1. INTRODUCTION
Military Remotely Piloted Air Systems (RPAS)Footnote 1 are growing beyond the point where they are regarded merely as possessing niche capabilities that make them suitable for persistent and hazardous tasks. Many of their properties make them very attractive to an operational commander; Remotely Piloted Aircraft (RPA) are generally able to remain on-station conducting Intelligence, Surveillance and Reconnaissance (ISR) tasks for much longer periods than their manned equivalents, and significantly the loss of an RPAFootnote 2 does not result in the death or capture of the crew. However, lingering doubts remain in many minds regarding the full utility of RPAS, and this may be slowing or preventing the full penetration of RPAS into military inventories (and, in turn, their adoption by the Civil Aviation sector). The RAF's Air Warfare Centre (AWC) has gained significant understanding of RPAS in NATO's Class IIFootnote 3 category during recent trials and operations, and this paper uses evidence gathered from this activity, viewed through the prism of an ‘assurance framework’, to examine where improvements might or should be made to speed the acceptance of RPAS into mainstream aviation activity. The paper will begin by examining the military approach to achieving airworthiness certification for RPAS, including an assessment of risk management activity, to demonstrate the parity which already exists between manned and remotely piloted aircraft. Next the paper will investigate the seams between manned and remotely piloted aircraft operations through an examination of the operational environment. This will highlight current difficulties in airspace integration, the complexity of the working environment for RPAS crews (including communications systems, human factors and geodetic datums), and suggest methods of overcoming the identified shortcomings. Finally there will be a brief look at the third pillar of assurance, crew competence. Whilst it is largely outside the author's remit to comment on much of the training required for RPAS operations (encompassing, as it does, everything from ground maintenance through imagery analysis to crew training), a brief examination of the level of training required for RPAS crew is undertaken. The conclusion draws together the evidence gained from AWC operations of Class II RPAS to identify essential improvements which would increase the employability of RPAS, both within the military and, by extension, across the civil aviation sector.
2. INTEGRITY OF THE AIRCRAFT
The UK Ministry of Defence (MOD) uses a framework of Concept, Assessment, Design, Manufacture, In-service and Disposal (CADMID) to guide all aspects of a given procurement programme, from the smallest system to the largest, most complex and expensive equipment. However, with much of the military's current RPAS inventory having been purchased off the shelf as Urgent Operational Requirements for operations in Iraq and Afghanistan, it has not always been possible to guide the CADM portions of this process. Regardless, and in order to ensure the deployment of a known quantity, all military RPAS are subject to a rigorous assurance framework to ensure their safety during operation, linking regulatory and procedural elements into an overall airworthiness framework.
Aircraft registered in the UK, or operating in UK airspace, are governed by the UK Air Navigation Order (ANO) 2009. Her Majesty's aircraft are exempt from almost all of the ANO by virtue of Article 252(1), but the elements of the ANO that MOD must comply with relate to Rules of the Air, flying displays, fatigue and noise. The authoritative documents for the governance of UK military flying are the Military Aeronautical Regulation Document Set (MARDS). Joint Service Publication (JSP) 553, is part of the set, and in Para 1.3, states; ‘internal MoD regulatory arrangements should be at least as effective as those in respect of civil aircraft contained in the ANO’. Defence Standard 00-970 goes on to elaborate that the acceptable peacetime loss rates for military aircraft, including RPAS, are loss of aircraft once per million flying hours, or one fatal accident per million flying hours. JSP 553 provides additional guidance, as follows:
• When operating within ‘Danger Areas’:
Broadly acceptable 2nd partyFootnote 4 accident rate is to be better than 1×10−3 per year.
Broadly acceptable 3rd partyFootnote 5 fatal accident rate is to be better than 1×10−4 per yearFootnote 6
• And when operated outside Danger Areas:
Broadly acceptable 2nd party accident rate is to be better than 1×10−5 per year.
Broadly acceptable 3rd party fatal accident rate is to be better than 1×10−6 per year.
Airworthiness of the aircraft is captured in the Release to Service. The method of assessing risk is detailed in Def Stan 00-56 where risk is described as being either unacceptable, tolerable or broadly acceptable (see Table 1). These three classes are considered in conjunction with the requirement that measures have been taken to reduce the risk to as low as reasonably practicable (ALARP). In making this judgement, the MoD uses statements and analysis from the Design Organisation, the project team, and, usually, an independent assessorFootnote 7. There is no concession for remotely piloted systems; RPA need to be constructed with the same level of integrity and quality as a conventional piloted aircraft and a clear safety audit trail is still required. This evidence is then used to support the production of the Release to Service, which is signed-off at 2-star level.
Extract from Def Stan 00-56 Issue 4.
The RAF uses a series of matrices to manage risk, derivativesFootnote 8 of which follow in this section. Overall programme risk is owned by the Duty Holder who chairs a Safety Committee comprising all safety stakeholders for the system. The Safety Committee produces a Safety Management Plan, the first stage of which is to produce a Summary of Hazards and Likely Accidents, a sample of which is at Table 2. The left hand column identifies the risk, probability of occurrence, potential consequence and owner. This leads to a statement of the ‘Total Risk’. The table describes mitigation strategies and owners of these strategies, enabling a residual risk to be calculated.
Summary of Hazards and Likely Accidents.
Having identified the events that might occur, the next stage is to identify the frequency of occurrence. The MOD has definitions to aid the decision-maker and these are listed in Table 3. Analysis can be used to inform the decision-maker: for instance, if during the contractor development phase, two aircraft were lost in 100 hours, then this would suggest a ‘Probable’ assessment.
Description of Probability of Occurrence.
The severity of an event is an assessment of the damage, injuries or deaths that would probably result from the realisation of the risk. These are described as catastrophic, critical, significant, marginal or negligible. The next stage of the process combines frequency of risk with severity and this provides the total level of risk, displayed in Table 4.
Frequency /Severity Matrix.
Total Risk is expressed as extreme, very high, high, medium and low and each of these risk categories has an associated description. For example, extreme risk implies multiple casualties, loss of the aircraft and significant damage to reputation. Extreme risk is owned at 3* level, very high at 2* and then progressively downwards through the rank structure, as summarised in Table 5.
Description of risk.
Risk mitigations are added for each line. A manager is assigned to implement these mitigations and the impact of their effect is found in the residual probability / residual severity fields. Note that if a risk is in the Medium, High or Very High categories it MUST be managed to be ALARP.
Once the risks associated with a Project have been captured the risk map is populated: see Table 6. Risks change with the passage of time: The mission may become more complex; the number of aircraft in the airspace could increase; the crew will become more familiar with the method of operating. All of these changes drive a requirement to revisit the Summary of Hazards and subsequently the Risk Map. Weekly production of a Risk Map provides a picture of total risk and whether the risk is rising or falling. The level of risk and vector are objective tools on the worth of continuing with a project. In Table 7 we see a high level of risk with an increasing trend. With the airworthiness aspects of the RPAS assured either through design, risk management activity, or a combination of both, the RPAS will be deployed on operations.
Sample Risk Map.
Risk Map Showing Degree of Risk and Trend.
3. THE OPERATIONAL ENVIRONMENT – AIRSPACE
Three types of airspace should be considered; UK, civil overseas and operations.
For UK airspace, guidance on RPAS is provided in CAP 722: Unmanned Air System Operations in UK Airspace – Guidance. Essentially CAP 722 requires RPAS to operate within segregated airspace such as a Danger Area or a Restricted Area (Temporary), or within the visual line of sight of the operator, unless the RPAS is fitted with an approved sense and avoid system. National air traffic services cannot be used to provide a surrogate sense and avoid because CAP 722 direction is that flight of RPAS should not create an additional burden.
Civil, overseas airspace would come under the host nation rules.
On operations, restrictions will be described in an Airspace Control Order (ACO). The ACO may need to cover a range of conflict from peacekeeping across the spectrum to war-fighting and it should pay appropriate regard to host nation civilian regulations. The ACO will, for UK military, be overlaid with MARDS guidance. JSP 550 (JSP 550 Rule 320.100.1) stresses the requirement for a layered safety approach that achieves a level of safety with respect to collision avoidance, equivalent to manned aircraft. Typically, in peacekeeping / peace enforcement, the ACO uses a see and avoid principle, overlaid with procedural separation. Both civilian and military aircraft will be found in this type of airspace. The absence of a pilot within the RPA negates see and avoid as an option and an alternative mechanism must be sought. In the future this could be a suite of sensors that support an onboard, autonomous system capable of maintaining separation from other platforms; in the near term this separation could be achieved with the RPA pilot exploiting a feed from an Air Traffic Control radar, a Tactical Air Control Centre (TACC) disseminating the Recognised Air PictureFootnote 9, or datalink picture passed to the Ground Control StationFootnote 10 (GCS). This traffic information will need to be made available to the RPAS-pilot through suitable multi-function displays built to the same standard as conventional manned aircraft. When operating under an ACO it is possible to task a TACC to provide additional services to RPAS, thus opening up the possibility of operating in unsegregated airspace.
Beyond see and avoid sensors, do RPA require additional systems in ACO controlled airspace? When engaged in peacekeeping / peace enforcement, military RPAS will be in an air environment with military and civil platforms. The former have Identification Friend or Foe (IFF) and may have data links whilst the latter should be fitted with Mode S and Airborne Collision Avoidance Systems (ACAS). It is assumed that aircraft operating under grandfather rights will have IFF.
Some RPA are physically small and it is difficult for primary radar to detect them. In the operational domain it is essential for RPAS to be included in the overall Recognised Air Picture, so a requirement for an IFF emerges. Scale J of the ANO 2009 requires large manned aircraft to carry ACAS and the reactive logic in these systems will provide Resolution Advisories to pilots. To enable this capability, ACAS rely on all air platforms carrying Mode S transponder equipment. The carriage of an Enhanced Mode S transponder on a military RPAS engaged in peacekeeping / peace enforcement will provide an increased level of safety to civil aircraft that fly from normal airspace into ACO airspace on Airbridge missions and demonstrate a commitment toward achieving ALARP status. ACAS in remotely piloted aircraft were examined under the ASTRAEA Programme (Autonomous Systems Technology Related Airborne Evaluation & Assessment) but the findings are not in the public domain.
For all three airspace types, the RPAS crew would ideally communicate with air traffic organisations without introducing additional systems to the national ATC infrastructure. This implies civil ATC compatible radios. Turning to navigation, a GPS-only solution is insufficient because CAA guidance (CAP 722, 2010) is that civilian registered RPAS should be protected from deception or misleading data and MOD is required to demonstrate a similar level of safety. Moreover, operational considerations require a degree of resilience to GPS jamming.
To capture all these needs military RPAS require equivalence to ANO 2009, Schedule 5 scales A, (Radios), E3 (IFF including Enhanced Mode S), H (navigation systems) and, highly desirable, Scale J (ACAS).
4. THE OPERATIONAL ENVIRONMENT – COMPLEXITY
Military airpower is used to generate an effect; RPA are best used when a piloted aircraft cannot complete the task for reasons of endurance or potential risk to a human crew. The main advantages of air power compared to land forces are ubiquity and speed of response. The ideal RPA is therefore flexible in its area of operation, survivable, possesses a long endurance and, if an ISR asset, the ability to download product without landing. It is likely that mission profiles will be complex.
Class II RPAS are typically controlled from a dedicated GCS, a working environment with a workstation for each crew member and air conditioning to support the needs of the electronics. Quality of GCS varies and, undoubtedly, some provide better support to the crew than others. There is a requirement for the GCS to communicate with the aircraft whilst it is on the ground, and the RPA crew need to communicate with the groundcrew during start-up and recovery. Inevitably, to maintain line-of-sight it is necessary to place the launch and recovery GCS in close proximity to the flight line. Depending on GCS design, the crew may be subjected to high levels of noise. Given this environment, the communications system will need careful design if the telephone / radio / intercom are to be effective systems for the operating crew. In terms of actual control of the RPA, the adoption of radio control model aircraft-type boxes has proved to be cheaper than the more sophisticated Hands on Throttle and Stick (HOTAS) systems used in manned aircraft. However, HOTAS systems were developed to facilitate the operation of multiple systems simultaneously in a stressful environment. There is a clear lesson from witnessing the operation of some Class II RPAS that the human machine interface must be sensibly integrated and that separate systems are unacceptable.
The development of instrument displays for some RPA is immature. A graphical display that replicates an analogue format, such as the conventional circular altimeter is fine, whereas the inclusion of tabulated information in a table is unlikely to be satisfactory. As has been found over many years of manned aviation, the difficulty with digital instrumentation is that every piece of information has to be individually assimilated (Garland, Reference Garland2010). A pilot needs to be able to rapidly scan instrumentation looking for ‘the needle in the wrong place’ that a conventional instrument panel provides. Digital data nested in a table does not facilitate easy association between two pieces of information. For example, a conventional altimeter has the analogue readout and a digital millibar sub-scale. In this event it is easy to see if the subscale has been mis-set. On a digital system it requires the operator to move his eyes from one table area to another. It is also very difficult to judge rate information with digital instruments – unlike the easily assimilated message of a rapidly unwinding altimeter needle. Designers should consider the guidance given in Def Stan 00-250 (Def Stan 00-250 Section 15, 2008).
Historically, Controlled Flight into Terrain (CFIT) was (CAP 780, 2008) the major contributor to aircraft loss, until the adoption of Terrain Proximity Warning Systems (TPWS) in public transport aircraft. The CAA annual safety review (CAP 780, 2008) figures for the >5700 Kg class (professionally operated on visual/instrument flights) provides a rational comparison for the RPAS in which we are interested. Despite the mandatory installation of TPWS systems (ANO Schedule 4 Scale X, 2009) in this class of manned aircraft, in the 2008 Safety Review, CFIT was cited as the cause of 24% of fatal accidents. Arguably TPWS is a partial, but not total answer. The RAF recognises CFIT as a major issue; Typhoon, Tornado GR4 and Harrier are fitted with terrain referenced navigation systems that warn the pilot if he is about to descend below a pre-set “floor”. Generally RPAS are not fitted with TPWS and this should lead to two considerations:
• Does the quality of image provided to the RPA pilot provide the cues (situation awareness) to prevent CFIT? The quality of image provided to the crew via the Pilotcam varies from one RPA type to another but, compared to looking out from the flight deck, the image presented to the pilot lacks depth, and at low level, any sensation of speedFootnote 11. Arguably, an RPA that provides the crew with grainy imagery, combined with poor weather, will result in reduced appreciation of where the airframe is in relation to terrain. Add high workload and an absence of TPWS and the conditions are set for a CFIT accident. A recent USAF accident report identified CFIT during a high-intensity sortie segment as the cause of a Predator crash on operations in Afghanistan (www.airforcetimes.com). Off-station, it may be possible to divert sensor bandwidth to pilotcam imagery to increase the clarity of the picture it provides.
• The second consideration relates to automatic recovery systems in the event of lost link between the RPA and GCS. Some, but not all, RPA under these conditions will fly to a get well waypoint and from this waypoint will follow a pre-defined track to the airfield and landing. Careful planning is needed to ensure that when the RPA goes to the initial waypoint it does not route directly, if high ground is in the way. Unless the onboard navigation system has some form of 3-dimensional model, there is no mechanism to prevent the RPA impacting high terrain.
RPA equipped with sensors to image particular co-ordinates on the Earth's surface need to know the position of a target relative to the aircraft. The geodetic model used to define the target co-ordinates should be specified, so that the need for co-ordinate conversion can be identified. In addition, automatic take off and landing systems require that the co-ordinates of the runway boundaries are captured and input to the RPAS. The same Earth model needs to be used by both systems. Prior to overseas deployment, the runway co-ordinates will need to be made available to a contractor as Government Furnished Information. The RPAS crew require a mechanism to check that runway or target data is input in the correct format and correct Earth model, and data should electronically flow through the mission planning system and GCS displays without the need for multiple input of the same information.
5. THE OPERATIONAL ENVIRONMENT – WEATHER
With the requirement to conduct missions of greater endurance, comes the potential requirement to fly in progressively more challenging weather. This includes icing conditions. Airframe icing is a problem for all RPA and, in addition for Class II RPA, precipitation, high or gusting winds, engine icing and propeller icing are also significant problems. The requirement for new platforms to work in extreme weather conditions can be specified in the CADMID process, but this rapidly leads to added expense. Rather than seek progressively higher operating limits, the AWC Unmanned Aircraft Systems Test and Evaluation Squadron sought an alternative strategy. Deployable meteorological units at operational locations capture a raft of weather data. By incorporating this data into an MS EXCEL® spreadsheet, it was possible to chop this data into time slices describing historically the rainfall, maximum wind velocity, and cloudbase. Runway heading could then be used to calculate the historical crosswind component. By entering the RTS limits for a particular platform, the spreadsheet could be used to provide a Percentage Availability of time that the RPA could operate to service a task. Sensitivity analysis could be conducted by changing the RTS limits in the model to establish whether any linear expansion of these limits would lead to a corresponding linear expansion of availability. For example, an AWC calculation showed that an increase of maximum crosswind limit from 12 kts to 15 kts would increase task availability from 56% to 71%. Such a model could be expanded further to capture the value of other systems on the platform – for example, the addition of a carburettor heater to a piston engine RPA would obviate carburettor icing in low power cruise and therefore potentially increase task availability.
Whilst discussing availability, it should also be noted that night operations bring two benefits to RPAS operations: Firstly, in many operational scenarios the number of aircraft movements reduces at night, freeing up runway availability; secondly, the windspeed tends to reduce as thermal heating drops off, further expanding the weather window. Thus even if the sensors rely on daylight to provide illumination, the ability to depart and recover at night is useful. Night operations require taxy, landing and navigation lights on the RPA.
6. THE OPERATIONAL ENVIRONMENT – REACH
As previously stated, ubiquity is a key air power attribute. UHF radios are the traditional means of communication with, and between, military aircraft. For an aircraft flying at 30,000 ft, two-way communication with ground agencies some 200 nautical miles (nm) distant is achievable. From AWC experience, a GCS using 30 metre towers, talking to an RPA at 10,000 ft, has a range of around 70 nm. UHF radio from ATC to an aircraft on the ground can have a range of less than 10 nm.Footnote 12 The consequence of this UHF limitation is that if an RPA is to be deployed to a location other than the one from which it departs, suitable arrangements will need to be made if a successful landing and taxy in is to be achieved. This might be a deployable Launch and Recovery Element. Some RPAS have a fully automatic recovery mode so that if communications are lost the RPA recovers to a pre-designated point and then lands on a specified runway. This method could be used to land at a pre-notified runway at a different airfield but a mechanism would need to be put in place to taxy in and shut down the RPA once the landing run is complete. The GCS at the launch airfield would not be able to achieve this.
Therefore, the major constraint on RPA operations at range is no longer endurance, but maintaining radio line-of-sight from the GCS. This limitation is of less consequence if the RPA can remain high, but when the RPA is required to descend (shows of force, or descent below cloudbase to obtain Electro-Optic sight of a target), this will become a problem. An alternative control means is via satellite link (known as Beyond Line of Sight, and typically the preserve of larger Class III RPAS). The General Atomics Aeronautical Systems Inc MQ-9 Reaper systems require Ku band communications relay satellites; such capacity could be military owned or rented from commercial sources. The UK MOD Skynet 5 www.spacedaily.com is hosted on X-band, and this architecture is not designed to support the transfer of imagery from RPAS to a ground site. To achieve this capability it would be necessary to rent additional Ku capacity. However, the Thales TopConnect® development www.ainonline.com may give a glimpse of an alternative way ahead. TopConnect® is designed to deliver internet connectivity into airliners using Ka-band satellite connectivity. Delivery of imagery from a RPA to a ground station is a technical problem of the same degree, but the communication is obviously in the reverse direction. A cheaper alternative may be to transmit imagery over an X-band satellite link but using smarter data compression techniques. It may also be possible to extend the range of a RPA by the use of a Rebroadcasting Station. This would likely be a radio system that replicates the UHF C2 functionality of the GCS and would be connected to the GCS by microwave link or broadband phone link. Typically this could extend the range of a RPA at 4000 ft an additional 60 km in a specific direction. Whilst the UK has, in the author's opinion, rightly been wary of procuring non-sovereign RPAS capability that carries a heavy SATCOM budget, the civil air industry initiative to provide internet connectivity for civil aircraft shows that an affordable way ahead is likely to be within our grasp.
7. CREW COMPETENCE
Training underpins the competence of the RPAS operating crew. The RAF is currently using conventionally trained pilots to fly RPA. Obviously the training of these pilots is expensive and the conventional pilot training course is necessarily focussed on the requirements to operate piloted military aircraft, which may differ from RPAS operation. Recently, the RAF instigated Trial DAEDALUS, which is a course designed to train individuals, who have not previously qualified to fly piloted aircraft, to fly the Predator RPAS. Whatever the results of DAEDALUS, it is apparent that for operating platforms with automatic take-off and landing systems, hand-eye co-ordination may not be as important as that required to pilot conventional aircraft. However, the requirement to understand airspace and the air environment is equally important for conventional and RPAS pilots. For RPAS, the high reliance on software in automated aircraft requires considerable familiarity with Information Systems.
8. CONCLUSIONS
Military aircraft assurance is provided through attention to the three pillars of; aircraft integrity, the operational environment and crew competence. Until RPAS fully meet all these requirements, MOD will continue to exercise great caution when operating RPAS and this will impede their greater utilisation in the battlespace.
Considering aircraft integrity, Class 2 RPAS should meet safety standards equivalent to piloted aircraft. However, those RPAS purchased to fill Urgent Operational Requirements may not have been through the full procurement CADMID cycle and thus fail to achieve this requirement. To manage this additional risk, the RAF has designed an assurance framework of management techniques. Aircraft integrity includes an ability to support the operating crew. RPAS operators need look-out and cockpit instrumentation that equate to manned aircraft. As the crew is denied the ability to look-out additional electronic screens should display the local air picture. The operating crew needs an adequate environment; the GCS must be soundproofed and cooled. The RPAS crew will need a communication suite to facilitate their communication with the crew chief, the RPA, and ATC. Suitable controls and instrumentation that allow the crew to communicate with these agencies whilst simultaneously controlling the RPA are essential. Aircraft integrity is aided by the inclusion of systems and, again, these should be of similar sophistication to manned aircraft. One particular area that requires attention is prevention of CFIT. As well as TPWS sensors, planning tools for the crew can obviate the circumstance leading to CFIT from arising in the first place. Moreover, should the RPA be lost link and returning home the RPA will need to have 3D mapping embedded in the flight control system so that logic circuits prevent the RPA from flying into high ground. Much of this can be wrapped up in a statement that Class 2 RPA will need systems that produce the effects described in ANO 2009 Schedule 4, Scale X and Schedule 5 scales, A, E3, H and J.
The operational environment includes weather, reach and airspace. Class II RPAS are typically not equipped with systems that allow them to cope with rain, strong winds or icing. Commanders increasingly demand levels of availability that mean systems must be improved to cope with these challenges. The ability to operate at night allows runway availability to be exploited and adds additional operational flexibility, even if the sensors are not fully night capable. A key attribute of air power is reach but Class 2 RPAS are limited because they rely on line of sight communications from the GCS. Further work is required to extend the controllable range; this might include SATCOM but could also include locating the transmitter / receiver aerials at greater heights, innovative use of commercial airliner internet connectivity or the use of rebroadcast systems. The most pressing issue is the ability to integrate with other airspace users. The regulatory environment requires that a suitable means of integration be achieved. In the operational airspace ACAS, the use of TACC and aircrew access to the Recognised Air Picture could provide a way forward.
The crew competencies to become UK military RPAS pilots and commanders are defined (JSP550 R320.110.3). The RAF is reviewing what skill sets can be reduced (compared to conventionally manned aircraft) and which need to be increased. Part of the ongoing RAF work in this area is being undertaken in Trial DAEDALUS. Experience to date has already demonstrated that operation of some RPAS relies less on hand-eye co-ordination than manned aircraft but, conversely, a greater understanding of communication and information technologies are needed. It is also apparent that the operation of RPAS will require closer engagement by communications engineers. The UK MOD will increasingly source its RPAS through core procurement process. The airworthiness issues described above should be managed within the CADMID cycle. However, the assurance framework described, coupled with design and technology improvements as set out in this paper, and a full understanding of crew competency issues as they relate to RPAS, will ensure that RPAS are able to be fully integrated into future military operations. This will, in turn, set the conditions for RPAS to be embraced by the civil aviation community.
ACKNOWLEDGEMENTS
The author thanks Clive Blount, Joint Development, Concepts and Doctrine Centre Shrivenham for proof reading, Robert Robertson RAF, for permission to quote from the risk assessment matrix and Christopher Craghill RAF and Christopher Thirtle RAF for guidance and advice.
