Abstract
The fresh new traits that new equipment possesses, such as the high complexity of complex equip-processing, the multiformity of the equip-used environment, the coupling characteristic of the human-equipment-environment factors, and the dynamic idiosyncrasy of risk, bring huge challenges to the safety analysis and evaluation. According to the characteristics of a complex system, such as hierarchy, structure, and complex operating environment, this paper analyzes and depicts the state evolution process of equipment from hazard symptoms to accidents under the influence of initial events (faults, human errors, etc.). At the same time, the parameters representing the concept of safety distance are put forward to effectively control the time. Combined with a certain abroad type of carrier-based aircraft landing process, the landing process safety analysis model is established to verify the applicability of theoretical methods. Through simulation, the hazard modes and their relationship with effective control time are analyzed and the safety constraints model of the landing process is established.
1. Introduction
As the system becomes increasingly complex, the occurrence of system accidents and the accident process show strong multifactor coupling characteristics. The slight change in the initial condition and different combinations of various factors will lead to different behaviors [1–3]. Human behaviors in the behavior process naturally will stimulate different combination features and bring about complicated system accident evolution processes through various forms of coupling of mutual interaction and mutual supplementation and mutual restriction among operational environments, hardware systems, and software systems in the field of material, energy, and information [4–7].
Regarding exploring the law of accident occurrence, there are many domestic and foreign accident-causing theories; among them, the STAMP-system attribution model proposed by Nancy Leveson of MIT is a typical representative of the final stage of accident modeling development. People all believe that during the evolution of accidents, the fixed sequence of accidents does not exist. Within a certain range of space-time, there exist interactive factors such as humans, equipment, and environment and there will be an accident [8, 9]. However, the theory put forward by Nancy covers the aspects of management and humanity, without providing a specific and strongly practicable modeling and analysis method.
Traditional safety analysis methods depend too much on personal experience; methods such as FTA and ETA analyze the known logical relationship between cause and effect of an accident process. In respect of methods used for safety simulation, comprehensive research has been carried out home and abroad, particularly in the field of human factors, and human decision-making models and human recognition process models have been provided [10–12]. With regard to simulation analysis of accident processes, on the one hand, the Petri net and finite-state equipment are applied to the analyses of flight processes of commercial aircraft and contingency plans as a quantitative analysis conducted on the basis of a known accident process. On the other hand, the effects of hardware failure modes on the safety of equipment are analyzed at the mechanism angle and a model-based safety analysis method is proposed [13, 14].
In view of the situation based on multiview and complex system behavior processes, an accident modeling method is proposed for accident-causing factors, combinations of these factors, and accident evolution paths, and under the effects of certain factors and the combinations of factors, whether the system will have an accident is identified and then the safe state space of a complex system is established.
The distance between the state of the system and the safety boundary is reflected in the process of system behavior coupled by many factors of the man-machine loop, that is, the controllable time left for people when the system has dangerous symptoms. The length of controllable time reflects the length of safe distance, which is related to whether an accident occurs or not, that is, for two risk events with the same probability and influence. If the former immediately causes irreparable serious consequences, the latter has a certain reaction time, and taking corresponding measures during this reaction time may bring different consequences and then there is a difference between the two risks.
The study in [15] was based on the analysis of the controllability and variability of risk, and the concept of reaction time was introduced. Considering that reaction time, accident probability, and accident consequence are independent of each other, a three-dimensional risk assessment model is proposed. However, the reaction time is closely related to the accident probability and the accident consequence. From the appearance of accident symptoms to the occurrence of accidents, the probability of accidents changes dynamically with the different reaction time points. That is, the same system state deviation or abnormal coupling danger occurs at different time points, which has different impacts and causes different accident probabilities [16].
Therefore, based on the theory of system state and safety boundary distance mentioned above, according to the characteristics of system behavior process, this paper puts forward one of the characteristics of safety distance, effective control time, and analyzes the relationship between effective control time and risk.
2. Accident Evolution Process of the Complex System
During the operation of systems, the occurrence and development of accidents have a close relationship, with the hierarchical structure, sequential logic relationship among activities, and system state of the system behavior process. Failure causes are reflected in the components of a system and its state, that is, unsafe human behavior, unsafe substance conditions, unsafe environmental states, even management failure, and their interrelations and interactions. Due to human error, equipment failure, and environmental change, the output will change correspondingly. An operator adjusts the system state through output feedback, and the equipment will have a certain self-adaptive function as well. When the system state goes beyond the safety limit, the system will then be in a dangerous state; i.e., without effective control, there will be an accident.
Complex system accident has the following features:(1)Dynamic. From safety to danger and from danger to accident, the system state is in a dynamic changing process, changing with continuously interaction among human, equipment, and environment.(2)Process-Oriented. From occurrence and development to accidents, the process shows characteristics of the time delay of development and secondary effects of events before the accident occurrence.(3)Uncertainty. All the elements affecting system safety, such as human operation, equipment failure, and environmental change, are uncertain and make the evolution of the system state from being in a safe state to an accident state.(4)Multifactor Coupling. During the operation of a system, humans, equipment, and environment are in the same loop, and due to human error, equipment failure, or environmental change, the output will be changed correspondingly. Hence, the occurrence of accidents is closely related to the coupling characteristic of subsystem failures in the system.
The state space of the evolution of system state during operation can be divided into three categories: safe space, hazard state space, and accident state space (the latter two can be jointly called unsafe state space) [17]. The state margin is the dividing line between safe and unsafe state space. The safety margin is also the watershed of safety control. Specifying the evolution path of system accidents and establishing a system safety margin are of significant importance. The accident evolution process is shown in Figure 1.
In the state space, every time the system goes from the initial state to the final state, it corresponds to an evolution path of the system state. The points above the evolution trajectory represent the state points experienced by the system in this evolution process. Because of the randomness, the trajectories of multiple system behavior processes maybe different. Judging whether the system behavior process is hazardous or not, according to whether the trajectory crosses the safety boundary, if the trajectory crosses the safety boundary, the effectiveness of risk control measures can be judged by measuring the distance between each point in the hazardous space part of the trajectory and the safety boundary. If the distance between the point indicating the state of the system and the safety boundary is greater than a specified range, the accident trend is irreversible and the accident will inevitably occur in the process of this system behavior. On the contrary, if the safety distance is less than the specified range, it can still be corrected by taking appropriate control measures to ensure that the system behavior process trajectory returns from the dangerous state space to the safe state space.
Without considering the influence of abnormal deviations among personnel, environment, and equipment, the operator should adjust according to the system state to make the system run to meet the safety requirements. An abnormal deviation usually includes equipment failure, personnel operation error, and an abnormal environment. On this basis, considering the coupling influence of the man-machine loop, the risk of deviation is injected into the normal coupling interaction by superposition and the interaction influence can evolve with the running process. The multifactor risk model is shown in Figure 2 [18].
3. Effective Control Time Characterization of Safe Distance
3.1. Concept
As mentioned earlier, when a hazardous symptom occurs, the different reaction time points have an important influence on the development and results of the system state. Therefore, the paper puts forward the safe distance, the minimum safe distance, and the effective safe distance and obtains the corresponding risk reaction time, the minimum reaction time, and the effective control time in combination with the reaction time, which is the three parameters for evaluating the safe distance, as shown in Figure 3:(1)Risk reaction time TR refers to the time from the occurrence of hazard symptoms to the occurrence of the final accident [19]. The current risk assessment generally considers the possibility of risk occurrence and the consequences of risk. It only reflects the uncertainty and harmfulness of risk. The risk reaction time reflects the influence of the reaction time and the length of time on the change of risk, which is the variability of risk. In addition, the length of reaction time is one of the significant guidelines to developing a risk control plan, which is the embodiment of risk controllability.(2)The minimum reaction time TR0 refers to the shortest time when effective measures can be taken to prevent accidents.(3)The effective control time is the difference between risk reaction time and minimum reaction time, which reflects the length of time when effective control measures can be taken.
Effective control time is influenced by the specific hazard type, system composition, and personnel reaction time. The effective control time can be regarded as a complex function of the abovementioned influencing factors, , which is specifically described as follows:(1)Hazard type: different hazard modes act on the same system, resulting in different minimum reaction time points. For example, the combustion exothermic model adopts the formula of early fire growth pointed out by the National Fire Protection Association (NFPA): Here, Qf is the heat release rate of the fire, kW; t is the fire development time, s; and α is the growth coefficient of heat release rate of fire, kW/s2. According to the fire resistance of different system equipment, when Qf is determined, the time from the hazard symptom of the fire to the defined fire accident can be obtained:(2)The same danger mode occurs on different systems, and there may be different minimum reaction times. For example, if the overheating of the motor in the generator bay of a certain product leads to an increase in the shell temperature, the temperature rise formula is T0 is an initial working temperature of the motor, which meets the uniform distribution of 110–130°C, and the ambient temperature is set at 20°C. When the shell temperature reaches above 500°C, the cabin ignition point will be reached. Therefore, the elapsed time from the initial time to the cabin combustion accident can be obtained, that is, where is the Lambert W function.(3)Personnel's reaction time: personnel's reaction time refers to the time interval between the stimulus and reaction. Generally, the simple reaction time of human vision is 0.2–0.25 seconds. The auditory response time is 0.12–0.15 seconds. Because the nerve transmission speed of human beings generally has a refractory period of about 0.5 seconds, the intermittent operation interval that requires sensory guidance should generally be greater than 0.5 seconds, the complex selective reaction time generally reaches 1–3 seconds, and the operation reaction time that requires complex judgment and recognition is even longer. The synthesis of these times is called human reaction time. Take the personnel control model as an example: is the lag of pilot's reaction to input information; it reflects the inherent delay characteristics of the pilot. According to the statistical results of the pilot’s nerves and muscles, the value is generally within the range of 0.2 ± 20% s. is the pilot static gain; it is one of the parameters that the driver needs to adjust to achieve optimal control, and its value is generally greater than 1. reflects the driver's prediction of the control process, which is generally 0–1.0 s. is the time lag of information transmission and processing, which is about 0–1.0 s. TN reflects the pilot’s load, and its value is in the range of 0.1 ± 20% s.
3.2. Relationship between Effective Control Time and Risk
The length of effective control time directly affects the risk. Based on the traditional risk assessment model, the concept of reaction time is introduced and the risk is defined as a function of the probability of occurrence of events, the influence level of consequences, and the effective control time:R is the risk, is the probability of occurrence of events considering effective control time, is the consequences of events considering effective control time, and is the effective control time.
The relationship between effective control time and accident probability reflects the variability of risk, as shown in Figure 4.
When the effective control time is infinite, the probability of the accident is zero, that is, the accident does not happen. When the effective control time is infinitely short, the personnel have no chance to take emergency measures and the accident is bound to happen with a probability of 1.where is the accident probability, is the hazard probability, and is the conditional probability of an accident when a hazard occurs at a certain time. The conditional probability is influenced by the effective control time.
The relationship between effective control time and accident severity reflects the controllability of risk, as shown in Figure 5.
When the effective control time is short and there is no time to take control measures, the severity of the accident is high. When the effective control time is prolonged, the severity of the accident will be reduced to a certain extent through the correct operation of personnel. When time is infinite, no accidents will occur; that is, the severity of the accident is the lowest.
4. Accident Modeling and Simulation of the Carrier-Based Aircraft Landing Process
This paper targets the landing process of a foreign carrier-based aircraft. It considers three factors that influence landing: vertical height variation of the aircraft carrier 3s before landing; human error due to the environment (such as at night); and the time when human error occurs [20–26].
4.1. Behavior Process Description
After having intercepted the glide path entrance, the pilot lowers the carrier aircraft down along the glide path with the aid of the Fresnel Lens Optical landing system, (FLOLS) and keeps the flight path angle at about −3.5°. FLOLS can send 5 layers of beams with different colors that are parallel to the glide path. The orange beam in the middle indicates the ideal track. If the pilot sees the orange beam, it means the aircraft is on the ideal track. Then, the carrier aircraft is under the condition where there exists a complex air environment, besides the natural wind field; there is turbulent flow that is aroused by the movement of aircraft carrier, of which the most significant one is wake flow called “cocktail.” Moreover, because of the constant movement of the aircraft carrier deck, as there is a large movement, the tail can be raised by 2 m or so, which possibly causes a large landing deviation. These external factors bring about difficulty for the pilot in maintaining a gliding track and accurate landing. At this time, the landing signal officer on the aircraft carrier will consider various factors, such as deck movement, aircarft features, and pilot skills and send a command to the pilot on the radio to make him adjust flight state or wave off [27].
4.2. Multiview-Based Process Modeling
4.2.1. Event View-Based Modeling
The landing process of carrier aircraft is complex, involving many factors, which include equipment such as aircraft, arrester wire, and Fresnel Lens Optical landing guidance system; personnel such as pilot and landing command officer (LSO); and environment such as crosswind, rain, heavy fog, and cocktail flow. The hierarchy modeling of the landing process is shown in Figure 6. As shown in Table 1, the landing location of carrier aircraft is the constraint criterion of safety.
One of the indexes used to measure the landing safety and landing accuracy of carrier-based aircraft is its landing deviation. Landing deviation refers to the positional relationship between the actual landing point and the ideal landing point of carrier aircraft, including longitudinal deviation and lateral deviation. Among them, longitudinal deviation includes horizontal position deviation and vertical height deviation. The classification standard of grade deviation is shown in Table 2. This paper focuses on vertical height deviation.
4.2.2. State View-Based Modeling
During the landing of an aircraft, safe state includes entering landing attitude and appropriate altitude, successful landing, and successful wave off; dangerous state includes low altitude, high altitude, and entering wave off state; and accident state includes crashing the carrier into the sea and out of the runaway.
The trigger events affect the aircraft state, which includes personnel and environment. Specific events are shown in Table 3.
The function of aircraft state transition is given as the aircraft motion model. When the carrier aircraft is gliding into the carrier, its speed and track angle are essentially unchanged; thus, aircraft motion model can apply the perturbation linear equation:where state vector , control vector , and output vector , of which represents the disturbance quantity of carrier aircraft speed, m/s; represents the disturbance angle of attack, rad; represents the disturbance pitch angle, rad; represents the disturbance pitch angle rate, rad/s; h represents the disturbance height variation, m; represents the throttle lever deflection angle, rad; represents the disturbance track angle, rad; and represents the disturbance vertical overload, .
The reference state-related parameters of a foreign carrier-based aircraft and the specific values of each starting derivative are shown in Table 4 and Table 1 [28].
From the above parameters, the matrix results of the state-space equation are calculated as follows:
Besides the Kinematics model of the aircraft, simulation involves other submodels:(a)Pilot Model. Apply the variant strategy pilot model. If the carrier aircraft is affected only by a small disturbance of wake flow, the pilot’s operation of the carrier aircraft is a constant tracking action; if the pilot is required to significantly change flight state, he will apply a discrete control strategy [24].(b)Aircraft Carrier Air Wake Model. Apply the marine atmosphere disturbance model defined in MIL-F-8785C, the speed components of which include free atmospheric turbulence component, steady component of aircraft carrier atmospheric wake flow, period component, and random component [29].(c)Aircraft Carrier Motion Model. Apply the engineered motion model that simulates six-degrees-of-freedom motion through harmonic form [30].
4.2.3. Process View-Based Modeling
Based on the description and analysis of the landing process of carrier aircraft, establish a landing process view and specify the logic relationship of input and output among key activities, as shown in Figure 7.
4.3. Simulation Analysis of the Hazard Mode and Effective Control Time of the Carrier-Based Aircraft Landing Process
During the flight, the landing commander pointed out that there was a deviation in the flying height of the carrier aircraft, so the pilot needed to take emergency actions to correct the deviation. Under the influence of comprehensive consideration of personnel, environment, and equipment status, personnel operation is deviated.
The landing safety simulation model is shown in Figure 8.
The same hazard mode and level occur at different time periods. Specific test cases are shown in Table 5. H2 is the starting point of the aircraft approach phase. H3 represents 15 seconds after the aircraft approaches. H4 represents 20 seconds after the aircraft approaches.
The simulation results are shown in Figure 9–13.
From the simulation results, it can be seen that the same hazard mode and level occur at different time points, resulting in different results. After the hazard occurs, the aircraft is in an abnormal state and deviates from the normal flight path due to the deviation of the driver's control of the elevator and accelerator. When the danger occurs at the starting point of the approach (H2), due to the sufficient adjustment time of the driver, the aircraft can land safely through the control compensation in the follow-up process, such as tilting the elevator upwards. By adjusting the elevator, throttle, and other operations, the aircraft can be adjusted to a normal state. For example, when H2 occurs, the pilot has enough time to operate, and the operation of the elevator and throttle is shown in Figures 10 and 11. Through adjustment, the flight altitude (Figure 9), trajectory angle (Figure 12), and airspeed (Figure 13) of the aircraft are all corrected before landing. However, when it happened in 10S (H3) and 15S (H4), the driver could not implement effective adjustment and an accident occurred. Moreover, the later the occurrence time, the more serious the deviation of the aircraft and the more serious the consequences.
5. Conclusion
In the aspect of safety principle theory, the multidimensional safety state-space theory is further improved. According to its important characteristics such as safety distance and safety state space, its characterization parameters, such as effective control time, are put forward. And, the relationship between effective control time and risk is analyzed, which provides a theoretical basis for further safety modeling and simulation analysis.
Considering the complex influence factors and high safety risks in the landing process of carrier-based aircraft, the safety modeling and simulation analysis are carried out and the interaction and coupling relationship between various influencing safety factors and factors in the landing process are clarified. The relationship between the effective control time and risk has been verified by the simulation and analysis.
The accident process of a complex system is extremely complicated, and the accident characteristics of different system equipment, different operation processes, and different operation environments are also different, so it is necessary to further synthesize and summarize the accident process characteristics of a complex system and establish corresponding accident process models. At the same time, the influence of effective control time is fully considered in the process of safety simulation.
Data Availability
The data used to support the findings of this study are included within the article.
Conflicts of Interest
The author declares that there are no conflicts of interest regarding the publication of this article.
Acknowledgments
The author appreciates his employer, China Academy of Civil Aviation Science and Technology.