Refining fault trees using aviation definitions for consequence severity

Unmanned aerial systems (UAS) are being considered for civilian tasks that are time consuming and costly for humans, such as package delivery or surveillance. To derive maximum benefit in these applications, UAS will need to be autonomous rather than remotely operated. Safety rules for autonomous, unoccupied vehicles have yet to be defined. As of February 2015, the Federal Aviation Administration (FAA) still requires that a UAS operator maintain line of sight with the UAS. As safety standards for autonomous flight emerge, it is expected that a very large number of UAS will take to the skies. Current methods for certification of aviation technologies are rooted in the assumption of manned flight in relatively low-density airspace. The massive number of expected UAS flights and the introduction of increasingly autonomous software autopilots mean that new methods for certifying UAS technologies are warranted. In particular, it is overconservative to assume that failures that could result in the loss of aircraft are necessarily catastrophic, as they would be in the case of a manned aircraft. In order to provide more flexibility in modeling faults, this article introduces methods that tune certification processes to better match FAA standards and to reduce overconservatism that can delay system certification. The basic idea of our work is to update the venerable fault tree, which is at the heart of most certification cases for new aviation technology. A fault tree quantifies risks associated with various failure events and maps the risk to a consequence, which is an unfavorable or hazardous outcome of those fault events. Failure events (also called fault modes) and their associated consequences (also called effects) are typically identified through a process called failure modes and effects analysis (FMEA). Failure modes are then mapped on to the fault tree, where related faults form branches that lead to an undesired consequence. Typically fault trees use a binary state to represent each event: either a fault event has occurred or it has not. The probability of fault occurrence is generally much, much lower than the probability of a nonoccurrence.Whereas conventional fault-tree analysis uses a binary state for each fault, our proposed method is different in that it uses a multilevel state. Introducing multiple severity levels allows for the consequences of events to be classified more precisely, recognizing that not all faults have the same (e.g. catastrophic) consequences. More precise classification of consequences promotes reduced overconservatism, particularly in safety-critical applications, like aviation, where sets of faults are classified by the worst case example from the set. Our work is not the first to generalize fault-tree analysis to use fault states with more than two values. Notably, fuzzy logic has been applied in the past to model multilevel fault states in general and aviation-specific safety systems. The limitation of prior work is that multiple severity levels have been assigned at the level of the fault mode (root cause) rather than at the level of the fault effect (final consequence). For safety analysis, unfortunately, it is not usually clear how to combine faults of different severity levels to determine their effect. Do two low-severity faults occurring simultaneously result in a higher severity consequence? There is no generic answer to this question for aviation applications, because the answer depends on the relationship between the two faults, which must be characterized on a case-by-case basis, for example by using an FMEA. Our proposed method modifies the structure of a traditional fault tree, by shifting focus away from individual faults and to groups of faults, called fault chains. A fault chain is a set of events that together result in an undesired consequence. Because the focus of the method is on consequences (rather than fault events) and because those consequences may take on multiple levels of severity, we call our method consequence severity level (CSL) analysis. The remainder of the article describes CSL analysis and its applications. As a starting point, Section II provides background on aviation severity levels and fault-tree analysis. Section III introduces CSL analysis. Afterward, Section IV presents a UAS case study for a representative application: the use of a UAS for an inspection application. Section V quantifies this application using both conventional and CSL analysis. To conclude, a final section summarizes key technical results and their impact for certification of future UAS.