In-Time Aviation Safety Management Systems (IASMS)
Explore the source record for details and available documents.
SEARCH · Search NASA
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Explore the source record for details and available documents.
Our current air transportation system has underserved markets, including local, regional, intraregional, and urban transportation of both people and cargo. Recent advances in aviation technology such as small highly-automated vehicles, electric aircraft, and automated air traffic are enabling business opportunities in these markets. Advanced Air Mobility, or AAM, refers to a community effort to overcome the gaps in operational rules, safety analysis, and overall acceptance, so that these new operations will be possible. For full details, please see: https://www.nasa.gov/aam As we think about how we can safely introduce these new operations, fundamental questions about how the structure of Safety Management Systems can be applied to AAM, and how that structure can be used to help us overcome the necessary technical and societal obstacles arise. Two of these questions are: • How do we tailor the requirements and desired level of monitoring and assessment to achieve safety given the breadth of possible operations and the associated risk of those operations? • How do we aid innovation by rapidly evaluating the safety of novel operations without losing associated rigor? We assume that a Safety Management System that enables these future systems will incorporate knowledge of the acceptable level of risk, and will utilize data science to automate the core monitor, assess and mitigate functions that will allow us to respond to risks and hazards in time to prevent safety incidents. In 2018, the National Academies proposed an In-Time Aviation Safety Management System (IASMS) that would advance these goals. (https://www.nap.edu/catalog/24962/in-time-aviation-safety-management-challenges-and-research-for-an) The National Academies made a clear distinction between in-time systems, in which hazards could be identified and risks mitigated in time to prevent incidents, and real-time systems, since many hazards and risks do not need real-time data and analysis to detect and mitigate.
NASA’s System-Wide Safety project is developing the concept and requirements for an assured In-Time Aviation Safety Management System (IASMS) that will: Improve the efficiency of flight, the access to airspace, and the expansion of services provided by air vehicles; Explore, discover, and understand the impact on safety from growing complexity introduced by industry modernization; Develop and demonstrate innovative solutions that enable the aviation transformation envisioned for global airspace system; Identify and proactively mitigate risks in accordance with target levels of safety; Assure safe, rapid, and repeatable access to a transformed National Airspace System (NAS)
The System Wide Safety (SWS) Safety Demonstrator (SD) Series drives development of an increasingly capable In-Time Aviation Safety Management System (IASMS) focusing on humanitarian applications, starting with wildfire response (SD-1). The goals of this report are to (1) provide an early hazard analysis and mitigation evaluation of wildfire response to support these efforts and (2) provide a demonstration of capabilities of the Fault Model Design Tools (fmdtools) and Manager for Intelligent Knowledge Access (MIKA) tools. fmdtools provides a modeling, simulation, and resiliency analysis framework in which a wildfire response model, the System Modeling and Analysis of Resiliency in Scalable Traffic Management for Emergency Response Operations (SMARt-STEReO), is built. MIKA is an intelligent knowledge manager with several capabilities, including assisting in hazard analysis by extracting and analyzing hazards from historical incident reports. The following topics are covered in the report: Understanding Wildfire Hazard Dynamics. We provide a description and simulated examples of how hazards occur in the SMARt-STEReO model of wildfire response and their effect on its outcome. This provides a common mental model and focuses the analysis presented in the remainder of the report. Wildfire Hazard Identification. MIKA identifies wildfire hazards from three relevant datasets: the ICS-209-PLUS, SAFECOM, and SAFENET. Hazards are manually organized into a taxonomy and MIKA analyzes each hazard’s effects, likelihood, severity, and risk. Evaluating Mitigation Strategies. The SMARt-STEReO wildfire response model built in fmdtools evaluates a subset of identified hazards. Specifically, we simulate the effect of communications faults and equipment faults on operator safety, the effect of changing winds and flammability, and a scenario with multiple ignition points and heavy smoke. Tool Limitations and Usage Considerations. We provide a discussion of appropriate tool use cases as well as limitations and considerations for usage. The tool findings are used to synthesize recommendations for wildfire response operations, which can be captured as part of an IASMS. Key recommendations are as follows: Hazards are identified from a broad spectrum of sources including aircraft subsystems, operational sources, and ground crew operations. Highest risk operational environment hazards identified are Evacuations. The highest risk manned aerial operations hazard categorized is Jumper Operations Mishap. Ground crew hazards that are highest risk are Burns, Cargo Operations Overhead, Dehydration, Entrapment, Falling Objects, Heart Attacks, Heat Exhaustion, Inadequate Training or Certification, Vehicle Breakdown, and Vehicle Collision. Modelled containment failures arise from a mismatch between the difficulty of the firefighting scenario and the capacity (e.g., speed, effectiveness, awareness) of the response. In firefighting scenarios where containment is possible (e.g., because the fire does not spread too quickly), these mismatches can occur because of a change in environmental conditions (e.g., wind, flammability, etc) or because of planning, equipment, or communications faults. Improvements to communications increase the capacity of the firefighting response by reducing the time needed to respond to the fire. While surveillance does not increase this capacity by itself, it increases operator safety by increasing state awareness, enabling firefighters to evade approaching fires. Increasing both has a synergistic effect. In general, these performance and resilience increases generalize over fault scenarios as well as unforeseen changes to circumstances (i.e., wind, aridity, etc.). However, these improvements need to be designed so as not to make the system prone to persistent large-scale communications outages, which can reduce performance.
As emerging flight operations become more prevalent and increasingly automated and distributed, the capabilities for managing safety of vehicles and operations will also need to evolve. To address this challenge, the National Academies has envisioned an In-Time Aviation Safety Management System (IASMS) capability for a wide range of aviation operations including current commercial operations as well as new entrants envisioned with advanced air mobility (AAM). The suite of IASMS services, functions, and capabilities (SFCs) would be implemented in a federated approach and would address trends as well as individual operations. Through predictive modeling and data analysis, IASMS is envisioned to identify arising risks so that they can be mitigated, in-time, before a safety incident occurs. IASMS and its requisite set of SFCs must leverage a wide range of information to perform. To better understand these new needs, FSF worked with the aviation and humanitarian communities to develop and validate scenarios that include traditional aviation operations and UAS operations intermingled as they are deployed for disaster management and first responder (DMFR) situations. The three scenarios developed include: • Post Natural disaster response, such as a hurricane, involving multiple parties utilizing traditional aviation and UAS to support rescue operations, surveil damage, and locate survivors needing assistance. • Wildfire fighting in remote locations with traditional aircraft for transport and fire-retardant delivery combined with UAS for surveillance of fire locations as well as to track individual firefighter locations. • Medical Operations and AAM in Urban Environments including passenger-carrying helicopters and AAM vehicles, medical missions (such as transport of radio-pharmaceuticals), and other UAS delivery operations (such as the delivery of defibrillators). Each scenario was developed and validated by representatives with expertise in humanitarian operations, urban and rural emergency response, air traffic management, UAS operations, and traditional flight operations. The scenario definitions address roles and responsibilities of individual actors, the appropriate utilization of UAS, and the actions taken by those actors to appropriately manage risks associated with the mission and environment. The risks to aviation traffic and to people on the ground explored included potential risks arising from incompatibilities in calculating reference altitudes (eg, differing uses of AGL, MSL, barometric, or GPS-derived values), loss of command and control (C2) communications, rapid changes in weather and winds, and physical interference. For each risk, IASMS SFCs were postulated in the context of monitoring services, risk assessment capabilities, and identifying appropriate mitigation strategies. The identified SFC capabilities were envisioned from known services postulated for IASMS and for UTM. For these unique environments, IASMS SFCs are needed to address conditions such as hazardous payloads, micro-climates and urban canyons, and the need to keep uninvolved air traffic out of the area where DMFR operations are being conducted. The second phase of analysis focused on inferring the specific information needs and the SFCs for IASMS, utilizing a structure of 16 information classes to organize requirements. For each of the risks identified in the workshops, it was postulated what data sources would be necessary to monitor critical aspects of the risk (eg, surrounding air traffic, ground population, terrain, etc). to be directly measured as well as data that would be derived, which implies additional SFCs for different actors to understand what information would likely be exchanged between parties. For an IASMS to be effective, additional research is needed to develop the advanced algorithms that can address the increasingly autonomous and complex operations in differing environments and to develop means of identifying unknown risks. Looking at these scenarios highlighted a number of research issues. These include the ability to quickly "cordon off" airspace thru temporary flight restrictions (TFRs) or other means, developing clear definitions to enable automation-based algorithms for prioritizing operations, defining airspace density metrics, standardization of altitude reporting, and establishing a basis for safety data metrics definition and collection. This paper seeks to outline the development of an IASMS in the context of the DMFR scenarios and resulting demonstrations. Utilizing this contextual approach, NASA will generate recommendations for an assured safety framework for AAM operations that enables AAM operations to safely access the NAS.
The aim of this project is the build out of a System Safety Model for System-Wide Safety’s Safety Demonstrator 1 (SD-1), which will be a demonstration of an In-Time Aviation Safety Management System (IASMS) in emerging wildfire response operations
Assuring safety in the NAS with the inclusion of new entrants, such as Advanced Air Mobility (AAM), will require overcoming unique safety challenges that result from combining innovative technologies with novel airspace concepts for moving people and cargo using autonomous vehicles. The focus of the In-time Aviation Safety Management System (IASMS) is to overcome AAM’s safety assurance challenges. The IASMS Concept of Operations (ConOps) describes an interconnected set of services, functions, and capabilities (SFCs) designed to manage operational risks, identify unknown risks, and inform system designs. This paper describes an approach for defining SFCs based on technology trends in research, assessment of known and unknown risks in voluntary safety reports, and causal and contributing factors in aviation accidents and incidents. This approach would identify potential SFCs that further expand the Monitor, Assess, and Mitigate (M-A-M) functionality that represents the enabling framework of the IASMS. Safety implications that will result from integration of AAM in the transformation of the National Airspace System (NAS) were addressed in National Academies committees reports on AAM and IASMS. Development of a ConOps for IASMS was a top recommendation and can be represented as a reframing of safety assurance that builds on real-time alerting such as the Traffic Alert and Collision Avoidance System, and adds the more encompassing in-time temporal parameter in recognition of the different timelines for collecting and assessing safety data for risk mitigations. For example, mining for safety trends from data sources such as the Aviation Safety Information Analysis and Sharing system occurs over a longer time period. Research on AAM operations poses that SFCs can be designed to monitor the safety margin appropriate for AAM including with regards to the distance between current flight parameters and nominal ideal conditions. These in-time comparisons will become more complex as the density of operations increases at least in certain areas and can include planned and actual 4D trajectory, and in-time comparisons having implications on conflict modeling and prediction including expected and actual departure time, fix/waypoint crossing times, and arrival time. These comparisons would be integrated as part of SFCs that redefine and inform new safety margin. An increased safety margin improves management of operational risks while reducing the potential for anomalies. An increased safety margin also has implications for operator confidence in the certainty of its operations and trust in automation. Technology trends in research could be used to refine existing SFCs and define needs for additional SFCs that provide safety improvements to the design and operation of vehicles, airspace design, and operator performance requirements. NASA is developing innovative approaches to safeguard against major accidents and incidents that have occurred in the NAS and those anticipated with the inclusion of envisioned AAM operations. The innovations use operational performance data to monitor, detect, and predict flight variations exceeding safe nominal patterns, such as would be caused by navigational error, severe weather complications, or hijacking of UAS controls. These innovative approaches have high potential to prevent accidents and incidents in the new AAM era. It is anticipated that elements of the innovations will evolve into SFCs for the IASMS. Voluntary safety reports can be monitored to identify anomalies related to design or operational performance risks. Reports could be periodically monitored and assessed for specific topics. Reports might serve as weak signals or precursors indicative of emergent risk such as when combined with other safety information. The architecture could include SFCs that are based on voluntary safety reports recognizing the periodic temporal nature of data analysis. As previously mentioned, aviation accidents with their causal and contributing precursors can inform the need for SFCs in the IASMS. Accidents and incidents at San Francisco International Airport such as Asiana 214 and Air Canada 759 illustrate how combinations of different factors lead to increased risk. These types of precursors and different factors have implications on the types of SFCs that could be needed to monitor and manage different sources and types of design and operational risk. Continuing to assure the safety of AAM as designs and operations gain in complexity can be accompanied by defining SFCs that also increase in complexity. These SFCs can leverage information from findings and recommendations synthesized across on-going research, voluntary safety reports, and accident and incident reports. These SFCs can serve to refine accuracy of algorithms and resolve limitations with current practices. The IASMS architecture represents the framework for the SFCs and their critical role in safety assurance.
Build out a System Safety Model for System-Wide Safety’s first Technical Challenge 5 (TC5) Safety Demonstrator (SD-1), which will be a demonstration of an In-Time Aviation Safety Management System in emerging wildfire response operations. Supporting the Systems Engineer and using Model-Based Systems Engineering (MBSE) practices, languages, and tools. Summer 2022 SD1 milestones: TC5-03-01 Initial Stakeholder Engagement Concept of Operations Development milestone and the upcoming TC5-03-02 Identification of key gaps and prioritization of NASA, SWS milestone.
The aim of this internship-based project was to contribute to the ongoing development of a systems model for System-Wide Safety’s first Technical Challenge 5 (TC5) series Safety Demonstrator (SD-1), which will be a demonstration of an In-Time Aviation Safety Management System (IASMS) in emerging wildfire response operations. Using Models-Based Systems Engineering (MBSE) principles to develop the model, I organized and traced previously collected stakeholder needs from the Spring 2022 NASA System-Wide Safety Wildland Firefighting Operations Virtual Workshop (https://nari.arc.nasa.gov/sws-wildfire) to system elements, creating connections which can be used in the future by the project engineers to identify and address requirements gaps throughout the system design process. I also identified and modeled preliminary use case scenarios for aerial assets in the demonstrator and, building on previously produced preliminary high-level models of the 8 SD-1 Services, Functions, and Capabilities (SFCs) and their IASMS data flows, worked to model the Real-Time Risk Assessment (RTRA) tool as an implementation of Risk Assessment and Management that can take in multiple sets of data monitored by SFCs. Project deliverables include stakeholder requirements tables and matrices and systems model diagrams produced with MagicDraw software in the SysML Systems Modeling Language, with eventual plans to connect model diagrams to a Department of Defense Operational Viewpoint (OV-1) graphic, a high-level operational concept graphic that will be used to visualize the SD-1 scenarioin a future phase. The system model serves to provide a common understanding of the scope of and activities necessary for the completion of SD-1,and traces how stakeholder needs are to be addressed.
Emerging operations involving Urban Air Mobility (UAM) poses a challenge to safety assurance and accessibility to the NAS. In particular, the public has a low tolerance for risk in aviation and the current NAS tends to be labor-intensive with limited ability to scale up for UAM. In response to this landscape, NASA is collaborating with industry to define an In-time Aviation Safety Management System (IASMS) Concept of Operations (ConOps) for a scalable UAM along with a service-oriented architecture. This architecture would better focus safety investments for technological solutions that overcome safety related barriers for emerging operations. By working with industry, consensus can be reached on desirable system traits that are based on integration of data and leverage increasingly autonomous and automated systems. These complex systems can identify anomalies, precursors, and trends that together enable more proactive management of operational risks.
Assuring safety in the NAS with the inclusion of new entrants that are part of Advanced Air Mobility (AAM) will require overcoming unique safety challenges that result from combining innovative technologies with novel airspace concepts for moving people and cargo using semi-autonomous/autonomous vehicles. Overcoming these AAM safety assurance challenges is the focus of the In-time Aviation Safety Management System (IASMS). The IASMS Concept of Operations (ConOps) describes an interconnected set of services, functions, and capabilities (SFCs)designed to manage operational risks, identify unknown risks, and inform system design to mitigate risk. This paper describes a broad approach for identifying SFCs involving technology trends in research, assessment of known and unknown risks in safety reports, and causal and contributing factors in aviation accidents and incidents. This approach leverages these sources to identify potential SFCs that enable the Monitor, Assess, and Mitigate (M-A-M)functionality that represents the enabling framework of the IASMS.
In-Time Aviation Safety Management System (IASMS) for Commercial Operations Developing methods to Improve risk management and safety assurance processes by proactively identifying risks and causal factors before an accident/incident occurs.
Ongoing research at NASA is driven by a strategic plan defined by the Aeronautics Research Mission Directorate and a vision for future In-Time Aviation Safety Management Systems (IASMS) as described by the National Academies. In both visions, system safety awareness and provision are expanded through increased access to relevant data; integrated analysis and predictive capabilities; improved real-time detection and alerting of domain-specific hazards; decision support, and in some cases, automated risk mitigation strategies. One primary research focus is to develop means by which more timely (i.e., “in-time”) actions may be taken to mitigate precursors, anomalies, or trends that are observed during operations. In this paper, we describe such means as a collection of Services, Functions, and Capabilities (SFCs) that are supported by an underlying information system. For example, an integrated risk assessment capability is envisioned that continuously monitors safety-related metrics and margins and recommends timely operational changes. Assessment functions and/or services can be based on data analytics and predictive models derived from heterogeneous data sets that span relevant indicator metrics and their time histories. Likewise, on-board functions can identify and reduce susceptibility to precursor conditions that have led (and can lead) to aircraft loss-of-control or out-of-control accidents. This paper summarizes development and testing of such an information system tailored to hazards anticipated for future highly autonomous flight missions near and over densely populated areas. Testing is accomplished via simulation and by using small, unmanned aircraft operating over a test range at NASA’s Langley Research Center. Flight plans and test scenarios are defined to emulate several use-cases, including package delivery; reconnaissance; fire management; and urban air taxi vertiport operations. Two test phases are summarized with Phase 1 occurring in (2019-2020) and Phase 2 ongoing (2021-present). Results focus on SFC performance, technology readiness level assessment, and requirements discovery/validation. Companion papers are cited throughout for additional details on the recent testing.
An onboard risk management automation design is presented based on run-time assurance principles, as well as the concept for In-Time Aviation Safety Management Systems (IASMS) as described by the National Academies. The automation is designed to operate independently of the autopilot and perform real-time risk assessment spanning multiple classes of hazards, predict constraint violations, and track autopilot states. In the event of elevated risk conditions or predicted constraint violations, the automation will select from a set of available contingencies and trigger autopilot mode changes if necessary to mitigate risk exposure. The onboard automation also informs the remote operator/pilot of what the independent monitor is observing and any contingency decisions or actions that may arise during flight. Details of an implementation of this design and results of verification and validation activities, as required to meet stringent NASA software and system assurance standards, are also presented. This includes simulation and flight testing using small unmanned aircraft systems.
Explore the source record for details and available documents.
The continued growth of aviation shall require new innovative technologies and operational concepts to meet the ever-increasing demands on air transportation. The NASA Advanced Air Mobility (AAM) project focuses on emerging aviation markets, such as Urban Air Mobility (UAM). UAM is defined as “...a safe and efficient system for air passenger and cargo transportation within an urban area. It is inclusive of small package delivery and other urban unmanned aerial system services and supports a mix of onboard/ground-piloted and increasingly autonomous operations” ([1]). The AAM project emphasizes technology development and validating system-level concepts and solutions in coordination with other NASA Aeronautics Research Mission Directorate (ARMD) projects to enable UAM metro- and micro-plex vertiport and airspace concepts of operations. The NASA AAM research portfolio includes the concepts of Remote Supervisor-in-Command (RSC) and Fleet and Airspace Manager (FAM) as possible human roles for consumer fleet providers. NASA research in RSC is focused on development of guidelines and standards for remote pilots/operators passively and actively controlling a large fleet of autonomous aircraft. For FAM, flight and ground system concepts and technologies to enable high density homogeneous operations at increased scale from vertiport(s), and coordination with other humans in the systems (e.g., UAM urban airspace manager, Air Traffic Control) are key research areas. The envisioned UAM operations are posited to require autonomous systems to enable functions ranging from fleet and resource management to vehicle control. Although automation has become increasingly sophisticated and ubiquitous in civil aviation, autonomy represents a significant evolution in automation, which has generally been limited in functional scope and capability. As autonomy takes on increasing responsibilities, humans and machines will be required to work together in new and different ways [2], rather than traditional design approaches focused on how machines (i.e., autonomy) can do the work of people. The emerging field of human-autonomy teaming (HAT) represents a comprehensive and prioritized research-driven approach to enable the success of future emerging aviation market applications through capabilities and principles that facilitate humans and machine working and thinking better together. The NASA Transformational Tools and Technologies (TTT) Autonomous System (AS) Sub-project was created to assist with the transition into higher levels of autonomy to enable new modes of air transportation, such as UAM. TTT-AS has identified HAT as a key research need to enable UAM while maintaining today’s ultra-safe aviation system safety levels. The latter challenge has been taken up by the NASA System-Wide Safety (SWS) Project, which recognizes that aviation safety, as it evolves, shall require new ways of thinking about safety to include integration of a wide-range of existing and new safety systems and practices, enhanced tools and technologies, increased access to data and data fusion, improved data analysis capabilities, enhanced in-time risk monitoring and detection, hazard prioritization and mitigation, safety assurance decision-support, and in-time integrated system analytics [3].The operational concept of UAM represents a variety of work that has been termed, “work-as-imagined” to characterize the idea that how people think that work is done and how work is actually done are often not the same [4]. To ensure design success and system safety, looking at “work-as-done” provides a comparative approach toward UAM concept and technology design through examination of corresponding analogs found today in aviation (e.g., on-demand operations) and other transportation domains (e.g., port operations). The paper shall discuss various alternative applications with specific focus on airline operation center (AOC) operations, and unmanned aerial system (UAS) command-and-control to inform scaled-versions of FAM and RSC, respectively, and with consideration of the national airspace system contextual environment. The tenets and principles of the HAT field and current NASA research efforts under the TTT-AS sub-project shall also be described. Finally, the SWS sub-project efforts to develop In-Time System-Wide Safety Assurance (ISSA) and In-Time Safety Management Systems (IASMS) are discussed in terms of how “in-time” safety assurance may be conceptualized for the on-demand mobility air taxi “work-as-imagined” operational concept [5]. As part of this effort, concepts from the emerging field of resilience engineering, are being studied. Traditional approaches to aviation safety have focused on what can go wrong and how to prevent it. Another approach to thinking about system safety should reflect not only “avoiding things that go wrong” (protective safety) but also “ensuring that things go right” (productive safety), that enables a system to exhibit the resilient performance [6] necessary for the success of the future aviation system emerging concepts of operations. The paper shall describe efforts focused on how productive safety and resilience may enable a more complete approach to system safety thinking and design of ISSA and IASMS for UAM. Future directions and research needs shall also be discussed.
Explore the source record for details and available documents.
Emerging operations involving Advanced Air Mobility (AAM), such as Urban Air Mobility (UAM), pose a challenge to safety assurance and to accessibility within the National Airspace System (NAS).In particular, the public has a low tolerance for risk in aviation and the current NAS tends to be labor-intensive with limited ability to scale up for UAM. In response to this landscape, NASA is collaborating with industry to define a Concept of Operations (ConOps) for In-time System-Wide Safety Assurance (ISSA) for scalable UAM involving a service-oriented architecture. This architecture focuses safety investments for technological solutions that can overcome safety related barriers for emerging operations. By working with industry, consensus can be reached on desirable system traits that are based on integration and fusion of data and leverage increasingly autonomous and automated systems. These complex systems can identify anomalies, precursors, and trends that together enable more proactive management of operational risks. AAM and UAM elevate the need for risk management in relation to increasing density and heterogeneity of vehicles and operations. Whereas safety in today’s NAS is built on a history of programs and technologies that react to incidents and accidents, AAM presents an opportunity to leverage that experience and its implications and proactively integrate safety into the earliest designs of vehicles and systems. In a perfect world AAM and UAM would not be inherently dangerous but until then ensuring the highest quality of safety requirements is the bridge to mitigating risks.