the sensor data available somewhere in the system to make better automation and envelope protection a reality. We expect this to start with simple features but ultimately to override the pilot when the pilot is doing something that will cause the airplane to crash.
The Small Directorate is funding research into using some of the low-cost equipment available in the industry, include the experimental equipment, to build envelope protection capability. We hope to ultimately end up with a system installed in a demonstrator airplane included the development of requirements for the installation. 30