Fire Risk Analysis of Runway Excursion Accidents in High-Plateau Airport

The risk assessment of runway excursion accidents in the high-plateau airport is a significant part of the airport operations and risk management. This article proposes a method to evaluate the risk of runway excursion accidents in the high-plateau airport with the probability and severity estimations of runway excursion in the high-plateau airport. Firstly, the probability estimation is calculated by combining the correction model and the Bayesian network. The probability correction model considers the runway length required for takeoff and landing, specific ambient temperature, and wind speeds in the high-plateau airport. Then, a high-plateau airport simulation evacuation model of evacuation capacity is established by the VR experiment, and the severity of evacuation in the high-plateau airport is evaluated, combining the endurance of fire products. Finally, based on probability and severity, the quantitative calculation value of risk is given. We also utilize the model on a case study to find the effect of temperature, wind speed, and altitude on this risk index. The results show that the risk of runway excursion accidents in the high-plateau airport is greatly affected by temperature and wind speed. The experimental airport’s risk value in February is about 11.8 times of that in September, and the risk value of the high-plateau airport is 7.32 times higher than that in a plain airport. The model successfully simulates the various scenarios at a high-plateau airport and other airports at different altitudes. It is proved that the fire risk of high-plateau airport runway excursion accidents should be paid attention to and provides scientific guidance for the airport’s aviation safety management based on the actual characteristics of a high-plateau airport.


I. INTRODUCTION
In the last few decades, civil aviation has brought convenience to people's life and promoted economic development. With the rapid development of civil aviation, civil aviation safety has been paid more and more attention. With the rapid development of the air transport industry, the increasingly prominent flight safety issues are derived. The take-off and the landing of an aircraft are the most dangerous phases of flight [1]. During take-off and landing, runway excursions continue to be the highest category of aircraft accidents and often exceed 25 per cent of all annual commercial air transport accidents [2].
The associate editor coordinating the review of this manuscript and approving it for publication was Keli Xiao .
A runway excursion accident is defined as an accident in which an aircraft on the runway surface departs the end or side of the runway surface during take-off or landing [2].
It consists of two types of events: 1. Veer-off: This is a runway excursion in which an aircraft departs the side of a runway.
2. Overrun: This is a runway excursion in which an aircraft departs the end of a runway.
Runway excursions accidents produce a derivative event that is more destructive and more harmful than the emergency itself. The effect of runway excursions can result in damage to aircraft, airfield, or off-airfield installations, including other aircraft, buildings, or other items struck by the aircraft [3]. The aircraft accident data obtained from the Aviation Safety Network is used to calculate the worldwide aviation accidents Many historical studies have shown that runway excursion accidents are far more serious than other runway accidents. The probability of fire caused by runway excursion is 12%, resulting in passenger and crew mortality of about 36% [5]. Therefore, it is significant to study the risk of runway excursion accidents. Because of the special lowpressure and low-oxygen environment and wind, the probability of the runway excursion on the high-plateau is different from that on the plain. Several studies on aerodrome risk sensitivity based on historical data have shown that increasing accident probability is mainly due to meteorological conditions and runway-related factors. The probability of an aircraft overrunning in inclement weather can be quadrupled [6], [7]. In the high altitude area, the influence is more obvious because of its special low pressure and low oxygen environment. However, there is no research on calculating the probability of runway excursion accidents under the plateau environment.
High-plateau airports are no less than 2,438 meters (8,000 feet) above sea level [8]. At present, there are 47 highplateau airports in the world, of which 20 are in China [9].
The proportion of China's is as high as 42.6%. The number of high-plateau airport flights in China has doubled in the past decade. Airports can directly boost the tourism economy, which accounts for about 5% of China's GDP. Also, in many western regions, the proportion reaches 8% or even 10% [10]. High-plateau airport plays an important role in promoting economic and tourism resource development in the western region. Therefore, civil aviation carriers should pay enough attention to high-plateau airports' safe operation. In highplateau airports, there will be more serious safety problems than those in low altitude areas, such as altitude reaction of personnel, deterioration of flight performance, and so on. These reasons are likely to cause aircraft fire accidents, which threaten the airport's safety.
The research on risk management in civil aviation is mostly based on Bayesian Network, risk matrix, and simulated prediction. FAA has developed a risk management manual for pilots. Potential risks are identified by using the pave framework (p-pilot, a-aircraft, V-eVironment, E-External pressures) [11]. Insua et al. provided a framework for national aviation risk decisions based on a risk matrix [12]. Combining with the multi-agent group (MAG), Wang et al. constructed an evaluation model of civil aviation risk management based on the BDI model [13]. Feng et al. formulated the hypotheses for the airfield security risk sources from four aspects, such as human, equipment, environment, and management. The hypotheses were verified through questionnaires, statistical analysis, and constructing a structural equation model [14]. Combined with the accidents or unsafe incidents in the airport between 2008 and 2012, Liu et al. constructed a new index system to judge the airport's safe level [15]. Tang et al. constructed an infectious dynamic process model of airport flight area human risk based on the SEIRS epidemic disease model for risk management. The conclusion provides the theoretical basis for the strategic focus of different risk management stages and control [16], [17]. Ng et al. [18] pointed out that investigating the risk assessment technique under the distributionally robust approach to achieve lowertolerance-to-loss-of-delay compensation. At present, the risk assessment research for aircraft accidents is mostly focused on plain areas. There is a lack of systematic research on aircraft accident risk under the high-plateau airport's special environment.
Our main contributions as following. We build a risk assessment model for the high-plateau airport to the runway excursion accident and prove the reliability and practicability of the model in the verification of different altitude airports. More specifically, first of all, we calculate the probability of runway excursion accident of high-plateau airport by calculating runway length and Bayesian network, which quantitatively reflects that the probability of runway excursion accident in high altitude airport is much higher than that in the plain airport. Then, based on the social force model, the panic parameter calculation formula of high altitude flight passengers in cabin evacuation is established through VR experiment. Combined with the existing research, it is well applied in various altitudes. Finally, according to the basic definition of the risk matrix, combining the probability with the simulation results of evacuation, the quantitative risk value of the runway excursion accident in different environments is given. Besides, the evaluation model we proposed is implemented on the risk simulation evaluation platform we built. In the follow-up study, we can directly replace the risk assessment of other types of aircraft accidents in the high-plateau airport into our assessment platform, and we can get the standardized values of different aircraft accident risks.
The rest of the paper is organized as follows. Section II discusses the related work about the change of human evacuation ability and the simulation analysis of indoor personnel behaviour decision in high altitude environment. Section III introduces the overall definition of risk in this paper, which is calculated based on the risk matrix. Section IV introduces the criterion of severity assessment and the VR experiment process. Section V introduces the probability calculation method, including the calculation method of required runway length and the Bayesian network model. Section VI reports the evaluation results of our method in extensive experiments on case data. Finally, Section VII concludes the paper.

II. RELATED WORK A. EFFECT OF HIGH-PLATEAU ON HUMAN
Many scientists have studied the effect of high altitude on human body function, such as learning [19], reaction time [20], and decision making [21], [22]. Limmer et al. studied the effects of low oxygen on pilots' performance at high altitude [23]. The results showed that low temperature and dehydration might be the influencing factors. Roach et al. concluded that oxygen partial pressure decreases exponentially with altitude during high altitude exposure, resulting in hypoxia that leads to cognitive and physiological changes [24]. Based on Boris's relationship between altitude and human's oxygen uptake, Chen has given the velocity variation at different altitudes [25]. However, it does not consider the negative impact of panic and can not accurately reflect the evacuation speed of the evacuees in the high-plateau because of the limited psychological factors. Therefore, it is very meaningful to establish an evacuation capability model considering the degree of panic for the evacuation simulation of high altitude accidents.

B. INDOOR MOBILITY INTERACTION
Modelling the interaction between different places is important because doing so can help us understand human mobility and its relationship with the environment. Especially in the evacuation of a small environment such as a cabin, the prediction of human indoor activities is more important. Yin et al. [26] proposed stochastic process models to predict the goals of indoor human activities. Liu et al. [27] analyzed the interaction between stores in shopping malls via customer flow to determine whether indoor mobility interaction follows the gravity law and what are its influencing factors. Liu et al. [28] developed a proactive workflow model that automatically constructs the workflow states and estimates the parameters describing the workflow transition patterns for healthcare. There is still little practical knowledge of how the management of mental load and stress relates to the wayfinding process itself. However, in the evacuation scene of the plateau, psychological panic is an important factor that can not be ignored. Kalimeri and Saitis [29] proposed a multimodal approach to the automatic inference of stressful environmental conditions affecting the visually impaired people when moving in unfamiliar spaces using a random forest classifier and features extracted from the EEG, EDA, and BVP modalities. However, none of these methods was developed for cabin evacuation. What's more, these methods are field tests. It is almost impossible to build and reproduce the evacuation scene of plateau cabin fire in this paper; otherwise, it will cost a lot.

C. EMERGENCY EVACUATION SIMULATION
With the development of computer technology, many physical dynamic models describing particles and fluids have been used in the study of simulating evacuation behaviour. The biggest characteristic of computer simulation is a short time, cost-saving and safety. At the same time, because simulation technology can carry out large-scale crowd simulation experiments. The simulation model can be divided into the macro model, mesoscopic model and micromodel [30]- [32]. Micro model is the most widely used and effective model. It can show human behaviour in simulation experiments by giving each individual different personnel attributes. At present, the most widely used model in the emergency evacuation scene is the social force model. Jiao et al. improved the social force model by modifying the elastic coefficient of the human body and introducing speed psychological force [33]. Seyfrid et al. obtained the effect of self-driving force and psychological force on the evacuation speed and density by studying relevant data [34]. Parisi et al. used the social force model to analyze the relationship between panic degree and evacuation speed [35].
There has been much research on cabin emergency evacuation. At present, the commonly used simulation software for pedestrian evacuation in engine room mainly includes airEXODUS, VacteAir, ARCEVAC and Angiologic software [36], [37]. The direction of smoke in a fire, the speed of personnel, and the choice of exits are factors that restrict people's ability to evacuate [38]. The passengers' panic is an important parameter for the evacuation of aircraft accidents. Miyoshi et al. developed the AAMAS model. AAMAS model considers the impact of passengers' panic on the evacuation, and the evacuation simulation of the Indonesian Eagle Aviation accident was carried out to verify its effectiveness [39]. However, these studies are carried out in the plain airport, which lacks accuracy in high-altitude environments.

III. METHOD
Based on the definition of Risk Matrix, the fire risk (R) of runway excursion accidents in the high-plateau airport can be 204402 VOLUME 8, 2020 established as a function of the probability (P) and the severity (S) of the runway excursion accidents, as shown in the below.
P and S are the probability and severity of an aircraft running out of the runway at a high-plateau airport.
Therefore, the risk assessment is divided into severity assessment and probability assessment.
The severity of the aircraft accident at the high plateau airport lies in the smoke hazard and the personnel evacuation capacity caused by the low pressure and low oxygen. Therefore, combining with the fire hazard analysis of cabin in the high altitude to humans, and the evacuation simulation, the severity of high altitude airport can be comprehensively evaluated. On the other hand, the aircraft requires a longer run distance in the high-altitude airport because of the low-pressure and poor operating environment. Therefore, the probability of runway excursion is greater. This article quantitatively evaluates the probability based on measuring the run distance and the Bayesian network method. Finally, a simulation platform is set up for case analysis. The research process is shown in Figure 2.

IV. SEVERITY ESTIMATION
According to the Classification for Ground Accidents of Civil Aviation, people's death or injury in an accident is an important indicator for measuring the severity, which depends on the evacuation capacity of the people during the evacuation process and the endurance to fire products. This article divides the risk of aircraft fire in the airfield into four levels and scores the severity of the accident at each level, as shown in Table 1.
The special environment of the high-plateau airport will cause different psychological and physiological pressures than the plain. However, there is a lack of research on the parameters of personnel's evacuation ability in the cabin at high altitudes. Virtual reality technology can restore real scenes; moreover, it can save time and costs. Therefore, it can make up for the shortcomings of field investigation and computer simulation. In this article, experiments on the factors that affect people's evacuation ability in high-plateau are conducted through virtual reality technology. Finally, based on the literature, fire and smoke spread in the cabin at high altitude was set up in the severity assessment module, combined with the people's evacuation capacity and endurance to fire products at high altitude.

A. HAZARD ANALYSIS
In the simulation of an aircraft fire accident, thermal radiation, temperature, CO concentration change, and personnel's endurance are the main consideration.
According to existing literature [40], personnel's endurance to these three influencing factors is shown in the Tables 2,3,4.   Because high-plateau is in a special environment of low pressure and low oxygen, fire products' change law is different from the plain area. Based on the Heskestad & Delichatisios model and Oka's research, the temperature decay model and CO propagation model of cabin ceiling jet under different pressures have been established [41]- [43].
The calculation formulas are as follows: In the formula, α is the entrainment coefficient ratio; H(m) is the height between the fuel source and the ceiling; r(m) is the horizontal distance away from the plume centerline axis along with the ceiling. T max,0 (K) represents maximum ceiling temperature rise. T max,r (K) is temperature rise at horizontal distance r from the plume centerline axis. C 0 (ppm) is CO concentration beneath the ceiling at the flame centerline. C r (ppm) is CO concentration at the position of r distance from the flame centerline. By setting the fire source and based on the spread formulas, the CO concentration, temperature, and thermal radiation at different distances are calculated. The casualties under different evacuation conditions are calculated by combining with the evacuation ability and tolerance degree.

B. EXPERIMENT ANALYSIS METHOD
During the cabin's evacuation at high altitudes, the plain's psychological and physiological factors are different. Therefore, personal evacuation capacity will be reduced. To input the simulation data more accurately in ANYLOGIC, it is necessary to obtain the personal evacuation data at high altitudes.
The panic of personnel is an important influencing factor of evacuation capacity. Therefore, based on an emergency evacuation's improved social power model, obtain the parameters that describe the panic factor through theoretical analysis. Finally, combined with virtual reality experiments and existing research, the calculation formulas of a panic factor can be obtained at different altitudes.

1) THEORETICAL ANALYSIS
Helbing et al. proposed a social force model based on Lewin's theory [44]. The model describes the pedestrian movement as the movement towards the desired target under multiple forces' combined action. The formula is as: f p i is the driving force generated by the passenger i when he wants to reach the desired destination. f ij is the interaction between passenger j and i. f iw is the force of passenger i subjected to obstacles. dv i dt is the acceleration of the passenger i. m i is the i's weight.
During the evacuation in the cabin, the panic factor makes passenger's desired speed more quickly. Based on equation (4), a panic factor was introduced to improve the desired speed to study this phenomenon. The relationship between forces is shown in Figure 3. The improved social force model is as: is the direction of passenger i 's desired velocity. c i is the passenger i 's panic factor for in-cabin evacuation, it represents the level of panic for in-cabin evacuation.
j =i f ij + W f iw is affected by the area density and obstacles. When the area density and the obstacle environment are the same, this force is equal. Therefore, by integrating the equations (5) and (6), the panic factor is shown below.
dt is the acceleration of the passenger i under panic, dv 1 dt is the acceleration of the passenger i under normal cir- is the initial desired speed of the passenger i under normal circumstances and panic; v 1 (t), v 2 (t) is the actual speed of the passenger i in normal and panic circumstances. τ 1 , τ 2 is the passenger's adaptation time under normal and panic circumstances.
When setting the desired speed of people at different altitudes, the calculation formula can be obtained according to the study by Chen [25].
v 0 i is the desired velocity at different altitudes; v 0 is the desired velocity of the 25-year-old man and woman in the 204404 VOLUME 8, 2020 plain; k H is the altitude correction parameter, h(km) is altitude. k A is the age correction parameter; a is age.

2) EXPERIMENTAL DESIGN
A Boeing 737-700 aircraft overrunning in the airfield was set in this virtual reality scene. There are 3 safety exits on each side, 128 seats in its cabin, including 8 first-class seats and 120 economy class seats. The fuselage length is 33.6m, of which the front door is about 6.37m from the aircraft nose, 9.26m from the central emergency door, and 19.57m from the rear door. The rear door is 7.66m from the tail. The cabin is 3.53 meters wide and 2.2 meters high. The aisle in the middle of the aircraft cabin is about 0.4-0.6m, allowing only one person to pass. The model of the plane is shown in Figure 4. According to the Human Dimensions of Chinese adults, the ratio of space occupied by men and women is 1:0.9 in the virtual reality simulation. AASKV4.0 research report summarizes a large number of aircraft emergency cases. It can be found that the number of available hatches in 67% of aircraft emergency evacuation is above 50%. When an accident occurs in the airfield, the aircraft usually makes an immediate landing, and the aircraft will have a certain deflection angle with the ground during the landing. One side door cannot be used as a passenger escape exit due to the influence of the fuselage's tilt. Therefore, the scene is set for the evacuation of passengers from one side emergency exit. When the accident occurs, the passengers, after the reaction time, get up from their positions and evacuate. Then, they reach the cabin door to make a jump slide. After reaching the assembly area, emergency evacuation complete. Finally, participants are asked to fill out a questionnaire. The experimental settings are shown in Table 5.
The cabin is divided into the common areas of A1-A3, the seat areas of S1-S6, the corridor areas of C1 and C2, and the safety exits of E1-E8, as shown in Figure 5.
In the beginning, participants are randomly placed in the S1-S6 area. As the aircraft's front door is 9.26 m from the central emergency door and 19.57 m from the rear door, according to the distance between the S1-S6 and the exit, the area is divided into a, b and c positions. The distance is 2-4.5 m, 4.5-7 m, and 7-9.5m, respectively. In each experiment, participants are placed in a, b and c.
To ensure the evacuation drill's authenticity and safety, the experiment is conducted in an outdoor environment at an altitude of 3600m. The research group published the registration form with rewards through online registration through the WeChat group, public account, and other means. Therefore, the final screening criteria are blows.
1. Select persons with an age distribution between 18-50 and 51-60 years old. Since minors and the elderly over 60 mainly rely on their families' help when evacuating, they are not considered.
2. Try to select people from different professions. 30 volunteers participated in the evacuation, mainly composed of undergraduates, postgraduates, doctoral students, and teachers of Nanjing University of Aeronautics and Astronautics. All personnel is in good health. The personnel characteristic variables are further screened through preliminary statistics of the questionnaire data, as listed in Table 6.   As more than 50% of the people are not familiar with VR equipment, we analyze the individual adaptation through the 100-meter free running time of the virtual reality tunnel, as shown in Table 7. It can be found that after the guidance and their own training, the average evacuation time to reach a stable value. Therefore, the direct influence of familiarity with VR equipment on evacuation time is excluded.
The panic questionnaire was designed based on Zhang [45], which is shown in Table 8. In the questionnaire, scores 1-8 are objective physiological evaluations, scores 9 are subjective evaluations, and A-D indicates scores 0-3, respectively. The calculation formula of the panic score is shown below.
S P is the panic score, is the total objective physiological score, N O is the number of objective physiological, is subjective evaluations.

3) EXPERIMENTAL RESULTS AND DETERMINATION OF MODEL PARAMETERS
Due to the narrow space in the evacuation part of the experiment cabin, the time interval recommended by B. Steffen is used when calculating passenger acceleration. The time interval is set to [t − t, t + t], t = 0.2s. V 2 is the velocity at Through experiments, the speed of passengers of different groups after accelerating to a stable speed, and the adaptation time to reach the desired speed, as shown in Table 10.
Simultaneously, the three routes of the a, b, and c areas in the cabin are divided, as shown in Figure 7.
Observe the observation area at the intersection of the seat and the aisle, the main aisle, and the cabin exit. Through the program to monitor the speed of different people's categories, calculate the acceleration and the panic factor.
Above all, choose the evacuation route at c and get each person's speed and density in the A1-C3 area by a virtual reality experiment program. Take the case of a young man named M.  Since the external force of the cabin evacuation mainly comes from the chair's effect on people and the interaction between people, when the density is the same, the external force is equal. Take the man's panic value at A3 as an example. The density of point A3 in the group emergency evacuation is the same as that of Point B1 in the group normal evacuation, so the external force is considered equal. The panic factor value is 0.75 by equation (8). In the same method, the other points of M are calculated. The results are shown in Table 10.
It is obvious that M's level of panic is different from one location to another. Simultaneously, through experimental video and data, we can find that the higher the density, the higher the degree of panic; the closer to the hatch, the lower the degree of panic. The actual speed also affects the change of the degree of panic. Therefore, it can be found that speed, density, and distance from the door have a linear relationship with the panic factor. Regression analysis is performed by SPSS 23. To ensure a high degree of fit, all young men are grouped according to their density, actual speed, and distance from the cabin door. Simultaneously, linear regression analysis of panic values is performed using the data of all young men at a, b, and c areas.
c M = 0.028 + 0.053ρ − 0.141v(t) + 0.047d range + σ (12) d range is the distance of the passenger i's current position from the hatch door. F test is performed to test the hypothesis (F = 79.403, p = 0.000 <0.05, R2 = 0.944). Therefore, the model fit is high. The regression coefficient value of the actual speed is −0.163 (t = −2.932, p = 0.011 <0.05), which means that the actual speed will significantly negatively affect the panic factor. The regression coefficient value of the density is 0.053 (t = 3.355, p = 0.005 <0.01), which means that the density will have a significant positive effect on the panic factor. The regression coefficient value of distance is 0.008 (t = 0.619, p = 0.546> 0.05), which means that distance does not affect the relationship of panic factors. Therefore, remove the distance and perform the regression analysis again, as shown in the formula (14) blow.
The test for the model's multicollinearity found that all the VIF values in the model are less than 5, meaning that there was no colinearity in the model. The D-W value is near 2, which indicates that there was no autocorrelation in the model. Therefore, there is no correlation between the sample data. The regression coefficient value of the actual speed is −0.178 (t = −3.703, p = 0.002 <0.01), and the regression coefficient value of the density is 0.062 (t = 9.063, p = 0.000 <0.01). F test is performed to test the hypothesis (F = 124.009, p = 0.000 <0.05, R2 = 0.943), meaning the model fit is high.
The same goes for young females, old males, and old females with varying degrees of panic. The panic calculation formula for different groups of people is shown below.

V. PROBABILITY ESTIMATION
To evaluate the probability (P) of the runway excursion accidents in the high-plateau airport, this article calculates the probability of overrun and veer-off, respectively. The probability (P) of the runway excursions can be calculated from VOLUME 8, 2020  the probability of the overrun (P r ) plus the probability of the veer-off (P v ).
The overrun risk is worked out by measuring the run distance in the high-plateau airport and estimating the veer-off probability based on the Bayesian network. The risk probability formula of runway excursion accidents in the high-plateau airport is established.

A. OVERRUN
Due to the quick changes in temperature and wind speed at high plateau airports, the range of run distance is also larger than that of plains. According to the relationship between the required distance and the maximum available distance, the risk probability of the high-plateau airport's overrun accidents is calculated.
There is much research on calculating the run distance, which can be further established as a function of aircraft characteristics and external factors. Take Boeing 737-800 as an example [46]. Figure 8 shows the effect of aircraft weight on takeoff and landing distance.
The relationship between temperature and the run distance is shown in Figure 9. The wind has the same effect on arrivals and departures, as shown in Figure 10. In Figure 10, Positive values represent headwinds, and negative values represent tailwinds.
The run distance of landing and take-off, can be modelled as a function of the base distance and these three external  factors, as shown in below.
β and γ are the coefficients of aircraft landing and take-off; WD is the wind speed (knots, n mile/h); t is the temperature ( • C); W is the weight ratio (%); d is the required runway distance (1000 feet). Assuming that these factors have similar effects on other aircraft as the Boeing 737-800, the same coefficients as β 0 and γ 0 are used to determine the runway distance of other types of aircraft, as shown in Table 11. In the high plateau airport, the run distance is greatly affected by the external environment. Therefore, it is necessary to consider the influence of altitude to modify the above formula. Su and Zhao [47] found that the run distance on landing increases with altitude. Cai et al. [48] tested the run distance at different altitudes, and the effect of altitude on the run distance was obtained. Based on the above research methods, the effect of altitude on the run distances of take-off and landing is shown in Figure 11. Combined with Reference [47] and field survey data, the parameters are set as follows: The approach altitude is 15 meters, the temperature is 15 • C, the average longitudinal slope of the runway is 8%, the average landing weight of the aircraft is 18680 kg, the aircraft glide angle is 3 • , and the adverse wind speed of the runway is 2.3 m/ s. It can be found that the run distance of landing increases slightly with the increase of the altitude of the airport, which can be regarded as a linear growth. However, the run distance of take-off is greatly affected by altitude. When the altitude is lower than 2500 meters, the growth rate of take-off distance is slightly faster. In this article, we use the least square method fit the curve of the key nodes in Figure. 11 to obtain the modified run distance of take-off and landing in the highplateau airport. The least-square method is the most widely used and high precision method in the field of curve fitting by minimizing the sum of squares of errors to obtain the approximation function with the smallest error with known data points [49], [50]. The fitting formula is as follow: The conservatism in handling airport traffic in such operations should be increased, as an accident due to the improper runway usage causes dramatic loss and disruption to the airport management [51]. The intercept is increased as the standard running distance. For an airport with an altitude of H, a standard take-off taxiing distance of d takeoff and a landing taxiing distance of d landing the revised take-off taxiing distance and landing taxiing distance of the aircraft are shown below. d landing = 0.14H + d landing (18) d takeoff = 0.59H + d takeoff (19) When the required run distance is longer than the available run distance, the overrun accident will occur. The probability calculation formula of an overrun accident in the high plateau airport is shown below.
P rt and P rl are the probability of take-off and landing in the high-plateau airport. l landing and l takeoff are the maximum available landing and takeoff distance of the runway in the high-plateau airport.

B. VEER-OFF
The reason for the veer-off accidents is complex, so it is difficult to build an accurate dynamics model. The Bayesian network is the most common research tools. Therefore, a method for calculating the probability of aircraft veer-off accidents in the high-plateau airport is established by the Bayesian network in this article.
Based on the 63 incidents of the veer-off accidents in the Civil Aviation of China (CAAC) from 1996 to 2010 as training samples, the aircraft veer-off accident's parameters are studied. Because the Bayesian network model in this paper does not involve hidden variables, so the Expectation-Maximization algorithm is used to learn the parameters of the network, and the posterior probability process is implemented by the special software GeNIe of Bayesian network. The Bayesian network structure is shown in Figure 12.
The probability of veer-off accidents due to the coupling of any two risk factors is obtained by Bayesian networks, as shown in Table 12.
Therefore, combined with the probability of any two risk factors working together, and the independent probability distribution of each risk factor's occurrence, the veer-off accidents' total probability can be calculated.
VOLUME 8, 2020  p i and p j represent the independent probabilities of occurrence of the two risk factors Y i and Y j in Table 12, i, j ∈ (1, n). n is total number of risk factors in the model. S ij represents the probability of the veer-off accidents when these two risk factors are combined, which value is shown in Table 12. This article uses log-normal distribution to represent the probability distribution of the risk factors, and the density function is as follow.
µ and σ are parameters of the log-normal distribution, µ is position parameter, σ is the scale parameter. x represents a whole coupling factor under the coupling effect of various external factors (wind speed, pressure, human factor, etc.) in different airport environments, which is related to the operating environment of the high-plateau airport.

VI. SIMULATION
ANYLOGIC is fast simulation software and provides a variety of simulation methods, including process-based discrete event modelling, agent-based modelling, system dynamics simulation, and so on. The software has provided process modelling library, pedestrian library, track library, road traffic library and other methods, which can quickly model aircraft and personnel. Process modelling library is process-centred modelling, which can model real-world systems in terms of entities (transactions, customers, products, parts, vehicles, etc.), processes (the sequence of operations usually involves queues, delays, resource utilization) and resources. This article models the aircraft operation process in the airfield and simulates the probability and severity of runway excursion accidents in the high-plateau airport based on the run distance, emergency evacuation of the aircraft, and fire danger. First, establish the aircraft's probability assessment module, draw the airport operation scenario, input the environmental parameters and probability calculation formulas. Fire probability can be calculated. Then, establish the aircraft's severity assessment module, set up aircraft emergency evacuation simulation scenarios, input fire parameters, and personnel evacuation parameters so that the severity of fire accidents can be evaluated in combination with the simulation results' death and injury. Finally, combined with the probability and severity obtained from the simulation, evaluate the overall risk. The simulation process is shown in Figure 13.
Take high-plateau airport as an example. The altitude of this airport is 3600m. The airport has a single runway. The available runway length is 3800m, 45 meters wide. The airport's airfield simulation scenario drawn in ANYLOGIC is approximately 1:20,000 to the actual size, as shown in Figure 14.

A. SCENARIO IDENTIFICATION
The simulation environment is an aircraft cabin with 100 seats and 6 emergency exits. The ratio of the model to the actual size is about 1:150, the simulation scenario is drawn in ANYLOGIC, as shown in Figure 15. Three experimental scenarios are set up to study the influence of the three parameters of fire location, environmental factors, and altitude.
(1) Set up three kinds of fire scenarios. The fires are located in the nose, middle, and tail of the cabin. The available cabin doors in the accident are shown in Fig16. The fire location of the latter two groups will be determined according to the results of this group.
(2) To assess the overall fire risk level of the runway excursions accidents at this airport, evaluate the risk of aircraft running out of the runway in different months of a year. The environmental data of this airport are shown in Table 13.
(3) To compare the runway excursion risk at different altitudes, the fire risk level is comprehensively evaluated by setting up five altitudes of 4600m, 3600m, 2600m, 1600m, and 0m. To reduce the impact of environmental factors, taking 5 • C and wind speed of 0 m/s as an example.
The wind speed and temperature of the high-plateau airport have great uncertainty. We use the white Gaussian noise [52], [53] to represent the effect of random changes in wind speed and temperature. Limited to the altitude of the high-plateau airport, the take-off and landing performance needs to be guaranteed. So, the aircraft must use the full runway length [46]. When the altitude is 0m, the γ 0 is 1400m, β 0 is 1200m. Setting the parameters of the formula (23). According to this airport's historical statistical data fitting, µ of a single risk factor that aircraft excursion's is 2.54, the σ is 0.39. Due to mainly discussing the influence of the high-plateau airport environment rather than the weight, set the empty weight of an aircraft is 14120 kg, the average takeoff/landing weight is 18680kg.
The evacuation speed setting considering the panic factor and the smoke spread characteristic of the fire in high altitude was obtained from Section IV. A. According to the personnel's endurance to the fire, the airport's fire severity level is evaluated by the mortality rate. At the altitude of 3600m, the atmospheric pressure is 0.6 atm. The combustion rate coefficient is 0.48, and the average value of heat energy released per unit mass of fuel is 1.2×10 7 J. The fire intensity is set to a cube of 1m×1m×1m [54]. In the simulation platform, the evacuation procedures with temperature, wind speed, and altitude changes are simulated 60 times, respectively. During the simulation process, passengers choose the seat randomly.
Based on the above parameter data, combined with the probability formula input and simulation evacuation data output, the simulation scenarios of the three sets of parameter changes are simulated.

B. RESULT ANALYSIS 1) FIRE LOCATION
The simulation results are shown in Table 14.
The evacuation time is the longest when the fire is in the aircraft's nose and the shortest when it is in the middle of the cabin. Except for the middle part of the cabin, the evacuation VOLUME 8, 2020  time exceeded the 90s emergency evacuation rule for civil aircraft. There may be several reasons: • When the fire is on the aircraft tail, the cabin's rear door is not available. Therefore, passengers must evacuate forward. The B737-700 has more room in the back of the cabin, so more people will be stuck in the rear door, causing congestion. Finally, passengers will be in further panic and slower evacuation.
• When the fire is on the aircraft nose, more people are evacuated from the middle door, even though there are two available doors at the rear door. The main reason is that in the beginning, the sitting passenger is looking forward. When the fire accident occurs, people's subjective consciousness will run forward. Therefore, although there are two available hatches behind the cabin, the cabin personnel still evacuate forward subconsciously. Simultaneously, the people in front of the cabin moved closer to the middle, which led to crowding, but the rear doors of the cabin could not be fully utilized.
• Comparing Figure 16 To reduce the other two experiments' influence, choose the fire position, which is less affected by the model to simulate. Therefore, in the follow-up experiment, set the fire location in the middle of the cabin, and the available combination of hatches is shown in Figure 16(a).

2) TEMPERATURE AND WIND SPEED
This article establishes the relationship between the run distance, the temperature, and wind speed of take-off/landing, as shown in Figure 17. The tailwind is positive, and the headwind is negative, and the wind is parallel to the runway direction. The following findings can be found.
• The run distances of take-off and landing at this highplateau airport are significantly affected by wind speed and temperature.
• The influence of wind speed is more obvious. The run distance increases rapidly with the increase of tailwind speed.
• Temperatures below 20 • C have little effect on the run distance. When temperatures are above 20 • C, the run distance increased slightly.
• The take-off distance is more affected by wind speed and temperature than the landing distance.
Repeat experiments with the environmental parameters of this airport in different months. The average fire probability of the aircraft overrun was obtained by equations (20) and (21). According to Table 13, the factors' probability distribution of the aircraft excursion is input in the simulation process. The sum of the probabilities of the runway excursion accidents of different months is shown in Figure 18.
The following findings can be found.
• The firing probability of runway excursion accidents at this airport is higher in winter than in summer. The firing probability of the take-off fluctuates greatly with the change of the month.
• The runway excursion fire accident probability of the take-off is greater than that of landing.
• Figires17 and 18 show that runway excursion accidents at high altitudes are sensitive to wind speed and temperature changes.
A four-moment evacuation scenario during a simulation is shown in Figure 19. The simulation results are shown in Table 15.
The changes in risk are shown in Figure 20.
The simulation results show that: • It takes about 80 to 90 seconds for the 100-seat aircraft to be evacuated in case of a midchain fire, and the evacuation times and average death toll vary slightly, but not much.
• Summer deaths are slightly lower than other seasons, possibly due to summer temperatures and oxygen levels, and other outside parameters are more in line with human comfort.
We can draw the following conclusions: • The risk level at this airport during the summer is significantly lower than that during the winter, with the most dangerous February risk being 11.8 times the safest September. It may be related to weather, temperature, and the amount of oxygen in the air. It can be found that the risk level in winter is higher than that in summer in both the probability and severity of this airport.
• In risk management, we should pay attention to the overall risk level, while the risk level of runway excursion accidents at high altitude is more affected by the severity. So reducing severity level is very important.

3) ALTITUDE
The probability of runway excursion accidents at different altitudes is shown in Figure 21. • The probability of the runway excursion accidents decreases significantly as altitude decreases. The probability level at 4600m is about 10 times that at 0m. With the decrease of altitude, the change range of probability level between adjacent altitudes slows down gradually.
• At different altitudes, the probability of takeoff is greater than the probability of landing. As the altitude rises, the differences become more pronounced. At 4600m, the takeoff's probability is about twice as high as the probability of the landing.
• It can be seen that at 2600m, the probability range has increased significantly, and the probability of takeoff is significantly greater than the landing.
The simulation results are shown in Table 16. • It takes about 60 to 90 seconds for the 100-seat aircraft to be evacuated. As altitude increases, the evacuation time increases significantly, and the average death toll increases slightly. Severity levels changed significantly at 2600m and 4600m. Therefore, aircraft fire accidents in high altitude area are dangerous because of the limitation of evacuation speed and the fire hazard.
The changes in risk at different altitudes are shown in Figure 22. • The risk value increases rapidly at higher altitudes, with an exponential relationship.
• The risk value at the 4600m is about 7.32 times greater than that at the plain airport. The risk of runway excursion accidents in plateau airport is influenced by altitude.
• The changing trend of risk is basically the same as that of probability and severity. Probability is more affected by the change of altitude. Therefore, the main reason for the difference of risk between plateau airport and the plain airport lies in probability: the influence of environmental factors of the plateau airport.

VII. CONCLUSION
This article focuses on the risk assessment of the runway excursion accidents in the high-plateau airport and builds a risk simulation assessment platform based on the aircraft accident scenarios in the high altitude airport. The correction probability model of the runway excursion accidents at high-plateau airport is established through the in-depth analysis of probability and severity from two perspectives.
Based on the social force model and VR experiments, the evacuees' panic parameter formula in the cabin was established. Besides, combined with existing research, it can be applied to different altitudes. Finally, a method for assessing the risk of runway excursion accidents at the high-plateau airport was established. The changes in temperature, wind speed, and altitude are simulated, and quantitative risk level comparisons are given. The model can be applied to the risk assessment and management of runway excursion accidents in the high-plateau airport. The following conclusion can be drawn from the test results: 1)The fire probability of runway excursion accidents at this airport is higher in winter than in summer. The most dangerous risk value in February was about 11.8 times that in September. Wind speed and temperature greatly influence the risk of runway excursion accidents in the high-plateau airport.
2)Compared with the plain airport, the fire risk of the runway excursion accidents in the high-plateau airport is about 7.32 times. The risk at the high-plateau airport is greatly affected by altitude. With the increase of altitude, the risk increases exponentially.
Therefore, to reduce the fire risk caused by runway accidents in the high-plateau airport, the civil aviation administrator should pay more attention to the safety of the runways of airports in high altitude areas. Airports should prevent the runway excursion accidents from occurring and control the aircraft's take-off and landing operations, especially when the altitude exceeds 2600m. The risk in winter and step up security support in the high-plateau airport should be the focus on.
Also, to reduce the risk level of the runway excursion accidents at the high-plateau airport, airport managers need to pay more attention to the evacuation work. It is necessary to publicize safety knowledge for high-altitude passengers, reduce their panic levels, minimize evacuation time to reduce casualties and reduce the risk of runway excursion accidents in the high-plateau airports. This paper only considers the risk of runway excursion accidents. There is a lack of risk research for various ground accidents in the high-plateau airport. We will further study various ground accidents in the high-plateau airport to optimize the simulation and risk assessment platform in future work.
QUAN SHAO was born in Ezhou, China, in 1981. He received the Ph.D. degree from the Institute of Public Safety, Tsinghua University, Beijing, China, in 2009. He is currently an Associate Professor with the College of Civil Aviation, Nanjing University of Aeronautics and Astronautics. His research interests include safety management of civil aviation, airport security and risk assessment, and emergency decision-making for emergencies.
MINGMING YANG was born in Hohhot, China, in 1996. She received the B.S. degree in engineering from Central South University, in 2018. She is currently pursuing the M.S. degree in transportation with the Nanjing University of Aeronautics and Astronautics. Her current research interests include safety of civil aviation, risk assessment, and system simulation.
CHENCHEN XU was born in Xuzhou, China, in 1993. She received the B.Eng. and M.Sc. degrees in air transportation management from the Nanjing University of Aeronautics and Astronautics, in 2012 and 2016, respectively. She is currently pursuing the Ph.D. degree with Ghent University, Belgium. Her current research interests include airport safety management and airplane evacuation management.
HAO WANG was born in Fujian, China, in 1994. He received the B.S. degree in engineering from Qingdao Technological University, in 2017, and the M.S. degree in transportation from the Nanjing University of Aeronautics and Astronautics, in 2020. His current research interests include transportation planning and management, system optimization, and simulation.
HAORAN LIU was born in Suqian, China, in 1996. He received the B.S. degree from the Zhengzhou University of Aeronautics, in 2018. He is currently pursuing the master's degree with the College of Civil Aviation, Nanjing University of Aeronautics and Astronautics. His current research interests include transportation planning and management, system optimization, and simulation.