Risk assessment in aerospace systems Jacek S. Stecki PHM Technology/Monash University

1. Risk assessment in aerospace systems Jacek S. Stecki PHM Technology/Monash University Melbourne, Australia

2. Key issues – Risk drivers Supportability: Reduction of life-cycle cost Safety – environmental, personnel Reliability – hardware, functional Reduced manning levels Need to reduce the volume of scheduled maintenance Secondary effects of failures Inherent design problems Need to reduce spare parts inventory High performance requirements Availability of specialised personnel Insurance and classification Criticality of the equipment to productivity/availability Cost of lost production or lost availability as a result of equipment failure Cost of fixing a problem in terms of repair and bringing the machine back to a serviceable condition Etc.

3. Integrated Logistics Support Integrated logistics support (ILS) is an integrated approach to the management of logistic disciplines in the military The pupose of ILS is to ensure that the supportability of the system is considered during its design and development in order: To create systems that last longer and require less support To reduce costs To increase return on investments To assure supportability throught the operational life of the system The impact of ILS is measured in metrics: Reliability - Availability - Maintainability (RAM) Reliability - Availability - Maintainability - Testability (RAMT) Reliability - Availability - Maintainability - System safety (RAMS).

4. Integrated Logistics Support Assuring continued operation and functioning of the systems

5. Performance-based Logistics Performance-based Logistics (PBL) is an outcome-based, performance-oriented product support strategy A product support provider (PSP) or product support integrator (PSI) is contracted to meet performance metric (s) for a system or product The purpose of PBL: • increased system availability, reliability • shorter maintenance cycles, and/or • reduced costs Thus PBL fits well with ILS ---------------------------------- • In U.S. Department of Defense (DoD) acquisition programs, the PBL approach is mandated as a first-choice strategy. • A PBL contract was awarded to Alstom for delivery of trains in France • Also called Performance-based-Contracts

6. Reliability - Availability – Maintainability (RAM) The ability of an item to perform a required function under given conditions for a given time interval It is generally assumed that the item is in a state to perform this required function at the beginning of the time interval Generally, reliability performance is quantified using appropriate measures. In some applications these measures include an expression of reliability performance as a probability, which is also called reliability.

7. Risk reduction – CBM/PHM What is it? • Risk assessment using techniques like FMECA, HAZOP, RCM etc. • Diagnostics – is the process of determining the state of a component to perform its function(s) • Prognostics – is predictive diagnostics which includes determining the remaining life or time span of proper operation of a component • Health Management – is the capability to make appropriate decisions about maintenance actions based on diagnostics/prognostics information, available resources and operational demand.

8. PHM - Fusion of the technologies Sensors Artificial intelligence Neural nets, fuzzy logic, genetic algorithms Algorithms (vibration etc.) Communication capabilities Interchange of maintenance data Integration of data Security of data User friendly interface Autonomy to be provided by software agents (Jack platform from AOS)

9. Goals of PHM • Enhance Mission Reliability and Equipment Safety • Reduce Maintenance Manpower, Spares, and Repair Costs • Eliminate Scheduled Inspections • Maximize Lead Time For Maintenance and Parts • Procurement • Automatically Isolate Faults • Provide Real Time Notification of an Upcoming Maintenance Event at all Levels of the Logistics Chain • Catch Potentially Catastrophic Failures Before They Occur • Detect Incipient Faults and Monitor Until Just Prior to Failure

10. PHM Paradigm (Joint Strike Fighter F35)

11. Joint Strike Fighter F35 PHM Setup

12. Aerospace Risks • Severe operating environment • Stringent statutory safety standards • Safety critical systems • Expensive Maintenance • Long innovation lead time • High technology • Conservative attitudes • High reliability requirements • Single shot operations • Very high cost of failure Tools to deal with risks • Computer based design methods • Reliability and Hazard Analysis • Failure analysis (FMECA/FTA) • PHM (Prognostics and Health Management) • Condition Monitoring - CBM • Testing

13. CBM/PHM - what are we dealing with? Algorithms Failure modes Failure modes Failure modes Functional Analysis Production Losses Training Training Training Training FMECA FMECA FMECA FMECA FMECA FMECA Detection Standards Sensors Prognostics BIT Reliability Reliability Reliability Risk Minimization $$$$$$$! Diagnosis Diagnosis Diagnosis Training Training Training Simulation Fault Tree Condition monitoring Sensor fusion Sensor fusion Sensor fusion Maintenance Downtime Faults Hazards Safety Testing Fall-back Analysis ROI Education Education Artificial intelligence Maintainability Availability

14. Reasons for failure of Risk Assessment Dependencies of failures not identified – spreadsheet vs model based Inadequate Identification of Risks - functional failures (failure modes) vs physical failures Incomplete database of failures (deficient FMECA) Taxonomy – confusion what is the cause, mechanism of failure, fault, symptom and/or failure mode Sensor fusion not based on failures dependencies (fall-back – testability) Diagnostic rules not based on dependencies Reliability of Hardware not the same as Functional Reliability Different models for Criticality and Reliability Assessment

15. Risk reduction or is it? • Risk is still there if failures are missed • We cannot design a diagnostic system without knowledge of failures • We do not really know what we should monitor • Sensors cover only identified failures

16. Barriers The Advanced Technology Program (ATP), of the National Institute of Standards and Technology (NIST), held a workshop on Condition-Based Maintenance (CBM) as part of it's November 17-18, 1998 Fall Meeting in Atlanta. Discussions with companies identified 3 technical barriers to CBM's widespread implementation: • The inability to accurately and reliably predict the remaining useful life of a machine ( prognostics) • The inability to continually monitor a machine (sensing) • The inability of maintenance systems to learn and identify impending failures and recommend what action should be taken (reasoning). These barriers could potentially be addressed through innovations in three technical areas: • Prognostication capabilities • Cost effective sensor and monitoring systems • Reasoning or expert systems

17. Risk Assessment FMECA Failure Modes FMECA PossibleFailures Effects What effect does the failure have ? FMECA Criticality Analysis Criticality Analysis of failure FMECA

18. Modeling Failure

19. Modelling of failure

20. Fault propagation - dependability All faults are enumerated. Transient and steady-state responses to faults are identified

21. PHM Cycle PHM requires two main cycles of development, design and operation • The Design Cycle is required in order to generate the knowledge base from which the PHM system can obtain its decisions. • The Operation Cycle describes the steps taken within the PHM system from detection of faults through to conveying instructions or actions.

22. Interaction between MAD and CBM/PHM Layers at Design Stage MAD – Maintenance aware Design

23. Criteria for RCM Processes SAE JA1011 “Evaluation Criteria for RCM Processes” defines seven questions for RCM: • What are the functions…of the asset…(functions)? • In what ways can it fail…(functional failures)? • What causes each functional failure (failure modes)? • What happens when each failure occurs (failure effects)? • In what way does each failure matter (failure consequences)? • What should be done…(proactive tasks and intervals)? • What should be done if a suitable proactive task cannot be found?

24. MADe software

25. RR250 Engine Lubrication System

26. Jet Engine Lubrication System Model

27. Model of pump

28. Define Component Structure

29. Define Component Functions

30. Define Physical Failures

31. Propagate Functional Failures >> Dependency

32. Assess Criticality

33. Produce FMEA/FMECA Report

34. Assess hardware Reliability

35. Fault Tree

36. Define Sensors Locations

37. Select sensors and generate diagnostic rules

38. CAD concurrent with MADe

39. PHM Design Cycle Deliverables At the end of the risk assessment process, the user has knowledge of: • How the system can fail (failure modes) • How critical each failure is • What are the causes of functional failures • What are the interactions between functional failures • What physical failures are linked to functional failure • Where to place sensors – i.e sensor fusing • How to monitor physical failures • How to diagnose functional failure • What is the expected reliability of the sensing system • What is the expected functional and hardware reliability of the system

40. Concluding Remarks Despite expectations the acceptance and effectiveness CBM is in question. To be effective: • CBM/PHM programs must be designed and executed with the knowledge of the risks to which a system is exposed, i.e. the knowledge how the system fails • Model-based failure analysis, defining failures dependencies and improving completeness of risk identifications, should be adopted in preference to spreadsheet and “spreadsheet” like FMECA methodology • Model-based failure analysis should be adopted to enhance knowledge retention, knowledge transfer and to facilitate integration of risk assessment through supply chains • Taxonomies of functions, failure concepts, components should be adopted to improve readability/portability of risk assessment results • Diagnostic rules and Sensors sets should be selected on the basis of dependencies between failure modes (symptoms >>> syndrome) • Clear hierarchy of failure concepts (cause> failure mechanism> fault> failure mode) should be enforced in risk assessment process • Physical failures (cause/failure mechanism/fault) and their symptoms should form basis for BIT design

41. Thank You!